Countly/countly-server 25.03.52-LTS

Countly Release 25.03.52-LTS (Long term support)

on GitHub

Security Fixes:

• [docker] Rebuilt the api and frontend images as multi-stage builds on Debian 13 with Node.js 24, so compilers, development headers and build tooling are no longer present in the shipped images.
• [core] Updated vulnerable transitive dependencies through npm overrides: tar, form-data, brace-expansion, minimatch, immutable, ip-address, basic-ftp, websocket-driver, js-yaml, body-parser, qs, postcss, protobufjs and ws
• [hooks] Replaced the unmaintained v8-sandbox custom-code sandbox with isolated-vm, which exposes no network, filesystem or process surface to custom code. Custom code that relies on setTimeout, setInterval or asynchronous completion now fails with a logged error instead of running, and the bufferToBase64 and base64ToBuffer helpers are no longer available
• [ab-testing] Replaced pystan 2.19 and its pickled models with cmdstanpy and compiled Stan executables, removing the end-of-life Python 3.8 runtime

Fixes:

• [hooks] Custom code calling setResult(undefined) no longer fails the effect
• [docker] A plugin whose dependency install or asset build fails now fails the image build instead of being shipped broken without warning
• [ab-testing] The model runner locates its CmdStan installation automatically when CMDSTAN is not set in the service environment

Enterprise Fixes:

• [ab-testing] /o/ab-testing/check-models reports whether the models are actually compiled.

Enterprise Features:

• [ab-testing] Added /o/ab-testing/test-models, a global-admin diagnostic that runs a model against supplied variant data and returns the raw result

Dependencies:

• [core] Node.js 20 to 22 for package installs and upgrades. The hooks plugin requires Node.js 22 or later, as isolated-vm does not support Node.js 20. Fresh installs on Ubuntu and RHEL now install Node.js 22, and bin/upgrade/25.03/upgrade.nodejs.22.sh upgrades an existing 25.03 install. RHEL 8 additionally installs gcc-toolset-11 and Python 3.8, since isolated-vm publishes no prebuilt binary for glibc 2.28 and has to be compiled there
• [docker] Node.js 20 to 24, Debian 12 to 13, npm 10 to 11.19.0. Custom plugins containing native addons must be rebuilt, and images derived from these must reinstall any build tooling they need
• [ab-testing] Python 3.8 to 3.12, pystan 2.19.1.1 to cmdstanpy 1.2.5 with CmdStan 2.36.0
• [hooks] v8-sandbox 3.2.12 to isolated-vm 6.2.0