Release Notes - v0.70.9

v0.70.9

Title: Improve stake accounting, API security, and node reliability

Date: Not provided

Version: v0.70.9

Release: v0.70.9

This release improves delegated stake accounting, transaction submission, API deployment security, Koios parity, ledger validation, and recovery behavior for Dingo nodes and library consumers.

Recommended Network Compatibility ⚠️

Network	Compatible
mainnet	⛔
preprod-testnet	✅
preview-testnet	✅
musashi	✅

✨ Highlights

• Improved pointer address UTxO accounting for address payload types 4 and 5 by preserving pointer certificate positions through migration v13, resolving stake across the Shelley through Babbage eras with de-registration handling, and including pointer stake in historical and live snapshots and Mark calculations. Mithril gap ingestion now carries certificate deposits, correcting understated delegated stake and pool leader thresholds. Existing databases require a resynchronization or rebuild to populate utxo_pointer; the metadata interfaces now expose certDeposits through TransactionStore.SetGapBlockTransaction and pointer inputs through StakeSnapshotStore.GetPointerStakeInputsForPools.

• Corrected TxSubmission handling by matching replies to transaction hashes, rejecting unknown or duplicate bodies, and restoring validated transactions to requested order before mempool admission so reordered peer replies preserve dependency and FIFO order.

• Verified that embedded Cardano network configurations match the configurations shipped in container images through CI and make config-parity, with scheduled checks for upstream drift.

• Removed bearer authentication from the public Blockfrost, Mesh, and UTxO-RPC APIs and removed the separate --api-bind-addr, APIBindAddr, and API authentication settings. These APIs now use the shared --bind-addr, which defaults to 0.0.0.0; optional TLS remains available, and Midnight remote plaintext no longer needs its former opt-in gate. This breaking change requires deployments that relied on built-in API authentication to use a private bind address or an external gateway, with TLS configured as needed.

• Added custom Koios v1 host configuration through koiosParity.baseUrl, DINGO_KOIOS_PARITY_BASE_URL, --koios-parity-base-url, KOIOS_URL, and --koios-url, with optional insecure HTTP settings, URL validation, credential redaction, and cache provenance invalidation.

• Refined Leios ledger application so best-effort endorser references no longer block when the application does not read them. Required waits now share a bounded window, CIP waits use a bounded grace phase, mandatory fetches reserve concurrency, and Prometheus wait metrics classify arrived, timed out, cancelled, and unavailable outcomes.

• Persisted the deposit held by each pool registration and refunded that amount during POOLREAP. Migration v12 backfills legacy records and safely restarts interrupted column additions; unknown deposits remain NULL and use the legacy deposit_amount fallback.

• Clarified Koios parity results by classifying pending reward differences at a chain position as reference_lag instead of hard divergence, with aligned account and pool comparisons.

• Fixed UTxO-RPC encoding for large negative Plutus integers by using CBOR tag 3 with the (-1-n) magnitude without changing input values.

• Hardened ledger and forging validation to fail closed by enforcing historical header cryptography except for Mithril-covered slots, enabling forged-block self-validation by default, rejecting missing or empty Plutus cost models and invalid KES genesis settings, retaining applicable phase-2 validation during historical processing, checking Byron protocol magic, and enforcing exact block-body sizes.

• Aligned Leios fetch deadlines to one caller-anchored timer and reused parent cancellation when its deadline is equal to or earlier than a child deadline, preventing incorrect peer cooldown classification.

• Made chain and ledger rollback publication atomic, validated hash-bearing slot-zero points, and assigned a dedicated hard-failure identity to ledger rollback failures after truncation.

• Stabilized Midnight indexer startup and reconstruction by sharing configuration, using the current persisted ledger tip, and preserving the first fatal shutdown cause.

• Updated the plutigo dependency to v0.6.1 so PlutusV4 BLS multi-scalar builtins consistently reject invalid out-of-range scalars, matching cardano-node behavior.

• Retained reward_account_output in Koios parity CORE mode without the normal cleanup bound, including after live restore and truncation, preventing permanent account comparison failures. Previously pruned data is not backfilled.

• Clarified EventBus behavior by documenting inline and ordered delivery and recommending an ordered-lane barrier for deterministic tests.

• Resolved Leios continuation-audit producer references, reported pending references as inconclusive rather than missing, bounded scheduling, and added outcome metrics.

• Bounded scheduler and slot-clock tests with state confirmation and bounded waits instead of fragile real-time windows; this change affects tests only.

• Isolated block-by-hash metric tests in subprocesses to prevent shared-counter races; this change affects tests only.

• Reserved bounded disk capacity for Badger-backed test databases to improve CI reliability; this change affects tests only.

• Calculated the earliest comparable Koios parity epoch from the Mithril bootstrap boundary, bounded backlog and parity checks, and failed closed when recorded boundaries are malformed.

• Documented and tested that unknown pool deposits remain NULL and use the legacy refund fallback.

• Relaxed SQLite durability for throwaway migration test databases to reduce CI runtime; this change affects tests only.

• Prevented Badger directory-lock races during restore by allowing restore-blob cleanup to finish despite a cancelled restore context until provider shutdown completes.

• Preserved immutability assertions while removing shared ChainSync state restoration from tests; this change affects tests only.

• Added point-aware LocalStateQuery support for AcquireSpecificPoint, validating requested points against the current chain and using them for supported historical GetPoolDistr2/PoolStakeDistribution, GetCurrentProtocolParams within the live tip epoch, and GetEpochNo queries. Invalid fork points return ErrPointNotOnChain, unsupported or unavailable history returns ErrHistoricalStateUnavailable, GetUTxOWhole remains live-only, and acquired point state is released when connections close.

• Improved ledger peer discovery by excluding malformed relay hostnames from peer lists and snapshots while continuing to accept valid IP addresses and DNS names.

• Separated expected pipeline pressure and shutdown worker cancellation from unexpected failures in Prometheus metrics and DEBUG logs, making routine conditions easier to distinguish.

• Classified the synthetic PlutusV2 cost model gap as informational in Koios parity results while retaining failures for genuine cost model mismatches and other language versions.

• Expanded point-pinned LocalStateQuery support for historical GetStakeDistribution, GetCurrentPParams, and GetUTxOByTxIn reconstruction using as-of-slot state. The queries fail closed with ErrHistoricalStateUnavailable when history is unavailable and enforce aggregate reference-script budgets during block admission and forging.

• Stabilized cloud mirror lifecycle test retries by synchronizing startup scan assertions with a probe marker; this change affects tests only.

• Enforced consensus-compatible PlutusV2 behavior during the synthetic cost model gap by rejecting PlutusV2 transactions in Babbage, Conway, and Dijkstra with ErrNoCostModelForPlutusV2. Transactions previously accepted or estimated during that interval may now fail validation.

• Limited definite-length CBOR map allocation to the remaining input, rejecting entry counts that cannot fit before allocating memory while leaving indefinite-length maps unchanged.

• Bounded Blockfrost transaction submission and evaluation request bodies by size and time with a 60-second listener read timeout and a default 15-second per-body deadline. Invalid or truncated bodies continue to return HTTP 400 responses.

• Exposed Badger asynchronous close completion through BlobStoreBadger.Closed(), allowing callers to wait until directory locks are released and avoiding lifecycle races on Windows.

Full Changelog: v0.70.8…v0.70.9

---

Docs authored by Doc Holiday