Changelog

Track what's new, changed, and fixed in DebugBundle. This page covers product-level changes. For detailed SDK changelogs, see the individual SDK package release notes.

Format

This changelog follows Keep a Changelog conventions:

• Added — New features and capabilities
• Changed — Changes to existing functionality
• Fixed — Bug fixes
• Removed — Removed features
• Security — Security improvements

[Unreleased]

[1.5.3] - 2026-06-19

Changed

• Published the shared contract and JavaScript SDK patch line at @debugbundle/shared-types@1.3.1, @debugbundle/redaction@1.3.1, @debugbundle/sdk-node@1.3.1, and @debugbundle/sdk-browser@1.3.1.
• Published the canonical server-SDK patch line at debugbundle-python@1.1.2, debugbundle/sdk-php@1.1.2, github.com/debugbundle/debugbundle-go@v1.1.1, debugbundle@1.1.2, com.debugbundle Java SDK 1.1.1, and the NuGet DebugBundle.* package family at 1.1.1.
• Promoted the root debugbundle repository release line to 1.5.3 and synchronized the hosted dogfooding manifests to the published JS SDK patch line.

Fixed

• Reduced malformed hosted ingestion rejects by normalizing installed SDK envelope drift server-side while the patched SDK releases move custom app context into envelope context, remove legacy request payload extras, and preserve redaction on the canonical event path.

[0.1.3] - 2026-05-22

Added

• Canonical root-repository GitHub Releases on v* tags so the debugbundle monorepo now has a product-level public release surface alongside the package-specific CLI, MCP, shared-package, and SDK releases.
• Official GitHub Releases for the standalone JavaScript SDK repo, Python SDK repo, and WordPress plugin repo, including installable WordPress ZIP assets.

Changed

• Defined the root debugbundle repository version as the canonical public DebugBundle product release number used by the public site and product changelog.
• Published the current WordPress plugin release through GitHub Releases while keeping WordPress.org directory publication as a separate follow-up.

Security

• Hardened OAuth state validation by switching GitHub install and web-session callback comparisons to constant-time checks.
• Hardened browser trace propagation matching by removing caller-provided regular expressions from the allowlist path and keeping string-only matching.

[0.1.2] - 2026-05-13

Added

• Local-first onboarding for full capture-to-investigation workflows without a cloud account.
• Connected-mode dual-source retrieval with --source narrowing and cloud artifact caching.
• CLI local processing, MCP local-store parity, incident lifecycle actions, probes, webhooks, alerts, billing, and self-hosting.

Changed

• Project setup now produces a .debugbundle/ scaffold instead of flat config files.
• SDK initialization detects local versus connected mode from project configuration.
• Bundle generation remains deterministic for the same normalized source inputs.

SDK Versions

Next Steps

• What's New — Blog posts about product updates
• Installation — Get started with the latest version
• FAQ — Frequently asked questions