cardano-foundation/cardano-rosetta-java 1.5.4 on GitHub

Cardano Rosetta Java v1.5.4

Cardano Rosetta Java v1.5.4 is a security and maintenance release for the legacy 1.x line that moves it to JDK 25 LTS and adds compatibility with cf-token-metadata-registry 2.0.0.

Caution

This is a mandatory release. The 1.x images ran JDK 24, a non-LTS release that no longer receives security fixes, so they could not get the fix for the eMudhra intermediate CAs whose private keys were compromised in October 2026. v1.5.4 moves the 1.x line to Eclipse Temurin 25.0.5 LTS, whose trust store no longer contains the root certificates that signed them. All 1.x operators should upgrade.

Key Improvements

Moved from JDK 24 (no longer updated) to JDK 25 LTS (Eclipse Temurin 25.0.5), which receives security fixes, including the eMudhra CA fix. This applies to all images that include a JDK: the API, the indexer and the all-in-one image. Image builds now verify the JDK download against its published checksum.
Token registry (CIP-26 / CIP-68) enrichment works with both cf-token-metadata-registry 2.0.0 and earlier registry versions. Tokens the new registry serves without a name or description no longer cause request failures, and logos keep the format 1.x clients already use.
The indexer no longer stalls on a transaction with extremely deeply nested metadata, as seen on Preview (#847).
Docker Compose starts the pre-built Cardano Node image without the manual configuration override that v1.5.3 required.

Upgrade / Compatibility

From v1.4.x or v1.5.x: Compatible, no resync required. Preserve the existing indexer database and Cardano Node data, and redeploy with the v1.5.4 images. If you build the images yourself, they now build and run on JDK 25. Yaci Store (0.1.7), Cardano Node (11.1.3) and Mithril are unchanged, so the database schema does not change.
v1.5.3 mainnet repair: If you have not upgraded to v1.5.3 yet, its mainnet repair still applies to databases that synced past mainnet block 14,053,493 on an older version. v1.5.4 includes the fixed Yaci (0.3.12).
Docker Compose: The CARDANO_CONFIG_CONTAINER_PATH: /config override described in the v1.5.3 notes is now built into the Compose configuration and can be removed from your overrides. The 1.x line no longer publishes its own Cardano Node image, so it no longer overwrites the image the 2.x line uses.
Token registry users: v1.5.3 and earlier are not compatible with cf-token-metadata-registry 2.0.0. Upgrade Rosetta before, or together with, your registry. The public preprod registry (preprod.tokens.cardano.org) already runs 2.0.0.
Already on v2.x: Stay on the 2.x line and upgrade to v2.4.1, which has the same fixes. This release is not a downgrade path.

API / Configuration

/block, /block/transaction, /search/transactions, /account/balance, /account/coins: token registry metadata with cf-token-metadata-registry 2.0.0.
- Registry 2.0.0 also serves tokens that do not fully follow their CIP. For such tokens, currency.metadata can come without name or description. Both fields were always optional in the schema; only policyId is required. Previously, a request touching such a token failed with HTTP 500.
- CIP-26 logos stay hex on 1.x. Every 1.x release has returned the CIP-26 logo.value as the hex string older registries serve, labelled format: base64. Registry 2.0.0 serves the logo as base64 instead (registry#88), so 1.x converts it back to hex. 1.x clients receive the same value whichever registry version is used, and no client change is needed. The 2.x line returns real base64, since v2.3.0. CIP-68 logos (format: url) are unchanged.
/block, /block/transaction, /search/transactions: transaction size for deeply nested metadata.
- A transaction nested too deeply to measure is now indexed without a size, so its metadata.size is null, instead of stalling sync. All other transactions are unaffected.
/network/options: reported middleware version updated.
- version.middleware_version is now 1.5.4. Request and response schemas, operation types and error codes are unchanged.

Environment updates:

API_DOCKER_IMAGE_TAG: 1.5.3 → 1.5.4 for Mainnet and Preprod Docker Compose. Use 1.5.4-pre-release for the prerelease images.
INDEXER_DOCKER_IMAGE_TAG: 1.5.3 → 1.5.4 for Mainnet and Preprod Docker Compose. Use 1.5.4-pre-release for the prerelease images.

What's Changed

fix: prevent Cardano Node image collisions between release lines by @linconvidal in #821
fix: 1.5.4 backport: JDK 25 LTS with eMudhra CA fix, token registry 2.0.0 support, indexer stall fix by @matiwinnetou in #853

Full Changelog: 1.5.3...1.5.4