Skip to content

v0.36.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 17:14
v0.36.2
41da9cb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrade notes

Security: certifi updated to 2026.10.19 (GHSA-6q48-6c7w-9gw2)

certifi is the Python package that supplies the root certificates the API trusts on many of its outbound HTTPS connections; the others use the operating system's certificate store in the image. The upstream advisory GHSA-6q48-6c7w-9gw2, rated critical, is about one of those roots, emSign ECC Root CA - G3: intermediate certificates that chain to it have compromised private keys and have been revoked. certifi 2026.10.19 no longer contains that root.

  • Which images. The API images (core and full) of every release through 0.36.1 ship certifi 2026.7.22. 0.36.2 ships certifi 2026.10.19. The dashboard images and the SDKs do not include certifi.
  • What used certifi's list. The API checks a server's certificate against certifi's list when it makes these outbound HTTPS connections: calls to AWS services through the AWS SDK, which include sign-in through Amazon Cognito when you enable it; webhook notifications; the LLM proxy's calls to Google Gemini; and, in the full image, integrations with GitHub, Jira and Salesforce and data-warehouse connections.
  • What used the operating system's list. These outbound connections check the certificate against the operating-system certificate store in the API image instead: calls to Anthropic and OpenAI models (by the LLM proxy, AI experiment design, results interpretation and LLM-as-judge scoring); Slack notifications; email sent through SendGrid; Redis over TLS; and, in the full image, sign-in through OpenID Connect (with GitHub as the provider, its e-mail check uses certifi's list). Through 0.36.1 that store (Debian ca-certificates 20250419) contained emSign ECC Root CA - G3, and also AAA Certificate Services, a root that cross-signed the same compromised intermediates. In 0.36.2 (Debian ca-certificates 20250419+deb13u1) it contains neither.
  • Who should upgrade. If your deployment uses any connection in either list, upgrade to 0.36.2. If it signs users in through Amazon Cognito or OpenID Connect, do it first.
  • What changes. After the upgrade, a connection to a server whose certificate chains to emSign ECC Root CA - G3 fails verification, whichever list it uses. On the operating system's list, one whose certificate chains only to AAA Certificate Services fails as well; certifi's list did not contain that root before either. The other emSign roots are unchanged in both lists.
  • The fix is to upgrade: pull core-0.36.2 or full-0.36.2, or rebuild your own image from this release. Nothing in Controlvar's logs would show an interception of this kind.

CDK: dev and demo stacks

CDK: dev and demo now run the API with staging settings. Until this release, a stack deployed with ENVIRONMENT=dev (the default) or ENVIRONMENT=demo gave the API and migration tasks APP_ENV=dev or APP_ENV=demo, which the application runs with development settings: /metrics answered without a token and weak secrets were accepted. They now get APP_ENV=staging, as staging does; staging and prod are unchanged. With staging settings the API also stops allowing pages served from localhost to call it, and a dev or demo stack whose secrets do not meet the staging rules refuses to start on a revision that carries the new value.

cdk deploy of this release does not change an API that is already running: its service moves to a new revision only through a CodeDeploy deployment. To check a stack, read APP_ENV in the revision in service, not in the family's newest revision (which cdk deploy rewrites, so it reads staging at once): TD=$(aws ecs describe-services --cluster experimentation-$ENV --services experimentation-backend-$ENV --query "services[0].taskSets[?status=='PRIMARY'].taskDefinition" --output text), then aws ecs describe-task-definition --task-definition "$TD" --query "taskDefinition.containerDefinitions[?name=='backend'] | [0].environment[?name=='APP_ENV'] | [0].value" --output text. dev or demo means the API in service still runs with development settings.

To fix such a stack, rebuild it from this release ("Destroying an environment" in the CDK guide), or keep it: run cdk deploy, then, from a checkout of this release, IMAGE=$(aws ecs describe-task-definition --task-definition "$TD" --query "taskDefinition.containerDefinitions[?name=='backend'] | [0].image" --output text) and NEW_ARN=$(scripts/register_task_definition.sh experimentation-backend-$ENV "$IMAGE") (it copies the newest revision, changes only the image, and takes a digest only), and deploy $NEW_ARN with Steps 1 and 4 to 6 of "Restart the API on the revision it is serving" in the Rollback Runbook. Do not deploy the newest revision as cdk deploy registers it: its image is the bootstrap placeholder. Replace any secret the start-up refuses; the task's log lists each one.

0.36.2 (2026-10-21)

Bug Fixes

  • infra: every CDK environment runs the API with staging or production settings (#1308) (6b69d27)

Dependencies

Documentation

  • compose: open the dashboard at localhost and point SDKs at it (#1300) (b46908c)
  • self-hosting: the by-hand AWS guide, corrected from an end-to-end run (#1310) (a8e420e)

Images

docker pull ghcr.io/controlvar/controlvar:core-0.36.2      # API, core profile
docker pull ghcr.io/controlvar/controlvar:full-0.36.2      # API, full profile
docker pull ghcr.io/controlvar/controlvar-web:core-0.36.2  # dashboard, core profile
docker pull ghcr.io/controlvar/controlvar-web:full-0.36.2  # dashboard, full profile

API images are built for linux/amd64; dashboard images for
linux/amd64. A host on any other architecture runs them under
emulation.

Verifying

Every image is signed with cosign keyless and carries an SPDX SBOM
attestation:

cosign verify ghcr.io/controlvar/controlvar:core-0.36.2 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

cosign verify-attestation --type spdxjson ghcr.io/controlvar/controlvar:core-0.36.2 \
  --certificate-identity-regexp '^https://github\.com/Controlvar/controlvar/\.github/workflows/release\.yml@refs/(heads/main|tags/v[0-9].*)$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The same SBOMs are attached below.

Assets 7
Loading