LoginSign Up
← Back to all sparks
C

Countly

ANALYTICS
Velocity5.0

Open-source product analytics for mobile and web.

countly.com ↗

Countly's LTS line is spending its releases on hardening the surfaces customers extend.

product-analyticsself-hostedsecurity-hardeningsandboxingltsjourney-engine
◆Current state
The 25.03 LTS and 24.05 branches are moving together, and the recent content is dominated by security and scoping work rather than features. The latest LTS rebuilds the api and frontend Docker images as multi-stage builds on Debian 13 with Node 24 so compilers and build tooling no longer ship, overrides fourteen vulnerable transitive dependencies, and replaces the unmaintained v8-sandbox behind custom code with isolated-vm. Earlier releases scoped internal event hooks to their own apps, fixed the consents table returning fields beyond the consent columns, and stopped dashboard widgets being copied by users without access to the referenced apps.
◆Where it's heading
The pattern across these releases is closing the gaps where a customer-supplied artefact — custom hook code, a copied widget, a projection on a request — could reach further than intended. That work is now touching the runtime itself, and the isolated-vm swap is a breaking change: custom code relying on setTimeout, setInterval or async completion fails with a logged error instead of running. The journey engine is the only place shipping genuinely new capability, and it is enterprise-only.
◆Prediction
Expect follow-up releases to soften the custom-code migration, since the isolated-vm switch silently breaks any hook that awaited a timer, and further ab-testing work now that pystan has been replaced with compiled Stan executables.

◆Recent moves

  1. 6d ago

    Custom-code sandbox swapped to isolated-vm; images rebuilt on Node 24

    The custom-code sandbox moves from the unmaintained v8-sandbox to isolated-vm, removing network, filesystem and process surface — and breaking any hook that relied on setTimeout, setInterval or asynchronous completion. Images are rebuilt as multi-stage Debian 13 and Node 24 builds, transitive dependencies are overridden, and ab-testing drops the end-of-life Python 3.8 runtime for compiled Stan executables.

    View source ↗
  2. 15d ago

    Fixes for event keys containing special characters

    Event descriptions and custom labels now render for event keys containing special characters, with a data-manager duplicate-row fix on the enterprise side. The 24.05 backport of a fix that also shipped to the LTS line the same day.

    View source ↗
  3. 15d ago

    Journey deeplinks take dynamic parameters; hooks validated on save

    Journey deeplinks gain dynamic parameter support, and internal event hooks are both validated on save and scoped to the apps the hook belongs to. The scoping change is the clearest instance of the hardening pattern running through this branch.

    View source ↗
  4. 26d ago

    Star-rating logo path and data-manager transformation fixes

    A star-rating widget logo resolving to the global app logo path after an edit, plus an intermittent data-manager transformation failure. Two narrow fixes with no wider change.

    View source ↗
  5. 27d ago

    LTS backport: data-manager transformation fix

    The 24.05 backport of the data-manager transformation fix alone. Same change as its LTS sibling, cut a day earlier.

    View source ↗
  6. 1mo ago

    Journeys survive user merges; SDK-provided asset paths

    Running journeys are remapped to the surviving user on a merge, keeping the furthest-progressed instance and stopping duplicates, and several plugins now honour an SDK-supplied asset path. The user-merge handling closes a real correctness gap in long-running journeys.

    View source ↗