v0.36.0

0.36.0 (2026-10-17)

⚠ BREAKING CHANGES

• sdk: the SDK packages are named @controlvar/* on npm and controlvar / controlvar-openfeature on PyPI, and Python code imports from controlvar and controlvar_openfeature. Only @controlvar/js-sdk and controlvar (both 0.1.1) are published so far; install the others from this repository, as each SDK's page shows. The Go module path is github.com/controlvar/controlvar/sdk/go; the Java and Android coordinates are com.controlvar:*. The edge SDK's baseUrl is required.

Features

• sdk: publish the SDKs as Controlvar packages (#1280) (ea739ed)

Documentation

• name the demo apps' addresses on the compose stack page (#1279) (1cc19ae)

Images

docker pull ghcr.io/controlvar/controlvar:core-0.36.0      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.36.0      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.36.0  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.36.0  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.36.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.36.0 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.