[Greaker]

Release

Promote development at 0179f1c to main for sandbox v0.14.1.

Included

• NGINX Gateway Fabric 2.8.1 (NGINX Gateway Fabric 2.8.1: drops the distrusted eMudhra roots #363), replacing 2.8.0: dependency updates (NGINX Agent 3.12.3, WAF 5.16.1, Go 1.27.3). The Gateway API and NGF CRDs are identical to 2.8.0. Both 2.8.1 images hold neither distrusted eMudhra root, so the register row is fixed.
• Blockscout source builds (Blockscout source builds: upgrade the Alpine CA bundle, frontend on Node 24.22.2 #364): build-images.sh upgrades the Alpine CA packages in the backend's runtime stage (20261020-r0 instead of the base image's 20260909-r0) and moves every frontend stage to node:24.22.2-alpine, whose built-in roots no longer hold "emSign ECC Root CA - G3". Each step stops the build if the upstream Dockerfile text is not found exactly once (backend) or twice (frontend). The frontend row is fixed; the backend row stays open because certifi 2.17.0 still holds that root (certifi 2.18.0 needs a newer hackney than v12.0.4 locks).
• Register review of the unchanged open rows (Known Issues: eMudhra register review of the unchanged open rows #365): the Kind node, nginx-unprivileged and slither-action were re-read and stay open, and slither-action now records the python:3.10 base it builds from.

Trust-store register in docs/KNOWN_ISSUES.md after this release: 14 images, 10 fixed and 4 open (Kind node, Blockscout backend, nginx-unprivileged, slither-action).

Compatibility and live-release notes

Patch release for a gateway pin, the source-build steps and documentation. Since v0.14.0, contracts/, the application source, the Dockerfiles and the Helm charts are unchanged; the only edits outside the register are the NGF version in common/versions.yaml, its fallback in common/helpers.sh, the matching service label, and build-images.sh.

Non-local rollout impact

Change	Node wipe	Contract redeploy	One-way on existing data	Rollout notes
NGF 2.8.1	No	No	No	Apply the unchanged CRDs, then upgrade the chart; the control plane and the data-plane Deployment restart once, so ingress is briefly interrupted. Rollback is a version revert
Blockscout source builds (Alpine CA upgrade, frontend on Node 24.22.2)	No	No	No	The backend and frontend images rebuild from the same tags with the two Dockerfile edits; the explorer pods restart once
Register review	No	No	No	Documentation only

Images that rebuild

• nb-ui, nb-bond-api and BENS: unchanged. The repo's content-hash functions give the same tags at v0.14.0 and at this commit (nb-ui f74c7e5da495, nb-bond-api 190dc70323a7, BENS 8f80d98b085b), so none of them rebuilds.
• Contracts: no source, script or image input changed.
• Blockscout backend and frontend are built from source and rebuild with the new steps.

Local sandbox note: a sandbox that already runs the same-tag frontend image keeps it. The -kind tag is unchanged and the node's image cache is used (IfNotPresent), so after build-images the cached frontend image must be removed from the node (or the cluster recreated) before the rebuilt frontend runs. The backend picked up its new tag without this.

Verification

• CI: the pull requests for NGINX Gateway Fabric 2.8.1: drops the distrusted eMudhra roots #363–Known Issues: eMudhra register review of the unchanged open rows #365 had no failing check.
• Local scripts on development at 0179f1c: check-public-repo-hygiene.py, check-markdown-links.py, check-third-party-licenses.py, check-besu-qbft-baseline.py, check-node-version-consistency.py and check-image-hash-inputs.sh all pass.
• Local lifecycle on an existing sandbox (Kind node v1.36.4), upgraded in place with the chain and explorer data kept:
  • ./sandbox.sh registry-reset stopped at the frontend pull because that image is not published (as documented), then ./sandbox.sh build-images ran end to end in 6 min 21 s. Both guards and both patch steps ran.
  • ./sandbox.sh start completed in 5 min 16 s. Every pod is Running; the images are Besu 26.11.0, Blockscout backend v12.0.4, the rebuilt frontend, smart-contract-verifier v1.11.2 and NGF 2.8.1; the Gateway is Programmed=True; the UI and explorer answer 200 through it.
  • NB Bond API reports ok with ingestion lag 0 at the chain head; Blockscout indexes blocks at 1.00 (internal-transaction indexing was still at 0.91).
  • contracts.sh verify-latest: 13 of 13, all already verified in the explorer, so I also sent a fresh standard-JSON verification of a small contract to the running verifier pod, which returned SUCCESS.
  • CA stores read in the running pods: the frontend pod holds none of the roots (Node v24.22.2, 118 roots, Alpine 20261020-r0). The backend pod's Alpine bundle (20261020-r0) and castore 1.0.22 are clean, and certifi 2.17.0 still holds "emSign ECC Root CA - G3".
• Not run: the hackney and certifi update mentioned in Blockscout source builds: upgrade the Alpine CA bundle, frontend on Node 24.22.2 #364, and a recreate of the cluster from genesis.

No Besu node, chain, contract, deployment-environment, or live application change occurs by merging this PR. Artifact publication and GitOps promotion remain separate gated operations.