Merge branch 'main' into warren/HDX-3732-appnav-user-menu-crash

Author: kodiakhq[bot]

.changeset/hdx-3277-service-quote-escape.md

@@ -0,0 +1,5 @@
+---
+'@hyperdx/app': patch
+---
+
+fix: escape service filter values on Services page to handle quoted names safely

.changeset/link-button-variant.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/app": patch
+---
+
+feat: Add `link` variant for Button and ActionIcon components

.changeset/olive-hounds-double.md

@@ -0,0 +1,5 @@
+---
+"@hyperdx/app": patch
+---
+
+feat: show inline span durations in trace timeline

.changeset/silver-carrots-change.md

@@ -0,0 +1,6 @@
+---
+"@hyperdx/common-utils": patch
+"@hyperdx/app": patch
+---
+
+feat: Add support for dashboard filters on Raw SQL Charts

.github/workflows/security-audit.yml

@@ -0,0 +1,17 @@
+name: Vulnerability Alerts
+
+on:
+  schedule:
+    - cron: '0 9 * * *' # Daily at 9am UTC
+  workflow_dispatch:
+
+jobs:
+  alert:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: kunalnagarco/action-cve@v1.14.23
+        with:
+          org: hyperdxio
+          token: ${{ secrets.DEPENDABOT_NOTIF_PAT }}
+          slack_webhook: ${{ secrets.SLACK_WEBHOOK_VULNERABILITIES }}
+          severity: medium,high,critical

AGENTS.md

@@ -152,6 +152,27 @@ skip hooks. If the pre-commit hook fails (e.g. due to husky not being set up in
 a worktree), run `npx lint-staged` manually before committing to ensure lint and
 formatting checks pass. Fix any issues before creating the commit.
 
+## Merge Conflict Resolution
+
+1. **Never blindly pick a side.** Read both sides of every conflict to
+   understand the intent of each change before choosing a resolution.
+
+2. **Refactor/move conflicts require extra verification.** When one side
+   refactored, moved, or extracted code (e.g., inline components to separate
+   files), always diff the discarded side against the destination files before
+   declaring the conflict resolved. Code can diverge after extraction — the
+   other branch may have made fixes or additions that the extracting branch
+   never picked up. A naive "keep ours" resolution silently drops those changes.
+
+3. **Verify the result compiles.** After resolving, check for missing imports,
+   broken references, or type errors introduced by the resolution — especially
+   when discarding a side that added new dependencies or exports.
+
+4. **Ask for help when uncertain.** If you are not 100% confident about which
+   side to keep, or whether a change can be safely discarded, stop and ask for
+   manual intervention rather than guessing. A wrong guess silently breaks
+   things; asking is always cheaper than debugging later.
+
 ---
 
 _Need more details? Check the `agent_docs/` directory or ask which documentation

agent_docs/code_style.md

@@ -36,6 +36,7 @@ The project uses Mantine UI with **custom variants** defined in `packages/app/sr
 | `variant="primary"` | Primary actions (Submit, Save, Create, Run) | `<Button variant="primary">Save</Button>` |
 | `variant="secondary"` | Secondary actions (Cancel, Clear, auxiliary actions) | `<Button variant="secondary">Cancel</Button>` |
 | `variant="danger"` | Destructive actions (Delete, Remove, Rotate API Key) | `<Button variant="danger">Delete</Button>` |
+| `variant="link"` | Link-style actions with no background or border (View Details, navigation-style CTAs) | `<Button variant="link">View Details</Button>` |
 
 ### DO NOT USE (Forbidden Patterns)
 
@@ -58,11 +59,15 @@ The following patterns are **NOT ALLOWED** for Button and ActionIcon:
 <Button variant="primary">Save</Button>
 <Button variant="secondary">Cancel</Button>
 <Button variant="danger">Delete</Button>
+<Button variant="link">View Details</Button>
 <ActionIcon variant="primary">...</ActionIcon>
 <ActionIcon variant="secondary">...</ActionIcon>
 <ActionIcon variant="danger">...</ActionIcon>
+<ActionIcon variant="link">...</ActionIcon>
 ```
 
+**Link variant details**: Renders with no background, no border, and muted text color. On hover, text brightens to full contrast. Use for link-style CTAs that should blend into surrounding content (e.g., "View Details", "View Full Trace").
+
 **Note**: `variant="filled"` is still valid for **form inputs** (Select, TextInput, etc.), just not for Button/ActionIcon.
 
 ### Icon-Only Buttons → ActionIcon

package.json

@@ -76,7 +76,7 @@
     "brace-expansion": "^2.0.2",
     "diff": "^5.2.2",
     "on-headers": "^1.1.0",
-    "fast-xml-parser": "^4.4.0",
+    "fast-xml-parser": "^4.5.4",
     "systeminformation": "^5.24.0"
   }
 }

packages/api/openapi.json

@@ -1389,6 +1389,11 @@
             "description": "SQL query template to execute. Supports HyperDX template variables.",
             "example": "SELECT count() FROM otel_logs WHERE timestamp > now() - INTERVAL 1 HOUR"
           },
+          "sourceId": {
+            "type": "string",
+            "description": "Optional ID of the data source associated with this Raw SQL chart. Used for applying dashboard filters.",
+            "example": "65f5e4a3b9e77c001a567890"
+          },
           "numberFormat": {
             "$ref": "#/components/schemas/NumberFormat",
             "description": "Number formatting options for displayed values."

packages/api/src/routers/external-api/__tests__/dashboards.test.ts

@@ -2311,6 +2311,7 @@ describe('External API v2 Dashboards - new format', () => {
 
     it('can round-trip all raw SQL chart config types', async () => {
       const connectionId = connection._id.toString();
+      const sourceId = traceSource._id.toString();
       const sqlTemplate = 'SELECT count() FROM otel_logs WHERE {timeFilter}';
 
       const lineRawSql: ExternalDashboardTile = {
@@ -2324,6 +2325,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'line',
           connectionId,
           sqlTemplate,
+          sourceId,
           compareToPreviousPeriod: true,
           fillNulls: true,
           alignDateRangeToGranularity: true,
@@ -2342,6 +2344,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'stacked_bar',
           connectionId,
           sqlTemplate,
+          sourceId,
           fillNulls: false,
           alignDateRangeToGranularity: false,
           numberFormat: { output: 'byte', decimalBytes: true },
@@ -2359,6 +2362,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'table',
           connectionId,
           sqlTemplate,
+          sourceId,
           numberFormat: { output: 'percent', mantissa: 1 },
         },
       };
@@ -2374,6 +2378,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'number',
           connectionId,
           sqlTemplate,
+          sourceId,
           numberFormat: { output: 'currency', currencySymbol: '$' },
         },
       };
@@ -2389,6 +2394,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'pie',
           connectionId,
           sqlTemplate,
+          sourceId,
         },
       };
 
@@ -2457,6 +2463,43 @@ describe('External API v2 Dashboards - new format', () => {
       });
     });
 
+    it('should return 400 when source connection does not match tile connection', async () => {
+      const otherConnection = await Connection.create({
+        team: team._id,
+        name: 'Other Connection',
+        host: config.CLICKHOUSE_HOST,
+        username: config.CLICKHOUSE_USER,
+        password: config.CLICKHOUSE_PASSWORD,
+      });
+
+      const response = await authRequest('post', BASE_URL)
+        .send({
+          name: 'Dashboard with Mismatched Source Connection',
+          tiles: [
+            {
+              name: 'Raw SQL Tile',
+              x: 0,
+              y: 0,
+              w: 6,
+              h: 3,
+              config: {
+                configType: 'sql',
+                displayType: 'table',
+                connectionId: otherConnection._id.toString(),
+                sourceId: traceSource._id.toString(),
+                sqlTemplate: 'SELECT count() FROM otel_logs',
+              },
+            },
+          ],
+          tags: [],
+        })
+        .expect(400);
+
+      expect(response.body).toEqual({
+        message: `The following source IDs do not match the specified connections: ${traceSource._id.toString()}`,
+      });
+    });
+
     it('should create a dashboard with filters', async () => {
       const dashboardPayload = {
         name: 'Dashboard with Filters',
@@ -3100,6 +3143,7 @@ describe('External API v2 Dashboards - new format', () => {
 
     it('can round-trip all raw SQL chart config types', async () => {
       const connectionId = connection._id.toString();
+      const sourceId = traceSource._id.toString();
       const sqlTemplate = 'SELECT count() FROM otel_logs WHERE {timeFilter}';
 
       const lineRawSql: ExternalDashboardTileWithId = {
@@ -3114,6 +3158,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'line',
           connectionId,
           sqlTemplate,
+          sourceId,
           compareToPreviousPeriod: true,
           fillNulls: true,
           alignDateRangeToGranularity: true,
@@ -3133,6 +3178,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'stacked_bar',
           connectionId,
           sqlTemplate,
+          sourceId,
           fillNulls: false,
           alignDateRangeToGranularity: false,
           numberFormat: { output: 'byte', decimalBytes: true },
@@ -3151,6 +3197,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'table',
           connectionId,
           sqlTemplate,
+          sourceId,
           numberFormat: { output: 'percent', mantissa: 1 },
         },
       };
@@ -3167,6 +3214,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'number',
           connectionId,
           sqlTemplate,
+          sourceId,
           numberFormat: { output: 'currency', currencySymbol: '$' },
         },
       };
@@ -3183,6 +3231,7 @@ describe('External API v2 Dashboards - new format', () => {
           displayType: 'pie',
           connectionId,
           sqlTemplate,
+          sourceId,
         },
       };
 
@@ -3271,6 +3320,45 @@ describe('External API v2 Dashboards - new format', () => {
       });
     });
 
+    it('should return 400 when source connection does not match tile connection', async () => {
+      const dashboard = await createTestDashboard();
+      const otherConnection = await Connection.create({
+        team: team._id,
+        name: 'Other Connection',
+        host: config.CLICKHOUSE_HOST,
+        username: config.CLICKHOUSE_USER,
+        password: config.CLICKHOUSE_PASSWORD,
+      });
+
+      const response = await authRequest('put', `${BASE_URL}/${dashboard._id}`)
+        .send({
+          name: 'Updated Dashboard with Mismatched Source Connection',
+          tiles: [
+            {
+              id: new ObjectId().toString(),
+              name: 'Raw SQL Tile',
+              x: 0,
+              y: 0,
+              w: 6,
+              h: 3,
+              config: {
+                configType: 'sql',
+                displayType: 'table',
+                connectionId: otherConnection._id.toString(),
+                sourceId: traceSource._id.toString(),
+                sqlTemplate: 'SELECT count() FROM otel_logs',
+              },
+            },
+          ],
+          tags: [],
+        })
+        .expect(400);
+
+      expect(response.body).toEqual({
+        message: `The following source IDs do not match the specified connections: ${traceSource._id.toString()}`,
+      });
+    });
+
     it('should delete alert when tile is updated from builder to raw SQL config', async () => {
       const tileId = new ObjectId().toString();
       const dashboard = await createTestDashboard({