Skip to main content

​
🔵 Release v2.453.16

⭐ Simple Complexity • 4 commits • 15 files changed
Security hardening release focused on protecting logging infrastructure. The Logtail logging token is now strictly server-only, preventing accidental exposure to browser clients. This release also includes improvements to MCP regression testing and CI/CD automation for better release reliability.

​
What’s New

  • Server-Only Logging Token — Logging source token now strictly server-only, preventing accidental browser exposure
  • Enhanced MCP Testing — Deterministic regression test harness replays real-world MCP payloads to catch schema regressions
  • CI/CD Improvements — Automated review state tracking and affected-only linting for faster feedback loops
  • Better Observability — Clearer boot-time visibility for logging configuration issues

​
Apps Updated

User App

— No changes

API

✓ Updated - 1 change

Admin

— No changes

MCP Server

✓ Updated - 1 change

Models

— No changes

Games

— No changes

​
Detailed Changes

Server-Only Logging Token
  • Logtail source token (LOGTAIL_SOURCE_TOKEN) is now strictly server-only
  • Removed acceptance of NEXT_PUBLIC_LOGTAIL_SOURCE_TOKEN to prevent accidental token exposure
  • This prevents Next.js from inlining logging tokens into browser bundles (which would expose tokens to all visitors)
  • Boot-time warning message now accurately reflects server-only configuration
  • Client-side observability (session replay, web vitals) remains available via NEXT_PUBLIC_BETTERSTACK_TAG_TOKEN as designed
Why this matters: The Logtail source token grants full write access to your logging infrastructure. Accidentally exposing it to browsers would allow any visitor to write logs under your organization, potentially corrupting audit trails or causing data loss. This fix ensures the token stays protected on servers only.
Regression Testing
  • Deterministic MCP replay harness (scripts/mcp-replay.ts) now includes comprehensive test cases
  • Replays real-world payloads that previously failed, ensuring schema fixes don’t regress
  • Tests handle model quirks like fill-all-fields behavior and XML transport coercion
  • Gate validates schema shape at transport boundary (catches bugs missed by unit tests alone)
  • 25+ deterministic test cases covering all major tool interactions
Why this matters: Chat sessions are probabilistic — a model might emit a field 95% of the time, so three passing sessions don’t guarantee a fix. The replay harness fires the EXACT payloads that previously bounced, catching regressions instantly without waiting for the right LLM output variance.
Automation & Linting
  • Review automation state tracking now kept accurate across CI runs
  • Introduced affected-only linting (pnpm lint:affected) for pre-push validation
  • Full repository linting still runs in CI as the authoritative gate
  • Faster feedback loops for developers on feature branches
Workflow Governance
  • Code Owner assignments updated for better review routing
  • Auto-approval workflows refined for safe configuration-only PRs

​
For Administrators

No user-facing feature changes in this release. This is a stability and security update focused on infrastructure hardening. Recommended action: No action required. This release improves platform security without requiring any configuration changes.

​
For End Users

No user-facing changes in this release. Backend stability improvements only.

​
Security Notes

This release hardens the logging infrastructure by ensuring that sensitive tokens cannot be accidentally exposed to users’ browsers. The change is backward compatible — if you were using the NEXT_PUBLIC_LOGTAIL_SOURCE_TOKEN workaround, simply use LOGTAIL_SOURCE_TOKEN instead (without the NEXT_PUBLIC_ prefix).

​
Technical Details

Logging Token Scope Change:
  • Previous: Accepted both LOGTAIL_SOURCE_TOKEN (server) and NEXT_PUBLIC_LOGTAIL_SOURCE_TOKEN (browser — bad practice)
  • Current: Accepts only LOGTAIL_SOURCE_TOKEN (server)
  • Impact: 🟢 No production impact if using recommended configuration
MCP Testing: The replay harness now validates every schema hardening fix against live MCP transport, not just unit tests. This proved invaluable when the reward_allocations operation field fix was tested — three consecutive real chat sessions passed by chance, but the replay harness caught the regression instantly.

​
Contributors

dch@dch2 commits • +166/-70 lines

jamescockayne@jamescockayne1 commit • +14/-16 lines

changelog-bot@nudj-changelog-bot1 commit • Documentation sync

​
Release Stats

​
Known Items

  • This release contains no breaking changes
  • Logging token configuration uses LOGTAIL_SOURCE_TOKEN (not NEXT_PUBLIC_*)
  • MCP regression testing is deterministic and runs on every deployment
v2.453.16 deployed on July 20, 2026