LoginSign Up
← Back to all sparks
O

OpenReplay

ANALYTICS
Velocity5.0

Open-source session replay and product analytics platform

openreplay.com ↗

OpenReplay lets self-hosters block the hosts a recorded session can make its asset cacher fetch.

session replayself-hostedsecurity hardeningbackportsgo
◆Current state
OpenReplay's feed is still backend maintenance across the 1.25 to 1.27 lines. On Nov 3 it added ASSETS_DENY_HOSTS so the asset cacher refuses chosen hosts before any DNS lookup, after a probe session crash-looped a pod. The same day brought a fix for EE 1.26 images that crashed on start and a product-analytics user fix backported to three lines.
◆Where it's heading
The work is hardening the self-hosted stack: safer asset fetching, startup crash fixes and the same patch landing on several release lines. The deny list moving into a shared package suggests asset handling is being made consistent across versions. No new user-facing features have appeared in recent entries.
◆Prediction
Expect ASSETS_DENY_HOSTS to reach the 1.25 line next, following the usual backport pattern.

◆Recent moves

  1. 22h ago

    1.26: deny list for hosts the asset cacher may fetch

    The ASSETS_DENY_HOSTS option reaches 1.26, letting self-hosters reject asset hosts before any request or DNS lookup. Its log format matches 1.27 so one query covers both versions.

    View source ↗
  2. 23h ago

    1.26 EE: fix startup crash from a removed SCIM import

    Every 1.26 EE API, alerts and crons image crashed on start after SCIM code was removed but still imported by SAML2. The fix keeps SSO group-to-role mapping working.

    View source ↗
  3. 23h ago

    1.26: assets Helm chart version bump

    A chart version bump that ships the assets service change to 1.26 Helm installs. No behavior change on its own.

    View source ↗
  4. 23h ago

    1.26: create analytics user when tracker.start() gets a userID

    A further 1.26 tag of the product-analytics user fix, which creates or refreshes the user when a userID is passed to tracker.start().

    View source ↗
  5. 1d ago

    1.27: asset cacher can reject a deny list of hosts

    The asset cacher gets ASSETS_DENY_HOSTS, rejecting listed hosts and redirects to them before any DNS lookup, after a probe session crash-looped a pod. The host matcher moves into a shared package and now accepts wildcards.

    View source ↗
  6. 1d ago

    1.25: create analytics user when tracker.start() gets a userID

    The product-analytics user fix is backported to 1.25, so users passed to tracker.start() are created or refreshed. It follows the feed's pattern of landing one fix on three lines.

    View source ↗