Release Notes - v0.202.3

v0.202.3 (August 31, 2026)

Title: Strengthen ledger validation and protocol reliability

Date: August 31, 2026

Version: v0.202.3

This release strengthens transaction and governance validation, bounds client requests, and improves handling of invalid signatures and missing or malformed responses.

💪 Improvements

• Improved reward account withdrawal validation: CIP-0019 reward account addresses now undergo strict validation across Shelley through Dijkstra. The ledger rejects malformed, non-reward, trailing-byte, and duplicate withdrawal addresses, and requires a key witness for key credentials or a native script witness for script credentials.

• Added LocalStateQuery safeguards: Set inputs now accept at most 10,000 items and reject duplicates. Empty or undersized response shapes now return errors instead of allowing the client to read missing values.

• Refined leios-fetch request handling: When a request slot becomes abandoned, later requests wait about one second before returning ErrRequestSlotAbandoned rather than blocking indefinitely. Late responses remain isolated from later requests.

• Corrected Byron simple block signature validation: Signatures now include the main-block tag and CBOR-encoded protocol magic with the signed payload. Validation rejects signatures based only on raw ToSign bytes.

• Strengthened Conway and Dijkstra constitution guardrails: Proposal policy hashes must be nil when the constitution has no guardrails script hash, or must exactly match it when one exists. The ledger rejects explicit empty hashes and validates the required script authorization.

Additional Changes

• Updated test fixture dependency: github.com/blinklabs-io/ouroboros-mock now uses v0.17.0 instead of v0.16.1, providing the newer mock fixtures while leaving production behavior unchanged.

• Recognized community contribution: @AniketR10 made a first contribution to gOuroboros in this release.

Compare: v0.202.2…v0.202.3

Release: v0.202.3

---

Docs authored by Doc Holiday