7.0.15

Fixed

• Governance JavaScript evaluation (member ballots and the constitution's validate, resolve and apply steps) is now bounded by the same js_runtime_options heap, stack and execution time limits used for application requests, including while loading and initialising the module that contains those functions. A single member can no longer stall or exhaust the primary by supplying module-scope code without a bounded execution window. (#8341, #8346, #8351)
• JavaScript application heap, stack, and execution-time limits now cover top-level module initialisation and response conversion, in addition to endpoint handler execution. (#8346)
• Restricted ccf.gov.validateConstitution to the constitution's validate step. It is no longer exposed to applications, ballots, or the constitution's resolve and apply steps. Evaluating the proposed constitution is now bounded by the caller's js_runtime_options heap, stack and execution time limits, sharing the remaining execution time of the validate step, rather than running unbounded (#8341).
• Failures of the JS interpreter itself (out of memory, stack overflow, or interruption) while evaluating a module's top-level code are now reported as a failure to load that module, rather than being ignored (#8341).
• The JS crypto bindings (ccf.crypto.wrapKey, ccf.crypto.unwrapKey, ccf.crypto.verifySignature) and snp_attestation.verifySnpAttestation now copy each ArrayBuffer argument into an owned buffer before running any code that can re-enter JavaScript (property getters, toString / Symbol.toPrimitive, JSON conversion, etc.). Since QuickJS 2026-06-04, ArrayBuffer.prototype.transfer and .resize() let script free or reallocate the backing store, so the previous pattern of holding a raw pointer returned by JS_GetArrayBuffer across such calls was a use-after-free hazard (#8340, #8349).
• An RSA-OAEP label passed to ccf.crypto.wrapKey or ccf.crypto.unwrapKey which is present but is not an ArrayBuffer is now reported as a TypeError. Previously it was ignored, but left an exception pending on the interpreter which could surface later as an unrelated failure. An absent, null or zero-length label continues to mean "no label" (#8349).
• Strengthened access checks on JavaScript KV handles, including namespace restrictions in the historical KV (#8318).
• The JS response body copy path no longer trusts the typed array's construction-time length: for a length-tracking Uint8Array over a resizable ArrayBuffer that was later shrunk (or a view whose byteOffset has fallen outside the current buffer), the copy is now clamped against the backing buffer's real current size, preventing a heap over-read introduced with the QuickJS 2026-06-04 update (#8340, #8347).
• Invalid PEM construction and JSON deserialisation errors no longer include the supplied data, which may contain private key material (#8330).
• Reaching the soft session cap on an unsecured RPC interface no longer terminates the node by attempting a TLS handshake without a certificate. (#8331)
• Transactions from an earlier view are now rejected before entering the replication queue even after the node has stepped down. This prevents rolled-back writes from being replicated after a later election and blocking subsequent replication (#8293, #8295).
• Nodes now retain a peer's reconnect address even when an incoming node-to-node channel was established before its Raft configuration was applied. Previously, losing that connection could prevent outbound consensus messages from reaching the peer and stall elections (#8336).

Changed

• Updated QuickJS to 2026-06-04, with isolated build-time patches for out-of-memory backtrace handling and enforcement of lowered heap limits (#8340).
• CBOR parsing now rejects composite (array or map) and tagged values used as map keys anywhere in the decoded document, including nested maps in optional COSE headers (#8297).

Removed

• Removed the exported evercbor CMake target and installed libevercbor.a library. Applications using CCF's public APIs that explicitly depend on this target or link this library directly must remove that dependency. No further build changes are necessary: the replacement CBOR implementation is linked transitively by CCF (#8297).

Fixed

• Transactions with pending writes now correctly validate foreach, size, and clear observations of an existing empty KV table made at revision zero. Previously, these observations could be mistaken for no whole-map read dependency (#8320).
• The OpenAPI schema for GET /node/consensus and GET /node/network now correctly marks details.primary_id and primary_id as nullable, matching their null value while no primary is known (e.g. between elections). Previously the schema required a non-null string, causing spurious response validation failures (#8344).