Consensys/web3signer 26.7.0-RC1 on GitHub

Support for Hashicorp Vault Kubernetes authentication PR 1195
The eth1 signing endpoint (POST /api/v1/eth1/sign/{identifier}) accepts an optional applyHash field. It defaults to true, preserving the existing behaviour of applying Keccak-256 to data before signing. Setting it to false signs the caller-supplied data as a pre-computed digest, which must be exactly 32 bytes. Supported by file-based, AWS KMS and Azure Key Vault signers. PR 1213

Fix Key Manager API (POST /eth/v1/keystores) accepting a keystore whose JSON pubkey field does not match the decrypted private key. A mismatched import now returns status: "error" for that entry rather than poisoning the slashing-protection database under the claimed (unverified) pubkey. Thanks to Suhyeon for responsible disclosure.

The Key Manager API (DELETE /eth/v1/keystores) now only attempts to delete keystore files that follow the <pubkey>.yaml naming convention. Files using a different naming scheme are left untouched. This replaces the previous approach of scanning all metadata files and matching on the EIP-2335 pubkey field, which is optional and not guaranteed to be correct.
Java 25 is now required to build Web3Signer (previously Java 21).
The .tar.gz and .zip binary distributions now require Java 25 on the host machine to run Web3Signer (previously Java 21).
Docker images are unchanged — they have shipped Java 25 since 25.12.0.
Contributors no longer need to install JDK 25 manually. The build now uses a Gradle toolchain (JavaLanguageVersion.of(25)) with the foojay resolver, so Gradle will auto-detect a locally installed JDK 25 and download Temurin 25 if none is found. The Gradle daemon itself can run on any JDK supported by Gradle 9 (17+).

Downloads

Binary	Checksum
web3signer.tar.gz	Checksum
web3signer.zip	Checksum

Default image (Ubuntu + Eclipse Temurin JRE 25):
docker pull consensys/web3signer:26.7.0-RC1

Hardened image (Google Distroless, read-only-filesystem compatible):
docker pull consensys/web3signer:26.7.0-RC1-distroless

Full Changelog: 26.4.2...26.7.0-RC1