Skip to content

BetterDB-inc/monitor

v0.28.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 7d Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

prometheus monitoring obsevability redis valkey

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Light signal
editorial:auto 7d

Version v0.28.0 introduces air‑gapped license activation via signed JWTs, RS256 entitlement tokens for fallback validation, and a `/license/status` API reporting detailed license metrics.

Why it matters: Enables secure offline licensing with new JWT‑based flows and status endpoint; critical for environments lacking constant internet connectivity.

Summary

AI summary

Updates ⬆ Upgrade notes, 🔒 Signed, tamper-proof entitlements, and 📊 Status & UI across a mixed release.

Changes in this release

Feature Medium

Adds support for air‑gapped/offline license activation via signed JWT tokens.

Adds support for air‑gapped/offline license activation via signed JWT tokens.

Source: llm_adapter@2026-07-19

Confidence: high

 —
Feature Medium

Adds RS256‑signed entitlement tokens for online validation that are verified locally as a fallback during outages.

Adds RS256‑signed entitlement tokens for online validation that are verified locally as a fallback during outages.

Source: llm_adapter@2026-07-19

Confidence: high

 —
Feature Medium

Adds `/license/status` endpoint reporting source, mode, instance limit, expiry, and clock‑rollback detection.

Adds `/license/status` endpoint reporting source, mode, instance limit, expiry, and clock‑rollback detection.

Source: llm_adapter@2026-07-19

Confidence: high

 —
Feature Medium

Introduces environment variables `BETTERDB_OFFLINE_LICENSE`, `BETTERDB_OFFLINE_LICENSE_FILE`, and `BETTERDB_DATA_DIR` for offline license handling and state persistence.

Introduces environment variables `BETTERDB_OFFLINE_LICENSE`, `BETTERDB_OFFLINE_LICENSE_FILE`, and `BETTERDB_DATA_DIR` for offline license handling and state persistence.

Source: llm_adapter@2026-07-19

Confidence: high

 —
Feature Low

Provides upgrade guidance: existing online deployments remain unchanged; optional writable volume for state persistence.

Provides upgrade guidance: existing online deployments remain unchanged; optional writable volume for state persistence.

Source: llm_adapter@2026-07-19

Confidence: high

 —
Bugfix Medium

Fixes temporary flash to community tier during offline‑license activation or refresh.

Fixes temporary flash to community tier during offline‑license activation or refresh.

Source: llm_adapter@2026-07-19

Confidence: high

 —
Bugfix Medium

Fixes correct reporting of real/perpetual license expiry during outages instead of showing short token window.

Fixes correct reporting of real/perpetual license expiry during outages instead of showing short token window.

Source: llm_adapter@2026-07-19

Confidence: high

 —
Bugfix Medium

Enforces offline‑license expiry on read paths and adds `kid`‑based signing‑key rotation support.

Enforces offline‑license expiry on read paths and adds `kid`‑based signing‑key rotation support.

Source: llm_adapter@2026-07-19

Confidence: high

 —
Full changelog

Headline: air-gapped licensing. Monitors can now run paid tiers with zero outbound network, and every license validation is now cryptographically signed and verified locally.

✨ Air-gapped / offline licensing

  • Run Pro/Enterprise in fully air-gapped or offline environments. Download a signed offline license token from your account page (betterdb.com/account/licenses → Download) and activate it - the monitor verifies it locally against embedded public keys, with no phone-home.
  • Activate it two ways:
    • UI: Settings → License → "Air-gapped environment? Activate an offline license" (paste the token or upload the .jwt file).
    • Config: BETTERDB_OFFLINE_LICENSE (token string) or BETTERDB_OFFLINE_LICENSE_FILE (path to a mounted .jwt).
  • When running purely from an offline token (no license key configured), telemetry and phone-home are automatically disabled - nothing leaves the box.
  • Licenses are floating (advisory instance limit); re-download a fresh token to renew before it expires.

🔒 Signed, tamper-proof entitlements

  • Online validation now returns an RS256-signed entitlement token that the monitor verifies locally - a spoofed or compromised endpoint can no longer grant a tier.
  • The verified token is persisted and used as a fallback during entitlement-server outages or restarts, so your paid tier survives connectivity blips instead of dropping to community.
  • Verification precedence: fresh online → in-memory cache → persisted signed token → offline token → community.

📊 Status & UI

  • GET /license/status now reports source (online / cached / persisted-jwt / offline-token / community), mode, instanceLimit, offlineExpiresAt, and clockRollbackSuspected.
  • Expiry warnings surface at 30 and 7 days; advisory clock-rollback detection.

⚙ New configuration

| Env var | Purpose |
|---|---|
| BETTERDB_OFFLINE_LICENSE | Offline license token (string) |
| BETTERDB_OFFLINE_LICENSE_FILE | Path to an offline license .jwt (e.g. a mounted secret) |
| BETTERDB_DATA_DIR | Where license state is persisted (license.jwt, license-offline.jwt, license-clock.json; default ./data, files written 0600) |

🐛 Fixes & hardening

  • Paid tier no longer briefly flashes to community during offline-license activation or license refresh.
  • Real/perpetual license expiry is reported correctly during outages (not the short token window).
  • Offline-expiry enforcement on read paths; kid-based signing-key rotation support.

⬆ Upgrade notes

  • Fully backward compatible. Existing BETTERDB_LICENSE_KEY (online) deployments keep working unchanged - they additionally get a signed token cached for outage resilience. No action needed unless you want air-gapped operation.
  • If you want license state to survive restarts, mount a writable volume at ./data (or set BETTERDB_DATA_DIR).

🐳 Docker

docker pull betterdb/monitor:0.28.0

What's Changed

  • feat(licenses): signed entitlement tokens + offline (air-gapped) licenses by @KIvanow in https://github.com/BetterDB-inc/monitor/pull/322

Full Changelog: https://github.com/BetterDB-inc/monitor/compare/v0.27.0...v0.28.0

Security Fixes

  • Entitlement validation now cryptographically signed (RS256) preventing spoofed or compromised endpoints from granting paid tiers
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track BetterDB-inc/monitor

Get notified when new releases ship.

Sign up free

About BetterDB-inc/monitor

Valkey-first observability with Redis compatibility. Query real-time metrics, analyze slow commands, detect hot keys, and investigate performance issues directly from AI coding assistants.

All releases →

Related context

Earlier breaking changes

  • vagent-cache-py-v0.7.0 Cache keys changed for tool-using requests on the LlamaIndex adapter; existing cached entries will miss once after upgrade.
  • vagent-cache-v0.7.0 Cache keys for tool-using requests changed on Vercel and LlamaIndex adapters; existing entries become one-time misses.
  • vagent-v1.5.0 TLS is now mandatory; agent exits with error if `--valkey-tls true` is not set for IAM auth mode.

Beta — feedback welcome: [email protected]