v1.1.0

Releval 1.1.0 (7 September 2026) adds Slack notifications for evaluation runs and AI judging, hardens security across the REST and MCP surfaces, and publishes the browser tracker for User Behavior Insights.

Three changes alter behaviour on an existing instance. Read the next section before upgrading.

Before you upgrade

Search endpoints validate TLS certificates by default. Each endpoint now has an allow invalid certificate setting, and endpoints you create from now on validate. Endpoints that already exist are migrated with the setting on, so nothing that works today stops working. Turn it off per endpoint once the endpoint presents a certificate Releval can verify.

A failed evaluation run now reports Failed. A run that could not start, or in which every query failed, previously showed as Completed with no results. It now correctly reports as Failed. A run where only some queries failed still reports Completed; a visible failed-query count is coming.

Breaking changes

• A run that could not start, or in which every query failed, reports Failed instead of Completed with no results.
• Search endpoints validate TLS certificates by default, with a per-endpoint opt-out; existing endpoints keep working.

Security

• Security hardening across the REST and MCP surfaces. Upgrading is recommended.
• The User Behavior Insights workspace can run its queries as a dedicated read-only ClickHouse user; see New configuration.

Features

• Slack notifications. Connect a workspace once with a bot token, then route any evaluation, or every evaluation, to a channel. Choose which outcomes to hear about: runs completed, failed or cancelled, and AI judging completed, failed or cancelled. Each message carries the run's metrics and the change against the previous run, is sent once the metrics are ready, and is not lost if Releval restarts in between. Connecting, rotating or removing a workspace is Admin only, as is routing notifications for every evaluation; Members can route an evaluation they work on.
• Releval__BaseUrl sets the address every link Releval sends out of band is built from: Slack messages, invitations, email confirmation and password resets. Without it, Slack messages carry no links back to the run.
• The Sites page shows whether each Site is delivering events, with the time of its last event and the count from the last 24 hours, so a broken tracker install is visible at a glance.
• The browser tracker is published: @releval/tracker on npm, or releval-tracker.global.js from the tracker's GitHub release, and the Sites page's install instructions show both.
• Tracked events record which Site they came from and the query text, available in the workspace as site_id and user_query.
• Buttons across the app have tooltips.

Fixes

• An evaluation with locked runs can no longer be deleted.
• Judgments entered immediately before navigating away are no longer lost.
• A slow corpus load no longer wipes what was already typed into the edit form.
• The Sites page's install instructions no longer point at a host that does not exist.
• An App Client can request a new token straight after using its previous one without the new token being rejected.
• Invitation, email-confirmation and password-reset links use Releval__BaseUrl when it is set, so inviting someone while reaching Releval on an internal name no longer mails them a link they cannot open. Deployments that leave it unset are unaffected.

New configuration

Setting	Required	What it does
Releval__BaseUrl	Recommended	The absolute URL members use to reach this deployment. Every link Releval sends out of band is built from it. Without it, Slack messages carry no links, and invitation, email-confirmation and password-reset links fall back to the address the request arrived on.
ConnectionStrings__ClickHouseReadonly	Recommended	Runs the User Behavior Insights workspace queries as a dedicated read-only ClickHouse user. Without it the workspace shares the main ClickHouse connection, and Releval warns at startup.

Create the read-only ClickHouse user as described under data storage in the configuration documentation, and point the connection string at it.

Upgrading

Back up your database first. Migrations are forward-only, and the User Behavior Insights tables in ClickHouse are updated automatically on startup.

docker compose pull
docker compose up -d

Migrations are applied at startup by default. To apply them ahead of the new version instead, run the image's migrate command and then start the app with MigrateOnStartup=false:

docker run --rm -e ACCEPT_EULA=Y \
  -e ConnectionStrings__Postgres="..." \
  releval/releval:1.1.0 migrate

migrate --script prints the SQL first if you would rather review it, and migrate --list shows which migrations a database has already applied.