v1.0.0-rc.7 release

CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to Zebra are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org).
 
+## [Zebra 1.0.0-rc.7](https://github.com/ZcashFoundation/zebra/releases/tag/v1.0.0-rc.7) - 2023-04-18
+
+This release features a security fix for unbounded memory use in zebra-network, introduces the "progress-bar" feature, and continues to address audit findings.
+
+### Security
+
+- Limit the number of leftover nonces in the self-connection nonce set ([#6534](https://github.com/ZcashFoundation/zebra/pull/6534))
+- Allow each initial peer to send one inbound request before disconnecting any peers ([#6520](https://github.com/ZcashFoundation/zebra/pull/6520))
+- Limit the number of non-finalized chains tracked by Zebra ([#6447](https://github.com/ZcashFoundation/zebra/pull/6447))
+- Update dependencies that only appear in the lock file ([#6217](https://github.com/ZcashFoundation/zebra/pull/6217))
+
+### Added
+
+- Add confirmations to getrawtransaction method response ([#6287](https://github.com/ZcashFoundation/zebra/pull/6287))
+- Add a config for writing logs to a file ([#6449](https://github.com/ZcashFoundation/zebra/pull/6449))
+- Add an experimental terminal-based progress bar feature to Zebra, which is off by default ([#6235](https://github.com/ZcashFoundation/zebra/pull/6235))
+- Create DockerHub image with mining enabled after each Zebra release ([#6228](https://github.com/ZcashFoundation/zebra/pull/6228))
+
+### Changed
+
+- Increase ZIP-401 mempool cost thresholds for Orchard transactions ([#6521](https://github.com/ZcashFoundation/zebra/pull/6521))
+- Suggest making sure the RPC endpoint is enabled for checkpointing ([#6375](https://github.com/ZcashFoundation/zebra/pull/6375))
+- Refactor the handling of height differences ([#6330](https://github.com/ZcashFoundation/zebra/pull/6330))
+- Upgrade shared dependencies to match `zcashd` 5.5.0 ([#6536](https://github.com/ZcashFoundation/zebra/pull/6536))
+- Lookup unspent UTXOs in non-finalized state before checking disk ([#6513](https://github.com/ZcashFoundation/zebra/pull/6513))
+- Stop re-downloading blocks that are in non-finalized side chains ([#6335](https://github.com/ZcashFoundation/zebra/pull/6335))
+
+### Fixed
+
+- Validate header versions when serializing blocks ([#6475](https://github.com/ZcashFoundation/zebra/pull/6475))
+- Stop ignoring new transactions after the mempool is newly activated ([#6448](https://github.com/ZcashFoundation/zebra/pull/6448))
+- Fix off-by-one error in DNS seed peer retries, and clarify logs ([#6460](https://github.com/ZcashFoundation/zebra/pull/6460))
+- Check that mempool transactions are valid for the state's chain info in getblocktemplate ([#6416](https://github.com/ZcashFoundation/zebra/pull/6416))
+- Remove transactions with immature transparent coinbase spends from the mempool and block templates ([#6510](https://github.com/ZcashFoundation/zebra/pull/6510))
+- Disable issue URLs for a known shutdown panic in abscissa ([#6486](https://github.com/ZcashFoundation/zebra/pull/6486))
+
+### Contributors
+
+Thank you to everyone who contributed to this release, we couldn't make Zebra without you:
+@arya2, @dconnolly, @gustavovalverde, @oxarbitrage, @teor2345 and @upbqdn
+
 ## [Zebra 1.0.0-rc.6](https://github.com/ZcashFoundation/zebra/releases/tag/v1.0.0-rc.6) - 2023-03-23
 
 In this release, we fixed several minor security issues, most notably [hardening Zebra in response to the vulnerabilities recently disclosed by Halborn](https://zfnd.org/statement-on-recent-security-disclosures-by-halborn/).

Cargo.lock

@@ -4992,7 +4992,7 @@ dependencies = [
 
 [[package]]
 name = "tower-batch"
-version = "0.2.37"
+version = "0.2.38"
 dependencies = [
  "color-eyre",
  "ed25519-zebra",
@@ -5016,7 +5016,7 @@ dependencies = [
 
 [[package]]
 name = "tower-fallback"
-version = "0.2.37"
+version = "0.2.38"
 dependencies = [
  "futures-core",
  "pin-project",
@@ -5880,7 +5880,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-chain"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 dependencies = [
  "bitflags 2.1.0",
  "bitflags-serde-legacy",
@@ -5946,7 +5946,7 @@ version = "1.0.0-beta.0"
 
 [[package]]
 name = "zebra-consensus"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 dependencies = [
  "bellman",
  "blake2b_simd",
@@ -5990,7 +5990,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-network"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 dependencies = [
  "bitflags 2.1.0",
  "byteorder",
@@ -6027,14 +6027,14 @@ dependencies = [
 
 [[package]]
 name = "zebra-node-services"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 dependencies = [
  "zebra-chain",
 ]
 
 [[package]]
 name = "zebra-rpc"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 dependencies = [
  "chrono",
  "futures",
@@ -6066,7 +6066,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-script"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 dependencies = [
  "displaydoc",
  "hex",
@@ -6079,7 +6079,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-state"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 dependencies = [
  "bincode",
  "chrono",
@@ -6119,7 +6119,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-test"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 dependencies = [
  "color-eyre",
  "futures",
@@ -6146,7 +6146,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-utils"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 dependencies = [
  "color-eyre",
  "hex",
@@ -6166,7 +6166,7 @@ dependencies = [
 
 [[package]]
 name = "zebrad"
-version = "1.0.0-rc.6"
+version = "1.0.0-rc.7"
 dependencies = [
  "abscissa_core",
  "atty",

README.md

@@ -77,7 +77,7 @@ You can run Zebra using our Docker image.
 This command will run our latest release, and sync it to the tip:
 
 ```sh
-docker run zfnd/zebra:1.0.0-rc.6
+docker run zfnd/zebra:1.0.0-rc.7
 ```
 
 For more information, read our [Docker documentation](book/src/user/docker.md).
@@ -90,7 +90,7 @@ Building Zebra requires [Rust](https://www.rust-lang.org/tools/install),
 
 Zebra is tested with the latest `stable` Rust version. Earlier versions are not
 supported or tested. Note that Zebra's code currently uses features introduced
-in Rust 1.65, or any later stable release.
+in Rust 1.68, or any later stable release.
 
 Below are quick summaries for installing the dependencies on your machine.
 
@@ -121,7 +121,7 @@ Note that the package `clang` includes `libclang` as well as the C++ compiler.
 Once the dependencies are in place, you can build Zebra
 
 ```sh
-cargo install --locked --git https://github.com/ZcashFoundation/zebra --tag v1.0.0-rc.6 zebrad
+cargo install --locked --git https://github.com/ZcashFoundation/zebra --tag v1.0.0-rc.7 zebrad
 ```
 
 You can start Zebra by
@@ -286,8 +286,6 @@ There are a few bugs in Zebra that we're still working on fixing:
 
 - Experimental Tor support is disabled until [Zebra upgrades to the latest `arti-client`](https://github.com/ZcashFoundation/zebra/issues/5492). This happened due to a Rust dependency conflict, which could only be resolved by `arti` upgrading to a version of `x25519-dalek` with the dependency fix.
 
-- Orchard proofs [fail to verify when Zebra is compiled with Rust 1.69 (nightly Rust)](https://github.com/zcash/halo2/issues/737). This will be resolved in the next Orchard release after 0.3.0.
-
 - Output of `help`, `--help` flag, and usage of invalid commands or options are inconsistent [#5502](https://github.com/ZcashFoundation/zebra/issues/5502). See the issue for details.
 
 ## Future Work

book/src/user/docker.md

@@ -11,13 +11,13 @@ You can deploy Zebra for a daily use with the images available in [Docker Hub](h
 ### Ready to use image
 
 ```shell
-docker run --detach zfnd/zebra:1.0.0-rc.6
+docker run --detach zfnd/zebra:1.0.0-rc.7
 ```
 
 ### Build it locally
 
 ```shell
-git clone --depth 1 --branch v1.0.0-rc.6 https://github.com/ZcashFoundation/zebra.git
+git clone --depth 1 --branch v1.0.0-rc.7 https://github.com/ZcashFoundation/zebra.git
 docker build --file docker/Dockerfile --target runtime --tag zebra:local
 docker run --detach zebra:local
 ```

tower-batch/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tower-batch"
-version = "0.2.37"
+version = "0.2.38"
 authors = ["Zcash Foundation <[email protected]>"]
 license = "MIT"
 edition = "2021"

tower-fallback/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tower-fallback"
-version = "0.2.37"
+version = "0.2.38"
 authors = ["Zcash Foundation <[email protected]>"]
 license = "MIT"
 edition = "2021"

zebra-chain/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "zebra-chain"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 authors = ["Zcash Foundation <[email protected]>"]
 license = "MIT OR Apache-2.0"
 edition = "2021"

zebra-consensus/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "zebra-consensus"
-version = "1.0.0-beta.22"
+version = "1.0.0-beta.23"
 authors = ["Zcash Foundation <[email protected]>"]
 license = "MIT OR Apache-2.0"
 edition = "2021"