7.0.7

Changed

• JWT/JWK auto-refresh outbound HTTP fetches (OpenID metadata and JWKS) now use the curl multi singleton client introduced in #7102, replacing the previous RPCSessions::create_client() path. Connection and TLS failures are now counted in refresh failure metrics via send_refresh_jwt_keys_error(), improving observability of network-level refresh errors (#7989).
• JWT/JWK auto-refresh now supports configuring the maximum response body size for fetched OpenID metadata and JWKS via the jwt.key_refresh_max_response_size node startup config setting (#7989).
• Fatal task worker stack traces now use libbacktrace for improved function and source-location resolution. Building CCF now requires the libbacktrace development package, and the RPM development package depends on libbacktrace-static (#7721).

Fixed

• Curl multi client shutdown now aborts queued async requests without performing network I/O, and curl response header capture now enforces default header size and count limits (#8005).
• Changing recovery members or the recovery threshold, refreshing recovery shares, or rekeying the ledger while the service is recovering now correctly returns an error instead of appearing to succeed. These operations were always potentially unsafe because at-recovery ledger secrets cannot be rekeyed; services with custom constitutions should update their set_member, remove_member, set_recovery_threshold, trigger_recovery_shares_refresh, and trigger_ledger_rekey actions to reject them while recovering (#7980).