Skip to content

Releases: Consensys-Incorporated/web3signer

Release list

26.7.0

26.7.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 05:56
26.7.0
015073b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Features Added

  • Support for Hashicorp Vault Kubernetes authentication PR 1195
  • The eth1 signing endpoint (POST /api/v1/eth1/sign/{identifier}) accepts an optional applyHash field. It defaults to true, preserving the existing behaviour of applying Keccak-256 to data before signing. Setting it to false signs the caller-supplied data as a pre-computed digest, which must be exactly 32 bytes. Supported by file-based, AWS KMS and Azure Key Vault signers. PR 1213

Bugs Fixed

  • Fix Key Manager API (POST /eth/v1/keystores) accepting a keystore whose JSON pubkey field does not match the decrypted private key. A mismatched import now returns status: "error" for that entry rather than poisoning the slashing-protection database under the claimed (unverified) pubkey. Thanks to Suhyeon for responsible disclosure.

Breaking Changes

  • The Key Manager API (DELETE /eth/v1/keystores) now only attempts to delete keystore files that follow the <pubkey>.yaml naming convention. Files using a different naming scheme are left untouched. This replaces the previous approach of scanning all metadata files and matching on the EIP-2335 pubkey field, which is optional and not guaranteed to be correct.
  • Java 25 is now required to build Web3Signer (previously Java 21).
  • The .tar.gz and .zip binary distributions now require Java 25 on the host machine to run Web3Signer (previously Java 21).
  • Docker images are unchanged — they have shipped Java 25 since 25.12.0.
  • Contributors no longer need to install JDK 25 manually. The build now uses a Gradle toolchain (JavaLanguageVersion.of(25)) with the foojay resolver, so Gradle will auto-detect a locally installed JDK 25 and download Temurin 25 if none is found. The Gradle daemon itself can run on any JDK supported by Gradle 9 (17+).

Security

  • Update base docker image to latest LTS Ubuntu 26.04.

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

Default image (Ubuntu + Eclipse Temurin JRE 25):
docker pull consensys/web3signer:26.7.0

Hardened image (Google Distroless, read-only-filesystem compatible):
docker pull consensys/web3signer:26.7.0-distroless

Full Changelog: 26.4.2...26.7.0

Assets 6
Loading
0 Join discussion

26.7.0-RC1

26.7.0-RC1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 10:21
26.7.0-RC1
015073b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Features Added

  • Support for Hashicorp Vault Kubernetes authentication PR 1195
  • The eth1 signing endpoint (POST /api/v1/eth1/sign/{identifier}) accepts an optional applyHash field. It defaults to true, preserving the existing behaviour of applying Keccak-256 to data before signing. Setting it to false signs the caller-supplied data as a pre-computed digest, which must be exactly 32 bytes. Supported by file-based, AWS KMS and Azure Key Vault signers. PR 1213

Bugs Fixed

  • Fix Key Manager API (POST /eth/v1/keystores) accepting a keystore whose JSON pubkey field does not match the decrypted private key. A mismatched import now returns status: "error" for that entry rather than poisoning the slashing-protection database under the claimed (unverified) pubkey. Thanks to Suhyeon for responsible disclosure.

Breaking Changes

  • The Key Manager API (DELETE /eth/v1/keystores) now only attempts to delete keystore files that follow the <pubkey>.yaml naming convention. Files using a different naming scheme are left untouched. This replaces the previous approach of scanning all metadata files and matching on the EIP-2335 pubkey field, which is optional and not guaranteed to be correct.
  • Java 25 is now required to build Web3Signer (previously Java 21).
  • The .tar.gz and .zip binary distributions now require Java 25 on the host machine to run Web3Signer (previously Java 21).
  • Docker images are unchanged — they have shipped Java 25 since 25.12.0.
  • Contributors no longer need to install JDK 25 manually. The build now uses a Gradle toolchain (JavaLanguageVersion.of(25)) with the foojay resolver, so Gradle will auto-detect a locally installed JDK 25 and download Temurin 25 if none is found. The Gradle daemon itself can run on any JDK supported by Gradle 9 (17+).

Security

  • Update base docker image to latest LTS Ubuntu 26.04.

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

Default image (Ubuntu + Eclipse Temurin JRE 25):
docker pull consensys/web3signer:26.7.0-RC1

Hardened image (Google Distroless, read-only-filesystem compatible):
docker pull consensys/web3signer:26.7.0-RC1-distroless

Full Changelog: 26.4.2...26.7.0-RC1

Loading

26.4.2

26.4.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Apr 05:11
26.4.2
221996a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bugs Fixed

  • Fix distroless image failing to load BLS native library under docker run --read-only. Issue #1175, PR #1176.

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

Default image (Ubuntu + Eclipse Temurin JRE 25):
docker pull consensys/web3signer:26.4.2

Hardened image (Google Distroless, read-only-filesystem compatible):
docker pull consensys/web3signer:26.4.2-distroless

Full Changelog: 26.4.1...26.4.2

Loading

26.4.1

26.4.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Apr 08:50
26.4.1
4c4ee0f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Important

The next Web3Signer release will require Java 25 to build and run. The Docker image is already on Java 25.

Features Added

  • Update Teku to 26.4.0 [Fulu upgrade for Gnosis chain]
  • Publish an additional hardened Docker image under the -distroless tag suffix (e.g. consensys/web3signer:26.4.1-distroless). Built from gcr.io/distroless/java25-debian13:nonroot — no shell, runs as non-root by default, and is compatible with docker run --read-only. See issue #1151.
  • Docker image labels migrated from the deprecated org.label-schema.* schema to the OCI Image Spec org.opencontainers.image.* annotations, which are consumed by modern registries and image-scanning tooling.

Bugs Fixed

  • Fix memory leak in the reload endpoint: removed validators were not being offloaded from the slashing-protection in-memory cache, and every reload unnecessarily re-registered all validators, causing old-gen heap pressure. Reload now processes only the delta of added/removed keys. PR #1167.
  • Fix jdbi parsed-SQL cache growth in ValidatorsDao by replacing inlined values and bindList expansions with parameterized array bindings. PR #1170.

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

Default image (Ubuntu + Eclipse Temurin JRE 25):
docker pull consensys/web3signer:26.4.1

Hardened image (Google Distroless, read-only-filesystem compatible):
docker pull consensys/web3signer:26.4.1-distroless

Full Changelog: 26.3.0...26.4.1

Loading

26.4.1-RC2

26.4.1-RC2 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Apr 04:01
26.4.1-RC2
4c4ee0f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Features Added

  • Update Teku to 26.4.0 [Fulu upgrade for Gnosis chain]
  • Publish an additional hardened Docker image under the -distroless tag suffix (e.g. consensys/web3signer:26.4.1-distroless). Built from gcr.io/distroless/java25-debian13:nonroot — no shell, runs as non-root by default, and is compatible with docker run --read-only. See issue #1151.
  • Docker image labels migrated from the deprecated org.label-schema.* schema to the OCI Image Spec org.opencontainers.image.* annotations, which are consumed by modern registries and image-scanning tooling.

Bugs Fixed

  • Fix memory leak in the reload endpoint: removed validators were not being offloaded from the slashing-protection in-memory cache, and every reload unnecessarily re-registered all validators, causing old-gen heap pressure. Reload now processes only the delta of added/removed keys. PR #1167.
  • Fix jdbi parsed-SQL cache growth in ValidatorsDao by replacing inlined values and bindList expansions with parameterized array bindings. PR #1170.

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

Default image (Ubuntu + Eclipse Temurin JRE 25):
docker pull consensys/web3signer:26.4.1-RC2

Hardened image (Google Distroless, read-only-filesystem compatible):
docker pull consensys/web3signer:26.4.1-RC2-distroless

Full Changelog: 26.4.0...26.4.1-RC2

Loading

26.4.1-RC1

26.4.1-RC1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Apr 01:03
26.4.1-RC1
24b70dc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bugs Fixed

  • Fix memory leak in the reload endpoint: removed validators were not being offloaded from the slashing-protection in-memory cache, and every reload unnecessarily re-registered all validators, causing old-gen heap pressure. Reload now processes only the delta of added/removed keys. PR #1167.
  • Fix jdbi parsed-SQL cache growth in ValidatorsDao by replacing inlined values and bindList expansions with parameterized array bindings. PR #1170.

Features Added

  • Update Teku to 26.4.0 [Fulu upgrade for Gnosis chain]

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

docker pull consensys/web3signer:26.4.1-RC1

Full Changelog: 26.4.0...26.4.1-RC1

Loading

26.4.0

26.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Apr 22:08
26.4.0
d1144f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Features Added

  • Update Teku to 26.4.0 [Fulu upgrade for Gnosis chain]

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

docker pull consensys/web3signer:26.4.0

Full Changelog: 26.3.0...26.4.0

Loading

26.4.0-RC1

26.4.0-RC1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Apr 23:53
26.4.0-RC1
d1144f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Features Added

  • Update Teku to 26.4.0 [Fulu upgrade for Gnosis chain]

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

docker pull consensys/web3signer:26.4.0-RC1

Full Changelog: 26.3.0...26.4.0-RC1

Loading

26.3.0

26.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Mar 02:24
26.3.0
9a782c3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Updated base Docker image packages to address CVE-2025-68973 (HIGH severity) in gpgv package
  • Docker images now apply all available security updates during build
  • Updated jackson dependencies to 2.21.1

Features Added

  • Update Netty to 4.2.9.Final
  • New --logging-format CLI option to select structured logging formats (PLAIN, ECS, GCP, LOGSTASH, GELF) without requiring custom Log4j2 configuration files. Issue #1144 via PR #1146.

Bugs Fixed

  • Fix unregistered validator IllegalStateException due to race condition in keymanager API

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

docker pull consensys/web3signer:26.3.0

Full Changelog: 25.12.0...26.3.0

Loading

26.3.0-RC1

26.3.0-RC1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Mar 02:02
26.3.0-RC1
cd4d0d1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Updated base Docker image packages to address CVE-2025-68973 (HIGH severity) in gpgv package
  • Docker images now apply all available security updates during build

Features Added

  • Update Netty to 4.2.9.Final
  • New --logging-format CLI option to select structured logging formats (PLAIN, ECS, GCP, LOGSTASH, GELF) without requiring custom Log4j2 configuration files. Issue #1144 via PR #1146.

Bugs Fixed

  • Fix unregistered validator IllegalStateException due to race condition in keymanager API

Downloads

Binaries

Binary Checksum
web3signer.tar.gz Checksum
web3signer.zip Checksum

Docker

docker pull consensys/web3signer:26.3.0-RC1

Full Changelog: 25.12.0...26.3.0-RC1

Loading