Release Notes - v0.205.0

v0.205.0

Title: Improve authentication, validation, and protocol reliability

Version: v0.205.0

This release strengthens authentication, protocol shutdown, metadata and ledger validation, UTxO-RPC conversions, and connection lifecycle controls.

⚠️ Breaking Changes

• Hardened message authentication: MessageAuthenticator now requires a StakeAuthority, derives the 28-byte Blake2b-224 PoolKeyHash, verifies KES signatures in process, rejects zero stake, and guards against KES period overflow. Relevant DMQ packages now fail closed when authentication is absent. Integrations that construct MessageAuthenticator must provide the required stake authority.

🐛 Bug Fixes

• Improved shutdown delivery: Context-aware delivery now lets BlockFetch and ChainSync Stop wait up to 250 ms for shutdown message delivery. Delivery errors, including context.DeadlineExceeded, return to the caller.

• Preserved nested metadata keys: Nested metadata maps now retain duplicate keys while outer auxiliary-data label maps continue to reject duplicate labels.

• Aligned Byron and SSC validation: Byron dropped-field decoding and SSC structural validation now follow cardano-ledger-compatible wire shapes. The decoder accepts compatible variable-length byte strings and wider values, while validation rejects invalid wire shapes.

• Strengthened UTxO-RPC rational validation: Shelley, Mary, Alonzo, and Babbage validation now rejects nil embedded rationals and values outside the permitted range.

• Enforced pool metadata URL limits: URLs accept up to 64 bytes before Conway and 128 bytes from Conway onward. UTxO-RPC handles absent metadata safely, and JSON keys use lowercase spelling.

• Retained nested UTXO failure context: Nested UTXO and UTXOW failures now preserve the enclosing era, including Conway and Dijkstra handling, and preserve unknown raw CBOR context for diagnosis.

• Corrected certificate UTxO-RPC conversions: Certificate responses now preserve deposit amounts in Coin and use the certificate pool hash for stake-vote delegation.

• Added connection lifecycle controls: KeepAlive, Client, and Server now provide Start and Stop controls with simpler notification callbacks. Legacy callback precedence remains in effect.

Release: v0.205.0

Compare: v0.204.7…v0.205.0

---

Docs authored by Doc Holiday