Release notes: Stella Ops v1.0.0-RC1-20261029

Release: v1.0.0-RC1-20261029 (release candidate, channel rc), first published 2026-10-29. Release commit: 75210df2875243a0ec85bb091e1a162507f197c2, the revision the images and the bundle state; in the current repository history it is 38a0350efb1ca0650b8e8dafd7cc9568bbad5225, the tip of branch release/v1.0.0-RC1-20261029. Licence: BUSL-1.1 with the Additional Use Grant; every image and the bundle carry the same LICENSE (SHA-256 ebd869191b46c2be818695ec338dbd95a083330fe2ceddad8c05b821bb714e3a).

What this release is

This release publishes the suite images, the stella CLI and the offline installation bundle under one dated tag, with the licence above. Every image is deployed by digest; the bundle’s release-manifest.yaml pins each one, and its signature verifies with the release public key https://stella-ops.org/keys/cosign.pub (file SHA-256 6877ef5b7368aa855cff4343fb665b5b16c08ed053bf8c6050a1dd3193d32f0d).

Provenance

Commit IDs are given as the images and the bundle state them. The current repository history carries the same revisions under other IDs: 75210df287 is 38a0350efb and fbedc49df6 is 2bdeeceac8.

• The release commit is fbedc49df642af14117d8782eab682def0a0bbd1 plus two fixes, and touches only the paths below. git diff --stat 2bdeeceac8 38a0350efb lists nine files:
  • the scanner-worker start-up fix (src/Scanner/StellaOps.Scanner.Worker/Program.cs, src/Scanner/__Libraries/StellaOps.Scanner.Events/ScannerEventsServiceCollectionExtensions.cs, two test files, and docs/modules/scanner/scan-completed-contract.md);
  • the installer health-wait fix (install.sh, install.ps1, the bundle README.md, and one test).
• scanner-web, scanner-worker and the bundle were built from the release commit.
• The other 29 suite images and stella-cli were built from fbedc49df6. The two fixes change no input of those images: no project outside the Scanner service references the changed Scanner library, and the installer is not part of any image.

Corrected before the release was announced

The first scanner-web and scanner-worker images published under this tag on 2026-10-29 (scanner-web@sha256:60a25ce5460bd8843a99ab0869a4f855c066bf45c8a9722915a4a8c04a826d8f, scanner-worker@sha256:928194070c2904726095bd25a8df45eb63e9179cb2337a0eb619d4b1ee1a7d59) were withdrawn the same day: on a new installation scanner-worker stopped at start-up with “AddEventingReliability registered 2 startup-migration hosts”. The tag now names the rebuilt images (scanner-web@sha256:98c7b66265392742ab62e5d0f3c90c76540685ae6e554c270a5a60dc3a330d16, scanner-worker@sha256:2eb199f60dea8c46933b6f767d5116bf891f54844bea9008408cee5c18647cdf), which the bundle manifest pins. A pull by the withdrawn digest still resolves; do not run those images. If you pulled either image by tag before the correction, pull again.

Known issues

• The first import of the offline vulnerability data takes hours. The installer imports the full seed (400,027 advisories, 5.3 GB) in one request and prints nothing until the import has finished. On the reference machine (8 vCPU, 25 GiB) the hub imported 565 to 950 advisories a minute, so the first import took about 8 to 10 hours. The other services keep running during the import; let the installer finish. A completed import is recorded in state/vulnerability-seed-import.json and is not repeated.
• Findings is not ready until the vulnerability data is projected. On a new installation, findings-web and findings-worker report not-ready until the imported advisories are projected. The installer recognises that state, lists the two services as “waiting for vulnerability data”, imports the seed, and then waits for them again. Any other Findings readiness failure is reported as unhealthy.