7.0.11

Added

• Recovery can now use a COSE snapshot signed by an earlier service identity after one or more disaster recoveries. Before deserialising the snapshot, the node reads previous-service-identity endorsement candidates from the public ledger suffix, validates a complete chain against the operator-provided identity, and retains it only for the current recovery attempt. Invalid or incomplete endorsement chains fall back to full-ledger replay (#8092).

Fixed

• Asynchronous ledger reads (used to serve committed entry ranges to the enclave) no longer access the host Ledger object after it has been destroyed during shutdown. The Ledger now waits for any in-flight read workers to finish, and workers that have not yet started skip accessing it, fixing a potential use-after-free on shutdown (#8003).

Changed

• TLS handshakes now prefer hybrid post-quantum key exchange groups, in the order SecP384r1MLKEM1024, SecP256r1MLKEM768, X25519MLKEM768, when the linked crypto provider supports them. The P-521, P-384 and P-256 groups are retained as fallbacks (#8107).
• ccf.cose.verify_receipt() has moved and been renamed to ccf.receipt.verify_cose(); the old name still works but is deprecated (#8109).