Versions and update checks

Versions

Version	Type	Carries
`0.X.0`	Feature	New features, and fixes.
`0.X.Y` (Y > 0)	Fix	Fixes only, with no change the previous `0.X` release cannot run on.
`0.X.Y` (Y > 0)	Security	A fix release that fixes the CVEs it names.

Releases are 0.x until 1.0.0. The running version shows on /version of the API and in stratumctl admin upgrade status.

Upgrades go forward. A release can also require a minimum version to upgrade from: upgrade to a release in between first. Going back is a rollback.

Update checks

The cloud reads the release mirror’s signed list of releases every six hours and lists the ones newer than what it runs. It never installs one by itself.

stratumctl admin upgrade available            # newer releases, with type, date and CVEs
stratumctl admin upgrade check --wait 2m      # check now

Running:  0.2.0
Mirror:   https://mirror.stratum-labs.cloud
Checked:  2h ago

VERSION  TYPE      PUBLISHED   CVES            UPGRADABLE
0.3.0    feature   2026-11-02  -               yes
0.2.1    security  2026-10-13  CVE-2026-12345  yes

The list is accepted only when it is signed by a release key the running version trusts, and never when it is older than one already read.

Readiness reports what the check found:

Finding	Severity
`UpdateAvailable`	info
`SecurityUpdateAvailable`	warning; the `security-update-unapplied` alarm fires after 7 days
`UpdateCheckFailed`	info; warning when the list was refused

The mirror setting

stratumctl admin upgrade mirror get
stratumctl admin upgrade mirror set --url https://mirror.example.com    # a mirror of your own
stratumctl admin upgrade mirror set --interval 1h
stratumctl admin upgrade mirror set --disable                            # no internet access
stratumctl admin upgrade mirror set --enable
stratumctl admin upgrade mirror set --default-url --default-interval     # back to the defaults

A mirror of your own holds a copy of the release mirror’s releases/stratum/ tree. An install without internet access turns the check off and upgrades from the release bundle.

Console: Admin › Substrate › Upgrades, under Sources.

Stable channel: release token

Stable releases are served on https://releases.stratum-labs.cloud to a release token from your Stratum Account (Company page, Enterprise support). With a token set, and the mirror setting the default, the update check and every release download read the stable channel and send the token there, over https, and to no other host. A mirror of your own never receives it.

When the stable channel does not serve a usable list of releases, the same check reads the default mirror instead, and the upgrade settings say why: revoked (an unknown or revoked token: mint a new one), plan ended (Enterprise support is not in force), unreachable (no connection, or an HTTP error such as a 404) or invalid (a list that does not verify). Each later check tries the stable channel again.

printf '%s\n' "$RELEASE_TOKEN" | stratumctl admin upgrade release-token set   # set or replace
stratumctl admin upgrade release-token get                                    # set? what the channel answered
stratumctl admin upgrade release-token clear                                  # back to the default mirror

The token is kept in the cloud’s secrets store and never shown again. At install, node.yaml upgrades.release_token sets it. Console: Admin › Substrate › Upgrades, in the upgrade settings.