Skip to content

Releases: Controlvar/controlvar

Release list

v0.39.0

v0.39.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Oct 22:33
v0.39.0
11fd155
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.39.0 (2026-10-30)

Features

  • dashboard: create and run a feature flag's rollout schedule (#1465) (ab3c128)
  • dashboard: create, activate and end the global holdout, and read its results (beta) (#1475) (ba7dbf7)
  • dashboard: edit a draft experiment's variants and metrics (#1468) (7140c71)
  • dashboard: guided setup turns on sequential testing (beta) (#1463) (b3fc517)
  • dashboard: manage exclusion groups, and add an experiment to one (#1473) (9f21fa8)
  • dashboard: schedule a draft experiment's start and end dates (#1471) (2d19351)

Bug Fixes

  • api: a duplicate exclusion group or holdout name answers 409 (#1467) (4bb6bcd)
  • api: the experiment page shows a group change or a scheduled start at once when caching is on (#1474) (55b2909)
  • dashboard: no light-grey text on the experiment form and page (#1477) (f50190f)
  • dashboard: the experiment page says "Starts" for a start still ahead, and shows whether sequential testing is on (#1450) (c27a304)
  • dashboard: the experiment page shows its exclusion group and the global holdout, read-only (#1452) (982041c)
  • deps: joserfc 1.7.6, for GHSA-9pg5-8c7x-5hfx (#1476) (314bd3e)
  • scheduler: a scheduled draft that cannot start stays a draft (#1464) (522fdc9)
  • site: one header on every page, with a phone menu (#1472) (fd26ece)
  • site: shared links show a preview card (Open Graph and Twitter tags, /og.png) (#1470) (d18d32f)

Images

docker pull ghcr.io/controlvar/controlvar:core-0.39.0      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.39.0      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.39.0  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.39.0  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.39.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.39.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Assets 7
Loading

v0.38.0

v0.38.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Oct 15:14
v0.38.0
ef21aa8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.38.0 (2026-10-29)

Features

  • dashboard: a revenue metric reads as revenue per user, with its difference and interval (#1406) (4421a06)
  • results: a revenue metric is analysed as its mean per assigned user (#1400) (7024eeb)
  • sdk: the JavaScript and Python SDKs report errors to safety monitoring (#1364) (6f827f9)
  • sdk: version 0.2.0 of the JavaScript and Python SDKs (#1421) (fc5c6b2)

Bug Fixes

  • ci: the docs journeys raise one alarm issue when the report cannot decide (#1395) (fd78a90)
  • ci: the docs-journeys report retries every read and names what fails (#1382) (5b42f12)
  • dashboard: better and worse follow lower_is_better; the form sets it (#1393) (d535bef)
  • demo: assign each experiment where it is used; keep off-list clicks off the sort bandit (#1403) (dd15c90)
  • demo: simulators keep the StreamPulse lift, date nothing ahead, and match the app (#1398) (a23b0fc)
  • demo: the rollout story waits for the safety monitor's rollback (#1404) (cd9eddf)
  • installer: uninstall counts the cache's automatic backup with what AWS is still clearing (#1399) (83c2095)
  • sdk: an event tracked without a key is still sent after the SDK's cache expires (#1358) (940fdf1)
  • stats: a mean arm whose values are all equal gets a result, not result_invalid (#1387) (00c498a)
  • stats: the winner and recommendation follow a metric's lower_is_better (#1383) (a6cced6)
  • tracking: a paused or completed experiment answers control with a reason, not 404 (#1362) (0caf581)
  • tracking: events for a paused or completed experiment count in no arm (#1359) (a50c469)

Dependencies

Documentation

  • api: name CUPED's variance divisor and state the history rule exactly (#1420) (9bfcc47)
  • api: the Bayesian example's numbers follow its posteriors (#1409) (341e7cf)
  • demo: StreamPulse targets devices through the web SDK; native SDKs send no attributes yet (#1371) (daa687e)
  • guide: say no guardrail verdict is produced; Breakdowns of a revenue metric (#1414) (4596352)
  • guides: guided examples, every step walked nightly by a journey (#1417) (05f5794)
  • guides: guided examples: Buy now arms, the reload rule, CUPED (#1430) (56a3f5d)
  • sdk: no SDK page says a paused or completed experiment answers 404 (#1370) (34ae5d1)
  • sdk: the provider and edge pages say where a track without a key goes (#1431) (1f8b41c)

Images

docker pull ghcr.io/controlvar/controlvar:core-0.38.0      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.38.0      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.38.0  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.38.0  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.38.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.38.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Loading

v0.37.0

v0.37.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 11:38
v0.37.0
6036d11
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.37.0 (2026-10-27)

Features

  • installer: install and uninstall on AWS with one command (beta) (#1311) (facb778)

Documentation

  • self-hosting: the beta AWS installer page (#1384) (21a3f5b)

Images

docker pull ghcr.io/controlvar/controlvar:core-0.37.0      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.37.0      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.37.0  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.37.0  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.37.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.37.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Loading

v0.36.4

v0.36.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 22:33
v0.36.4
79f8ed1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.36.4 (2026-10-23)

Bug Fixes

  • email: SMTP email checks the server's certificate, and SMTP_CA_FILE names a private CA (#1329) (297b9b7)

Security note: email through an SMTP server

Published as GitHub security advisory GHSA-j26w-qcgq-rvph.

Who was affected. Releases 0.2.0 to 0.36.3 with email on (EMAIL_ENABLED=true), SMTP_HOST set, and both SMTP_USERNAME and SMTP_PASSWORD set. That includes a SendGrid setup with SMTP_HOST also set, whenever a SendGrid send failed and the API fell back to SMTP. Email through SendGrid alone was not affected, and nothing Controlvar ships turns SMTP on.

What could have been seen. Before 0.36.4 the API did not check the SMTP server's certificate before signing in, so anyone on the network path between the API and the SMTP server could have read the SMTP username and password, and the test email itself. In these releases the API connects to the SMTP server only when a developer or administrator sends a test email (POST /api/v1/notifications/test with "channel": "email" and a recipient); nothing else sends email.

What to do. Upgrade to 0.36.4. Then, if a test email was ever sent with both login settings set, or you cannot tell, change the SMTP password at your mail provider and update SMTP_PASSWORD. Change it after the upgrade, not before: an earlier release would send the new password the same way. In the provider's sign-in records for that username, look for sign-ins from an address other than your API's outbound address, and for mail you did not send.

With SMTP_USERNAME or SMTP_PASSWORD empty, no password was sent; 0.36.4 still sends that mail without STARTTLS unless SMTP_CA_FILE is set (see below).

Email through an SMTP server: what to check after upgrading

  • Who: deployments with email on (EMAIL_ENABLED=true) and SMTP_HOST set that also set both SMTP_USERNAME and SMTP_PASSWORD, or set the new SMTP_CA_FILE. With SENDGRID_API_KEY set as well, this applies whenever a SendGrid send fails and the API falls back to SMTP.
  • What changes: the API completes STARTTLS and checks the server's certificate (valid for SMTP_HOST, trusted by the API image's operating-system certificate store or by SMTP_CA_FILE, TLS 1.2 or later) before it signs in or sends the message. If the server offers no STARTTLS or the certificate does not pass, nothing is sent. Setting SMTP_CA_FILE requires this even without a login.
  • What to do: use the server's STARTTLS port (usually 587; port 465 is not supported) and check that its certificate is valid for the name in SMTP_HOST. For a private certificate authority, set SMTP_CA_FILE to a PEM file inside the API container, readable by the API's user (uid 1001). It replaces the default store for SMTP; put both sets of certificates in the file if you need both.
  • How to check: send a test email with an administrator or developer token and an explicit recipient (POST /api/v1/notifications/test with {"channel":"email","recipient":"you@example.com"}) and read success in the response: HTTP 200 alone does not mean it was sent. If it is false, the API log has an error containing SMTP step= that names the step and what to check. If that error says the server accepted the message, confirm delivery before retrying.
  • Unchanged: email through SendGrid, and the order (SendGrid first, then SMTP when no SendGrid key is set or a SendGrid send fails). With either login setting empty and SMTP_CA_FILE blank, the SMTP session is as before: no STARTTLS and no login.

Images

docker pull ghcr.io/controlvar/controlvar:core-0.36.4      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.36.4      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.36.4  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.36.4  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.36.4 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.36.4 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Loading

v0.36.3

v0.36.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 21:05
v0.36.3
7879796
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.36.3 (2026-10-22)

Dependencies

Images

docker pull ghcr.io/controlvar/controlvar:core-0.36.3      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.36.3      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.36.3  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.36.3  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.36.3 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.36.3 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Loading

v0.36.2

v0.36.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 17:14
v0.36.2
41da9cb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrade notes

Security: certifi updated to 2026.10.19 (GHSA-6q48-6c7w-9gw2)

certifi is the Python package that supplies the root certificates the API trusts on many of its outbound HTTPS connections; the others use the operating system's certificate store in the image. The upstream advisory GHSA-6q48-6c7w-9gw2, rated critical, is about one of those roots, emSign ECC Root CA - G3: intermediate certificates that chain to it have compromised private keys and have been revoked. certifi 2026.10.19 no longer contains that root.

  • Which images. The API images (core and full) of every release through 0.36.1 ship certifi 2026.7.22. 0.36.2 ships certifi 2026.10.19. The dashboard images and the SDKs do not include certifi.
  • What used certifi's list. The API checks a server's certificate against certifi's list when it makes these outbound HTTPS connections: calls to AWS services through the AWS SDK, which include sign-in through Amazon Cognito when you enable it; webhook notifications; the LLM proxy's calls to Google Gemini; and, in the full image, integrations with GitHub, Jira and Salesforce and data-warehouse connections.
  • What used the operating system's list. These outbound connections check the certificate against the operating-system certificate store in the API image instead: calls to Anthropic and OpenAI models (by the LLM proxy, AI experiment design, results interpretation and LLM-as-judge scoring); Slack notifications; email sent through SendGrid; Redis over TLS; and, in the full image, sign-in through OpenID Connect (with GitHub as the provider, its e-mail check uses certifi's list). Through 0.36.1 that store (Debian ca-certificates 20250419) contained emSign ECC Root CA - G3, and also AAA Certificate Services, a root that cross-signed the same compromised intermediates. In 0.36.2 (Debian ca-certificates 20250419+deb13u1) it contains neither.
  • Who should upgrade. If your deployment uses any connection in either list, upgrade to 0.36.2. If it signs users in through Amazon Cognito or OpenID Connect, do it first.
  • What changes. After the upgrade, a connection to a server whose certificate chains to emSign ECC Root CA - G3 fails verification, whichever list it uses. On the operating system's list, one whose certificate chains only to AAA Certificate Services fails as well; certifi's list did not contain that root before either. The other emSign roots are unchanged in both lists.
  • The fix is to upgrade: pull core-0.36.2 or full-0.36.2, or rebuild your own image from this release. Nothing in Controlvar's logs would show an interception of this kind.

CDK: dev and demo stacks

CDK: dev and demo now run the API with staging settings. Until this release, a stack deployed with ENVIRONMENT=dev (the default) or ENVIRONMENT=demo gave the API and migration tasks APP_ENV=dev or APP_ENV=demo, which the application runs with development settings: /metrics answered without a token and weak secrets were accepted. They now get APP_ENV=staging, as staging does; staging and prod are unchanged. With staging settings the API also stops allowing pages served from localhost to call it, and a dev or demo stack whose secrets do not meet the staging rules refuses to start on a revision that carries the new value.

cdk deploy of this release does not change an API that is already running: its service moves to a new revision only through a CodeDeploy deployment. To check a stack, read APP_ENV in the revision in service, not in the family's newest revision (which cdk deploy rewrites, so it reads staging at once): TD=$(aws ecs describe-services --cluster experimentation-$ENV --services experimentation-backend-$ENV --query "services[0].taskSets[?status=='PRIMARY'].taskDefinition" --output text), then aws ecs describe-task-definition --task-definition "$TD" --query "taskDefinition.containerDefinitions[?name=='backend'] | [0].environment[?name=='APP_ENV'] | [0].value" --output text. dev or demo means the API in service still runs with development settings.

To fix such a stack, rebuild it from this release ("Destroying an environment" in the CDK guide), or keep it: run cdk deploy, then, from a checkout of this release, IMAGE=$(aws ecs describe-task-definition --task-definition "$TD" --query "taskDefinition.containerDefinitions[?name=='backend'] | [0].image" --output text) and NEW_ARN=$(scripts/register_task_definition.sh experimentation-backend-$ENV "$IMAGE") (it copies the newest revision, changes only the image, and takes a digest only), and deploy $NEW_ARN with Steps 1 and 4 to 6 of "Restart the API on the revision it is serving" in the Rollback Runbook. Do not deploy the newest revision as cdk deploy registers it: its image is the bootstrap placeholder. Replace any secret the start-up refuses; the task's log lists each one.

0.36.2 (2026-10-21)

Bug Fixes

  • infra: every CDK environment runs the API with staging or production settings (#1308) (6b69d27)

Dependencies

Documentation

  • compose: open the dashboard at localhost and point SDKs at it (#1300) (b46908c)
  • self-hosting: the by-hand AWS guide, corrected from an end-to-end run (#1310) (a8e420e)

Images

docker pull ghcr.io/controlvar/controlvar:core-0.36.2      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.36.2      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.36.2  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.36.2  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.36.2 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.36.2 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Loading

v0.36.1

v0.36.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Oct 06:13
v0.36.1
ff3a416
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The notes for this release line are in v0.36.0, including which packages are published.

0.36.1 (2026-10-18)

Bug Fixes

  • docs: name every compose profile in the getting-started teardown (#1286) (f2d64f4)

Images

docker pull ghcr.io/controlvar/controlvar:core-0.36.1      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.36.1      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.36.1  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.36.1  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.36.1 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.36.1 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Loading

v0.36.0

v0.36.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 22:04
v0.36.0
0c6f8c8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.36.0 (2026-10-17)

⚠ BREAKING CHANGES

  • sdk: the SDK packages are named @controlvar/* on npm and controlvar / controlvar-openfeature on PyPI, and Python code imports from controlvar and controlvar_openfeature. Only @controlvar/js-sdk and controlvar (both 0.1.1) are published so far; install the others from this repository, as each SDK's page shows. The Go module path is github.com/controlvar/controlvar/sdk/go; the Java and Android coordinates are com.controlvar:*. The edge SDK's baseUrl is required.

Features

  • sdk: publish the SDKs as Controlvar packages (#1280) (ea739ed)

Documentation

  • name the demo apps' addresses on the compose stack page (#1279) (1cc19ae)

Images

docker pull ghcr.io/controlvar/controlvar:core-0.36.0      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.36.0      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.36.0  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.36.0  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.36.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.36.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Loading

v0.35.0

v0.35.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 18:02
v0.35.0
cdf655f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.35.0 (2026-10-17)

⚠ BREAKING CHANGES

  • Experimently is now Controlvar. New images are ghcr.io/controlvar/controlvar and ghcr.io/controlvar/controlvar-web. The ghcr.io/getexperimently/... images stay where they are; their floating :core and :full tags stay at 0.34.4 and receive no further releases, including security fixes, so pin the new path. Docker Compose keeps its project name and database user, so an upgrade with the new compose.yml keeps its data. The Helm chart is named controlvar; upgrade with your existing release name and every object, the database volume included, keeps its name. Signatures of new images name github.com/Controlvar/controlvar; releases.md gives the identity for each version. The MCP manifest gives the name controlvar. See docs/self-hosting/upgrading-to-controlvar.md.

Features

Images

docker pull ghcr.io/controlvar/controlvar:core-0.35.0      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.35.0      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.35.0  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.35.0  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.35.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.35.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Loading

v0.35.0-rc.1

v0.35.0-rc.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 17:59
v0.35.0-rc.1
09145d0

Images

docker pull ghcr.io/controlvar/controlvar:core-0.35.0-rc.1      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.35.0-rc.1      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.35.0-rc.1  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.35.0-rc.1  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.35.0-rc.1 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.35.0-rc.1 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Loading