github cardano-foundation/cardano-rosetta-java 2.1.1
on GitHub

pre-release6 hours ago

Cardano Rosetta Java v2.1.1 is a maintenance release focused on reference Kubernetes deployment, container health probes, endpoint input validation fixes, and a security hardening of the search path.

Cardano-Node compatibility: 10.5.4.

⚠️ This is not a mandatory release.

Key Improvements

  • Kubernetes deployment is now supported via reference Helm charts alongside the existing Docker Compose flow
  • Liveness and readiness probes added to all containers, giving orchestrators accurate sync and index-readiness signals
  • Security fix: hardened input validation and query construction on the search endpoint, resolved with domain validators and JOOQ bind parameters
  • Fixed several endpoints that previously ignored invalid input or silently defaulted to wrong values
  • Tunable connection pool for the yaci-indexer database
  • Fixed a rare crash with UTxO pruning enabled when the indexer was temporarily unavailable

Upgrade / Compatibility

  • From v2.1.0: Compatible, no resync required.
  • From v2.0.0: Compatible, no resync required.
  • From v1.x.x: Requires a full yaci-indexer resync only (Cardano Node data can be kept). See the resync procedure.
  • New deployment option: Kubernetes Helm charts are now available. Existing Docker Compose deployments continue to work unchanged.

API / Configuration

  • Security fix — /search/transactions: currency input validation and parameterized queries.

    • A report identified an issue in the search path where policyId and symbol were concatenated into raw JOOQ DSL.condition() SQL with only superficial escaping. The fix introduces strict domain validation (PolicyIdValidator, SymbolValidator, TokenNameValidator) and rewrites the H2 and PostgreSQL currency condition builders to use JOOQ bind parameters instead of string interpolation. Invalid values now return 400 with error 4023 (invalid policyId), 4024 (invalid token name), or 5059 (currency symbol not hex), matching the existing behavior of /account/balance and /account/coins.

  • /construction/derive: invalid address_type now rejected.

    • Previously, unrecognized values (e.g., "InvalidType") silently defaulted to Enterprise. Now returns 400 with error 4016 ("Provided address type is invalid"). Valid values are unchanged: Base, Enterprise, Reward.

  • /network/options: call_methods now populated.

    • Previously returned an empty list despite /call supporting methods. Now reports the supported methods (get_parse_error_blocks, mark_parse_error_block_checked), consistent with the /call endpoint.

  • /search/transactions: malformed coin_identifier now returns a structured error.

    • Previously threw an unhandled exception (HTTP 500) when the identifier lacked a : separator or had a non-numeric output index. Now returns 400 (not retriable) with a descriptive message.

  • Spring Boot Actuator liveness and readiness probes added to API and yaci-indexer containers.

    • API exposes GET /actuator/health/liveness and GET /actuator/health/readiness. The readiness probe reports ready only when the node is at chain tip AND all required database indexes are applied (sync stage LIVE). The yaci-indexer exposes equivalent probes gated on Yaci connection and sync state. See the updated Kubernetes deployment guide for probe configuration details.

  • YaciHttpGateway: InterruptedException no longer leaks to the request thread on IO errors.

    • When the yaci-indexer was temporarily unavailable, the request thread was left with its interrupted flag set, causing JDBC to abort the next DB query with "Unable to rollback against JDBC Connection". This was most visible on deployments with UTxO pruning enabled, where the subsequent oldest_block_identifier query would crash. InterruptedException and IOException are now handled separately.

Environment updates:

  • INDEXER_DB_POOL_MIN_COUNT: 12 (new, HikariCP minimum idle for the yaci-indexer DB pool)
  • INDEXER_DB_POOL_MAX_COUNT: 12 (new, HikariCP maximum pool size)
  • INDEXER_DB_POOL_MAX_LIFETIME_MS: 2000000 (new)
  • INDEXER_DB_POOL_CONNECTION_TIMEOUT_MS: 100000 (new)
  • INDEXER_DB_KEEP_ALIVE_MS: 60000 (new)
  • INDEXER_DB_LEAK_CONNECTIONS_WARNING_MS: 60000 (new)
  • INDEXER_DB_SHOW_SQL: false (new, toggles Hibernate SQL logging in the indexer)
  • INDEXER_DB_MONITOR_PERFORMANCE: false (new, toggles HikariCP JMX MBean registration)

What's Changed

Full Changelog: 2.1.0...2.1.1

Check out latest releases or
releases around cardano-foundation/cardano-rosetta-java 2.1.1

Don't miss a new cardano-rosetta-java release

NewReleases is sending notifications on new releases.

Get notifications