Release of Canton 3.5.2
Canton 3.5.2 has been released on June 03, 2026.Summary
This is a maintenance release that fixes an out of memory issue during synchronizer reconnect, addresses security vulnerabilities in the Canton docker base image, as well as minor improvements.Minor Improvements
- Updated the Docker base image to 1.0.8 to address vulnerabilities in Busybox: CVE-2025-46394, CVE-2025-60876.
- Fix sequencer subscription closing errors
Timeout 9 seconds expired, but readers are still active in Task closing flushing direct-sequencer-subscription. - Handle decoding of
ContractId Voidin PQS - Improve caching of contract key lookups
Deprecations
Removal of synchronous processing on the mediator
The synchronous processing mode on the mediator has been removed in favor of the asynchronous one that offers better performance. Config pathmyMediator.config.asynchronous-processing has been deprecated as it is on by default now.
Bugfixes
(26-002, Medium): OOM from high memory usage after disconnecting and reconnecting from/to a synchronizer
Issue Description
Because of the periodic time proof retrieval task (with interval minObservationDuration), the ConnectedSynchronizer instance cannot be garbage collected right away after a disconnect/reconnect from the synchronizer. This leads to higher memory consumption which can lead to OOMs.Affected Deployments
Participant nodesAffected Versions
All versions before 3.5.2Impact
High memory consumption and potentially OOM of the participantSymptom
The heap dump shows instances of the ConnectedSynchronizer from previously disconnected synchronizers. The stack of calls refers to PeriodicAcknowledgements, TimeProofRequestsSubmitterImpl, SynchronizerTimeTracker and finally ClockWorkaround
Restart the participant.Likeliness
SometimesRecommendation
Upgrade to 3.5.2Compatibility
The following Canton protocol versions are supported:| Dependency | Version |
|---|---|
| Canton protocol versions | 34, 35 |
| Dependency | Version |
|---|---|
| Java Runtime | OpenJDK 64-Bit Server VM (build 21.0.12+2-nixos, mixed mode, sharing) |
| Postgres | Recommended: PostgreSQL 17.10 (Debian 17.10-1.pgdg13+1) – Also tested: PostgreSQL 14.23 (Debian 14.23-1.pgdg13+1), PostgreSQL 15.18 (Debian 15.18-1.pgdg13+1), PostgreSQL 16.14 (Debian 16.14-1.pgdg13+1) |