[Polliog]

Release 1.4.0. Rolls up everything merged to develop since the October security sweep (#312): the hosting seams that let LogTide run as a multi-tenant service for others, plus the version bump. Every new setting is opt-in: with the new environment variables unset, a self-hosted instance behaves exactly as before (locked by the cloud-seams/env-unset regression suite).

Highlights

Added

• Combined telemetry byte quota: spans and metric datapoints are now metered in bytes like logs (spans.ingested.bytes, metrics.ingested.bytes), and the new telemetry.max_bytes_monthly quota caps logs, traces and metrics together. Over the limit, log, trace and metric ingestion answer 429
• Metric datapoint metering and quota: accepted OTLP datapoints are recorded as metrics.ingested.datapoints, with a new metrics.max_datapoints_monthly quota
• Quota grace and notifications: quota.grace_percent lets a quota overshoot by a margin before blocking, with one in-app and email notice per limit when a quota is reached and when it blocks
• Optional email verification (REQUIRE_EMAIL_VERIFICATION) and an hourly registration limit (REGISTRATION_RATE_LIMIT_PER_HOUR)
• Terms and Privacy acceptance (LOGTIDE_TERMS_URL, LOGTIDE_PRIVACY_URL, LOGTIDE_TERMS_VERSION): required at registration, re-asked on a version bump; ingestion with existing API keys is never blocked
• Organization caps per user: MAX_ORGANIZATIONS_PER_USER and MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTH (the latter closes the delete-and-recreate quota reset)
• projects.max capability, also enforced on project restore
• Instance-wide capability defaults via CAPABILITY_DEFAULTS_JSON, validated at boot
• Signed upgrade handoff (LOGTIDE_UPGRADE_URL, LOGTIDE_UPGRADE_SIGNING_SECRET) and an admin service token (LOGTIDE_ADMIN_SERVICE_TOKEN) for an external billing service
• Hosting guide: docs/cloud-seams.md documents every variable, the handoff token format and the metering rules

Changed

• Default quotas from CAPABILITY_DEFAULTS_JSON apply to every organization, including ones that never had an override
• The bundled Compose files pass the new variables through to backend and worker, empty when unset
• "Beta" wording removed from the README and the app footer

Fixed

• Entitlement limits of 2 GiB and above failed with an integer overflow (limit_value is now BIGINT, migration 059)
• Credentials in rate-limit keys: with Redis configured, raw API keys and session tokens were used as rate-limit key names; they are now hashed

Migrations

058 (email verification tokens), 059 (limit_value BIGINT), 060 (organization_creation_log), 061 (users.terms_accepted_at, users.terms_version). All additive, no backfill required.

Version bump

All 5 package.json, the release fallbacks (internal-logger.ts, hooks.client.ts, hooks.server.ts), Footer.svelte, README badge/intro/features header, and CHANGELOG.md dated [1.4.0] - 2026-10-20.

Full detail in CHANGELOG.md under [1.4.0].

[codecov]

Codecov Report

❌ Patch coverage is 95.62842% with 24 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/backend/src/modules/users/routes.ts	90.90%	8 Missing ⚠️
...es/backend/src/modules/users/email-verification.ts	87.50%	6 Missing ⚠️
...ackages/backend/src/capabilities/quota-notifier.ts	92.00%	4 Missing ⚠️
packages/backend/src/modules/settings/routes.ts	77.77%	2 Missing ⚠️
...backend/src/modules/auth/authentication-service.ts	90.90%	1 Missing ⚠️
...ckages/backend/src/modules/organizations/routes.ts	97.05%	1 Missing ⚠️
...ckend/src/modules/organizations/upgrade-handoff.ts	97.43%	1 Missing ⚠️
packages/backend/src/server.ts	85.71%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!