teeohhem · Nov 6, 2026 · Nov 4, 2026 · Nov 5, 2026
@@ -0,0 +1,6 @@
+---
+'@hyperdx/app': patch
+'@hyperdx/cli': patch
+---
+
+chore: GitHub links (changelog, support, package metadata) now point at `ClickHouse/ClickStack`, and `docker-compose.yml` pulls the app image as `clickhouse/clickstack`
@@ -1,2 +1,2 @@
 # One reviewer is picked round robin by the team's code review settings.
-* @hyperdxio/clickstack-app-devs
+* @ClickHouse/clickstack-app-devs
@@ -17,7 +17,7 @@ paste the URL if it does. If you're working from the repo, `yarn app:dev:local`
 plus onboarding → "Connect to Demo Server" gives you the same data locally. If
 it only happens with your own data, include the table schema
 (`SHOW CREATE TABLE ...`) and source settings.
-See https://github.com/hyperdxio/hyperdx/blob/main/CONTRIBUTING.md#reproducing-issues-and-prs
+See https://github.com/ClickHouse/ClickStack/blob/main/CONTRIBUTING.md#reproducing-issues-and-prs
 -->
 
 **Reproduces on play.hyperdx.io?** <!-- yes (link) / no / didn't try -->

@@ -7,7 +7,7 @@ contact_links:
     about:
       For usage questions, setup help, and general discussion, ask on Discord.
   - name: First-time contributor?
-    url: https://github.com/hyperdxio/hyperdx/blob/main/CONTRIBUTING.md#getting-vouched
+    url: https://github.com/ClickHouse/ClickStack/blob/main/CONTRIBUTING.md#getting-vouched
     about:
       No need to open an issue to get vouched. Open your pull request and a
       maintainer vouches from there.
@@ -26,4 +26,4 @@ labels: enhancement, Needs Feedback
 New issues start as `Needs Feedback` so we can discuss scope before anyone
 writes code. Once a maintainer swaps that for `Accepting PR`, the issue is ready
 to be picked up — see
-[CONTRIBUTING.md](https://github.com/hyperdxio/hyperdx/blob/main/CONTRIBUTING.md#from-issue-to-pull-request).
+[CONTRIBUTING.md](https://github.com/ClickHouse/ClickStack/blob/main/CONTRIBUTING.md#from-issue-to-pull-request).
@@ -1,4 +1,4 @@
-# Vouched contributors for hyperdxio/hyperdx.
+# Vouched contributors for ClickHouse/ClickStack.
 #
 # Pull requests from GitHub users who are not in this list are closed
 # automatically by .github/workflows/vouch.yml. See CONTRIBUTING.md for how to

@@ -1,4 +1,4 @@
-REPO: hyperdxio/hyperdx
+REPO: ClickHouse/ClickStack
 PR: #{{PR_NUMBER}}
 
 Review this pull request.

@@ -25,7 +25,7 @@ const MAX_BODY = 65536;
  * FOOTER repeats the rule and this anchor; the anchor test pins both to the AGENTS.md heading.
  */
 const GUIDE_URL =
-  'https://github.com/hyperdxio/hyperdx/blob/main/AGENTS.md#responding-to-review-feedback';
+  'https://github.com/ClickHouse/ClickStack/blob/main/AGENTS.md#responding-to-review-feedback';
 const GUIDE_LINK = `[How to respond](${GUIDE_URL})`;
 
 /**

@@ -8,8 +8,9 @@ name: Deep Review Resolver
 # Limitations:
 #   - Same-repo PRs only. Fork PRs cannot be pushed to from CI with the
 #     default GITHUB_TOKEN; the workflow exits early on forks.
-#   - Collaborator-gated. The job `if` requires OWNER/MEMBER/COLLABORATOR
-#     association on the triggering comment to prevent random drive-by use.
+#   - Write-gated. The job `if` requires OWNER/MEMBER/COLLABORATOR association
+#     on the triggering comment, and the first step checks the commenter has
+#     write access, since MEMBER covers every org member.
 #   - Single-shot. Re-trigger by commenting `/just-fix-it` again after the
 #     follow-up deep-review run posts an updated finding list.
 
@@ -38,6 +39,28 @@ jobs:
       actions: read
 
     steps:
+      # author_association MEMBER covers every org member, not just people with
+      # write access to this repo. Check the real permission before touching the PR.
+      - name: Require write access
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const username = context.payload.comment.user.login;
+            let p = {};
+            try {
+              const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username,
+              });
+              p = data.user?.permissions ?? {};
+            } catch (e) {
+              if (e.status !== 404) throw e;
+            }
+            if (!(p.admin || p.maintain || p.push)) {
+              core.setFailed(`${username} has no write access to this repo; ignoring /just-fix-it.`);
+            }
+
       - name: Acknowledge trigger
         uses: actions/github-script@v9
         with:

@@ -850,7 +850,7 @@ jobs:
           # collapsed P3 block. Twin of INLINE_FOOTER_BY_SEVERITY / AGENT_NOTICE
           # in .github/scripts/code-review/review-comments.cjs; the anchor test
           # there pins both to the AGENTS.md heading.
-          FOOTER='<sub>No finding blocks merge automatically. A maintainer will expect P0/P1 findings in code this PR changes to be fixed; P2/P3 are your call -- fix or reply. Never fix findings about surrounding code here; reply instead. Do not widen the PR. [How to respond](https://github.com/hyperdxio/hyperdx/blob/main/AGENTS.md#responding-to-review-feedback)</sub>'
+          FOOTER='<sub>No finding blocks merge automatically. A maintainer will expect P0/P1 findings in code this PR changes to be fixed; P2/P3 are your call -- fix or reply. Never fix findings about surrounding code here; reply instead. Do not widen the PR. [How to respond](https://github.com/ClickHouse/ClickStack/blob/main/AGENTS.md#responding-to-review-feedback)</sub>'
           # Only when there is something to triage, as renderSummary does for its
           # notice: a clean review or a zero-coverage (unhealthy-sandbox) one gets
           # no footer. Findings sit under a `### ` severity heading or, for P3

@@ -1270,11 +1270,11 @@ jobs:
           ```bash
           # macOS Apple Silicon
           INSTALL
-            echo "curl -L https://github.com/hyperdxio/hyperdx/releases/download/cli-v${VERSION}/hdx-darwin-arm64 -o hdx"
+            echo "curl -L ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/cli-v${VERSION}/hdx-darwin-arm64 -o hdx"
             echo "# macOS Intel"
-            echo "curl -L https://github.com/hyperdxio/hyperdx/releases/download/cli-v${VERSION}/hdx-darwin-x64 -o hdx"
+            echo "curl -L ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/cli-v${VERSION}/hdx-darwin-x64 -o hdx"
             echo "# Linux x64"
-            echo "curl -L https://github.com/hyperdxio/hyperdx/releases/download/cli-v${VERSION}/hdx-linux-x64 -o hdx"
+            echo "curl -L ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/cli-v${VERSION}/hdx-linux-x64 -o hdx"
             cat <<'USAGE'
 
           chmod +x hdx && sudo mv hdx /usr/local/bin/

@@ -11,7 +11,6 @@ jobs:
     steps:
       - uses: kunalnagarco/action-cve@v1.14.23
         with:
-          org: hyperdxio
           token: ${{ secrets.DEPENDABOT_NOTIF_PAT }}
           slack_webhook: ${{ secrets.SLACK_WEBHOOK_VULNERABILITIES }}
           severity: medium,high,critical
@@ -1,6 +1,6 @@
 {
   "@context": "https://openvex.dev/ns/v0.2.0",
-  "@id": "https://github.com/hyperdxio/hyperdx/blob/main/.vex/openssl-mongodb.vex.json",
+  "@id": "https://github.com/ClickHouse/ClickStack/blob/main/.vex/openssl-mongodb.vex.json",
   "author": "HyperDX Team",
   "role": "Supplier",
   "timestamp": "2026-02-17T00:00:00Z",

@@ -30,7 +30,7 @@ steps](#reproducing-issues-and-prs), and has [before/after
 screenshots](#ui-changes-need-beforeafter-screenshots) if it touches the UI.
 
 Good places to start: the [good first
-issue](https://github.com/hyperdxio/hyperdx/labels/good%20first%20issue) label,
+issue](https://github.com/ClickHouse/ClickStack/labels/good%20first%20issue) label,
 and [Discord](https://discord.gg/FErRRKU78j) if the dev setup gives you trouble.
 
 Why we do this: AI tools make it cheap to open a plausible-looking PR with no

@@ -38,7 +38,7 @@ separate MongoDB instance to persist your users, dashboards, searches and more.
 To get started, you can run the following image:
 
 ```bash
-docker run -e MONGO_URI=mongodb://YOUR_MONGODB_URI -p 8080:8080 docker.hyperdx.io/hyperdx/hyperdx:2-beta
+docker run -e MONGO_URI=mongodb://YOUR_MONGODB_URI -p 8080:8080 docker.clickhouse.com/clickhouse/clickstack:2
 ```
 
 You'll need to set the `MONGO_URI` environment variable to the URI of your

@@ -61,7 +61,7 @@ docker.clickhouse.com/clickhouse/clickstack-local
 
 ## Open Source & Cloud Versions (Beyond Local)
 
-If you're looking to deploy HyperDX to monitor a production environment (or anything outside your local environment), you can check out the [regular open source version](https://github.com/hyperdxio/hyperdx) or the [cloud hosted version](https://hyperdx.io/).
+If you're looking to deploy HyperDX to monitor a production environment (or anything outside your local environment), you can check out the [regular open source version](https://github.com/ClickHouse/ClickStack) or the [cloud hosted version](https://hyperdx.io/).
 
 ### Local vs Non-Local Versions
 

@@ -7,9 +7,9 @@
 <h1 align="center">HyperDX</h1>
 
 <p align="center">
-  <a href="https://github.com/hyperdxio/hyperdx/stargazers"><img src="https://badgen.net/github/stars/hyperdxio/hyperdx?label=%E2%98%85" alt="GitHub stars" /></a>
-  <img src="https://badgen.net/github/license/hyperdxio/hyperdx" alt="License" />
-  <a href="https://github.com/hyperdxio/hyperdx/actions/workflows/release.yml"><img src="https://github.com/hyperdxio/hyperdx/actions/workflows/release.yml/badge.svg" alt="Release" /></a>
+  <a href="https://github.com/ClickHouse/ClickStack/stargazers"><img src="https://badgen.net/github/stars/ClickHouse/ClickStack?label=%E2%98%85" alt="GitHub stars" /></a>
+  <img src="https://badgen.net/github/license/ClickHouse/ClickStack" alt="License" />
+  <a href="https://github.com/ClickHouse/ClickStack/actions/workflows/release.yml"><img src="https://github.com/ClickHouse/ClickStack/actions/workflows/release.yml/badge.svg" alt="Release" /></a>
   <a href="https://hyperdx.io/discord"><img src="https://img.shields.io/badge/Discord-5865F2?logo=discord&logoColor=white" alt="Join the HyperDX Discord" /></a>
 </p>
 
@@ -24,7 +24,7 @@ visualize logs and traces on top of any ClickHouse cluster (imagine Kibana, for
 ClickHouse).
 
 <p align="center">
-  <a href="https://clickhouse.com/docs/use-cases/observability/clickstack/overview">Documentation</a> • <a href="https://hyperdx.io/discord">Chat on Discord</a>  • <a href="https://play.hyperdx.io/search">Live Demo</a>  • <a href="https://github.com/hyperdxio/hyperdx/issues/new">Bug Reports</a> • <a href="./CONTRIBUTING.md">Contributing</a> • <a href="https://clickhouse.com/use-cases/observability">Website</a>
+  <a href="https://clickhouse.com/docs/use-cases/observability/clickstack/overview">Documentation</a> • <a href="https://hyperdx.io/discord">Chat on Discord</a>  • <a href="https://play.hyperdx.io/search">Live Demo</a>  • <a href="https://github.com/ClickHouse/ClickStack/issues/new">Bug Reports</a> • <a href="./CONTRIBUTING.md">Contributing</a> • <a href="https://clickhouse.com/use-cases/observability">Website</a>
 </p>
 
 - 🕵️ Correlate/search logs, metrics, session replays and traces all in one place
@@ -136,9 +136,9 @@ We welcome all contributions! There's many ways to contribute to the project,
 including but not limited to:
 
 - Opening a PR ([Contribution Guide](./CONTRIBUTING.md))
-- [Submitting feature requests or bugs](https://github.com/hyperdxio/hyperdx/issues/new)
+- [Submitting feature requests or bugs](https://github.com/ClickHouse/ClickStack/issues/new)
 - Improving our product or contribution documentation
-- Voting on [open issues](https://github.com/hyperdxio/hyperdx/issues) or
+- Voting on [open issues](https://github.com/ClickHouse/ClickStack/issues) or
   contributing use cases to a feature request
 
 **Pull requests.** Issues, bug reports and discussion stay open to everyone. For
@@ -170,7 +170,7 @@ We hope you give HyperDX in ClickStack a try and let us know how we're doing!
 
 ## Contact
 
-- [Open an Issue](https://github.com/hyperdxio/hyperdx/issues/new)
+- [Open an Issue](https://github.com/ClickHouse/ClickStack/issues/new)
 - [Discord](https://discord.gg/FErRRKU78j)
 - [Email](mailto:support@hyperdx.io)
 

@@ -0,0 +1,8 @@
+# Security policy
+
+Please do not report security vulnerabilities through public GitHub issues,
+discussions, or pull requests.
+
+HyperDX is part of ClickStack and follows the
+[ClickHouse security policy](https://github.com/ClickHouse/ClickHouse/security/policy).
+Report vulnerabilities through the process described there.
@@ -56,7 +56,7 @@ services:
     depends_on:
       - ch-server
   app:
-    image: ${HDX_IMAGE_REPO}/${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}
+    image: ${CH_IMAGE_REPO}/${NEXT_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}
     ports:
       - ${HYPERDX_API_PORT}:${HYPERDX_API_PORT}
       - ${HYPERDX_APP_PORT}:${HYPERDX_APP_PORT}

@@ -8,7 +8,7 @@ FROM base as dev
 LABEL org.opencontainers.image.vendor="HyperDX" \
       org.opencontainers.image.title="HyperDX Host Metrics (Dev)" \
       org.opencontainers.image.description="Host metrics collector for HyperDX development" \
-      org.opencontainers.image.source="https://github.com/hyperdxio/hyperdx" \
+      org.opencontainers.image.source="https://github.com/ClickHouse/ClickStack" \
       org.opencontainers.image.licenses="MIT"
 
 COPY ./config.dev.yaml /etc/otelcol-contrib/config.yaml
@@ -20,7 +20,7 @@ FROM base as prod
 LABEL org.opencontainers.image.vendor="HyperDX" \
       org.opencontainers.image.title="HyperDX Host Metrics" \
       org.opencontainers.image.description="Host metrics collector for HyperDX observability platform" \
-      org.opencontainers.image.source="https://github.com/hyperdxio/hyperdx" \
+      org.opencontainers.image.source="https://github.com/ClickHouse/ClickStack" \
       org.opencontainers.image.licenses="MIT"
 
 COPY ./config.dev.yaml /etc/otelcol-contrib/config.yaml
@@ -109,7 +109,7 @@ FROM node:${NODE_VERSION}-alpine AS prod
 LABEL org.opencontainers.image.vendor="HyperDX" \
       org.opencontainers.image.title="HyperDX Production" \
       org.opencontainers.image.description="HyperDX production image with API and App services" \
-      org.opencontainers.image.source="https://github.com/hyperdxio/hyperdx" \
+      org.opencontainers.image.source="https://github.com/ClickHouse/ClickStack" \
       org.opencontainers.image.licenses="MIT"
 
 ARG CODE_VERSION
@@ -232,7 +232,7 @@ FROM all-in-one-base AS all-in-one-noauth
 LABEL org.opencontainers.image.vendor="HyperDX" \
       org.opencontainers.image.title="HyperDX All-in-One (No Auth)" \
       org.opencontainers.image.description="HyperDX all-in-one image with ClickHouse, MongoDB, and OTel Collector (no authentication)" \
-      org.opencontainers.image.source="https://github.com/hyperdxio/hyperdx" \
+      org.opencontainers.image.source="https://github.com/ClickHouse/ClickStack" \
       org.opencontainers.image.licenses="MIT"
 
 COPY --from=hyperdx ./entry.local.noauth.sh /etc/local/entry.sh
@@ -248,7 +248,7 @@ FROM all-in-one-base AS all-in-one-auth
 LABEL org.opencontainers.image.vendor="HyperDX" \
       org.opencontainers.image.title="HyperDX All-in-One (With Auth)" \
       org.opencontainers.image.description="HyperDX all-in-one image with ClickHouse, MongoDB, and OTel Collector (with authentication)" \
-      org.opencontainers.image.source="https://github.com/hyperdxio/hyperdx" \
+      org.opencontainers.image.source="https://github.com/ClickHouse/ClickStack" \
       org.opencontainers.image.licenses="MIT"
 
 COPY --from=hyperdx ./entry.local.auth.sh /etc/local/entry.sh

@@ -68,7 +68,7 @@ FROM base AS dev
 LABEL org.opencontainers.image.vendor="HyperDX" \
   org.opencontainers.image.title="HyperDX OTel Collector (Dev)" \
   org.opencontainers.image.description="OpenTelemetry Collector for HyperDX development" \
-  org.opencontainers.image.source="https://github.com/hyperdxio/hyperdx" \
+  org.opencontainers.image.source="https://github.com/ClickHouse/ClickStack" \
   org.opencontainers.image.licenses="MIT"
 
 COPY --chown=10001:10001 docker/otel-collector/config.yaml /etc/otelcol-contrib/config.yaml
@@ -92,7 +92,7 @@ FROM base AS prod
 LABEL org.opencontainers.image.vendor="HyperDX" \
   org.opencontainers.image.title="HyperDX OTel Collector" \
   org.opencontainers.image.description="OpenTelemetry Collector for HyperDX observability platform" \
-  org.opencontainers.image.source="https://github.com/hyperdxio/hyperdx" \
+  org.opencontainers.image.source="https://github.com/ClickHouse/ClickStack" \
   org.opencontainers.image.licenses="MIT"
 
 COPY --chown=10001:10001 docker/otel-collector/config.yaml /etc/otelcol-contrib/config.yaml

@@ -57,7 +57,7 @@ exporters:
 service:
   # Pipeline `processors:` lists live in the base config.yaml so users can
   # swap them via CUSTOM_OTELCOL_CONFIG_FILE. See
-  # https://github.com/hyperdxio/hyperdx/pull/2351.
+  # https://github.com/ClickHouse/ClickStack/pull/2351.
   pipelines:
     traces:
       receivers: [otlp/hyperdx]

@@ -219,7 +219,7 @@ service:
   # CUSTOM_OTELCOL_CONFIG_FILE (e.g. to swap memory_limiter for a custom
   # version with limit_percentage). The OpAMP remote config intentionally
   # does NOT set `processors:` on these pipelines so the bootstrap+custom
-  # merge wins. See https://github.com/hyperdxio/hyperdx/pull/2351.
+  # merge wins. See https://github.com/ClickHouse/ClickStack/pull/2351.
   pipelines:
     traces:
       processors: [memory_limiter, transform/session_id, batch]

@@ -56,7 +56,7 @@ FROM node:22.23.4-alpine AS prod
 LABEL org.opencontainers.image.vendor="HyperDX" \
       org.opencontainers.image.title="HyperDX API" \
       org.opencontainers.image.description="HyperDX API service for observability platform" \
-      org.opencontainers.image.source="https://github.com/hyperdxio/hyperdx" \
+      org.opencontainers.image.source="https://github.com/ClickHouse/ClickStack" \
       org.opencontainers.image.licenses="MIT"
 
 ARG CODE_VERSION

@@ -148,7 +148,7 @@ Here's an example of how to set these variables in a Docker Compose file:
 version: '3'
 services:
   hyperdx-api:
-    image: docker.hyperdx.io/hyperdx/api:latest
+    image: docker.clickhouse.com/clickhouse/clickstack:2
     environment:
       - DEFAULT_CONNECTIONS=[{"name":"Local
         ClickHouse","host":"clickhouse:8123","username":"default","password":""}]

@@ -23,7 +23,7 @@ const PROMETHEUS_FETCH_TIMEOUT_MS = 30_000;
  * `path` must be an absolute path (every call site passes a literal starting
  * with `/`) -- this is not a general-purpose URL joiner.
  *
- * @see https://github.com/hyperdxio/hyperdx/issues/3046
+ * @see https://github.com/ClickHouse/ClickStack/issues/3046
  */
 export function joinPrometheusUpstreamUrl(
   upstreamHost: string,

@@ -39,7 +39,7 @@ server.start().catch(e => {
   // start() only rejects on non-retryable failures (e.g. MONGO_URI unset) —
   // transient MongoDB connection errors are retried internally. Exit so the
   // orchestrator restarts us instead of lingering as a zombie that listens
-  // but can never serve (https://github.com/hyperdxio/hyperdx/issues/2966).
+  // but can never serve (https://github.com/ClickHouse/ClickStack/issues/2966).
   logger.error({ err: serializeError(e) }, 'Server start failed, exiting');
   process.exit(1);
 });
@@ -110,7 +110,7 @@ const mcpMetricTypeSchema = z
  * Clients that forward MCP tool schemas straight to the provider therefore
  * get the ENTIRE tool list rejected because of this one field, and the user
  * sees a generic connectivity error that names neither the tool nor the
- * property. See https://github.com/hyperdxio/hyperdx/issues/2967.
+ * property. See https://github.com/ClickHouse/ClickStack/issues/2967.
  *
  * The wire type is the only thing that changes. Numeric input is still
  * accepted for callers working from a cached schema, the value is coerced