ZcashFoundation · mergify · Jul 2, 2023 · Jun 28, 2023 · Jun 28, 2023 · Jun 28, 2023
@@ -6,6 +6,85 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org).
 
 
+## [Zebra 1.0.1](https://github.com/ZcashFoundation/zebra/releases/tag/v1.0.1) - 2023-06-29
+
+Zebra's first patch release fixes multiple peer connection security issues and panics. It also significantly reduces Zebra's CPU usage. We recommend that all users upgrade to Zebra 1.0.1 or later.
+
+As of this release, Zebra requires Rust 1.70 to build. macOS builds are no longer officially supported by the Zebra team.
+
+If you're running `zebrad` in a terminal, you'll see a new Zebra welcome message.
+
+Please report bugs to [the Zebra GitHub repository](https://github.com/ZcashFoundation/zebra/issues/new?assignees=&labels=C-bug%2C+S-needs-triage&projects=&template=bug_report.yml&title=)
+
+### Breaking Changes
+
+This release has the following breaking changes:
+- Zebra limits each IP address to 1 peer connection, to prevent denial of service attacks. This can be changed using the `network.max_connections_per_ip` config. ([#6980](https://github.com/ZcashFoundation/zebra/pull/6980), [#6993](https://github.com/ZcashFoundation/zebra/pull/6993), [#7013](https://github.com/ZcashFoundation/zebra/pull/7013)).
+  Thank you to @dimxy from komodo for reporting this bug, and the Ziggurat team for demonstrating
+  its impact on testnet.
+- Zebra uses new APIs in Rust 1.70 to prevent concurrency bugs that could cause hangs or panics
+  ([#7032](https://github.com/ZcashFoundation/zebra/pull/7032)).
+
+### Support Changes
+
+These platforms are no longer supported by the Zebra team:
+- macOS has been moved from tier 2 to [tier 3 support](https://github.com/ZcashFoundation/zebra/blob/main/book/src/user/supported-platforms.md#tier-3) ([#6965](https://github.com/ZcashFoundation/zebra/pull/6965)). We disabled our regular macOS builds because Rust 1.70 [causes crashes during shutdown on macOS x86_64 (#6812)](https://github.com/ZcashFoundation/zebra/issues/6812). Zebra's state uses database transactions, so it should not be corrupted by the crash.
+
+### Security
+
+- Use Arc::into\_inner() to avoid potential hangs or panics ([#7032](https://github.com/ZcashFoundation/zebra/pull/7032))
+- Replace openssl with rustls in tests and experimental features ([#7047](https://github.com/ZcashFoundation/zebra/pull/7047))
+
+#### Network Security
+
+- Fix long delays in accepting inbound handshakes, and delays in async operations throughout Zebra. ([#7103](https://github.com/ZcashFoundation/zebra/pull/7103)). Thank you to the Ziggurat Team for reporting this bug.
+- Limit each IP address to 1 peer connection, to prevent denial of service attacks. ([#6980](https://github.com/ZcashFoundation/zebra/pull/6980), [#6993](https://github.com/ZcashFoundation/zebra/pull/6993))
+- Close new peer connections from the same IP and port, rather than replacing the older connection ([#6980](https://github.com/ZcashFoundation/zebra/pull/6980))
+- Reduce inbound service overloads and add a timeout ([#6950](https://github.com/ZcashFoundation/zebra/pull/6950))
+- Stop panicking when handling inbound connection handshakes ([#6984](https://github.com/ZcashFoundation/zebra/pull/6984))
+
+### Added
+
+- Make the maximum number of connections per IP configurable ([#7013](https://github.com/ZcashFoundation/zebra/pull/7013))
+- Make it easier to modify Zebra's config inside the Docker image ([#7045](https://github.com/ZcashFoundation/zebra/pull/7045))
+- Print a Zebra logo and welcome text if stderr is terminal ([#6945](https://github.com/ZcashFoundation/zebra/pull/6945), [#7075](https://github.com/ZcashFoundation/zebra/pull/7075), [#7095](https://github.com/ZcashFoundation/zebra/pull/7095), [#7102](https://github.com/ZcashFoundation/zebra/pull/7102))
+
+### Changed
+
+- Move macOS to tier 3 support ([#6965](https://github.com/ZcashFoundation/zebra/pull/6965))
+- Install from crates.io in the README, rather than a git release tag ([#6977](https://github.com/ZcashFoundation/zebra/pull/6977))
+- Add extra timeout logging to peer TCP connections ([#6969](https://github.com/ZcashFoundation/zebra/pull/6969))
+
+### Fixed
+
+- Stop overwriting custom user configs inside Zebra's Docker image ([#7045](https://github.com/ZcashFoundation/zebra/pull/7045))
+- Stop Zebra using 100% CPU even when idle ([#7103](https://github.com/ZcashFoundation/zebra/pull/7103)), thank you to james_katz for reporting this bug
+- Avoid potential hangs in the `tokio` async runtime ([#7094](https://github.com/ZcashFoundation/zebra/pull/7094))
+- Replace or add RPC content type header to support `zcashd` RPC examples ([#6885](https://github.com/ZcashFoundation/zebra/pull/6885))
+- Make `zebra-network` licensing clearer ([#6995](https://github.com/ZcashFoundation/zebra/pull/6995))
+
+#### Configuration
+
+- Ignore error from loading config if running the 'generate' or 'download' commands ([#7014](https://github.com/ZcashFoundation/zebra/pull/7014))
+- Apply force\_color to panic logs ([#6997](https://github.com/ZcashFoundation/zebra/pull/6997))
+
+#### Logging & Error Handling
+
+- Log a zebra-network task cancel on shutdown, rather than panicking ([#7078](https://github.com/ZcashFoundation/zebra/pull/7078))
+- Fix incorrect function spans in some logs ([#6923](https://github.com/ZcashFoundation/zebra/pull/6923), [#6995](https://github.com/ZcashFoundation/zebra/pull/6995))
+- Replace a state validation chain length assertion with a NotReadyToBeCommitted error ([#7072](https://github.com/ZcashFoundation/zebra/pull/7072))
+
+#### Experimental Feature Fixes
+
+- Add an elasticsearch feature to block serialize to fix experimental build failures ([#6709](https://github.com/ZcashFoundation/zebra/pull/6709))
+- Prevent progress bar from panicking by disabling limits that are never reached ([#6940](https://github.com/ZcashFoundation/zebra/pull/6940))
+
+### Contributors
+
+Thank you to everyone who contributed to this release, we couldn't make Zebra without you:
+@arya2, @conradoplg, @dconnolly, @dimxy from komodo, james_katz, @oxarbitrage, @teor2345, @upbqdn, and the Ziggurat team.
+
+
 ## [Zebra 1.0.0](https://github.com/ZcashFoundation/zebra/releases/tag/v1.0.0) - 2023-06-14
 
 This is our 1.0.0 stable release.

@@ -4736,7 +4736,7 @@ dependencies = [
 
 [[package]]
 name = "tower-batch-control"
-version = "0.2.41-beta.2"
+version = "0.2.41-beta.3"
 dependencies = [
  "color-eyre",
  "ed25519-zebra",
@@ -4760,7 +4760,7 @@ dependencies = [
 
 [[package]]
 name = "tower-fallback"
-version = "0.2.41-beta.2"
+version = "0.2.41-beta.3"
 dependencies = [
  "futures-core",
  "pin-project",
@@ -5665,7 +5665,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-chain"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 dependencies = [
  "bitflags 2.3.3",
  "bitflags-serde-legacy",
@@ -5725,7 +5725,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-consensus"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 dependencies = [
  "bellman",
  "blake2b_simd",
@@ -5770,7 +5770,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-network"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 dependencies = [
  "bitflags 2.3.3",
  "byteorder",
@@ -5811,7 +5811,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-node-services"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 dependencies = [
  "color-eyre",
  "jsonrpc-core",
@@ -5823,7 +5823,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-rpc"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 dependencies = [
  "chrono",
  "futures",
@@ -5855,7 +5855,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-script"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 dependencies = [
  "displaydoc",
  "hex",
@@ -5868,7 +5868,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-state"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 dependencies = [
  "bincode",
  "chrono",
@@ -5910,7 +5910,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-test"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 dependencies = [
  "color-eyre",
  "futures",
@@ -5937,7 +5937,7 @@ dependencies = [
 
 [[package]]
 name = "zebra-utils"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 dependencies = [
  "color-eyre",
  "hex",
@@ -5958,7 +5958,7 @@ dependencies = [
 
 [[package]]
 name = "zebrad"
-version = "1.0.0"
+version = "1.0.1"
 dependencies = [
  "abscissa_core",
  "atty",

@@ -195,3 +195,7 @@ Zebra is distributed under the terms of both the MIT license
 and the Apache License (Version 2.0).
 
 See [LICENSE-APACHE](LICENSE-APACHE) and [LICENSE-MIT](LICENSE-MIT).
+
+Some Zebra crates are distributed under the [MIT license only](LICENSE-MIT),
+because some of their code was originally from MIT-licensed projects.
+See each crate's directory for details.
@@ -1,6 +1,6 @@
 [package]
 name = "tower-batch-control"
-version = "0.2.41-beta.2"
+version = "0.2.41-beta.3"
 authors = ["Zcash Foundation <[email protected]>", "Tower Maintainers <[email protected]>"]
 description = "Tower middleware for batch request processing"
 # # Legal

@@ -1,6 +1,6 @@
 [package]
 name = "tower-fallback"
-version = "0.2.41-beta.2"
+version = "0.2.41-beta.3"
 authors = ["Zcash Foundation <[email protected]>"]
 description = "A Tower service combinator that sends requests to a first service, then retries processing on a second fallback service if the first service errors."
 license = "MIT OR Apache-2.0"

@@ -1,6 +1,6 @@
 [package]
 name = "zebra-chain"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 authors = ["Zcash Foundation <[email protected]>"]
 description = "Core Zcash data structures"
 license = "MIT OR Apache-2.0"
@@ -119,7 +119,7 @@ rand_chacha = { version = "0.3.1", optional = true }
 
 tokio = { version = "1.28.2", features = ["tracing"], optional = true }
 
-zebra-test = { path = "../zebra-test/", version = "1.0.0-beta.26", optional = true }
+zebra-test = { path = "../zebra-test/", version = "1.0.0-beta.27", optional = true }
 
 [dev-dependencies]
 # Benchmarks

@@ -1,6 +1,6 @@
 [package]
 name = "zebra-consensus"
-version = "1.0.0-beta.26"
+version = "1.0.0-beta.27"
 authors = ["Zcash Foundation <[email protected]>"]
 description = "Implementation of Zcash consensus checks"
 license = "MIT OR Apache-2.0"
@@ -62,13 +62,13 @@ orchard = "0.4.0"
 
 zcash_proofs = { version = "0.11.0", features = ["local-prover", "multicore", "download-params"] }
 
-tower-fallback = { path = "../tower-fallback/", version = "0.2.41-beta.2" }
-tower-batch-control = { path = "../tower-batch-control/", version = "0.2.41-beta.2" }
+tower-fallback = { path = "../tower-fallback/", version = "0.2.41-beta.3" }
+tower-batch-control = { path = "../tower-batch-control/", version = "0.2.41-beta.3" }
 
-zebra-script = { path = "../zebra-script", version = "1.0.0-beta.26" }
-zebra-state = { path = "../zebra-state", version = "1.0.0-beta.26" }
-zebra-node-services = { path = "../zebra-node-services", version = "1.0.0-beta.26" }
-zebra-chain = { path = "../zebra-chain", version = "1.0.0-beta.26" }
+zebra-script = { path = "../zebra-script", version = "1.0.0-beta.27" }
+zebra-state = { path = "../zebra-state", version = "1.0.0-beta.27" }
+zebra-node-services = { path = "../zebra-node-services", version = "1.0.0-beta.27" }
+zebra-chain = { path = "../zebra-chain", version = "1.0.0-beta.27" }
 
 # prod feature progress-bar
 howudoin = { version = "0.1.2", optional = true }

@@ -10889,3 +10889,65 @@
 2117616 0000000000b91c891557df28d4173766562cc455b3b5ab27e83c9a03958bbc14
 2118016 00000000013eb4b6e1cd5b9f19ad032670cad97fd4837b1dd7e876358ff8752a
 2118416 0000000000a5e8d0c81b4fb1036d94ac7d16d192bd068258d3aa07fe903b8736
+2118816 00000000003fb9615f739bad0dac026ed1c0f7861330737c4b55d292da4d981f
+2119216 0000000000b5e61882e7e4d69c75f335c96a6c1744e8d4602e77caa46f9ee187
+2119616 0000000000d8509fe19c295db85f6001031816dc05aff2674b95925b88c8242f
+2120016 0000000000dc0337c69742d294267dd2bd434017827151d6ae7965ec19fd3cef
+2120416 00000000010b5fb468a019e2b9115aa0e0ec8cb92017195a4ebd4e9b5a47c6be
+2120816 0000000001206742e94d9b3cb8187b4c26be13290724ef97848c62f7d01e90bb
+2121216 0000000000b2531dd904338ddf602c87ac70ec14e7aca566d297dff7278648ab
+2121616 0000000000b5fca10a6ff18c158d38b83369405362f97f5de4c9bf2cfd12b23c
+2122016 000000000121e68a6ab027b23fb9a5e73eb38fa6af0fef88931af48dafc71821
+2122416 0000000000ee1cb21aa6d9b957578ef6f3e45b6730ce7c6e22edfa729d3301f9
+2122816 0000000000fcc1ef9a8d0e4b71f55947fd094ac9254ee0f21e2531eec099a538
+2123196 0000000000c38a681500f237539b08b8d3f75d9ab0233e2b5252b76ddc4727d9
+2123582 0000000000c4014be9b89ef009959a45e4fb48c074881c7afe1780b760853127
+2123932 0000000000e4c93f99189deadd479ecabd3660de1041ebb4a0c5ef5d7cbe5e51
+2124280 000000000127f2b6c0c0ab4048b16116e559dc9b9a934fdbd7810e1ae49b5349
+2124602 0000000001bc3445533dfc7baf59b6294ea1d4585ee928ec18c79b6b49f3dabf
+2124906 00000000001e2edad0443cb8d4df1da641c3c58f2f83893e361fa37fd121c29d
+2125219 0000000001280e8b6a0642a896b7b5337aac71c543cc36b26d2d296ead4af381
+2125509 00000000001d565ed9c555b1b276dccaaa87a3c0bbed390a340c799776e37be0
+2125805 00000000017827e42bf3b99f40c6ee11c8d4e56dabb802ad56e74c766a31ae2c
+2126109 00000000014e149e7bbed108446e842a5c25e400423074ca891cd88c16e18bb1
+2126422 00000000005bf996c990b6124d3a93f50dd6a8403104be774a659f0c4a1ee54c
+2126703 00000000010b6fb36760137accc7926c3d8c314307816f15f84c63eefdded7a8
+2127017 00000000012e0ba6b5a5f0a4ff5310b931c063098f3e96fc997c7b6fb44a24ff
+2127320 000000000116fa60015d9f21754b07269703129fb4af00a7b33f7b0fb5c128bc
+2127612 0000000000df367879d160aab3f1c3834462110de823b7c2e1407014b49f5544
+2127899 00000000004731b6685e37ccead8caf23b7c1b229aab4407376a07766ea1871b
+2128194 00000000013eeadbf973df717320aa63ec2b3e81f0b19e521c37db25ce2ad630
+2128515 00000000002b17686a2aa58e52433e4a11fddd1172020e1464e91ba54d6bef29
+2128803 00000000017166558e5f022e46f2a476c67c69f9963f48951f421ab37426e3a4
+2129111 000000000136b194b3e7bcacf1a0222a8c7f6d3f739e42fb7db2b9ebcf1b6332
+2129418 0000000000ade562bdb165aa21fbefcc0d2e655e213e5ddf0b2bc5459c0b53c7
+2129741 0000000000408733f90084aad38ffa5a356d9f220e40ad077178d492e96ee696
+2130039 00000000015295051bce1c94530d5c8341f51b7aeabed721c26024088acc033e
+2130324 000000000047140460766777a3cc6ce71bccf3d2d1aeff7b74936f21cc9f666f
+2130628 000000000010fafc22180689562f6447240af96dc3645a666d88655a15509758
+2130915 0000000000ff00e5f8d3608e0549e680f32cb9eca3fe15eab2f1b43f8f5f1f38
+2131206 00000000007e0b7952afbd83aa3f8bbf5277eb025a8d7c130f750b9a75cdef40
+2131495 000000000060944b74e2badfc81d0043c4d97577450193a72c9f640bb8925b57
+2131813 0000000000eb90d10f092764603621bdc345875631ce08106e7bc5cdbea23902
+2132122 0000000000fe437b14ce7ad15b01d31f85076d84331ac0fefad44dbe81246e48
+2132410 0000000001768b04e8620bfd1de919e9ae09b04c0a962b158b106a33986b9aa8
+2132711 00000000007aadf626595d2e46ecff42d199b02849e7815fb4ab499e902b7923
+2133000 00000000012bd3092c628405bd45bd3c3ddfd9d7f282c5099047ec456a83d4dd
+2133300 0000000001affcdb85411d7d2edaae4ece70497edd418b6ac5a6b61471401d69
+2133604 0000000000cbe948c19907c592e4e2704ddb155c1da1cd3a2e6db5ebc8451494
+2133905 000000000157943224c2fc9672f4456dd5babf2fd7404077d85f9136d54fe067
+2134228 0000000000663b7abc789a86bbe3cb0a8fbe5be67c74302e9d6abeda775abd98
+2134528 0000000000449198effd2777d6a2157e94916e317b13eedda1b833c633cbdfb0
+2134835 00000000006ba2705c7eaafcc186ccad35b7f934da0c765e757f76e151137b27
+2135171 00000000010460ae8510ece826a72703f77ff0e7a463e33378c22e136f8152ea
+2135462 0000000001195d894fd61b555ace3d99a6c1c124d985880279d0435263941135
+2135769 000000000054b8e03388a56b73a9652f3ff23e87ade79993c76cf6d65397e353
+2136070 0000000000d350786b28b662a544fd929f02dd778b46bf73c0944bc6b0b39e2a
+2136396 00000000012230ee900503937205d1b6a6899128801a75b4b1d584f3c13e2fd4
+2136700 00000000002ae376a9bf93e1909594728aebda019466440037e75d3083e0b7e7
+2137028 00000000006023df4efc2a79131181cd46109b4bd788256ad10662edabbad5d1
+2137357 000000000057627e27490f20ff6290004762a698d7d69f9d818c2df2777d9282
+2137686 0000000000f52577e5e8392873b1206ccce3d4ea25360d297d3c3476dbd982de
+2138018 000000000006e84370babab79c13faa64113afb4386a92375983d3a7987619ca
+2138392 00000000010a100e0d11eabd1692eac1cb93989d2cd03b355e5b0240f77cf978
+2138792 00000000001c6417d7df1be185d6b0ec0657703eebb22e68a418a565da99dbad