LoginSign Up
← Back to all sparks
C

Countly

ANALYTICS
Velocity5.0

Product analytics platform for web and mobile, self-hosted or cloud

countly.com ↗

Countly 25.03.58 tightens API tokens, sessions and login lockouts in one security patch.

product-analyticsself-hostedsecurity-patchesapi tokenslts
◆Current state
Countly 25.03.58 is a security-heavy patch for the 25.03 line. App-restricted tokens must now declare their permissions, password changes and member lockouts revoke tokens, single-use tokens and reset links work once even under concurrency, and login failures count per account regardless of username casing. It also tightens access to dashboards, dbviewer and exports, and fixes file migration, remote-config targeting and star-rating widgets.
◆Where it's heading
The 25.03 LTS line keeps absorbing security work at a fast clip: an upstream Node CVE, certificate distrust, and now a sweep of Countly's own token and permission model. Feature work stays in enterprise licensing and journeys, while LTS releases mostly harden what exists.
◆Prediction
Expect a matching 24.05 backport of the token and permission fixes. Token owners may also need migration guidance, since existing app-restricted tokens without permissions are now limited to their owner's rights.

◆Recent moves

  1. 1d ago

    Countly 25.03.58: token scoping, revocation and access fixes

    Unlike the past two upstream-driven patches, this one fixes Countly's own access model: token scoping and revocation, single-use enforcement, per-account login throttling, and stricter rights checks on dashboards, dbviewer and exports. Self-hosters running integrations on app-restricted tokens should check that their tokens still have the permissions they need.

    View source ↗
  2. 3d ago

    Countly 25.03.57-LTS distrusts emSign roots, fixes A/B setup

    A follow-up patch that extends the emSign root distrust to the certifi upgrade script and fixes A/B testing setup on more systems. Installer and certificate maintenance.

    View source ↗
  3. 6d ago

    Countly 25.03.56-LTS: Node CVE patch, licence overdue banner

    Patches the Node.js Brotli CVE in images and existing installs, refreshes Python and certifi, and adds an enterprise payment-overdue banner tied to the licence server. Security upkeep plus another step in License v2 enforcement.

    View source ↗
  4. 17d ago

    Countly 25.03.55: throttled active-user refresh, explicit DB names

    A small 25.03 patch with operational weight for self-hosters: today's active-user figures are recalculated at most every five minutes instead of on every dashboard load, database names can be set explicitly, and note widgets work again. It continues the pattern of tuning the existing stack rather than adding new analytics surface.

    View source ↗
  5. 29d ago

    24.05.54: data-manager merge and logging fixes

    A two-line enterprise patch on the older 24.05 branch fixing event deletion after merges and removing a noisy log. It confirms 24.05 is still maintained, but nothing here changes what users can do.

    View source ↗
  6. 1mo ago

    25.03.54: License v2 entitlements and journey charts

    The most substantive release of the quarter: License v2 brings entitlements, slots, renewal and an offline policy, and the tracker gains license lifecycle reporting. Around that sit journey-engine chart improvements and a long list of funnel, formula and dashboard fixes. It points to Countly formalizing how enterprise self-hosted installs are metered.

    View source ↗