Knarr v0.49.0 — Security Hardening + Kademlia

What's new

Security hardening (SEC-01–SEC-08)

• SEC-01 — EventBus threading: per-topic locks prevent cross-coroutine interleaving
• SEC-02 — Netting lock: deduplicated cycle execution under asyncio.Lock
• SEC-03/04 — SSRF blocking: loopback and RFC-1918 range guards on all outbound connects
• SEC-05 — Fee payer guard: commerce handlers validate payer identity before crediting
• SEC-06 — Bounded caches: LRU eviction on peer, job, and session caches
• SEC-07 — Executor shutdown: ThreadPoolExecutor wait=True prevents mid-task teardown
• SEC-08 — NodeAPI class + write_receipt ordering fix

Kademlia plugin (KAD-01, KAD-02)

• KAD-01 — Kademlia sweep plugin: peer heartbeat, eviction, and routing-table maintenance moved to plugins/00-kademlia
• KAD-02 — Bootstrap eviction: _evict_bootstrap_peers promotes bootstrap-only peers out of the routing table once real peers are found

Protocol

• D-01 — BCW WebSocket restructure: _process_ws_account_event / _process_ws_signature_event split for cleaner Solana event handling
• D-02 — Bootstrap jitter/rejoin: isolation detection and exponential backoff for re-bootstrap after network partition
• PricingResolver — standalone resolver class in pricing_engine.py
• TLS sidecar — path fix in warehouse_manager.py