Affects
Teams deploying Tracer behind a browser client or with Consul service discovery enabled.
What changed
The documentation now correctly states that an unset or empty
CORS_ALLOWED_ORIGINS value blocks cross-origin requests. Configure an explicit allow-list when browser clients need cross-origin access.
Service discovery is active when SD_ENABLED=true. Tracer registers as midaz-tracer, resolves Access Manager through Consul, and falls back to PLUGIN_AUTH_ADDRESS if that resolution fails. Enabling discovery requires either SD_EXTERNAL_ADDRESS or SD_INTERNAL_ADDRESS.
Impact
Classification: Review recommended. This is a correction to the documented configuration contract; it does not announce a runtime change.
What you need to do
Review browser deployments that rely on an empty CORS setting and discovery-enabled deployments that do not declare an advertised address.