7.0.10

Changed

• ccf::http::ParsedQuery (in include/ccf/http_query.h), returned by ccf::http::parse_query(), is now a std::multimap<std::string, std::string, std::less<>> that owns its decoded keys and values, rather than a std::multimap<std::string_view, std::string_view> pointing into the source query string. Owned storage is required because each key and value is now URL-decoded individually after splitting, which produces bytes not present in the original query. Application code that consumed the previous std::string_view keys/values may need to be updated (#8024).
• ccf::RpcContext::get_request_query() (C++) and request.query (JavaScript apps) now return the raw, still percent-encoded query string, instead of a whole-string URL-decoded copy. This is what allows escaped separators to be preserved. Callers must decode each parameter after splitting: use ccf::http::parse_query()/ccf::http::get_query_value() (C++) or parse_request_query() (JS), or ccf::http::decode_query_component() to decode a whole query string (#8024).

Fixed

• HTTP query parameters are now split before URL-decoding, so escaped ampersands in query parameter names and values are preserved correctly (#8024).
• HTTP messages (requests or replies) whose Content-Length header advertises a body larger than the configured maximum body size are now rejected as soon as the headers have been parsed, rather than after enough body chunks have been received to exceed the limit (#8045).
• The thread-identifier helpers used by ccf/ds/logger.h (ccf::threading::get_current_thread_id, set_current_thread_id, and reset_thread_id_generator) have moved out of libccf into a new standalone ccf_threading static library, which find_package(ccf) exports automatically. This removes a long-standing implicit circular dependency (#7977).
• Build-graph change for consumers that link CCF component libraries directly. ccfcrypto now links the new ccf_threading library, and ccf_tasks and ccf_kv link ccf_threading directly instead of ccfcrypto. Downstream targets that linked ccf_tasks or ccf_kv directly and relied on them transitively supplying CCF cryptography must now link ccfcrypto explicitly. Applications built with add_ccf_app (which link ccf and ccf_launcher) are unaffected (#7977).
• As a temporary workaround for a Linux CIFS client kernel bug present in Confidential Azure Container Instances, uncommitted recovery ledger chunks are closed before their .recovery suffix is removed and reopened afterwards. This preserves the SMB write-caching lease on Azure Files, avoiding synchronous round trips for subsequent ledger writes. The workaround should be reverted once the Confidential Azure Container Instances platform upgrades to a kernel containing upstream fix 2c7d399e551c (#8072).

7.0.9

Fixed

• Curl request bodies can now be replayed when following redirects or retrying authentication (#8052).

7.0.8

Changed

• The node join protocol client now uses the curl multi singleton client (introduced in #7102) instead of the legacy enclave RPCSessions::create_client() HTTP client, matching the JWT refresh and snapshot-fetch clients. The service certificate remains the sole trust anchor for the join connection (the host certificate store is never consulted) (#8040).
• Node joins now check the target RPC address against the target node's certificate SANs. TLS certificate hostname verification (CURLOPT_SSL_VERIFYHOST) is now enforced on the join connection: the host in join.target_rpc_address must be covered by one of the target node's certificate Subject Alternative Names (SANs), and a join to an address absent from the target's SANs is now rejected (the previous join client did not check the target certificate name at all). CCF derives node-certificate SANs from node_certificate.subject_alt_names, or by default from each RPC interface's published_address, so standard deployments are unaffected; operators that configure a bespoke join.target_rpc_address must ensure it is present in the target node's certificate SANs (#8040).

Removed

• The unused enclave-side HTTP client infrastructure (RPCSessions::create_client, HTTPClientSession, HTTP2ClientSession, UnencryptedHTTPClientSession, and the ClientSession base) has been removed following the migration of the node join client to curl, completing the legacy HTTP client removal tracked in #7262 (#8040).

Fixed

• A node joining or recovering from a stale snapshot no longer fails to bootstrap its network identity history when the local key-value store briefly exposes a previous service identity. The network identity subsystem now detects that the topmost endorsement is signed by a stale service identity and retries (unbounded, matching the other pre-bootstrap waits) until the committed ledger suffix is replayed and the local store reaches the current service identity. Each retry logs the topmost endorsement's txid and the mismatching public keys (the endorsement's signer and the expected current network identity), so an operator can diagnose a node that stays in this state (#8042).

7.0.7

Changed

• JWT/JWK auto-refresh outbound HTTP fetches (OpenID metadata and JWKS) now use the curl multi singleton client introduced in #7102, replacing the previous RPCSessions::create_client() path. Connection and TLS failures are now counted in refresh failure metrics via send_refresh_jwt_keys_error(), improving observability of network-level refresh errors (#7989).
• JWT/JWK auto-refresh now supports configuring the maximum response body size for fetched OpenID metadata and JWKS via the jwt.key_refresh_max_response_size node startup config setting (#7989).
• Fatal task worker stack traces now use libbacktrace for improved function and source-location resolution. Building CCF now requires the libbacktrace development package, and the RPM development package depends on libbacktrace-static (#7721).

Fixed

• Curl multi client shutdown now aborts queued async requests without performing network I/O, and curl response header capture now enforces default header size and count limits (#8005).
• Changing recovery members or the recovery threshold, refreshing recovery shares, or rekeying the ledger while the service is recovering now correctly returns an error instead of appearing to succeed. These operations were always potentially unsafe because at-recovery ledger secrets cannot be rekeyed; services with custom constitutions should update their set_member, remove_member, set_recovery_threshold, trigger_recovery_shares_refresh, and trigger_ledger_rekey actions to reject them while recovering (#7980).

7.0.6

Added

• Experimental support for IPv6. Node RPC and node-to-node interface hosts may now be specified as IPv6 literals in bracketed form (e.g. [::1]:8000), and addresses are consistently parsed, bound, connected (with fallback across mixed IPv4/IPv6 resolved addresses), serialised, and embedded in redirect URLs for IPv6 (#7671).

Fixed

• Forwarded commands are no longer processed until the node is part of the network, matching the existing behaviour for other node-to-node messages. Previously a forwarded command could be executed while the node was in an earlier startup state, which could lead to undefined behaviour for some commands (#7936).

7.0.5

Changed

• The default and minimal sample constitutions reject set_jwt_issuer proposals whose issuer is not an https:// URL with no query or fragment. Previously, any string was accepted when auto_refresh was false (#7924).
• The default and minimal sample constitutions reject set_ca_cert_bundle proposals containing non-CA certificates or intermediate CA certificates; every certificate in the bundle must be a self-signed (root) CA (#7924).
• The default and minimal sample constitutions validate every JWK in set_jwt_issuer and set_jwt_public_signing_keys proposals: n/e/x/y must be base64url-encoded, kty must match the supplied key material, kid must be unique within a key set, use (if present) must be "sig", and alg (if present) must match the key type and curve per RFC 7518 section 3.4 (RS256 for RSA; ES256/ES384/ES512 bound to P-256/P-384/P-521). RSA keys must be at least 2048 bits, and EC coordinates must use the full zero-padded length for their curve (RFC 7518 section 6.2.1.2). P-521 is now an accepted EC curve (#7924).
• The default and minimal sample constitutions validate that set_member's encryption_pub_key, when present, is a well-formed RSA public key (#7924).

Security

• Host-created files (ledger chunks, snapshots, PID file, and node certificate/key files) are now created with restrictive permissions (0600) instead of relying on the process umask. Existing deployments will not see existing files affected; only newly created files will have these restricted permissions (#7916).

Dependencies

• Updated didx509cpp to 0.99.0 (#7943).

6.0.28

Fixed

• Nodes started in recovery or join mode from a snapshot more recent than the latest ledger file now correctly resume writing from the snapshot boundary (#7901).

7.0.4

Added

• Added verify_uvm_attestation_and_endorsements as a release artifact alongside the logging sample app (#7920).

Changed

• JSON parsing can now reject inputs whose object/array nesting depth exceeds a certain value, defaulting to 64 levels and overridable per call site via ccf::parse_json_safe's max_depth parameter (#7896).
• NetworkIdentitySubsystem retries when walking the previous-identity endorsement chain are now bounded by a new optional identity_history_fetch node startup config (max_attempts, retry_interval). On exhaustion the subsystem transitions to a new terminal FetchStatus::Partial: the validated suffix of the chain is still served, but historical receipts for seqnos below it fail with an error. Both the chain-extension retries and the pre-bootstrap waits (for the node to join the network, for the service-create txid, and for the first endorsement entry) now poll at retry_interval (default 100ms); the pre-bootstrap polling interval was previously hardcoded to 1s (#7922).

Deprecated

• Accessing ledger-signature names (table names, exception classes) via ccf.ledger now emits a DeprecationWarning; import them from ccf.signatures instead (#7904).

Fixed

• ccf.ledger MERKLE verification level now also verifies COSE-only ledgers (previously a silent no-op) (#7904).
• Nodes started in recovery or join mode from a snapshot more recent than the latest ledger file now correctly resume writing from the snapshot boundary (#7901).

7.0.3

Added

• Added a GLIBCXX_DEBUG CMake option to enable libstdc++ debug mode (_GLIBCXX_DEBUG) for CCF and its tests. When set, end-to-end tests run via ConcurrentRunner are throttled to fewer parallel suites to compensate for the slower runtime, and the submit binary (which links against Arrow) is disabled because Arrow is not built with _GLIBCXX_DEBUG (#7850).

Removed

• The USE_LIBCXX CMake option and all associated libc++/libc++abi build and packaging support have been removed. CCF now builds exclusively with libstdc++ (#7850).

Changed

• Upgraded QuickJS from 2024-01-13 to 2025-09-13 (#7849).
• On a joiner's first attempt, the primary now requires the joiner's startup seqno to be at least as recent as the primary's latest committed snapshot on disk, preventing snapshot-less joiners from replaying the entire ledger (#7844).

Fixed

• ledger_viz and split_ledger now recognise signature transactions in COSE-only signed ledgers (recorded in public:ccf.internal.cose_signatures) (#7868).
• Fix early exit of /log/public/historical/range when there are empty pages (#7869).

7.0.2

Added

• The governance proposal endpoints now include a ballotSubmitters field in their responses, containing the list of member IDs that have submitted a ballot for the proposal (#7840).