Consensys/web3signer 26.4.1-RC2

on GitHub

Features Added

• Update Teku to 26.4.0 [Fulu upgrade for Gnosis chain]
• Publish an additional hardened Docker image under the -distroless tag suffix (e.g. consensys/web3signer:26.4.1-distroless). Built from gcr.io/distroless/java25-debian13:nonroot — no shell, runs as non-root by default, and is compatible with docker run --read-only. See issue #1151.
• Docker image labels migrated from the deprecated org.label-schema.* schema to the OCI Image Spec org.opencontainers.image.* annotations, which are consumed by modern registries and image-scanning tooling.

Bugs Fixed

• Fix memory leak in the reload endpoint: removed validators were not being offloaded from the slashing-protection in-memory cache, and every reload unnecessarily re-registered all validators, causing old-gen heap pressure. Reload now processes only the delta of added/removed keys. PR #1167.
• Fix jdbi parsed-SQL cache growth in ValidatorsDao by replacing inlined values and bindList expansions with parameterized array bindings. PR #1170.

Downloads

Binaries

Docker

Default image (Ubuntu + Eclipse Temurin JRE 25):
docker pull consensys/web3signer:26.4.1-RC2

Hardened image (Google Distroless, read-only-filesystem compatible):
docker pull consensys/web3signer:26.4.1-RC2-distroless

Full Changelog: 26.4.0...26.4.1-RC2