Skip to main content

Release of Canton 3.5.2

Canton 3.5.2 has been released on June 03, 2026.

Summary

This is a maintenance release that fixes an out of memory issue during synchronizer reconnect, addresses security vulnerabilities in the Canton docker base image, as well as minor improvements.

Minor Improvements

  • Updated the Docker base image to 1.0.8 to address vulnerabilities in Busybox: CVE-2025-46394, CVE-2025-60876.
  • Fix sequencer subscription closing errors Timeout 9 seconds expired, but readers are still active in Task closing flushing direct-sequencer-subscription.
  • Handle decoding of ContractId Void in PQS
  • Improve caching of contract key lookups

Deprecations

Removal of synchronous processing on the mediator

The synchronous processing mode on the mediator has been removed in favor of the asynchronous one that offers better performance. Config path myMediator.config.asynchronous-processing has been deprecated as it is on by default now.

Bugfixes

(26-002, Medium): OOM from high memory usage after disconnecting and reconnecting from/to a synchronizer

Issue Description

Because of the periodic time proof retrieval task (with interval minObservationDuration), the ConnectedSynchronizer instance cannot be garbage collected right away after a disconnect/reconnect from the synchronizer. This leads to higher memory consumption which can lead to OOMs.

Affected Deployments

Participant nodes

Affected Versions

All versions before 3.5.2

Impact

High memory consumption and potentially OOM of the participant

Symptom

The heap dump shows instances of the ConnectedSynchronizer from previously disconnected synchronizers. The stack of calls refers to PeriodicAcknowledgements, TimeProofRequestsSubmitterImpl, SynchronizerTimeTracker and finally Clock

Workaround

Restart the participant.

Likeliness

Sometimes

Recommendation

Upgrade to 3.5.2

Compatibility

The following Canton protocol versions are supported:
DependencyVersion
Canton protocol versions34, 35
Canton has been tested against the following versions of its dependencies:
DependencyVersion
Java RuntimeOpenJDK 64-Bit Server VM (build 21.0.12+2-nixos, mixed mode, sharing)
PostgresRecommended: PostgreSQL 17.10 (Debian 17.10-1.pgdg13+1) – Also tested: PostgreSQL 14.23 (Debian 14.23-1.pgdg13+1), PostgreSQL 15.18 (Debian 15.18-1.pgdg13+1), PostgreSQL 16.14 (Debian 16.14-1.pgdg13+1)