Zebra 6.3.0

Added

• Added seeder.zec.rocks and seeder.testnet.zec.rocks as default DNS seeders
  (#11096).
• Prometheus metrics now separate peer connection attempts and terminal outcomes by network,
  direction, address family, lifecycle stage, and bounded outcome. Version-message metrics also
  report the bounded self-reported implementation class without using peer IPs or raw user agents
  as labels (#11135).
• New getdeprecationinfo RPC returning the block height and estimated time at which this
  release will halt for end of support, in zcashd's end_of_service format. The end_of_service
  object is only present on Mainnet, where end of support is enforced
  (#11097).

Changed

• Chain synchronization now downloads a peer's only unknown block hash from a short
  FindBlocks response, allowing nodes near the chain tip to continue advancing
  (#11165).
• Peer-set, crawler-handshake, and address-book gauges now include a network label, so Mainnet
  and Testnet values no longer overwrite each other in processes that run both networks
  (#11135).

Fixed

• getblocksubsidy now returns NU6-era funding stream metadata (recipient names and
  specification URLs) for NU6.1 and later upgrades. Amounts and addresses were never
  affected (#11172).
• Reject blocks whose total chain value pool balance would exceed MAX_MONEY,
  enforcing the cap on the total monetary base
  (#10817).
• Banning a misbehaving peer now removes every address book entry for that IP, and a banned IP is
  never selected as a reconnection candidate. Previously an entry on a different port could survive
  the ban and occupy the first candidate slot until the node restarted
  (#11173).

Security

• Inbound connections are canonicalized when they are accepted, so an IPv4 peer that connects to a
  dual-stack listener as an IPv4-mapped IPv6 address (::ffff:A.B.C.D) is keyed on its canonical
  IPv4 address. Previously the mapped address became the peer set key, so a ban issued for that
  peer's IPv4 address did not disconnect it while it stayed connected, and the same peer counted
  twice towards the per-IP inbound connection limit
  (#11129).
• Prevent a peer from delaying tip discovery by answering a block download with a canonical header
  and a rewritten coinbase height. Zebra now re-requests the hash immediately instead of waiting for
  a later sync round to rediscover it, and scores the peer when a parent block Zebra already holds
  proves the claimed height wrong
  (GHSA-g95h-hw6g-pvgv).
  Thanks to @zakura-security for reporting the issue.
• Blocks above the sync lookahead height limit no longer score the peer that served
  them, since that request is routed to an unrelated honest peer — scoring it let a
  malicious FindBlocks responder get honest peers banned during initial block
  download
  (GHSA-qhr3-cvch-5fh2).
• Peers that gossip consensus-invalid blocks are scored for misbehavior again. The inbound
  download cleanup only recognized VerifyBlockError, but the gossiped block verifier is a
  BlockVerifierRouter, which returns RouterError, so no score was ever applied and such
  peers were never banned
  (GHSA-8hh2-hrf2-cqf4).