CH-UI Changelog

CH-UI v2.18.0

Mon, 12 Oct 2026 12:00:00 GMT

Changed The GitHub push webhook needs a webhook secret. Save one under Admin → GitHub (new Webhook secret field) and put the same value in the GitHub webhook settings. Until then pushes no longer trigger a sync; Sync now is unaffected (#248). MCP keys with a database allow-list check the SQL they run. Queries that read outside the allow-list, or that CH-UI cannot verify (most table functions, d...

CH-UI v2.17.1

Mon, 12 Oct 2026 12:00:00 GMT

Security Shared dashboard links run only their own panels. The public query endpoint ran whatever SQL the request carried, with the ClickHouse credentials saved on the share, so anyone holding a link could run any statement those credentials allowed. A viewer now asks for a panel by ID and the server runs that panel's stored SQL, read only (readonly=1) and capped at 30 seconds and 32 MB of resu...

CH-UI v2.17.0

Sun, 11 Oct 2026 12:00:00 GMT

Added ch-ui reset-admin. Recovers the CH-UI admin role when nobody who holds it can sign in. With no flags it removes every admin assignment, so the next ClickHouse admin who signs in becomes the CH-UI admin, as on a fresh install. --user makes one user an admin instead. Safe to run while the server is up (docker exec ch-ui reset-admin in Docker), and recorded in the audit lo...

CH-UI v2.16.0

Sat, 10 Oct 2026 12:00:00 GMT

Security Client addresses behind a reverse proxy. X-Forwarded-For, X-Real-IP, X-Forwarded-Proto and X-Forwarded-Host are now believed only when the request arrives from a proxy in the new trustedproxies setting (TRUSTEDPROXIES, --trusted-proxies; default: loopback, private and link-local ranges; none or [] trusts no proxy). X-Forwarded-For is read from the proxy's end, skipping trusted hops, so...

CH-UI v2.15.0

Fri, 09 Oct 2026 12:00:00 GMT

Added Open a table from the SQL editor. Hold Cmd (macOS) or Ctrl and click a database or table name to open its tab. Names that resolve get a faint dotted underline and a hover hint; in db.table each part is its own link. A bare table name links only when exactly one database has it (#214). MCP write tools ask before writing. savequery, createdashboard, createmodel and createpipeline show the u...

CH-UI v2.14.3

Thu, 01 Oct 2026 12:00:00 GMT

Security /metrics no longer names the build. chuibuildinfo keeps only the goversion label; version and commit are removed from the unauthenticated endpoint, as they were from /health earlier. Dashboards that grouped by version lose that label (#210). Deleting another person's query history entry answers 404. It never deleted anything, but it answered 200 (#208). Fixed Audit Log shows the ClickH...

CH-UI v2.14.2

Thu, 01 Oct 2026 12:00:00 GMT

Security DOMPurify 3.4.16. The UI moves from 3.4.15, which is covered by GHSA-p98j-92pf-mc4p (low). The UI's only DOMPurify hook does not use INPLACE, so it was not exposed as written; the version is now pinned exactly (#205). Changed The website and documentation now live in this repository, under site/. ch-ui.com is built from it, so a change and its documentation land in the same pull reques...

CH-UI v2.14.1

Tue, 29 Sep 2026 12:00:00 GMT

Security The Brain approval audit log is admin only. GET /api/brain/audit returned every person's agent approvals (tool, arguments, who asked, who decided) to any signed-in user, viewers included (#202). Changed Documentation lives only on ch-ui.com/docs. The in-repo docs/ folder is removed; the README, the Settings legal links and the Claude Code plugin point at ch-ui.com, and the Terms and Pr...

CH-UI v2.14.0

Tue, 29 Sep 2026 12:00:00 GMT

Licensing release: every Pro feature is now under the Business Source License 1.1, and the free core no longer depends on any BSL code. No behaviour change. Changed License of Pro code. From this version, all code behind Pro features is under the Business Source License 1.1 (LICENSE.BSL) and carries the BUSL-1.1 header. This now includes Ask AI and the Brain agentic tools, audit forwarding to a...

CH-UI v2.13.3

Tue, 29 Sep 2026 12:00:00 GMT

One consistent answer to "what is Pro", enforced the same way by the server, the UI and the docs. Security Only admins can activate, replace or remove the license. Any signed-in user, viewers included, could remove it and lock Pro for everyone (#193). Changed Query parameters in the editor are free. Parameterized saved-query runs stay Pro (#194). An Enterprise license unlocks the same as Pro. B...

CH-UI v2.13.2

Tue, 29 Sep 2026 12:00:00 GMT

SSO users who share one ClickHouse service account are now separate people in CH-UI: roles, query history, Brain chats, stars and the audit log are per person. Security SSO roles are per person. Role overrides were keyed on the shared ClickHouse service account, so setting a role for one SSO user applied to every SSO user on the connection and overrode their IdP group mapping. An override now a...

CH-UI v2.13.1

Tue, 29 Sep 2026 12:00:00 GMT

License state that follows activation, a read-only grace period after a Pro license expires, and clearer login errors. Fixed License: activating or deactivating a license in Settings now unlocks or locks Pro pages immediately. Before, Pro pages kept the old state until the page was reloaded (#186). License: during the grace period after a Pro license expires, Pro pages open read-only with a not...

CH-UI v2.13.0

Mon, 21 Sep 2026 12:00:00 GMT

Production operations workflows for finding regressions, measuring improvements and reviewing events across ClickHouse environments. Added Performance regressions: compare normalized query patterns across equal windows, with minimum sample requirements and explicit coverage limits. Administrators can enable hourly scans using a dedicated background account. Saved investigations: retain baseline...

CH-UI v2.12.0

Sun, 20 Sep 2026 12:00:00 GMT

Dedicated accounts for reliable background execution, with explicit workspace permission delegation and tested credential rotation. Added Background accounts per connection and worker. Administrators can choose a verified dedicated ClickHouse account, an active user session, or Disabled for schedules, models, pipeline sinks, governance, Cluster Health and telemetry monitors. Passwords are encry...

CH-UI v2.11.1

Fri, 11 Sep 2026 12:00:00 GMT

Audit coverage for background work, and docs that point at the docs site. No dependency changes. Security Every background credential borrow is audited. Schedules, models, the pipelines sink, the governance syncer, the Cluster Health harvester and telemetry monitors run with the ClickHouse credentials of an active session on the connection. Only the governance syncer used to write an audit row...

CH-UI v2.11.0

Fri, 11 Sep 2026 12:00:00 GMT

A rebuilt interface and a real telemetry stack. No dependency changes. Added Telemetry, rebuilt: logs, traces, metrics, a service map, monitors and saved searches over the OpenTelemetry ClickHouse exporter's tables. Sources let you point CH-UI at any database and table and say which column plays which role, with one-click detection for the exporter's own layout and a DESCRIBE-backed allowlist s...

CH-UI v2.10.1

Thu, 10 Sep 2026 12:00:00 GMT

Hotfix for MCP behind a reverse proxy. No dependency changes. Fixed MCP clients got 403 Forbidden: invalid Host header through a reverse proxy. The MCP Go SDK's DNS-rebinding guard rejects requests that reach a loopback listener with a public Host header, which is exactly what the shipped nginx layout (upstream 127.0.0.1:3488, Host $host) produces. The guard ran after the key had already been a...

CH-UI v2.10.0

Thu, 10 Sep 2026 12:00:00 GMT

The MCP server catches up with the field. No dependency changes. Added OAuth 2.1 sign-in for the MCP server: CH-UI is its own authorization server for /mcp. Clients that only speak OAuth (claude.ai custom connectors, ChatGPT) and the sign-in path of Claude Code, Cursor and VS Code connect as the signed-in person: their connection, their ClickHouse grants, their name in the audit log. Discovery...

CH-UI v2.9.3

Wed, 09 Sep 2026 12:00:00 GMT

Changed modernc.org/sqlite 1.58.0 (SQLite 3.53.4), which carries upstream's fix for the journal-rollback data-corruption bug and replaces the interim super-journal patch. modernc.org/libc 1.75.6 and modernc.org/memory 1.12.1 move in lockstep (#153). github.com/coreos/go-oidc/v3 3.21.0: JWKS entries with unsupported key types are skipped instead of failing SSO verification (#153). CI pins govuln...

CH-UI v2.9.0

Mon, 31 Aug 2026 12:00:00 GMT

Added Embedded MCP server: CH-UI now serves the Model Context Protocol over streamable HTTP at /mcp, in the same binary. AI clients (Claude Code, claude.ai custom connectors, Cursor) authenticate with revocable chm keys (SHA-256 at rest, admin-managed in Admin → MCP Server) that bind a connection, a dedicated ClickHouse user, and an optional database allowlist. Free tools: listdatabases, listta...

CH-UI v2.8.0

Sun, 23 Aug 2026 12:00:00 GMT

Added Live query progress in the editor (#147): while a query runs, the result panel shows elapsed time, percent complete, rows and bytes read, and read throughput — the numbers ClickHouse's own /play reports. Progress is sampled from system.processes (300 ms) and streamed to the browser as progress messages on the existing NDJSON query stream. A user without SELECT on system.processes gets no...

CH-UI v2.7.0

Thu, 13 Aug 2026 12:00:00 GMT

Added Cost Center (Pro): showback/chargeback analytics for self-hosted ClickHouse. Prices real consumption from system.querylog (CPU core-hours via OSCPUVirtualTimeMicroseconds) and system.parts (GB-month storage) with configurable rates and currency. Includes team attribution via user-to-team rules with an allocation-coverage KPI, compute spend trend stacked by team, per-team/per-user tables,...

CH-UI v2.6.2

Thu, 13 Aug 2026 12:00:00 GMT

Fixed Telemetry time filters now work with DateTime64 columns: RFC3339 bounds are validated and rendered via parseDateTime64BestEffort instead of raw string literals that failed with TYPEMISMATCH (#143). Telemetry Setup Wizard values are actually used: the saved logs database/table is loaded on mount and passed up from the wizard, so the Log Explorer no longer falls back to default.otellogs (#1...

CH-UI v2.6.1

Thu, 23 Jul 2026 12:00:00 GMT

Added License as configuration: CHUILICENSEFILE (path to the license JSON, e.g. a mounted Kubernetes Secret) and CHUILICENSE (inline JSON) load and activate the Pro license at startup, taking precedence over one activated in the UI. An invalid or missing environment license logs a warning and never blocks startup. The Helm chart exposes it as license.existingSecret / license.secretKey. Fixed Gi...

CH-UI v2.6.0

Thu, 16 Jul 2026 12:00:00 GMT

CH-UI is now all-in on self-hosted: the cloud proof of concept is gone and its best features live here, behind the same offline-verified Pro license. Added Ask AI in the SQL editor: describe the query you want and get SQL generated against your schema, using your own AI provider key (Pro). Self-serve Pro licensing: buy at ch-ui.com, receive the signed license by email within a minute, and activ...

CH-UI v2.5.3

Mon, 29 Jun 2026 12:00:00 GMT

Fixed Command palette no longer enters an infinite Svelte update loop (effectupdatedepthexceeded) when opened: the open routine runs loadAll() inside untrack() so its writes to the databases/data stores can't re-trigger the effect that started it (#129). ⌘/Ctrl+K now toggles the command palette, so pressing it again closes the palette as the help text describes (#129). Added docs/connecting-to-...

CH-UI v2.5.2

Mon, 29 Jun 2026 12:00:00 GMT

Fixed Improve destructive-action alert contrast in the light theme so error and delete-confirmation panels in the database explorer are legible (#111). Changed Bump the Go dependency group: IBM/sarama 1.47.0→1.50.3, coreos/go-oidc/v3 3.18.0→3.19.0, go-chi/chi/v5 5.2.5→5.3.0, go-sql-driver/mysql 1.9.3→1.10.0, minio/minio-go/v7 7.0.98→7.2.0, lib/pq 1.11.2→1.12.3, modernc.org/sqlite 1.44.3→1.52.0,...

CH-UI v2.5.1

Mon, 15 Jun 2026 12:00:00 GMT

Security Rebuild release binaries and the Docker image on Go 1.25.11, patching 23 standard-library vulnerabilities reachable from the codebase (crypto/x509, crypto/tls, net/http, net/textproto, mime, net/url, os, …). Bump golang.org/x/net to v0.56.0 (GO-2026-4918). Fixed CI: the backend job now compiles (a //go:embed ui/dist placeholder), so go vet/go test/govulncheck actually run on every PR a...

CH-UI v2.5.0

Mon, 15 Jun 2026 12:00:00 GMT

Security Audit failed login attempts (user.loginfailed) in the immutable audit trail, not just successful logins — enables brute-force and credential-stuffing detection. Require admin role to create or delete a connection and to read or rotate a connection's tunnel token. Reads (list/get/test) remain available to any authenticated user. Admin-only access to the audit-log read and export endpoin...