All releases
v2026-10-27
October 27, 2026
Patch
In this release
New60
Fixed25
Total85

paging with ack and escalation independent of Discord

paging with ack and escalation independent of Discord shared error-tracking init with release/env tags for api, worker, herald, AI engine ( part 1) unbounded scraper_domain_scrape_total domain cardinality OOM-loops the cloud provider Pushgateway (218 restarts, 44% scrape uptime) vendor-class 'browser earns, T3 serves on the same exit' tier — T3 resolves 0% of every non-bot challenge class root-run digest drain creates root:0600 .lock — internal tooling-bridge and internal service digest writes f

New Features

60

paging with ack and escalation independent of Discord

paging with ack and escalation independent of Discord

shared error-tracking init with release/env tags for api, worker, herald, AI engine ( part 1)

shared error-tracking init with release/env tags for api, worker, herald, AI engine ( part 1)

vendor-class 'browser earns, T3 serves on the same exit' tier — T3 resolves 0% of every non-bot challenge class

vendor-class 'browser earns, T3 serves on the same exit' tier — T3 resolves 0% of every non-bot challenge class

escalation-aware tier outcome matrix

escalation-aware tier outcome matrix

AlterLab Agent Skills package + /.well-known/agent-skills index, snippets from the canonical manifest

AlterLab Agent Skills package + /.well-known/agent-skills index, snippets from the canonical manifest

versioned checksummed deploy bundle builder and atomic release installer

versioned checksummed deploy bundle builder and atomic release installer

follow-up: 2 deferred item(s) (deferred from )

follow-up: 2 deferred item(s) (deferred from )

capture browser errors and Core Web Vitals with release source maps

capture browser errors and Core Web Vitals with release source maps

agent-created accounts with human approval (device-flow style), scoped keys, Web Bot Auth, full fraud gating

agent-created accounts with human approval (device-flow style), scoped keys, Web Bot Auth, full fraud gating

OpenCode Zen as primary LLM provider (free zero-retention models), OpenRouter as fallback

OpenCode Zen as primary LLM provider (free zero-retention models), OpenRouter as fallback

pooled per-family blog CTA variant bandit driven by internal service reward job

pooled per-family blog CTA variant bandit driven by internal service reward job

suggest auto-recharge with per-recharge bonus and volume-tier step-up hint for depositors

suggest auto-recharge with per-recharge bonus and volume-tier step-up hint for depositors

follow-up: 2 deferred item(s) (deferred from )

follow-up: 2 deferred item(s) (deferred from )

agent-ready search output with one-call content and a competitor benchmark harness

agent-ready search output with one-call content and a competitor benchmark harness

insufficient-balance errors carry a top-up link and active welcome-offer deadline

insufficient-balance errors carry a top-up link and active welcome-offer deadline

follow-up: 2 deferred item(s) (deferred from )

follow-up: 2 deferred item(s) (deferred from )

verify AI crawler access weekly, track Common Crawl presence, publish a citable open dataset

verify AI crawler access weekly, track Common Crawl presence, publish a citable open dataset

weekly production agent-readiness probe + automated MCP post-deploy gate

weekly production agent-readiness probe + automated MCP post-deploy gate

follow-up: 2 deferred item(s) (deferred from )

follow-up: 2 deferred item(s) (deferred from )

long-term retention for SLI recording rules beyond 15 days

long-term retention for SLI recording rules beyond 15 days

T4 operation-deadline failures (~4.5% of T4 jobs) are not queue-driven; gate never triggers

T4 operation-deadline failures (~4.5% of T4 jobs) are not queue-driven; gate never triggers

WebMCP in-browser tools (estimate cost, docs search, try scrape, pricing)

WebMCP in-browser tools (estimate cost, docs search, try scrape, pricing)

add database, redis and cAdvisor exporters with baseline rules

add database, redis and cAdvisor exporters with baseline rules

Markdown for Agents at origin — Accept: text/markdown negotiation, rel=alternate links, marketing-page markdown, cache-safe

Markdown for Agents at origin — Accept: text/markdown negotiation, rel=alternate links, marketing-page markdown, cache-safe

bounded candidate egress countries for hintless identity_invariance fences from fleet recovery history

bounded candidate egress countries for hintless identity_invariance fences from fleet recovery history

A2A Agent Card and A2A endpoint generated from the shared tool registry

A2A Agent Card and A2A endpoint generated from the shared tool registry

per-family blog CTA copy and logged-out CTAs to a pre-filled playground instead of the signup modal

per-family blog CTA copy and logged-out CTAs to a pre-filled playground instead of the signup modal

agent discovery — content signals, api-catalog, Link headers, MCP server card, auth.md

agent discovery — content signals, api-catalog, Link headers, MCP server card, auth.md

usage-triggered in-product cross-sell (crawl/map/schedule/search/extract) + one product-tour email

usage-triggered in-product cross-sell (crawl/map/schedule/search/extract) + one product-tour email

robots.txt Content-Signal (search, ai-input, ai-train = yes), unblock Bytespider, add newer AI crawler groups

robots.txt Content-Signal (search, ai-input, ai-train = yes), unblock Bytespider, add newer AI crawler groups

experiment — card-on-file at onboarding doubles free balance, enabling one-click top-up

experiment — card-on-file at onboarding doubles free balance, enabling one-click top-up

conversion reward loop — Thompson-sampled post-family allocation on activation, replacing unmeasured '3-5x' prompt claims

conversion reward loop — Thompson-sampled post-family allocation on activation, replacing unmeasured '3-5x' prompt claims

IP-bound clearance reuse hits ~1% in every pool cohort because reserved exits rotate per job

IP-bound clearance reuse hits ~1% in every pool cohort because reserved exits rotate per job

claim-your-offer step after the first successful scrape, replacing the 2%-CTR deposit nudge

claim-your-offer step after the first successful scrape, replacing the 2%-CTR deposit nudge

blog playground embed pre-filled with the post's own target, moved up, extended to site-specific/pSEO posts

blog playground embed pre-filled with the post's own target, moved up, extended to site-specific/pSEO posts

blog conversion measurement — engaged denominator, code-copy/scroll events, fix internal service blog→signup join

blog conversion measurement — engaged denominator, code-copy/scroll events, fix internal service blog→signup join

welcome-offer countdown surfaces (dashboard bar, billing, playground) + truthful logged-out line

welcome-offer countdown surfaces (dashboard bar, billing, playground) + truthful logged-out line

'API version of this article' block near the top of DIY/bot-detection blog posts

'API version of this article' block near the top of DIY/bot-detection blog posts

monitoring Watchdog + provisioned off-host dead-man checks

monitoring Watchdog + provisioned off-host dead-man checks

welcome-offer deadline emails, HERALD.md real-deadline rule, launch window for never-paid users

welcome-offer deadline emails, HERALD.md real-deadline rule, launch window for never-paid users

internal service writes about and links to search, crawl, map, extract, monitor, schedule (0 posts link /search-api)

internal service writes about and links to search, crawl, map, extract, monitor, schedule (0 posts link /search-api)

funnel measurement — offer/claim events, deduped event names, bot filter, weekly cohort scorecard

funnel measurement — offer/claim events, deduped event names, bot filter, weekly cohort scorecard

server-side 48h welcome offer (100% first-deposit match, $25 cap) enforced at grant time

server-side 48h welcome offer (100% first-deposit match, $25 cap) enforced at grant time

abandoned-checkout recovery email + Stripe Checkout friction audit (52% of checkouts unpaid)

abandoned-checkout recovery email + Stripe Checkout friction audit (52% of checkouts unpaid)

support scrape_results on /v1/serp with per-page tier billing and refunds ( part 1)

support scrape_results on /v1/serp with per-page tier billing and refunds ( part 1)

Python and Node SDK expose engine, device, num, start for unified /v1/serp; web price copy pinned ( part 5)

Python and Node SDK expose engine, device, num, start for unified /v1/serp; web price copy pinned ( part 5)

post paid Stripe invoices (enterprise/subscription) to the Discord payments channel

post paid Stripe invoices (enterprise/subscription) to the Discord payments channel

unified batch mode with result-bearing webhooks on /v1/serp ( part 4)

unified batch mode with result-bearing webhooks on /v1/serp ( part 4)

/v1/search and /v1/search/batch become deprecated aliases onto the /v1/serp code path ( part 3)

/v1/search and /v1/search/batch become deprecated aliases onto the /v1/serp code path ( part 3)

export OTel spans from api and worker to a trace store

export OTel spans from api and worker to a trace store

every succeeded Stripe payment posts to the Discord payments channel exactly once

every succeeded Stripe payment posts to the Discord payments channel exactly once

move per-tier success alerts and decisions from final-tier counters to the outcome matrix

move per-tier success alerts and decisions from final-tier counters to the outcome matrix

/v1/serp accepts the union request contract and reports engine_used/served_from_cache ( part 2)

/v1/serp accepts the union request contract and reports engine_used/served_from_cache ( part 2)

off-infrastructure uptime and user-journey probes

off-infrastructure uptime and user-journey probes

activate incident ingest (0 events), real TTD/TTR, postmortems

activate incident ingest (0 events), real TTD/TTR, postmortems

central log store with 30-day retention and obs-logs query

central log store with 30-day retention and obs-logs query

follow-up: 6 deferred item(s) (deferred from )

follow-up: 6 deferred item(s) (deferred from )

self-hosted GlitchTip backend and internal tooling-provisioned SENTRY_DSN ( part 2)

self-hosted GlitchTip backend and internal tooling-provisioned SENTRY_DSN ( part 2)

weekly signal digest that turns unowned conditions into issues

weekly signal digest that turns unowned conditions into issues

alert-quality telemetry and weekly noise report per alertname

alert-quality telemetry and weekly noise report per alertname

Bug Fixes

25

unbounded scraper_domain_scrape_total domain cardinality OOM-loops the cloud provider Pushgateway (218 restarts, 44% scrape uptime)

unbounded scraper_domain_scrape_total domain cardinality OOM-loops the cloud provider Pushgateway (218 restarts, 44% scrape uptime)

root-run digest drain creates root:0600 .lock — internal tooling-bridge and internal service digest writes fail with EACCES since 2026-10-25

root-run digest drain creates root:0600 .lock — internal tooling-bridge and internal service digest writes fail with EACCES since 2026-10-25

traefik_4xx_flood pages on customer insufficient-balance 402s — not graded against the expected-class registry

traefik_4xx_flood pages on customer insufficient-balance 402s — not graded against the expected-class registry

replace personal GHCR_PAT on production hosts with scoped, short-lived pull credential

replace personal GHCR_PAT on production hosts with scoped, short-lived pull credential

per-host RFC 9728 OAuth protected-resource metadata (alterlab.io doc names mcp host → scan rejects it)

per-host RFC 9728 OAuth protected-resource metadata (alterlab.io doc names mcp host → scan rejects it)

investigate navigation-guard-redirect firing on /dashboard/billing (103 in 90d)

investigate navigation-guard-redirect firing on /dashboard/billing (103 in 90d)

stop promoting :latest image tags; pin mailpit (policy: never use latest)

stop promoting :latest image tags; pin mailpit (policy: never use latest)

production environment has no protection rules — add branch policy, document approval model

production environment has no protection rules — add branch policy, document approval model

DDG Lite still challenged on 23-41% of attempts after GET fix

DDG Lite still challenged on 23-41% of attempts after GET fix

snippet rewriter turns 'from alterlab.exceptions import X' into 'from exceptions import X' (6 posts held from backfill)

snippet rewriter turns 'from alterlab.exceptions import X' into 'from exceptions import X' (6 posts held from backfill)

remove the unbacked 'Powered by AlterLab' 20% top-up bonus claim

remove the unbacked 'Powered by AlterLab' 20% top-up bonus claim

email subject A/B never sends variant B; arms violate HERALD.md; add UTMs to all email links

email subject A/B never sends variant B; arms violate HERALD.md; add UTMs to all email links

Cloudflare Workers egress IP on the abuser blocklist blocks every Workers-hosted agent, crawler and SDK user

Cloudflare Workers egress IP on the abuser blocklist blocks every Workers-hosted agent, crawler and SDK user

appleboy ssh/scp deploy steps skip host-key verification (no browser compatibility:)

appleboy ssh/scp deploy steps skip host-key verification (no browser compatibility:)

vendor-script watch leaves bot protection system/kasada/anti-bot system unwatched and aws_waf/cloudflare unknown after key provisioning

vendor-script watch leaves bot protection system/kasada/anti-bot system unwatched and aws_waf/cloudflare unknown after key provisioning

unblock Cloudflare Workers egress and refuse Cloudflare-owned IPs in the blocklist

unblock Cloudflare Workers egress and refuse Cloudflare-owned IPs in the blocklist

quick deposits skip the first-deposit bonus the billing page promises; unify 'first deposit' and fix success-page bonus

quick deposits skip the first-deposit bonus the billing page promises; unify 'first deposit' and fix success-page bonus

GlitchTip secret key in internal tooling and optional error-tracking DSN

GlitchTip secret key in internal tooling and optional error-tracking DSN

follow-up: 1 deferred item(s) (deferred from )

follow-up: 1 deferred item(s) (deferred from )

follow-up: 1 deferred item(s) (deferred from )

follow-up: 1 deferred item(s) (deferred from )

quick deposits never post to the Discord payments channel

quick deposits never post to the Discord payments channel

carry overruled lower-tier successes across a T4 deferred resume

carry overruled lower-tier successes across a T4 deferred resume

Grafana admin password falls back to 'admin' when unset

Grafana admin password falls back to 'admin' when unset

unique validated request_id bound to every log line; return trace_id

unique validated request_id bound to every log line; return trace_id

docs, marketing and SDKs disagree with the Search API on price, engines and methods

docs, marketing and SDKs disagree with the Search API on price, engines and methods