Release Notes - v0.70.1

v0.70.1 (August 26, 2026)

Title: Strengthen recovery, API safety, and ledger reliability

Date: August 26, 2026

Version: v0.70.1

This release strengthens rollback, storage, peer discovery, ledger, governance, and transaction handling while improving API safety, network exposure controls, relay behavior, and build dependencies.

Recommended Network Compatibility ⚠️

Network	Compatible
mainnet	⛔
preprod-testnet	✅
preview-testnet	✅
musashi	✅

✨ Highlights

• Contained rollback conversion failures so WatchTx reports stream errors instead of exposing conversion panics, fetches deep rollbacks synchronously, and preserves each stream’s cursor so sequential Undo responses are not skipped.

• Bounded storage shutdown waits and made live restore or truncate requests trigger a supervised restart when storage cannot confirm that it has drained.

• Secured Windows extraction cleanup by using verified directory handles for rename, unlink, and directory removal, preventing path substitution after verification.

• Validated Leios endorser block transactions against manifest order, body hash, encoded size, and CBOR consumption before caching or storing them, while discarding stale persisted entries and refetching them.

• Updated the Blockfrost explorer example to Vite 8.2.2 so it receives the upstream Vite fixes and dependency updates.

• Refreshed the release and Antithesis workflows to use Docker login action 4.6.0 with upstream hardening and clearer OIDC errors.

• Rejected startup configurations that enable automatic snapshots with an S3 or GCS primary, while keeping manual CLI and Bark snapshots available.

• Verified recovery at the Byron to Shelley boundary so Shelley parameters appear at the first Shelley block and clear when rollback returns to Byron.

• Upgraded the AWS credentials SDK to 1.19.37 so the dependency set includes the current credentials components.

• Enhanced AWS S3 support with version 1.107.3, including presigning checksum header fixes and improved handling for HTTP 200 responses that contain errors.

• Cleared same-failure recovery state after committed tip progress while preserving it when the node replays the same tip.

• Reduced ledger discovery log volume and DNS churn through negative DNS caching, pre-resolved deny and known checks, normalized hostname deduplication, emergency refresh backoff, and quieter expected error logging.

• Required explicit midnight.serverEnabled configuration before serving Midnight gRPC traffic, made reflection opt in, kept loopback as the default, and required either allowInsecureRemote or TLS for remote plaintext access.

• Preserved provenance and attestation descriptors when assembling Buildx release manifests.

• Enforced the stake-derived VRF threshold outside genesis overlay slots while retaining dedicated validation for overlay slots.

• Clarified Byron-era protocol parameter responses: Blockfrost returns 404 when parameters are unavailable, UTxORPC returns FailedPrecondition, Mesh avoids substituting parameters, and configured drep_activity=0 remains valid.

• Synchronized terminal resync observation in ledger recovery tests with buffered event delivery, making race-resistant assertions deterministic.

• Cancelled removed mempool consumers so blocking NextTx waits end and return nil during connection cleanup.

• Completed the governance state adapter so it exposes Conway purpose roots, decodes persisted actions with active parameters, filters expired, enacted, and pending actions correctly, and derives inclusive expiry slots.

• Serialized ledger discovery refresh rounds so only one runs at a time and restored retry scheduling after interrupted, failed, or panicking rounds.

• Confirmed transactions after commit so WaitForTx accepts only post-commit active-chain events, ignores rollback and block-fetch events, removes duplicate confirmations, and tears down subscriptions safely.

• Refreshed the Sundae preview example to Vite 8.2.2 so it receives the upstream HMR and sourcemap fixes.

• Capped unary Connect request messages at 1 MiB for both compressed and decompressed sizes before decoding and authentication, returning HTTP 429 for oversized requests.

• Excluded each accepted peer vote’s source connection from relay and advanced relay cursors correctly.

• Returned removed Byron AVVM value to reserves atomically at the Shelley to Allegra transition with overflow protection and rollback and replay safety.

• Bounded restrictive Plutus execution during phase 2 by each protocol parameter set’s per-transaction MaxTxExUnits across Alonzo, Babbage, and Conway, while continuing to compare declared redeemer budgets and account for trailing slippage batches.

• Imported compatible current and preceding-epoch protocol parameters during Mithril ledger-state recovery, validated their availability before seeding rewards, cleaned provisional reward state transactionally, and skipped only affected reward epochs when parameters were unavailable.

• Closed immutable chunk readers on every block lookup return path, enabling Windows cleanup and preventing unreleased file handles.

• Gated continuation audits on the applied ledger tip: rollback windows arm only when the rollback point equals the applied tip, and stale windows clear when catch-up leaves the applied ledger behind.

• Made ChainSync arrival ordering deterministic in tests with an injectable clock, while production uses time.Now.

• Removed Bark’s 30-second HTTP WriteTimeout for TLS and cleartext servers while retaining read-header and idle timeouts, allowing long-running streaming responses.

• Prevented unconfirmed DevNet txpump batches by submitting one transaction per round, quarantining outputs for 600 slots based on genesis slot length, and waiting for healthy profile nodes.

• Denied wrong-network peers permanently after typed network-magic handshake mismatches for the in-memory PeerGovernor lifetime, suppressing rediscovery until restart while keeping same-network mismatches transient.

• Aligned committee voting sets so tallies count only seated, non-expired, non-resigned members with active hot-key authorization; ExpiresEpoch is inclusive, and tallies ignore unauthorized votes.

• Preserved prior Koios parity mismatch evidence when checks fail or mismatch replacement fails by waiting for required reads to succeed before replacing mismatches atomically.

• Bounded unauthenticated inbound handshakes with a 10-second absolute deadline outside the accept loop, closed pending connections during shutdown, and released capacity reservations on failure.

• Updated golang.org/x/net from 0.57.0 to 0.58.0.

• Validated fetched Mithril gap ranges as non-empty, continuous, hash-linked, and matching requested start and end points before persistence; mismatched peer responses fall through to another peer.

• Continued transaction ingestion after per-transaction decode or non-terminal admission failures by logging and skipping the affected transaction; terminal shutdown errors still stop the peer intake pump.

• Reduced default test-suite overhead by requiring the dingo_live_lifecycle_integration build tag for live two-node lifecycle tests, adding make test-live-lifecycle as the run command, and removing redundant Go caching and low-value overhead.

• Retained the latest successfully evolved KES key after a later evolution step failed, allowing signing to continue.

• Rejected malformed or unsupported immutable index versions, offsets, alignments, and ordering with errors instead of invalid reads or panics.

• Bounded Midnight indexer startup backfill at the applied ledger tip, avoiding duplicate scanning, exposing progress gauges, and failing fast when applied tip resolution fails.

Full Changelog: v0.70.0…v0.70.1

---

Docs authored by Doc Holiday