LoginSign Up
← Back to all sparks
C

Countly

ANALYTICS
Velocity6.3

Open-source product analytics for mobile and web.

countly.com ↗

Countly ripped out its custom-code sandbox and rebuilt its Docker stack from scratch in a single LTS drop.

analyticssecurityself-hostedltsenterprisedocker
◆Current state
Countly is in an extended security hardening cycle, maintaining two parallel LTS lines — 25.03.x and 24.05.x — with coordinated patch releases. The 25.03.52-LTS was structurally significant: Docker images rebuilt as multi-stage on Debian 13 and Node.js 24 to strip compilers and build tooling from production images, the legacy v8-sandbox replaced by isolated-vm eliminating network, filesystem, and process access from custom hooks, and the A/B testing backend migrated from end-of-life Python 3.8 and pystan to Python 3.12 and cmdstanpy. The 25.03.53 and 24.05.53 patches that followed addressed XSS, OIDC session handling, and embedded widget cross-origin policies.
◆Where it's heading
Countly is hardening its self-hosted security posture — the isolated-vm switch and Docker rebuild reduce attack surface without changing the product surface for end users. Running two LTS tracks simultaneously signals a maturing enterprise customer base that cannot upgrade on a quarterly cadence. Feature development in journey_engine and content continues on a separate lane from the security work, suggesting the two concerns are intentionally decoupled.
◆Prediction
The Node.js 22/24 migration will propagate to additional components. The isolated-vm change will likely prompt tighter documentation of what custom code can and cannot access. Dual LTS maintenance continues as long as significant deployments remain on 24.05.x.

◆Recent moves

  1. 4d ago

    Countly Version 25.03.53-LTS

    25.03.53-LTS patches multiple security issues: XSS at HTML sinks, cross-origin headers on embedded widget routes, OIDC session token scoping, and survey parameter forwarding. These follow directly from the 25.03.52 security hardening cycle — each fix tightens a boundary the refactored stack exposed.

    View source ↗
  2. 4d ago

    Countly Version 24.05.53

    24.05.53 backports key security fixes to the older LTS branch: prototype-key traversal guards, chart tooltip XSS prevention, OIDC session scoping, and timeline exclude-list input sanitization. Coordinated LTS maintenance means enterprise deployments on the older branch get security coverage without being forced to upgrade.

    View source ↗
  3. 27d ago

    Countly Release 25.03.52-LTS (Long term support)

    ⚡ SPARK

    25.03.52-LTS replaced the custom v8-sandbox with isolated-vm (no network, filesystem, or process access for custom hook code), rebuilt all Docker images as multi-stage on Debian 13 + Node.js 24 to strip build tooling from production images, and migrated A/B testing off end-of-life Python 3.8. This is the security-posture reset that the previous release cycle's individual patches were leading toward.

    View source ↗
  4. 1mo ago

    Countly Release 24.05.52

    Fixes event descriptions not rendering when event keys contain special characters like dots, dollars, and backslashes — an encoding bug that surfaced only for events with non-standard names.

    View source ↗
  5. 1mo ago

    Countly Release 25.03.51

    25.03.51 tightens security across hooks, dashboards, and pipelines: internal event hooks are now app-scoped so they cannot cross app boundaries, dashboard widget copying validates source-app access, and Docker image pins switch to SHA digest. These are the security boundaries that a refactored self-hosted stack needs enforced at the platform level, not just recommended in documentation.

    View source ↗
  6. 1mo ago

    Countly Release 25.03.50

    Fixes a star-rating widget path resolution bug where the logo resolved to the global app logo instead of the widget's own asset after editing. Minor UX regression fix with no product direction implication.

    View source ↗