v1.7.0

Tenderdash 1.7.0 is a security release. It bounds the work an unauthenticated
peer can force on a node, hardens the p2p, blocksync and state-sync paths
against malformed and hostile input, and fixes several ways a peer could brick
or stall a node.

This is a minor release, not a patch. Two configuration values change
behaviour in ways that can stop a node from starting or quietly cost it votes.
Both affect only hand-written config.toml files — configs generated by
dashmate take the new defaults and need no action. Read
UPGRADING.md before upgrading.

Operator-visible changes

• [consensus] verification-rate-limit now has a minimum. It must be 0
  (disabled) or at least 1 + MaxVoteExtensions, currently 33. A config
  setting it between 1 and 32 fails validation and the node will not start.
  Raise it to at least 33, or remove the line to take the default of 300.
• [consensus] peer-vote-rate-limit changed default and units. It counted
  messages per second and defaulted to 100; it now counts verification work per
  second and defaults to 600. A config still carrying = 100 keeps the number
  under the new meaning and will silently drop votes during gossip and catch-up.
  Remove the line, or set it in the new units.
• Commit validation is stricter. Commit.ValidateBasic now rejects commits
  whose threshold vote extensions carry a type not defined in the protobuf
  schema. A block store or WAL written by an earlier version that contains such
  a record may require a resync — see UPGRADING.md for how each case surfaces.
  This also means a node that has stored commits carrying a vote-extension type
  defined by a future release cannot roll back to this one.
• The unsafe commit-timeout override knobs are gone.
  unsafe-commit-timeout-override and unsafe-bypass-commit-timeout-override
  no longer exist. A config still setting them now reports a startup warning
  naming where the setting went, instead of being silently ignored.
• Metrics: consensus_vote_gate_fail_open is removed; several are added.
  See docs/nodes/metrics.md. Prometheus alert rules and
  a Grafana dashboard ship under docs/dos-observability/.

Protocol compatibility

P2PProtocol, BlockProtocol and ABCISemVer are unchanged. There are no
protobuf or p2p channel changes, so 1.7.0 nodes interoperate with 1.6.x nodes
and a fleet can be upgraded node by node.

Version reporting fix

Builds previously stamped the version against a stale module path, so the
linker silently ignored it and every build reported the fallback version —
1.6.0 images and pre-release images were indistinguishable by tenderdash version. Builds now report their real version.

Validation

The consensus, p2p, blocksync and state-sync changes were reviewed
individually, validated on devnet, and soaked on testnet before release.

See CHANGELOG.md for the complete list of changes.