Repository navigation
Release v0.11.0 - #334
Merged
Merged
Release v0.11.0#334
Conversation
…docs (#323) Mark Phase 5 (Besu 26.10.0) merged as #312 and move the plan to Phase 6. Record the operator's second confirmation of decision D4 (ffmpeg in the locally built Blockscout v12 image), given on 2026-10-21, in progress.md and in the design decision table, and note that #315 and #313 moved the BENS Python and Node pins outside the plan. services/nb-ui/DEVELOPMENT.md still named nginx-unprivileged 1.27-alpine as the runtime image; the pin is 1.30.6-alpine. Point at the common/images.yaml pin instead of repeating the tag so it cannot drift.
The operator answered four of the decisions in the documentation-refresh design on 2026-10-27: park the closed-loop settlement plan, park the wallet and entity-directory plans, park the transfer-eligibility known issue (no entry here; the gap stays with the bond coupon and maturity plan), and approve the status-line edit of two archived progress files. Record them in the design decision table and in progress.md, drop them from the blocked list, and point the next action at Phase 0. The three confirm-only rows stay open.
…325) Slice 1 of the documentation refresh plan. Replace the remaining references to a specific cloud platform, its managed Kubernetes service, and deployment tooling with environment-neutral wording ("non-local deployment", "the deployment") in the NB Bond API README, DEVELOPMENT, values example, env-vars and auth comments, the startup error text, the NB UI DEVELOPMENT and entraAuth header, the documentation index, a known issue, and the closed-loop and ERC-3643 plans. The Entra ID auth-mode wording stays. Point the ERC-3643 plan and a known issue at CONTRIBUTING.md and docs/plans/README.md instead of local tooling, before slice 2 archives that plan. The testMode descriptions were already neutral since #304, so regen:openapi leaves openapi.json unchanged. nb-bond-api lint, format and 293 tests pass; nb-ui format, lint, 139 tests and build pass. progress.md records the Phase 0 baseline re-run on c5b93c4.
Slice 2 of the documentation refresh plan. Move the superseded incremental ERC-3643 plan to docs/plans/archive/ with an archived note on its status line, rewrite its relative links for the new depth, and move its index entry to the archive list. Add a docs/plans/README.md convention so ADR plan pointers resolve after a plan is archived. Park the closed-loop settlement, FMI wallet, and entity-directory plans as the operator decided: each keeps Proposed status with a "parked 2026-10-27, not scheduled" prefix and an index note. The closed-loop plan gains a dated drift note (pre-reset evidence, all four cash legs on transferFrom, moved role-grant lines, Phase 6 largely delivered). The two 2026-07-15 plans suggest feature/ branches instead of imp/. With the operator's approval, update only the Current phase and Next action lines of the archived blockscout-catchup-indexer and sandbox-stop-keeps-state progress files to show #294 and #293 merged. progress.md marks Phase 1 merged as #325.
Slice 3 of the documentation refresh plan. Removed behaviour: failed-issuance units are burned by the final payCoupon rather than withdrawn (ARCHITECTURE), BOND_MANAGER_ROLE lists the functions it actually gates (contracts-security), the NB Bond API component view says "coupon and closure" instead of redeem, the runtime diagram no longer claims reserved ports 443 and 8546, the ingestion database list names real routes instead of /holders, and BENS is documented as deployed by blockscout.sh rather than a nonexistent bens-microservice.sh. services/AGENTS.md now lists nb-ui, and two link labels match their targets. Diagrams: the startup flow shows the resume of a stopped node and that contracts deploy only when not already deployed on the chain; the bond lifecycle classifier matches bondStatus (outstanding while supply or coupon periods remain). Known issues: the reopen entry becomes "Closed and finalised auctions cannot be reopened" (heading keeps "reopen" so AZURE_BOUNDARY.md stays accurate), the resolved ingestion entry is removed, the sample error no longer pins an ethers version, and two BENS follow-ups recorded only in an archived plan get their own entries. progress.md marks Phase 2 merged as #326.
Slice 4 of the documentation refresh plan. The 30 committed NatSpec pages linked their sources to blob/<commit>/src/... on GitHub: the path lacked the contracts/ prefix and the commit is on no branch, so every link was a 404, and the link checker skips http links. fix-links.py now rewrites each Git Source link into a link relative to the page, pointing at contracts/src/, and rewrites the homepage's relative links (a copy of contracts/README.md) only when they do not already resolve, so a second run changes nothing. It is applied to the committed pages: one line per page. Foundry 1.8.6 no longer emits mdBook Markdown; forge doc now writes a Vocs site scaffold. The committed mdBook pages stay the maintained reference, so the natspec README, contracts/README.md, and its homepage copy no longer tell readers to run forge doc. progress.md marks Phase 3 merged as #327 and records the Foundry change.
Slice 5 of the documentation refresh plan. THIRD_PARTY_LICENSES.md: snapshot dated October 27, 2026; a new nginxinc/nginx-unprivileged row (BSD-2-Clause, NB UI runtime stage); the Node.js row covers the NB UI build stage; the Blockscout application row says it is built locally from pinned source tags, since upstream no longer publishes release images. Every image pinned in common/ now maps to a row. CONTRIBUTING.md: the NB Bond API block uses the root-workspace npm ci that CI uses, a new NB UI block mirrors its workflow, the Contracts block adds check-verify-latest-mapping.sh, and a Repository Checks block lists the verification scripts CI runs and when each applies. README.md lists services/nb-ui/AGENTS.md, and the ADR 0001 index entry says it is superseded by ADR 0003. progress.md marks Phase 4 merged as #328.
All five slices merged (#325 to #329), and the hygiene, link, and license checks pass on development after the last one. Move the plan folder to docs/plans/archive/, set Status: Implemented, tick the exit and done criteria (noting the two that changed in Deviations), and record the post-merge checks and the final state in progress.md. The three confirm-only rows in the design's Decisions table were still unanswered at archive time; progress.md says so and their recommendations stand. Two relative links are rewritten for the new folder depth, and the documentation index moves the entry into the archive list.
Besu moves from 26.10.0 to 26.10.2 (26.10.1 was a Hoodi-only release). The 26.10.2 Docker image no longer trusts the eMudhra roots tied to the October 2026 CA compromise: its Temurin 25.0.3 cacerts drops "emSign ECC Root CA - G3" and "emSign Root CA - G1", which 26.10.0 still held. eth_getLogs and GraphQL logs now enforce --rpc-max-log-filter-addresses (default 1000), closing a bypass of GHSA-p6f8-q9mp-7mj9, and a JSON-RPC connection-counter leak is fixed. RPC behaviour changes: eth_getProof rejects more than 1024 storage keys, and eth_call, eth_estimateGas and trace_call* reject maxFeePerBlobGas without blob hashes. The sandbox is unaffected: NB Bond API ingestion filters logs by one address per call and nothing calls eth_getProof or sends blob fields. The pin moves in common/images.yaml, the infra/besu fallback, the baseline checker and the prose docs. The BENS build and runtime base moves from python:3.14.9 to 3.14.10 for CVE-2026-114583 (tarfile.tar_filter link escape) and CVE-2026-115557 (the ssl module blocks the compromised eMudhra intermediates' keys). Debian ca-certificates, pip and certifi are unchanged from 3.14.9. docs/KNOWN_ISSUES.md moves Besu from the still-exposed table to the fixed list and records the new BENS base. Verified locally: Besu upgraded in place on the existing chain (no wipe, no contract redeployment); both nodes report v26.10.2 on chain 2018 and a transaction was mined in block 282. A three-address eth_getLogs query succeeds, NB Bond API ingestion follows the head with lag 0, BENS rebuilt on 3.14.10 is healthy, and Blockscout indexed the new block. The hygiene, link, licence, node-version, Besu baseline and image-hash checks pass.
Move the source-built Blockscout backend from v11.2.6 to v12.0.3 and the frontend from v2.10.3 to v2.12.1, the newest v12 and v2.12 patches on 2026-10-27 (slice 6 of the image-pin-refresh plan). The pins move in common/images.yaml, the fallback tags in services/blockscout/values.yaml, and the backend major in services/blockscout/debugging.md. The v12 backend image installs Alpine's ffmpeg (GPL-2.0-or-later AND LGPL-2.1-or-later). Decision D4 accepted it: the image is built and run locally and not redistributed. THIRD_PARTY_NOTES.md and THIRD_PARTY_LICENSES.md record it. KNOWN_ISSUES.md: both Blockscout rows in the eMudhra table move to the new pins and stay exposed. The backend's castore 1.0.21, certifi 2.17.0 and Alpine bundles still hold the root; the frontend's Node 24.21.0 roots still hold it. The ghcr tag ceiling is re-checked. The upgrade is one-way on the explorer database: v12 migrates the schema and v11 cannot read it afterwards. Rollback reverts the pins, wipes the explorer database and reindexes; contracts are re-verified, not redeployed. progress.md records the local evidence and the #331 pin moves.
* Local registry 3.1.2, recreated on a pin change Move the local registry from registry:2.8.3 to 3.1.2 (slice 7 of the image pin refresh plan). 2.8.3 is in range of five advisories with no 2.x fix, and its Alpine 3.18 bundle still trusts "AAA Certificate Services". The 3.1.2 image Docker Hub rebuilt on 2026-10-26 runs on Alpine 3.24.3 with ca-certificates 20261020-r0, so docs/KNOWN_ISSUES.md moves the registry to the fixed eMudhra list. ensureKindRegistry used to docker start an existing container, so a registry pin change never reached a machine that already had one. It now compares the container's image with the pin, recreates it on a mismatch, and re-syncs the base and third-party images into the empty registry, as registry-reset does. This runs from registry-start, registry-sync, build-images and cluster start. Repo-owned images rebuild on the next service start; the Blockscout images come from the host cache or need build-images. kindRegistryHasImage and registryManifestDigest sent a Docker-v2-only Accept header. Every image the sandbox pushes is OCI, so on 2.8.3 and 3.1.2 alike both probes always reported "not cached" and registry-sync re-pushed every image on every run. They now accept OCI manifests and indexes as well. Registry 3 enables API deletes by default, so the image-report and cleanup-images hints no longer say deletes are disabled. Verified locally: a throwaway 3.1.2 on port 5099 found an OCI and a Docker v2 image with the widened header (the OCI digest matches buildx); one registry-start recreated the real registry on 3.1.2 in 9 seconds, still on 127.0.0.1:5001 and attached to the kind network; a second run did not recreate; ./sandbox.sh start pulled every pod from it with no pull failures and skipped the already-deployed contracts; image-report and cleanup-images --keep 1 work. The hygiene, link, licence, node-version, Besu baseline and image-hash checks pass. * Archive the image-pin-refresh plan as implemented Slices 1-6 merged (#308-#312, #332) and slice 7 lands in this PR, so the plan is complete. Move the folder to docs/plans/archive/, set Status: Implemented, and tick the exit and done criteria. progress.md records the final state and notes the criteria later changes carried forward: #331 moved Besu past the Phase 5 target to 26.10.2, and the Node pin bump landed as #313 without its own hash change. The documentation index moves the entry into the archive list. No link leaves the folder, so none needed rewriting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release
Promote
developmentat1d9d9c276ac3b544125d510bf0eb20dead309413tomainfor sandbox v0.11.0.Included
eth_getLogsand GraphQLlogsnow enforce--rpc-max-log-filter-addresses(default 1000), and a JSON-RPC connection-counter leak is fixed../sandbox.sh build-images, because upstream publishes no release images. The v12 backend image contains Alpine'sffmpeg, recorded in the licence inventory.python:3.14.10(Besu 26.10.2 and BENS python 3.14.10: drop eMudhra roots #331).registry:3.1.2(Local registry 3.1.2, recreated on a pin change; archive the plan #333).ensureKindRegistrynow recreates an existing registry container when its image no longer matches the pin and re-syncs the base images, and the presence and digest probes accept OCI manifests, soregistry-syncno longer re-pushes every image on every run.docs/KNOWN_ISSUES.md: Besu, the local registry and BENS move to the fixed list for the eMudhra root; the Blockscout rows show the new pins and stay exposed pending upstream releases.Compatibility and live-release notes
Minor release with platform changes only. Since v0.10.0,
contracts/src,contracts/scriptandcontracts/testare unchanged, the Helm charts are unchanged at 0.0.1 with the same value keys, and the API and UI change only in comments and one start-up error message.Contracts and the application
Platform
eth_getLogscall; ingestion uses one address per call.fill_internal_transactions_address_idsbackground migrationcompleted.Verification
developmenthead, includingvalidate-publication-hygiene,validate-image-hash-inputs,validate-node-versionand CodeQL.developmentat1d9d9c2:check-public-repo-hygiene.py,check-markdown-links.py,check-third-party-licenses.py,check-besu-qbft-baseline.py,check-node-version-consistency.pyandcheck-image-hash-inputs.shall pass.verify-latest13 of 13../sandbox.sh startran cleanly.No Besu node, chain, contract, deployment-environment, or live application change occurs by merging this PR. Artifact publication and GitOps promotion remain separate gated operations.