Zebra 6.2.2 fixes credential exposure in startup logs for nodes built with the elasticsearch feature and prevents zebrad-log-filter from executing log text as shell input. It also keeps 3 RPC responses internally consistent during reorgs or tip advances and retries the first peer-cache write sooner. Existing state databases do not need migration or resync.
Update Priority
| User Type | Priority | Reason |
|---|---|---|
Operators using elasticsearch or zebrad-log-filter
| Medium | Prevents password exposure in the startup config dump and shell execution from log text |
| RPC service operators | Medium | Keeps getblock, getblockheader, and gettxout internally consistent when chain state changes during a request
|
| Other operators | Low | No state migration or resync is required; peer caching improves on cold starts |
Changed
- The first peer disk-cache write is retried every 20 seconds until it succeeds, instead of waiting the full 5-minute update interval, so a cold-started node caches its peers soon after finding them (#11073).
Fixed
getblock,getblockheader, andgettxoutRPC methods now bind their follow-up state queries to the block hash resolved by the first read, avoiding internally inconsistent responses when a reorg or tip advance occurs mid-call (#10550).
Security
- The startup config dump no longer prints the Elasticsearch password in logs or journald when the
elasticsearchfeature is enabled (#11051). zebrad-log-filterno longer executes log text as a shell command, so a log line containing a single quote cannot run commands as the user running the filter (#11050).
How to Upgrade
Upgrading from Zebra 6.2.0 or 6.2.1 does not require a state migration or resync.
Docker
docker pull zfnd/zebra:6.2.2
# or update your compose file and:
docker compose pull && docker compose up -dBinary
- Stop
zebrad(systemctl stop zebradorCtrl+C) and wait for a clean shutdown. - Replace the binary with
zebrad-6.2.2-<arch>-unknown-linux-gnu.tar.gzfrom this release's assets, or runcargo binstall zebrad. - Start
zebradagain.
Source
git fetch && git checkout v6.2.2
cargo build --releaseSource builds require Rust 1.91 or newer, protoc, a C++ compiler, and libclang.
For installation guidance, see Install Zebra.
Compatibility
| Component | Supported |
|---|---|
| Operating systems | Linux (prebuilt binaries: x86_64 and aarch64, glibc 2.34+); macOS and Windows via source build
|
| Zcash protocol | All network upgrades through NU6.3 (Ironwood) |
| State database | Format 28.0.0; unchanged from Zebra 6.2.0 and 6.2.1, no resync required |
| Minimum Rust for source builds | 1.91 |
| zcashd compatibility | Experimental constrained-sidecar mode; review the safety guidance before production use |
| End of support | Block 3,545,960, approximately 105 days after release |