Highlight.io Absorbed Into LaunchDarkly

Highlight.io Absorbed Into LaunchDarkly

Highlight.io is no longer a separate product. The domain redirects entirely to launchdarkly.com, the last self-hosting release dates from August 2025, and the highlight.run library still ships on npm only because it became an internal dependency of LaunchDarkly's observability packages. If you are looking for Highlight.io as a tool to deploy, what you found is not what the documentation in search results describes.

Where the old addresses lead

Instead of trusting what search results remember, you can check the redirects yourself. Six addresses, one destination.

for u in https://highlight.io https://www.highlight.io https://highlight.io/docs \
         https://highlight.io/pricing https://highlight.run https://docs.highlight.run; do
  printf '%s -> ' "$u"
  curl -sL -o /dev/null -w '%{http_code} %{url_effective}\n' "$u"
done

All six return 200 and the destination https://launchdarkly.com/. This is not a redirect to a migration page or to a product section. Everything, including the documentation and the pricing page, lands on the LaunchDarkly home page, titled "Runtime Control for AI-Era Software, Feature Flags & AI Agent Control". The product presents itself as a feature flag and agent control platform, with observability as one tab rather than the core of the offering.

The exception is app.highlight.io, which returns 200 at its own address, meaning the application for existing accounts still responds. I did not check what appears after signing in, because I have no account there, and I am not guessing.

The repository behaves differently from the domain. github.com/highlight/highlight returns 200 without redirecting, is not archived, and still accepts changes. The newest commit on the main branch is titled feat(highlight.io): redirect landing page to launchdarkly.com and dates from 20 August 2026, two days ago. That commit produced the state described above and also dates the moment the brand disappeared from the web.

The repository lives, but not as a product

Activity on the main branch is sparse and maintenance-shaped. Besides the redirect, the recent commits are a bump of basic-ftp to 5.3.1 for CVE-2026-2769 on 20 August 2026, a rotation of an expired enterprise environment file on 18 August 2026, removal of account resolvers on 27 July 2026, and an invitations fix on 16 April 2026. Four changes in four months, all reactive.

Releases are rarer still. The last one in the repository is docker-v0.5.6, created on GitHub on 8 August 2025. The preceding docker-v0.5.5 is dated 23 June 2025, and docker-v0.5.4 and docker-v0.5.3 both come from 12 February 2025. Nothing new has shipped for self-hosters in a year.

The split between channels matters here and is easy to trip over. The server packages froze together with the repository, the browser package did not. These are two different lifecycles under one brand name that no longer exists.

The whole @highlight-run/* family shipped for the last time on the same day, 22 August 2025, exactly one year ago. The only piece that still receives releases is highlight.run.

Who publishes highlight.run

This question decides everything, because whether you can still use the package depends on it. The answer is unambiguous and visible in the registry metadata.

npm view highlight.run@10.7.1 repository.url dependencies license
# https://github.com/launchdarkly/observability-sdk.git
# { '@launchdarkly/js-client-sdk': '^4.0.0',
#   imurmurhash: '^0.1.4',
#   'stacktrace-js': '2.0.2' }
# Apache-2.0

The repository field points at launchdarkly/observability-sdk, not highlight/highlight. The production dependency is @launchdarkly/js-client-sdk in the ^4.0.0 range. The homepage field still points at https://github.com/highlight/highlight#readme and is the only leftover of the old address, so the metadata is inconsistent.

The unpacked tarball settles the matter. dist/ contains LDObserve.js, LDObserve.d.ts, LDRecord.js and LDRecord.d.ts, and the exports map in the manifest exposes the ./ld/observe and ./ld/record paths alongside the older ./observe and ./record. The package README states outright that session recording is powered by the launchdarkly/rrweb fork, synced with upstream rrweb v2.0.1.

The shortest proof, though, sits in the LaunchDarkly package. The entire dist/index.d.ts file in @launchdarkly/observability 1.1.19 is two lines, and both are re-exports.

// @launchdarkly/observability 1.1.19, dist/index.d.ts
export { Observe as default, LDObserve } from 'highlight.run';
export type { ObserveOptions } from 'highlight.run';

// @launchdarkly/session-replay 1.1.19, dist/index.d.ts
export { Record as default, LDRecord } from 'highlight.run';
export type { RecordOptions } from 'highlight.run';

Both LaunchDarkly packages declare highlight.run at exactly 10.7.1, with no range. The conclusion: highlight.run is today the recording and collection engine inside the LaunchDarkly SDK, published under its old name so installations do not break. The library lives on, but as part of somebody else's product rather than as a standalone tool.

The acquisition trail in the metadata

I found no official acquisition announcement. The blog listing on launchdarkly.com contains no post about Highlight, the addresses launchdarkly.com/news/ and launchdarkly.com/press/ return 404, and the LaunchDarkly home page does not mention the Highlight name once. Guessed addresses such as /blog/launchdarkly-acquires-highlight/ also return 404. The date can nevertheless be narrowed down from the npm registry, because nothing disappears there.

Version 9.18.0 from 12 May 2025 has no repository field in its manifest and no licence file in the tarball at all. Version 9.19.0 from 7 August 2025 has both, and the notice in the licence file reads "Copyright 2025 Catamorphic, Co.". Catamorphic Co. is the legal entity behind LaunchDarkly, and the same notice appears in the LICENSE file of the launchdarkly/observability-sdk repository.

That gives a window: ownership changed hands between 12 May and 7 August 2025, and the trace appeared in the packages on 7 August 2025. This is not the signing date, only the date from which the public artefacts stopped belonging to Highlight Inc. Treat it as inference from metadata, not as a vendor statement.

The same date explains why the @highlight-run/* family shipped for the last time on 22 August 2025 and never again. Two weeks after the handover a final maintenance release went out and the matter was closed.

Licence checked from three sources

I checked three independent places for both package families and for the repository itself. The results agree on substance but are incomplete in form, and a dependency audit will show it.

Source one, the licence file in the highlight/highlight repository. Of the spelling variants only LICENSE exists, with no extension. The names LICENSE.md, LICENSE.MD, LICENSE.txt, LICENCE and COPYING all return 404. The file itself is not a single licence but a splitter: the notice "Copyright (c) 2020-2023 Highlight Inc.", then a statement that the contents of the highlight.io/ directory fall under the licence in highlight.io/LICENSE, the contents of enterprise/ under the licence in enterprise/LICENSE, and everything else under Apache 2.0, whose full text follows below. Both referenced files actually exist, which is not a given, because in other projects such pointers turn out to be broken. highlight.io/LICENSE holds the full Apache 2.0 text, and enterprise/LICENSE is the Highlight Enterprise License, which permits production use only after accepting the subscription terms at https://highlight.io/terms. That address now redirects to launchdarkly.com, so the terms the licence points to are no longer publicly available at the stated link. This is a real legal problem for anyone who wants to run the enterprise/ directory.

Source two, the license field in the package registry. Here there is an inconsistency inside a single family. highlight.run, @highlight-run/node, @highlight-run/next, @highlight-run/react and @highlight-run/sourcemap-uploader declare Apache-2.0. The @highlight-run/cloudflare 3.1.0 package has no license field at all. That is not a trivial detail, because @highlight-run/next 7.9.38 depends on @highlight-run/cloudflare at exactly 3.1.0, so installing the Next.js integration pulls a package with no declared licence into your tree.

On the Python side the divergence has a different cause. highlight-io 0.10.2 carries the classic License: Apache-2.0 metadata field. Its successor, launchdarkly-observability 1.3.2, uses the newer License-Expression: Apache-2.0 field defined by PEP 639, which makes the PyPI API return license: null for it. A tool reading only the old key will consider that package unlicensed even though it has a licence.

Source three, the contents of the published package, is the most interesting.

npm pack highlight.run@10.7.1 --silent | xargs tar tzf | grep -i licen
# package/LICENSE
head -1 package/LICENSE
# Copyright 2025 Catamorphic, Co.

npm pack @highlight-run/cloudflare@3.1.0 --silent | xargs tar tzf | grep -i licen
# (no output)

The tarballs of highlight.run 10.7.1, @highlight-run/node 3.12.22 and @highlight-run/react 21.0.0 each contain a 557-byte LICENSE file with the Apache 2.0 header and the notice "Copyright 2025 Catamorphic, Co.". There is code in the tarballs: highlight.run 10.7.1 has thirty files, ten of them JavaScript, and @highlight-run/node has twenty-seven. The @highlight-run/cloudflare 3.1.0 tarball has seventeen files and no licence file, but does contain two build logs from the .turbo directory that leaked into the publish. On the Python side neither the highlight_io-0.10.2 wheel nor the launchdarkly_observability-1.3.2 wheel contains a licence file, the licence lives in metadata only.

Audit summary: the effective licence of the client libraries is Apache 2.0 with copyright held by Catamorphic Co., that is LaunchDarkly. The self-hosted server is Apache 2.0 outside the enterprise/ directory, which requires a paid subscription on terms no longer reachable at the stated address. The copyright notice in the repository still names Highlight Inc. and the year 2023, which you will need to be able to explain during a formal review, much as with Stack Auth after its rename to Hexclave.

Does self-hosting still work

Partly. The container images are still published in the GitHub Container Registry and can still be pulled anonymously.

TOKEN=$(curl -s "https://ghcr.io/token?scope=repository:highlight/highlight-backend:pull&service=ghcr.io" \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")

curl -s -o /dev/null -w '%{http_code}\n' \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/vnd.oci.image.index.v1+json" \
  https://ghcr.io/v2/highlight/highlight-backend/manifests/docker-v0.5.6
# 200

The manifests for ghcr.io/highlight/highlight-backend:docker-v0.5.6 and ghcr.io/highlight/highlight-frontend:docker-v0.5.6 return 200. Note that the highlight namespace on Docker Hub holds no public repositories at all, so GHCR is the only channel.

The docker/.env file on the main branch, however, hardcodes BACKEND_IMAGE_NAME=ghcr.io/highlight/highlight-backend:docker-v0.5.2 and the same for the frontend, four releases behind the newest. Anyone starting the stack straight from the repository gets the version from 30 January 2025, not the August one. Raising the tag to docker-v0.5.6 is a one-line edit, but you have to know about it.

The dependency set itself is heavy. docker/compose.yml starts ZooKeeper, Kafka, ClickHouse at 24.3.15.72-alpine, PostgreSQL with the pgvector extension from the ankane/pgvector:v0.5.1 image, Redis 8.0.2 and an OpenTelemetry collector at 0.128.0, plus the project's own backend and frontend. The GOMEMLIMIT variable is set to 16 GiB, which captures the scale of the requirements. This is not something you park next to your app on one small machine.

The sober assessment: it can be started, but you take on a stack that has had no security fixes for a year, pins ClickHouse and Redis versions from early 2025, and has no upgrade path. For experiments on an isolated network, fine. For production with user data, no.

What the remainder costs today

The LaunchDarkly pricing page renders in raw HTML, so the figures can be read without running JavaScript. The Developer plan costs $0 / mo, forever and covers 5 thousand session replays and 5 thousand errors per month, 14 days of data retention, one project and three environments. Once the limit is reached ingestion stops, with no charges.

The Foundation plan is usage-billed. The plan card states $8.33 per 1k client-side MAU / mo for annual billing, while the comparison table lower on the same page states $10 / mo per 1K MAU. These are the same billing line in two payment modes: 8.33 dollars times twelve months is 99.96 dollars a year, against 120 dollars when paid monthly, a discount of roughly 17 percent. I quote both numbers because the page shows them side by side without explaining the difference.

The Foundation plan includes 5 thousand session replays, 5 thousand errors, 10 million log records and 10 million traces per month, retention rises to 30 days, and overage costs 5 dollars per thousand units. Service Connections are billed separately: the first five each month are included, every additional one costs 10 dollars per month. The Enterprise plan is priced on request, offers 100 days or more of retention and contracted billing. The Guardian add-on, covering guardrail metrics and automatic rollback, is priced separately and available only on the Enterprise tier.

The point for anyone who came looking for Highlight.io: you are buying a feature flag platform in which observability is a module billed by monthly active users. The pricing model is entirely different from the product you were looking for.

What to use instead

Highlight.io combined three things: session replay, error tracking and logs. With the product broken up, the simplest route is to pick a separate tool for each, or one that covers two.

If you stay with LaunchDarkly, moving to the official packages is short, because you call the same code under a different name. The SDK has a plugin architecture and attaches to the feature flag client.

import { initialize } from 'launchdarkly-js-client-sdk'
import Observability from '@launchdarkly/observability'
import SessionReplay from '@launchdarkly/session-replay'

const client = initialize(
  '<CLIENT_SIDE_ID>',
  { key: 'authenticated-user@example.com' },
  {
    plugins: [
      new Observability({
        networkRecording: { enabled: true, recordHeadersAndBody: true }
      }),
      new SessionReplay()
    ]
  }
)

One caution about the example in the @launchdarkly/observability README: instead of initialize it calls a function named init3, which does not exist. That is a documentation typo, not a different API name.

If you are leaving, the old H interface from highlight.run maps over without much loss. The methods H.init, H.identify, H.track, H.consumeError, H.getSessionURL and H.stop have counterparts in every replacement in the table. The options passed to H.init as the second argument of type HighlightOptions include tracingOrigins, networkRecording, disableConsoleRecording, privacySetting, samplingStrategy, environment, serviceName, version, backendUrl and otlpEndpoint, among others. The last two matter most when cutting yourself off from the managed service, because they redirect traffic to your own endpoint.

// existing setup: pointing at your own backend instead of the service
import { H } from 'highlight.run'

H.init('PROJECT_ID', {
  backendUrl: 'https://otel.example.com/public',
  otlpEndpoint: 'https://otel.example.com',
  environment: 'production',
  serviceName: 'checkout-web',
  disableConsoleRecording: false,
  networkRecording: { enabled: true, recordHeadersAndBody: false }
})

In applications built on Next.js the migration is easier because @highlight-run/next never gained support for the newer framework releases anyway, so removing it usually solves a problem you already have. In plain React the swap comes down to replacing the context provider and the user identification calls.

Common mistakes

The first and most common: installing @highlight-run/next in a new project on the strength of an old blog post. The package drags along highlight.run pinned to 9.20.0, @highlight-run/node 3.12.22, @highlight-run/react 21.0.0, @highlight-run/cloudflare 3.1.0 and @highlight-run/sourcemap-uploader 0.6.3. That whole set dates from August 2025 and will receive no further fixes.

The second: mistaking highlight.run for the product. New versions of that package ship regularly, the latest one a week ago, and it is easy to conclude the project is healthy. It is not. Versions ship because @launchdarkly/observability and @launchdarkly/session-replay pin it exactly and need updates. It is somebody else's SDK dependency, not a maintained product.

The third: mixing generations in one project. @highlight-run/node 3.12.22 requires highlight.run at exactly 9.20.0, while the LaunchDarkly packages require exactly 10.7.1. Both pins are rigid, so the package manager installs two copies of the library at different versions. Two copies register listeners on the same browser events, which ends in duplicated events or in quietly losing some of them.

The fourth: starting the stack from docker/.env without raising the image tag. You get docker-v0.5.2 from 30 January 2025 instead of docker-v0.5.6 from August of the same year.

The fifth: basing a licence audit purely on the registry field. You will block @highlight-run/cloudflare because it declares no licence and ships no licence file, and at the same time wave through packages carrying the Catamorphic Co. notice without noticing the copyright now belongs to a different entity.

The sixth: linking to Highlight.io documentation in internal material. Every such link now lands on the LaunchDarkly home page, with no hint of what the reader was looking for.

FAQ

Was Highlight.io acquired by LaunchDarkly

Everything points that way, though I found no official announcement. The domain redirects to launchdarkly.com, the npm packages point at the launchdarkly/observability-sdk repository, and the licence files in the tarballs carry the notice "Copyright 2025 Catamorphic, Co.", LaunchDarkly's legal entity. The trace appeared in the metadata between 12 May and 7 August 2025.

Can I still use the highlight.run package

Technically yes, since it is published and licensed under Apache 2.0. In practice I advise against it unless you use it through the official @launchdarkly/observability and @launchdarkly/session-replay packages. Outside that context there is no managed service to send data to and no documentation at a public address.

Is the highlight/highlight repository archived

No. It returns 200, accepts changes and has open issues. Activity is limited to security and maintenance fixes, and the last image release, docker-v0.5.6, dates from 8 August 2025.

Can Highlight still be self-hosted

Yes, the GHCR images respond and docker/compose.yml is complete. The stack requires Kafka, ZooKeeper, ClickHouse, PostgreSQL with pgvector, Redis and an OpenTelemetry collector, and all dependency versions come from the first half of 2025 and will get no fixes. For production with user data it is a poor choice.

What should I use instead of Highlight.io

For self-hosted session replay, OpenReplay. For replay combined with product analytics, PostHog. For errors, Sentry. For logs and traces, Axiom. If you already use LaunchDarkly feature flags, their own observability packages are the shortest path, because they run the same code underneath.

Which licence covers the Highlight code

The client libraries are Apache 2.0 with copyright held by Catamorphic Co. The server repository is Apache 2.0 outside the enterprise/ directory, which carries its own commercial licence requiring a subscription on terms whose address now redirects to launchdarkly.com. The @highlight-run/cloudflare 3.1.0 package declares no licence and contains no licence file.