v4.8.6

Container Security (#1094)

• The API and indexer now run as the unprivileged user bcd (uid/gid 10001) instead of root; entrypoint scripts and unnecessary packages (curl, jq) have been removed from the runtime images.
• no-new-privileges, cap_drop: ALL, read_only: true, and tmpfs on /tmp have been added to the docker-compose.yml and docker-compose.flextesa.yml files.
• CORS in the API: The Authorization header has been removed from the allow-list, and the AllowCredentials option has been disabled.

Lambda parsing fix (#1093)

Insecure type checks for l.Value.(string) in the file internal/bcd/ast/lambda.go have been removed—previously, they caused a panic or 500 error when the lambda value was incorrect.
FromJSONSchema now validates input data: non-string values, empty code, and invalid Michelson expressions return ErrValidation (i.e., 400 instead of 500).
A CaptureException with the endpoint tag is now sent to Sentry instead of CaptureMessage. Tests have been added (lambda_test.go, ast_test.go).

Configuration (#1079)

The initial indexing level for Tezos X has been moved to the TEZOSX_START_LEVEL environment variable

Commits

• added TEZOSX_START_LEVEL env variable in configs (#1079) #1079 (Konstantin)
• 7dc9a7d: Add Dependabot for GitHub Actions & pin actions to commit SHAs (#1080) (Artem Poltorzhitskiy) #1080
• deps: Bump golang in /build/indexer (#1087) #1087 (dependabot[bot])
• deps: Bump golang in /build/api (#1086) #1086 (dependabot[bot])
• deps: Bump actions/setup-go from 6.5.0 to 7.0.0 (#1085) #1085 (dependabot[bot])
• deps: Bump alpine from 3.22 to 3.24 in /build/indexer (#1083) #1083 (dependabot[bot])
• deps: Bump alpine from 3.22 to 3.24 in /build/api (#1082) #1082 (dependabot[bot])
• deps: Bump github.com/moby/go-archive from 0.2.0 to 0.3.0 (#1088) #1088 (dependabot[bot])
• deps: Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#1092) #1092 (dependabot[bot])
• deps: Bump appleboy/telegram-action (#1091) #1091 (dependabot[bot])
• upgrade go to 1.27 (#1097) #1097 (Artem Poltorzhitskiy)
• parsing lambda (#1093) #1093 (Artem Poltorzhitskiy)
• b1debae: Security hardening for API & indexer containers (#1094) (Artem Poltorzhitskiy) #1094