​

Release of Canton 3.6.1

​

Summary

• Decouples the validator memory usage from the number of hosted parties and their stakeholder groups to lift party growth restrictions on the network
• Constant-time effort for processing non-local party hosting changes for improved security and availability resilience

​

What’s New

​

New ACS commitment pipeline

• The digest processor aggregates the ACS and the changes to it into per-party and per-counterparticipant digests.
• The sender turns digests into commitments by signing them and sends them to the counterparticipants.
• The matcher receives the commitments from counterparticipants and compares them to the local digests to detect mismatches.

• daml.participant.sync.commitments.checkpoint-watermark tracks the progress of the digest processor in record time of the connected synchronizer. It corresponds to the former daml.participant.sync.commitments.last-locally-checkpointed metric.
• daml.participant.sync.commitments.tick-watermark tracks the finished reconciliation interval of the digest processor. It corresponds to the former daml.participant.sync.commitments.last-locally-completed metric.
• daml.participant.sync.commitments.received-watermark tracks the sequencing time of the latest received new ACS commitment. It corresponds to the former daml.participant.sync.commitments.last-incoming-received metric.
• daml.participant.sync.commitments.matching-watermark tracks the record time up to where the matcher has progressed. It replaces the former daml.participant.sync.commitments.last-incoming-processed, which measures the end of the period of the received commitment instead of the record time of when the commitment was sequenced.
• daml.participant.sync.commitments.sender.watermark-timestamp tracks the period end record time up to where the node has sent its commitments.
• daml.participant.sync.commitments.digest-processor-health, daml.participant.sync.commitments.matcher-health, and daml.participant.sync.commitments.sender.sender-health, report on the health of the different components.
• daml.participant.sync.commitments.running-digest-processor.loaded-digests counts the number of loaded digests in memory and gives an indication of the memory usage of the new processor.
• daml.participant.sync.commitments.latest-matching-status tracks the matching status of the youngest reported commitment period. The metric is labeled with the counterparticipant.
• daml.participant.sync.commitments.latest-matching-status-period-end tracks the timestamp of the end of the youngest reported commitment period. The metric is labeled with the counterparticipant.

​

Daml

​

Daml-LF 2.3 is now the default target version

build-options:
  - --target=2.2

build-options:
  - --target=2.3

​

Daml choices can now make external calls

canton.participants.<participant>.parameters.engine.extensions

ExternalCallError (PreparationFailed | ExecutionFailed | InvalidOutput)

​

Daml Script: cross-SDK dependencies

​

Daml Stdlib updates

• (:|) and (<|) are added as synonyms for DA.NonEmpty, and Show is defined using the same representation.
• Logic.reduce no longer incorrectly merges a nested Disjunction as a Conjunction.
• toNNF in DA.Logic is now idempotent for stacked negations.
• toDNS in DA.Logic is now idempotent for stacked negations.

​

Participant Query Store (PQS): renamed from Scribe

​

Overview

​

Action required: renamed deployment artifacts (breaking)

​

SQL and query changes

--target-postgres-properties-authenticationPluginClassName=com.azure.identity.extensions.jdbc.postgresql.AzurePostgresqlAuthenticationPlugin

​

Reliability improvements

​

Experimental Post Quantum Cryptography

​

Ledger API Improvements

​

Lookup by Transaction Hash

• gRPC: UpdateService.GetUpdateByHash
• JSON API: POST /v2/updates/update-by-hash

​

Completion Lookup by Transaction Hash

• gRPC: CommandCompletionService.GetCompletionByHash
• JSON API: POST /v2/commands/completion-by-hash

​

Party JWTs (self-signed JWTs)

• The Ledger API now exposes a GetJwks endpoint. This can be used to obtain public keys for specific parties in JWK format.
  • gRPC: JoseService.GetJwks
  • JSON API: GET /v2/jose/jwks/synchronizer/<synchronizer-id>/party/<party-id>
• A type = party-jwt can be added to participants.<participant>.ledger-api.auth-services to enable this feature.

​

New Sequencer Aggregator

​

Support for Postgres 18

​

Traffic Enforcement App

• Add admin endpoint to prune events from the traffic enforcement event table - PruneEvents. This is used to keep the event table from growing indefinitely. This does not affect the account balance. WARNING: Affects de-duplication. If an event is pruned, de-duplication UpdateAccount requests on it will NOT be possible.
• The configuration field for the traffic enforcement app has been renamed from traffic-enforcement to traffic-accounting. The old name is still accepted for backwards compatibility, but will be removed in a future release.

​

Synchronizer Limits

​

String Validation

​

Improved Sequencer Logging

​

Heavy DB Migrations

​

lapi_events_party_to_participant Database Migration

• A party column is added to the lapi_events_party_to_participant table. The migration takes roughly 30 seconds per 1 million parties.
• The external_string column of the string_interning table now enforces a not null constraint. This is a no-op for existing data, but prevents future inserts of null values.

​

Reassignment store database migration

​

Breaking changes

​

Removal of Deprecated Configuration keys

• The following configuration keys were deprecated in 3.5 and no long exist in 3.6; and need to be removed from the configuration files:
  • `topology.use-new-processor
  • topology.use-new-client

​

Admin API

​

Sequencer API

​

Error Codes

​

Scala Console

• Removed the protocolVersion parameter from all <node>.topology.<mapping>.list console commands as it was not working properly.
• The com.digitalasset.canton.config.PositiveInt.increment method now returns an Either[InvariantViolation, PositiveInt] instead of a PositiveInt.
• The com.digitalasset.canton.config.NonNegativeNumeric.increment method now returns an Either[InvariantViolation, NonNegativeNumeric] instead of a NonNegativeNumeric.
• NonEmpty has moved from com.daml.nonempty to com.digitalasset.nonempty, and its scalaz type class instances have been replaced by cats ones. Separately, scalaz has been removed from the published Daml-LF modules: for example the Order and Equal instances on Value.ContractId are now a standard Scala Ordering.

​

Security

​

TLS Versions

​

TLS Default Cipher Suites

• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

• canton.participants.<participant>.ledger-api.tls.ciphers if you have canton.participants.<participant>.ledger-api.tls set already
• canton.sequencers.<sequencer>.public-api.tls.ciphers if you have canton.sequencers.<sequencer>.public-api.tls set already

canton.participants.<participant>.ledger-api.tls.ciphers =
  [
    "TLS_AES_256_GCM_SHA384",
    "TLS_CHACHA20_POLY1305_SHA256",
    "TLS_AES_128_GCM_SHA256",
    "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
    "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
    "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
    "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
  ]

canton.sequencers.<sequencer>.public-api.tls.ciphers =
  [
    "TLS_AES_256_GCM_SHA384",
    "TLS_CHACHA20_POLY1305_SHA256",
    "TLS_AES_128_GCM_SHA256",
    "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
    "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
    "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
    "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
  ]

​

Metrics

​

Ledger API and Indexer Metrics

• The indexer queue metrics daml.participant.api.indexer.indexer_queue_blocked, daml.participant.api.indexer.indexer_queue_buffered and daml.participant.api.indexer.indexer_queue_uncommitted are now exposed as gauges instead of meters.
• The metric daml.participant.api.services.pruning.contract_pruning_retried, which tracks how many times contract pruning was retried, is now a histogram.
• Removed the unused metrics daml.participant.api.lapi.streams.transaction_trees_sent and daml.participant.api.index.transaction_trees_buffer_size.

​

ACS Commitment Metrics

• daml.participant.sync.commitments.<synchronizer-alias>.counter-participant-latency.<participant> -> daml.participant.sync.commitments.counter-participant-latency
• daml.participant.sync.commitments.<synchronizer-alias>.largest-counter-participant-latency -> daml.participant.sync.commitments.largest-counter-participant-latency
• daml.participant.sync.commitments.<synchronizer-alias>.largest-distinguished-counter-participant-latency -> daml.participant.sync.commitments.largest-distinguished-counter-participant-latency

​

ACHS Processing Metrics

• Removed database metric daml.participant.api.indexer.achs_processing.* which captured runtime metrics for all types of database calls.
• Added the following metrics to capture individual database metrics for ACHS initialization (establish snapshot baseline):
  • daml.participant.api.indexer.achs_processing.initialization.store_achs_valid_at
  • daml.participant.api.indexer.achs_processing.initialization.update_achs_last_pointers
  • daml.participant.api.indexer.achs_processing.initialization.add_activations_to_achs
  • daml.participant.api.indexer.achs_processing.initialization.remove_deactivated_from_achs
• Added the following metrics to capture individual database metrics for ACHS maintenance (during indexing):
  • daml.participant.api.indexer.achs_processing.maintenance.store_achs_valid_at
  • daml.participant.api.indexer.achs_processing.maintenance.update_achs_last_pointers
  • daml.participant.api.indexer.achs_processing.maintenance.add_activations_to_achs
  • daml.participant.api.indexer.achs_processing.maintenance.remove_deactivated_from_achs

​

Configuration

​

Renamed participant parameter commit-after-failed-activeness-check

​

Minor Breaking Configuration Changes

• Unknown config keys are now making config parsing failing. This mechanism was already in place, but it didn’t include all the config keys, which is now fixed.
• Separated the config for support of dev and alpha protocol versions. In order to use pv=dev, you now have to specify dev-version-support = true instead of alpha-version-support = true (canton.parameters.non-standard-config = true is still needed).

​

Artifacts

• kms-driver-api and kms-driver-testing are now published to Maven Central, and will no longer be available in Artifactory.
• canton-protobuf.zip has been renamed to canton-api.zip to reflect that the archive now contains more than protobuf files.

​

Deprecations

​

Legacy Ledger API / JSON API endpoints disabled by default (removal in 3.7)

canton.participants.<participant>.features.deprecated.enable-deprecated-endpoints-34 = true
canton.participants.<participant>.features.deprecated.enable-deprecated-parameters-34 = true
canton.participants.<participant>.features.deprecated.enable-deprecated-endpoints-35 = true

• gRPC InteractiveSubmissionService.GetPreferredPackageVersion and the console command preferred_package_version. Use GetPreferredPackages / preferred_packages instead, which resolve the preferred packages for one or more package-name vetting requirements in a single call.
• GET /v2/interactive-submission/preferred-package-version. Use POST /v2/interactive-submission/preferred-packages instead.
• (WebSocket) GET/POST /v2/updates/trees. Use /v2/updates instead with updateFormat.includeTransactions.transactionShape = TRANSACTION_SHAPE_LEDGER_EFFECTS
• (WebSocket) GET/POST /v2/updates/flats. Use /v2/updates instead with updateFormat.includeTransactions.transactionShape = TRANSACTION_SHAPE_ACS_DELTA
• GET /v2/updates/transaction-tree-by-offset/{offset}. Use POST /v2/updates/update-by-offset instead with updateFormat.includeTransactions.transactionShape = TRANSACTION_SHAPE_LEDGER_EFFECTS.
• POST /v2/updates/transaction-by-offset. Use POST /v2/updates/update-by-offset instead with updateFormat.includeTransactions.transactionShape = TRANSACTION_SHAPE_ACS_DELTA
• GET /v2/updates/transaction-tree-by-id/{update-id}. Use POST /v2/updates/update-by-id instead with updateFormat.includeTransactions.transactionShape = TRANSACTION_SHAPE_LEDGER_EFFECTS
• POST /v2/updates/transaction-by-id. Use POST /v2/updates/update-by-id instead with updateFormat.includeTransactions.transactionShape = TRANSACTION_SHAPE_ACS_DELTA
• POST /v2/commands/submit-and-wait-for-transaction-tree. Use POST /v2/commands/submit-and-wait-for-transaction with transactionFormat.transactionShape = TRANSACTION_SHAPE_LEDGER_EFFECTS instead. Note that the response carries a flat transaction.events array rather than a transactionTree.eventsById map.

• The deprecated filter and verbose fields of (WebSocket) GET/POST /v2/updates and (WebSocket) GET/POST /v2/state/active-contracts. Use updateFormat respectively eventFormat instead.

• GET /v2/package-vetting. Use POST /v2/package-vetting/list instead.
• POST /v2/package-vetting. Use POST /v2/package-vetting/update instead.
• GET /v2/state/active-contracts-page. Use POST /v2/state/active-contracts-page instead.

​

Reminder: Legacy Ledger API / JSON API endpoints will be removed in version 3.7.

​

Reminder: Support for scope-based access tokens will be removed in version 3.7

• “Scope-based” access tokens, i.e. JWTs without any audience specified, have been deprecated in version 3.5.
• Versions 3.5 and 3.6 allow configurations using the default or explicitly configured target audiences, and log a warning for non-compliant configurations.
• In release 3.7, support for “scope-based” tokens will be removed entirely to enforce a valid aud field in every incoming JWT. The scope field will be repurposed to serve exclusively as an additional, optional claim for fine-grained permissions.

​

Logback upgraded to 1.6 deprecates conditionals

​

Minor Deprecations

• StaticSynchronizerParameters.defaultsWithoutKMS has been deprecated in favor of StaticSynchronizerParameters.defaults. Supported cryptographic schemes now have parity between KMS and non-KMS configurations.
• The ledger-api-server-parameters.contract-id-seeding configuration parameter is deprecated and no longer used. The contract ID seeding now uses the same random source as the rest of Canton, which is the equivalent of the strong type.
• Ledger JSON API /v2/state/active-contracts-page is now available via POST; the GET variant that expects a request body is deprecated.
• Deprecated configuration settings: canton.participants.<participant>.parameters.ledger-api-server.indexer.use-weighted-batching and canton.participants.<participant>.parameters.ledger-api-server.indexer.submission-batch-insertion-size. These are no longer supported.

​

Minor Improvements

• Mediator: Fix for the mediator verdict sender to correctly stop retrying to send verdicts if the sequencer reports that the verdict has already been successfully aggregated.
• Minor performance fix: time proofs have now a max sequencing timeout of 2 minutes and they no longer create a performance regression during synchronizer catch-up. Furthermore, synchronous rejects were not properly cleaned up by the sequencer client immediately after the reject was processed, but relied on the timeout logic to pick up the requests.
• Improved observability of indexer initialization (all related logs populated with a newly forged trace-context, terminating log-reporter upon failed ACHS initialization, additional WARN logs on failed ACHS initialization).
• Improved observability of Ledger API streaming (improved DEBUG log markers to of ID queries, DEBUG logging with timing information for payload queries).
• InternalIndexService streams improved with default retry/recovery and better observability.
• Database network timeout errors reported via error code INDEX_DB_SQL_NETWORK_TIMEOUT_ERROR error category changed to TransientServerFailure making it retryable. This problems logged on WARN log level.
• The HTTP server now rejects too deeply nested json structures. The check uses the same values as the already existing gRPC check for nested daml records. This means that the Ledger JSON API client may now observe an error from HTTP (BadRequest) where previously the INVALID_ARGUMENT/COMMAND_PREPROCESSING_FAILED or INVALID_ARGUMENT/VALUE_NESTING error was returned.
• The submitter does not have to be a stakeholder of all contracts during automatic reassignment, only of those that are actually reassigned to a target synchronizer. The previous check was considered too strict: it required the submitter to be a stakeholder of all involved contracts, even ones that were, for instance, disclosed contracts already on the target synchronizer.
• The HTTP server for the Ledger JSON API is now explicitly configured with a maximum content length. A new config option http-ledger-api.max-inbound-message-size has been added. If not configured, the gRPC setting ledger-api.max-inbound-message-size will be used. Previously, an implicit limit of 8 MB was used, so this change should not affect existing configurations.
• The concurrency limit interceptor ActiveRequestInterceptor now caches rejection responses instead of generating a new error (and thereby filling the stack trace) for each rejected response, once the concurrency limit is filled.
• Onboarding party submission prevention: Ensures a participant does not submit a transaction or reassignment on behalf of an onboarding party.
• OpenAPI and AsyncAPI files are now included in the API archive, and the bundle is published as a Maven artifact on GAR.
• New metric to track the number of active stakeholder groups of a participant: daml.participant.sync.commitments.active-stakeholder-groups
• <canton-node>.replication.connection-pool.connection.client-connection-check-interval is introduced that allows configuring the PostgreSQL-specific client_connection_check_interval parameter for DB locked connections. This is a safety mechanism to prevent hanging connections in case of network issues. The default value is 5 seconds.
• <canton-node>.replication.connection-pool.connection.max-inconclusive-read-only-checks is introduced that allows configuring the maximum number of inconclusive read-only checks before a connection is closed. The default value is 3.
• Connection pool metrics:
  • Add a psid label, populated if it is provided when connecting. This should be the case starting from the second connection to a synchronizer, or upon LSU.
  • Close the connection-health and subscription-health metrics associated to the psid when the pool is closed, instead of closing all the existing ones when the pool is started.
• Updated com.google.protobuf libs from 3.25.5 to 4.35.1
• A call to AcknowledgeSigned with a timestamp before the upgrade time returns immediately, without any acknowledgement being done.
• The ActAsAnyParty access right has been added to the Ledger API. This allows a user to submit transactions on behalf of any party. This feature is intended for use cases where a user needs to act on behalf of multiple parties, such as in a multi-tenant environment. The new access right can be granted to the users only by a participant administrator either at user creation time or through the GrantAccessRight command.
• The JSON Ledger API now rejects malformed identifiers (e.g. template-id) provided in requests (one that does not follow the <package>:<moduleName>:<entityName> format) with a descriptive 400 Bad Request error that names the expected format, instead of surfacing it as an internal error.
• The JSON Ledger API now honours an optional, client-supplied Request-Timeout header (value in milliseconds) that sets a per-request timeout. The value is validated against a configurable [lower-bound; upper-bound] window (defaulting to [1s; 60s]): values within the window are enforced as-is, values above, or below the lower bound, a non-positive value, or a non-numeric value is rejected with a descriptive 400 Bad Request. When the header is absent, the server default request timeout applies unchanged. The window can be configured under http-ledger-api.client-request-timeout:
  canton.participants.<participant>.http-ledger-api.client-request-timeout {
    lower-bound = 1s
    upper-bound = 60s
  }
  
• The default size of the Ledger API in-memory fan-out buffer (<participant>.ledger-api.index-service.max-transactions-in-memory-fan-out-buffer-size) has been increased from 1000 to 1100 to accommodate serving ACS commitments from the buffer.
• Health check service improvements:
  • liveness gRPC health check is now up and reporting as SERVING before the database migrations are performed (when used with migrate-and-start = true), to address the issue of k8s liveness probe failures during long-running migrations.
  • Mediators will report readiness NOT_SERVING when liveness is also NOT_SERVING, where previously it was possible for a mediator to report readiness SERVING while liveness was NOT_SERVING.
  • HTTP health checks now expose the liveness and readiness, under the URIs /health/liveness or health/live and /health/readiness or /health/ready endpoints, respectively. /health is still available for backward compatibility, mapping to readiness.
• Improved log trace correlation in the JSON Ledger API: package and health endpoints that previously logged with an empty trace context now propagate the caller’s TraceContext.
• Protocol messages now use Zstandard (zstd) compression starting with protocol version 36, while earlier protocol versions continue to use gzip. This internal optimization is applied automatically and does not require configuration changes.
• getLedgerEnd endpoint in StateService can now return latest observed record time for the requested synchronizers along with ledger end offset.
• Participant health state now includes indexer as a soft dependency. Indexer health state will be present in readiness endpoint response, but it won’t influece response code.
• Removed redundant root-hash signature from informee and encrypted view messages.
• participant_id label is added onto participant metrics
• Added ErrorInfo metadata to traffic enforcement rejections so callers don’t need to parse the message text.
  • TRAFFIC_ACCOUNT_VALIDATION_FAILED: account_id, balance, traffic_cost
  • TRAFFIC_UPDATE_OUT_OF_BOUND: account_id, traffic_delta, delta_type
• Support for OTLP remote metrics reporting, including optional OAuth2 Client Credentials authentication
  canton.monitoring.metrics.reporters = [{
    type = otlp
      endpoint = "http://localhost:4317"
      protocol = grpc
      auth {
        type = oauth-client-credentials
        token-url = "http://localhost:8080/token"
        client-id = "test-client"
        client-secret = "test-secret"
      }
   }]
  
• AWS KMS keys created by Canton can now be configured with custom tags through the custom-tags setting.
• The default of the indexer’s uncommitted-queue warning threshold (<participant>.ledger-api.indexer.queue-uncommitted-warn-threshold) has been increased from 5000 to 14000. This threshold controls when the Uncommitted queue is growing too large warning is emitted.
• Admin API streaming calls are now bounded to protect nodes from resource exhaustion:
  • Their duration is capped by the new <node>.parameters.processing-timeouts.admin-stream-open-bound value (default: 2 hours).
  • The number of concurrently open calls is capped per method (default: 10) via the admin server’s limits configuration.
• Changing identity providers for a party through UpdatePartyDetails is no longer possible, UpdatePartyIdentityProviderId must be used instead.
• An internal change is introduced which grants ReadAsAnyParty permissions to the traffic enforcement service. This removes the need to use non-standard config options to run local traffic enforcement with auth enabled:
  canton.participants.<participant_name>.ledger-api.admin-token-config.act-as-any-party-claim=true
  canton.participants.parameters.non-standard-config=true
  
• The participant admin party is now exempt from the traffic enforcement balance check during submission.
• Subview package vetting, checked at submission time, is now verified during confirmation request validation.
• Fixed the parsing of the Sec-WebSocket-Protocol header in the Ledger JSON API. As specified by RFC 6455, clients send the subprotocol values separated by a comma and a space (for example daml.ws.auth, jwt.token.<token>). Canton split the header on the comma only, so the leading space stayed attached to the following value and that value was silently discarded, making the request fail with an UNAUTHENTICATED error. The values are now trimmed, so such requests are accepted.
• The Ledger API vetting endpoints are exposed in the Canton console:
  • The Ledger API endpoint PackageService.ListVettedPackages is exposed as participant.ledger_api.packages.list_vetted_packages
  • The Ledger API endpoint PackageManagementService.UpdateVettedPackages is exposed as participant.ledger_api.packages.update_vetted_packages
• Added the request type to the sequencer cap rejection message.
• PrefetchContractKey has a new optional limit field stating how many contracts to prefetch for that key, on top of disclosed contracts. Absence is interpreted as 1 (the previous behavior), 0 is rejected, and values are capped at 2^31 - 1. The system may impose further limits.
• Commands referencing a contract ID whose Canton contract ID version is not supported (for example a malformed or foreign-format ID, including via a disclosed contract) are now rejected with UNSUPPORTED_CONTRACT_ID (gRPC NOT_FOUND), carrying the contract ID as an error resource. Previously this path raised an internal error. The same applies to contract key lookups resolving to such a contract.
• canton.participants.<participant>.parameters.engine.transaction-limits bounds what the engine may produce during interpretation (value-size, node-children, transaction-nodes, total-informees, and others). All bounds default to their maximum, so the default behavior is unchanged.
• The nonempty and base-validation libraries are now published to Maven Central.
• The docker da-base-image has been bumped to 1.0.15 to fix an issue with bash in certain kubernetes environments.
• Sequencer: fixed the V2 sequencer initialization endpoints (InitializeSequencerFromGenesisStateV2, InitializeSequencerFromLsuPredecessor, InitializeSequencerFromOnboardingStateV2) failing when the uploaded state exceeded 2GB, the maximum size of a single protobuf ByteString.
• Parsing of protobuf messages carrying an unknown version number is now failing.
• Participant: fixed the memory growth during ACS import caused by the repair indexer keeping all imported contract activations in an in-memory cache until the end of the import.

​

Compatibility