Release v0.17.1

v0.17.1 - CA compromise patch, and finishing upgrades

A patch release on top of v0.17.0. It rebuilds everything the stack ships against certificate stores that no longer trust the compromised eMudhra intermediates (CVE-2026-111943), fixes empty LLM dashboards on stacks that were upgraded instead of freshly installed, and makes sure an upgrade actually reaches your running stack.

Important

Upgrade is recommended for every v0.17.0 install. The obol binary, the dashboard, the storefront, the x402 components and LiteLLM are all rebuilt for the eMudhra distrust.

Warning

This software is early alpha, you could lose what you put in. Please use caution when it comes to non-testnet assets. Back up before upgrading: obol stack export --file backup.tar.gz.

Install / Upgrade

# Fresh install
curl -fsSL https://stack.obol.org/v0.17.1 | bash
obol stack init && obol stack up

# Upgrade an existing stack
curl -fsSL https://stack.obol.org/v0.17.1 | bash   # offers to bring your running stack up to v0.17.1
obol doctor

---

Release Highlights

eMudhra CA compromise (CVE-2026-111943)

• obol CLI is built with Go 1.27.3, whose crypto/x509 distrusts the compromised eMudhra intermediates.
• Stack images (x402 verifier and buyer, serviceoffer-controller, job-broker, demo server) are built on golang:1.27.3-alpine.
• Dashboard and public storefront are built on patched Node images (node:24.22.1-alpine and node:22.23.4-alpine).
• LiteLLM moves to an image with certifi 2026.10.19 (affected emSign roots removed) and refreshed base-image CA certificates.

Upgrades now reach your running stack

• obolup finishes the update. After installing a new obol, obolup offers to bring a running stack up to that version. On a terminal it asks (default yes); without one it only does so with --yes or OBOL_UPGRADE_STACK=true.
• You're told when a stack is behind. obol doctor, plus a one-line notice on other commands, flags a stack the current CLI hasn't brought up yet.

LLM metrics on upgraded stacks

Stacks first installed before v0.16 and upgraded with obol upgrade never gained LiteLLM's Prometheus settings, so /metrics returned 401 and the LLM dashboards were empty. obol upgrade and obol stack up now add any missing settings to the live config and restart LiteLLM, without overriding values you set yourself.

What's Changed

• fix(llm): turn LiteLLM metrics on for stacks upgraded with obol upgrade by @OisinKyne in #891
• security: Go 1.27.3 and patched Node images for eMudhra CA compromise by @OisinKyne in #896

Full Changelog: v0.17.0...v0.17.1