LoginSign Up
← Back to all sparks
C

Countly

ANALYTICS
Velocity5.0

Open-source product analytics for mobile and web.

countly.com ↗

Countly's two LTS lines now get the same security fixes within a week of each other.

analyticssecurityself-hostedltsaccess-tokens
◆Current state
Countly ships security patches on two LTS lines, 25.03 and 24.05. In late October 25.03.56 moved the Docker images to Node.js 24.22.1 for a Brotli CVE and brought Python 3.12.15 to the A/B testing stack; 25.03.58 tightened tokens: app-restricted tokens must state their permissions, password changes revoke a member's tokens, and single-use tokens hold under concurrent requests. 24.05.55 then brought those same fixes to the older line, including the isolated-vm sandbox for custom hook code that 25.03 adopted in August.
◆Where it's heading
The work is about access control and supply chain, not new analytics features. Tokens, sessions and login counting are being tightened release by release, and the 24.05 line is being pulled up to the 25.03 runtime (Node.js 22 for custom code, Python 3.12 with CmdStanPy for A/B testing) instead of being left on older stacks. Feature work shows up only in small items such as explicitly named databases and a licence payment-overdue banner.
◆Prediction
Expect more paired patches as token and session hardening continues on both lines. The entries don't say how long 24.05 will keep receiving backports.

◆Recent moves

  1. 14d ago

    Countly Version 24.05.55

    The 24.05 line catches up with 25.03 in one release: Node.js 24.22.1 images for the Brotli CVE, a move to Node.js 22 for package installs, isolated-vm for hook custom code, and the same app-token permission rules. Older deployments now get the August sandbox change and the October token hardening together.

    View source ↗
  2. 17d ago

    Countly Version 25.03.58

    A token-focused security release: app-restricted tokens must state the permissions they grant, password resets and member locks revoke tokens, single-use tokens work once even under concurrent requests, and login failures count per account regardless of case. This is the access-control half of October's hardening.

    View source ↗
  3. 19d ago

    Countly Version 25.03.57-LTS

    A follow-up to 25.03.56's certificate script: it also distrusts the emSign roots that certifi dropped, and the A/B testing setup script handles more server layouts. Fixes to the previous patch's tooling rather than new protection.

    View source ↗
  4. 21d ago

    Countly Version 25.03.56-LTS

    Node.js 24.22.1 in the Docker images for a Brotli decoder CVE, an upgrade script for Node.js 22 installs, and Python 3.12.15 with fresh pip and certifi for A/B testing. It also adds explicit database names and a payment-overdue banner for enterprise licences, the only feature work in this run of patches.

    View source ↗
  5. 1mo ago

    Countly Version 25.03.55

    Enterprise fixes that limit today's active-user recalculation to every five minutes and keep previous values on failure, plus a restored note widget. Housekeeping between the security releases.

    View source ↗
  6. 1mo ago

    Countly Version 24.05.54

    Two data-manager fixes on the 24.05 line: event processing after merges and a noisy transformation log. Maintenance with no user-facing change beyond the fix.

    View source ↗