Release Notes - v0.70.0

v0.70.0

Title: Strengthen ledger validation, node reliability, and operator security

Date: Not provided

Version: v0.70.0

This release strengthens Byron validation and replay recovery, improves synchronization and shutdown reliability, expands API security and query capabilities, and updates operator tooling, dependencies, and documentation.

Recommended Network Compatibility ⚠️

Network	Compatible
mainnet	⛔
preprod-testnet	✅
preview-testnet	✅
musashi	✅

✨ Highlights

• Fixed Byron replay by recovering valid redeem witnesses wrapped in CBOR tag 24 from the original transaction data, verifying signatures with the configured Byron protocol magic and domain tags, and matching each witness to the correct input address root. Mainnet from genesis replay now accepts valid Byron inputs, including inputs from private networks with custom protocol magic.

• Improved rollback and resynchronization by publishing ChainsyncResync events after synchronization locks are released. Subscriber backpressure no longer deadlocks rollback or resynchronization and stalls chainsync.

• Preserved DevNet failure evidence by saving observed chain snapshots, container status, and bounded service logs in separate scenario artifact directories during cleanup. Intermittent scenario failures retain diagnostics after teardown.

• Added cryptographic and header checks for Byron PBFT blocks, along with issuer and delegation state reconstruction, caching, and Mithril trust boundary handling. These checks reject invalid historical headers while valid processing remains consistent across restarts and rollbacks; current slot clock errors no longer trigger header recovery.

• Updated github.com/klauspost/compress to 1.19.2, incorporating upstream zstd and huff0 fixes and improvements.

• Introduced an opt-in parallel block decode pipeline with two workers, configurable through blockPipelineEnabled, DINGO_BLOCK_PIPELINE_ENABLED, or --block-pipeline-enabled. Validation and application retain serial ordering, startup rejects the option on Musashi, and retry handling remains isolated; this experimental option stays disabled by default.

• Refreshed the workflow checkout action pins to 7.0.1, bringing upstream checkout safety fixes into continuous integration.

• Included AWS SDK serialization fixes and a recursive collection panic fix by updating github.com/aws/smithy-go to 1.27.7.

• Expanded API listener security with shared api.tls and api.auth defaults, provider-level overrides under plugins.api.<name>.config, and token authentication for Blockfrost, Mesh, and UTxORPC. The configuration rejects incomplete TLS or authentication settings before listeners start, bypasses authentication for CORS preflight requests, and preserves legacy UTxORPC TLS behavior.

• Changed the default PostgreSQL metadata connection from sslmode=disable to sslmode=require. Explicit connection strings remain unchanged, while deployments that require plaintext must set sslMode: disable explicitly.

• Resolved blockfetch stalls by releasing locks around requests, draining earlier work for each connection, ignoring stale generations, moving continuations to workers, and bounding shutdown. Synchronization and shutdown no longer wedge under callback or backpressure interactions, and repeated in-flight timeouts now log at Warn.

• Established on-chain Leios BLS key and proof of possession verification with deterministic committees selected by stake coverage. Dingo no longer uses derived fallback keys and requires configured signing keys to match registered on-chain keys; this experimental behavior prevents keyless or mismatched operators from contributing verified votes.

• Corrected reward withdrawal accounting by exposing LedgerView.RewardAccountBalance, rejecting withdrawals above the available balance, subtracting partial withdrawals, and retaining zero-withdrawal validation. Balances now remain consistent across partial withdrawals, replay, and rollback.

• Retained configured Genesis fork selection during live restore and truncate operations, so the selection remains active without a restart.

• Isolated the pprof bind address with debugBindAddr, DINGO_DEBUG_BIND_ADDR, and --debug-bind-addr. The debug listener now defaults to loopback independently of public or private binds across serve and Mithril paths; wildcard exposure requires explicit configuration.

• Enabled UtxosByTxIn queries to accept multiple transaction inputs through batched, deduplicated, and chunked lookups. Ledger queries omit missing live inputs, while UTxORPC retains its error on missing contract.

• Refined the Google API dependency set with google.golang.org/api 0.292.0 and aligned gRPC and genproto dependencies, refreshing client definitions and checksums.

• Completed partially fetched Leios endorser blocks when peers re-offer them by retaining sparse transaction progress and requesting only missing tail entries. An expiry limit for incomplete cache entries prevents indefinite retention; this experimental behavior helps near-tip blocks finish instead of restarting partial fetches.

• Hardened release validation with race-enabled checks, timeouts, safer shell handling, multi-architecture manifest checks, pinned actions, and reduced permissions. Release automation now protects published releases from deletion or overwrite during reruns.

• Recovered from deterministic replay transaction failures by identifying duplicate inputs, performing bounded rewind and fresh intersection recovery, and throttling repeated attempts with a latch. These failures no longer cause endless peer rotation or replay stalls.

• Configured root peer selection through targetNumberOfRootPeers, DINGO_TARGET_ROOT_PEERS, or --target-root-peers. Dingo settings take precedence over Cardano settings, the default is 60, -1 means unlimited, live reinitialization applies changes without a restart, and Dingo preserves local roots.

• Secured Mithril archive extraction by rejecting destination symlinks and time-of-check-to-time-of-use races, verifying digests, and publishing vetted trees atomically. Exclusive, merge, and replace policies control extraction, and an exclusive extraction into a non-empty destination now requires the replace policy.

• Protected storage after an incomplete ledger drain by skipping database and plugin shutdown and returning an explicit error. This avoids closing storage while ledger work may still be active and reduces corruption risk.

• Redacted secret-bearing configuration from startup logs with structured, fail-safe handling for tokens, keys, passwords, DSNs, and unknown fields. Text and JSON logs retain troubleshooting details without exposing secrets.

• Documented standardized discovery through docs/README.md and docs/code-reference.md. Repository guidance files now link to these pages so readers and coding agents can find version-matched documentation.

• Corrected epoch forecasting at hard-fork and era boundaries so cached parameters never cross a confirmed or configured boundary; the ledger applies successor-era parameters during full rollover and retains deferred header-verification classification.

• Expanded Mesh and Rosetta contract coverage and corrected block height and index translation. Historical /account/balance requests now use the requested block, return block-not-found for unresolved points, and advertise historical lookup.

• Protected Unix socket paths with metadata, liveness, and identity checks, removing only confirmed stale sockets. Startup now preserves regular files, symlinks, directories, live sockets, and ambiguous paths and reports a clear failure.

• Updated the Sundae Preview example dependency @sundaeswap/core to 2.13.1 and its transitive @sundaeswap/math dependency to 0.3.0; the latter requires TypeScript 5 for the example build environment.

• Enhanced development and build tooling for the Sundae Preview example by updating the vite development dependency in examples/dingo-sundae-preview from 8.2.0 to 8.2.1 and refreshing its matching lockfile and dependency graph.

• Refreshed the Blockfrost Explorer example Vite dependency to 8.2.1 with matching lockfile updates, bringing upstream fixes and improvements.

• Improved DevNet cleanup so it remains best effort without replacing the underlying test exit status. Temporary stake keys now retain the host user and group ownership, and cleanup handles temporary directories more reliably.

• Verified exact ChainSync messages exchanged between peers through shared protocol fixtures and a side-effect-free client lookup, making protocol regressions visible through actual message behavior.

• Hardened reward and withdrawal parity checks with nil-safe helpers and modern iteration, keeping pre-commit static analysis clean without changing production behavior.

• Aligned deployable Blockfrost Explorer, Gov Lens, and Sundae Preview Kubernetes examples with Dingo 0.70.0 image pins and matching README versions.

• Enabled optional API-mode synchronization with CIP-26 token registries and local metadata caching for Blockfrost asset responses. Operators can configure the source, interval, timeouts, size limits, logo storage, and private-address allowance through YAML, environment variables, or CLI flags; the feature is disabled by default and the mainnet registry is approximately 240 MB.

• Restored Byron-era state at slot 0 during genesis sync for Byron-genesis networks, avoiding Shelley-shaped parameters and skipping inappropriate Byron reward calculation. Existing stale epoch-cache geometry now triggers a warning that requires an empty-database resync; Dingo does not repair it automatically.

• Clarified Windows keyfile permission checks by distinguishing an unresolvable DACL trustee from a foreign trustee. The LA alias is accepted only for Built-in Administrators ownership, while unsafe ownership remains rejected.

• Strengthened remote restore recovery with preflight validation, rollback backups for metadata and blob pairs, compensating rollback, and a retryable RestoreRecovery handle. Failed external restores no longer leave mixed provider state, and nodes remain stopped while rollback requires attention.

• Implemented UTxORPC v1beta QueryService.ReadState for Cardano GetStakePoolDistribution with deterministic ordering, a consistent ledger tip, bounded validated filters, and structured unavailable errors. Clients no longer receive UNIMPLEMENTED for this query.

• Closed the EventBus in the unsubscribe test so its asynchronous worker exits, preventing the event package tests from leaving a worker behind without changing production behavior.

• Improved YAML parse and decode errors by including the resolved configuration file path, and kept the bundled example configuration parseable. Startup failures now identify the file that requires correction.

• Updated AWS SDK credentials and related module versions and checksums, bringing upstream maintenance and S3 response-handling fixes to builds.

• Forwarded accepted peer votes through Leios relays by reusing the diffusion queue without duplicating diffusion across live lifecycle rebuilds. This experimental behavior lets relay-connected prototype block producers receive forwarded peer votes.

• Adjusted OpenTelemetry dependencies so OTLP HTTP endpoints without a path no longer append /v1/traces; endpoint configurations may need an explicit signal path such as /v1/traces, and Retry-After handling has changed. OTLP HTTP trace export now supports attribute.MAP values.

• Renamed the metadata transaction-handle interface from metadata.TransactionStore to metadata.TxnStore while splitting narrower storage interfaces. Downstream code that uses metadata.TransactionStore for transaction handles must switch to metadata.TxnStore.

• Pinned Docker Buildx action references to 4.3.0, so CI and publishing use the newer pinned action.

• Limited consumed UTxO cleanup to bounded batches and made blockfetch waits observe ledger cancellation, keeping catch-up and teardown responsive.

• Added PostgreSQL statementTimeout and lockTimeout settings and MySQL statementTimeout, lockTimeout, readTimeout, and writeTimeout settings for metadata work. SQL transactions now propagate cancellation and validate timeout values; all fields default to zero, and explicit DSNs ignore these provider timeout fields.

• Introduced scheduled and manual benchmark comparisons with persistent run history, statistically significant slowdown reporting, and symlink and path safety. Benchmark drift is surfaced without gating merges.

• Scoped imported reward parameters to the relevant positive-stake snapshots, aggregated incomplete-pool errors deterministically, and corrected skip-warning attribution. Mithril-imported reward seeding now avoids unrelated pools and reports all incomplete inputs.

• Made mempool eviction optional: evictionWatermark: 0 disables FIFO eviction, the defaults are now evictionWatermark: 0 and rejectionWatermark: 1.0 instead of 0.90 and 0.95, positive eviction values must remain below the rejection watermark, and transaction submission now considers available admission headroom.

• Enabled database snapshot, restore, and truncate commands for PostgreSQL, MySQL, S3, and GCS metadata and data: dingo database snapshot, dingo database restore, and dingo database truncate. The commands validate before destructive resets, cloud backups use framed data, snapshotDir must be writable, and Docker database environments include UID/GID 1000:1000 and database client tools.

• Prevented nodes from silently stopping chain following by resolving event delivery and network to chain stalls and deferred header liveness wedges. Leader threshold and pipeline telemetry now expose progress, imported reward bases receive their initial state, and SQLite WAL startup is more reliable.

• Added support for the Musashi 2026w32 prototype respin with updated genesis, protocol, topology, and snapshot data. The respin requires node version 11.1.0-prototype-2026w32 and uses the updated snapshot schema.

• Updated the SQLite driver and embedded engine dependencies.

• Deferred consumed UTxO cleanup during catch-up when the node is materially behind a known upstream tip and prevented overlapping cleanup runs. When the upstream tip is unknown, cleanup falls back to the local tip.

• Normalized Mithril snapshot metadata before checking cache paths by validating network and digest identity and applying consistent v1 and v2 cache and extraction paths.

• Improved chain selection and recovery by trusting delivered peer frontiers instead of advertised tips, including history that remains safe across rollbacks.

• Stabilized database telemetry with consistent signal behavior, connection pool health checks, and Unix socket DSN parsing fixes. Legacy signals and the opt in setting are no longer available.

• Refreshed the Blockfrost Explorer development type definitions for Node.js.

• Defined Koios parity coverage with a coverage matrix, strict epoch matching, and explicit parity omissions in reports.

• Hardened continuous integration attestations with the updated attestation action.

• Expanded streamed UTxO CBOR maps to support up to 100,000,000 entries, while generic maps remain limited to 10,000,000 entries.

• Scoped Conway feature checks to the scripts that require them, so unrelated available Plutus V1 and V2 reference scripts no longer cause Conway feature rejection.

• Updated the OpenTelemetry stdout exporter dependency.

• Quieted routine Mithril snapshot messages by moving per file synchronization details to DEBUG while keeping aggregate progress visible.

• Clarified Leios peer vote diffusion: peer votes now receive a one hop echo through the relay.

• Handled multi era boundary blocks by validating authorized two era transitions, applying the source transition before the successor transition, and recording the final era protocol version in the snapshot.

• Ignored historical primary chain headers during primary chain replay so they no longer trigger fork resolution, and kept local header lookup from falling back to archive storage.

• Preserved the wire sizes of reconstructed pre Alonzo Shelley and Allegra update transactions for fee and size validation. Typed nil protocol parameters now return an incompatibility error.

• Synchronized terminal recovery resync handling so recovery reaches its final state deterministically.

• Hardened strict Koios preview validation by propagating parity failures as fatal errors, skipping pre staking account scans, setting the default account reward history request body limit to 4 KiB, and correcting ledger boundary transition ordering and timing.

• Admitted locally forged blocks synchronously without EventBus proposal matching, then ran observers after admission.

• Rejected future ChainSync headers by recording network arrival time, waiting until slot onset within a two-second clock skew window when appropriate, and dropping headers outside the window without changing state or penalizing peers. A single coalesced resynchronization per connection now starts at the earliest dropped slot, and shutdown or connection removal cancels pending timers.

• Updated the AWS SDK configuration dependency from 1.32.31 to 1.32.37, including upstream maintenance for S3 response body handling.

• Introduced optional experimental VRF and KES validation in the block processing pipeline through blockPipelineValidateEnabled, --block-pipeline-validate-enabled, or DINGO_BLOCK_PIPELINE_VALIDATE_ENABLED. Block processing must also be enabled; validation, recovery, and metrics improvements apply only when this option is explicitly enabled, and it remains disabled by default.

• Accelerated event-driven DevNet scenarios, aligned test user and group identities with the host, protected pending publishes with locks, and preserved failure artifacts for diagnosis.

• Restricted Musashi validation bypasses to an unambiguous prototype profile and rejected conflicting network identity combinations, establishing a clear prototype compatibility boundary.

• Extracted the ChainSync stall recycler into a lifecycle-managed component while preserving its behavior and improving shutdown handling and testability.

• Expanded GetUTxOByAddress to accept multiple addresses with exact filtering, chunked lookups, and duplicate removal.

• Required HTTPS for Mithril aggregator and artifact URLs by default. Local development and tests can use the default-false mithril.allowInsecureHttp setting, --mithril-allow-insecure-http, or the DINGO_MITHRIL_ALLOW_INSECURE_HTTP escape hatch.

• Upgraded the pgx PostgreSQL driver from 5.9.2 to 5.10.0, incorporating decoder bounds, TLS CancelRequest, and connection handling fixes.

• Refreshed the Sundae Preview development dependency @types/node from 26.1.2 to 26.2.0.

• Corrected full final Plutus ExUnits accounting for slippage batches and expanded typed validation coverage.

• Changed Ouroboros construction to require dependency injection, safely close and replace instances during live restore, and preserve handlers. Library callers must provide the required dependencies when constructing Ouroboros instances.

• Controlled CIP-0163 delegator inactivity witness writes with top-level delegatorInactivityEnabled and delegatorInactivity settings and matching CLI and environment bindings. This consensus-affecting feature remains off by default and cannot run with Mithril bootstrap enabled.

• Rebuilt the Musashi prototype cardano configs image as 20260817-1; prototype deployments must rebuild and redeploy with the updated image.

• Bounded PeerGovernor shutdown and ledger peer DNS and discovery with contexts and a shared shutdown timeout.

• Added artifact and snapshot identity, phase, and aggregate archive file counts to Mithril progress and logs, with one callback for concurrent immutable downloads.

• Improved shared blob and metadata storage conformance and migration tests and corrected S3 handling for empty pages and 404 responses.

• Preserved and repaired transaction_id indexes required by witness cleanup during deferred index drops and rebuilds, preventing API mode backfill degradation.

• Upgraded the root gouroboros dependency from a pseudo-version to released v0.194.0 and updated protobuf, including upstream deep-fork chain selection behavior.

• Raised nested-module Go toolchain floors to 1.26.7, added govulncheck continuous integration and pre-commit instructions, and updated the scanner invocation policy.

• Hardened optional experimental block pipeline validation so replay rejects invalid OpCert and KES cases, propagates errors, and recovers persisted failures. Admission cryptography remains fail closed, and the enabled combination requires a nonzero Shelley slotsPerKESPeriod; the option remains disabled by default.

• Staged ledger Apply events until durable commit and serialized Apply and Undo ordering around rollback. Failed transactions no longer emit Apply events.

• Returned read-only stake distribution transaction cleanup errors and joined them with calculation errors. Callers can receive a distribution together with a non-nil error.

• Refined analyzer cleanliness and test and benchmark hygiene without changing production behavior.

• Secured Mithril snapshot download and extraction filesystem operations with verified os.Root handles to prevent time-of-check-to-time-of-use symlink escapes. The Go toolchain floor is 1.26.7, and govulncheck now gates releases.

• Fixed rollback handling for accounts imported from Mithril or genesis data by restoring active, pool, and DRep status when no registration certificate is available. Dingo upgrades existing databases automatically and keeps account state and its rollback reference atomic.

• Halted ledger processing when Mithril trust-window validation cannot recover through the permitted paths. Persistent halt and unrecoverable trust-window signals, together with repeated error announcements, identify when a newer snapshot or a genesis resynchronization is required.

• Shared block and header decoding across peer connections for identical data with bounded caching and hit and miss metrics, reducing repeated decoding work while keeping failures isolated.

• Corrected the Docker build configuration so BuildKit checks pass before an image build begins, preventing undefined environment expansions from reaching the build.

• Preserved the Byron EBB parent state when resuming genesis or bootstrap processing, ensuring that the first Byron block after the slot-zero EBB receives the correct validation. An unavailable parent classification no longer bypasses normal validation.

• Limited decoded block buffering to one commit batch for BlockFetch subscribers and one 50-block batch during chain replay, reducing retained memory while preserving lossless backpressure.

• Expanded Koios reward-account parity to compare every account exactly per epoch, with coverage-aware fetching and caching, mismatch reporting, optional standalone account checks, and validation that rejects negative grace periods. In-process observer checks are enabled by default and may increase Koios requests.

• Improved DevNet portability by deriving expected Docker user and group IDs from Bash id, so cleanup assertions work on Linux, macOS, and Windows Git Bash.

• Recovered queued blockfetch operations after an unavailable range by retrying on the active best peer, reporting recovery only after it starts successfully, and clearing stale peer selection when every attempt fails.

• Skipped Mithril directory-swap regression checks on platforms that cannot rename open directories, while retaining coverage where the operation is supported.

• Added Windows build and test coverage outside the release path for pushes to main and manual runs, with bounded jobs and diagnostics for hung tests.

• Released the transaction commit barrier exactly once on each terminal path, including blob synchronization failures, so later writers and snapshot operations do not stall.

• Updated the Antithesis validation environment to gouroboros v0.194.0, plutigo v0.3.0, and testify v1.12.0, along with refreshed indirect dependencies.

• Restored post-Mithril leader checks using the imported capture point, ensuring stake-threshold validation applies to the first complete epoch after a mid-epoch bootstrap while retaining legacy exact-anchor compatibility.

• Removed the unavailable backbone.mainnet.emurgornd.com:3001 endpoint from the mainnet topology, so nodes no longer attempt to use that bootstrap peer after redeployment.

• Bumped aws-sdk-go-v2 from 1.43.6 to 1.43.7, bringing upstream S3 presigning and HTTP 200 error-handling fixes.

• Persisted effective Shelley and Musashi extra genesis pools and delegations before capturing the genesis snapshot, rejecting ambiguous duplicate pool assignments without requiring a schema change.

Full Changelog: v0.69.0…v0.70.0

---

Docs authored by Doc Holiday