From 87f7af80dd06bebcbdbcc31ee54c45cffb5f40f5 Mon Sep 17 00:00:00 2001 From: jholdstock Date: Fri, 21 Aug 2026 20:18:23 +0800 Subject: [PATCH] docs: Add 1.5.0 release note --- docs/release-notes/release-notes.1.5.0.md | 111 ++++++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100644 docs/release-notes/release-notes.1.5.0.md diff --git a/docs/release-notes/release-notes.1.5.0.md b/docs/release-notes/release-notes.1.5.0.md new file mode 100644 index 00000000..6d142783 --- /dev/null +++ b/docs/release-notes/release-notes.1.5.0.md @@ -0,0 +1,111 @@ +# vspd 1.5.0 + +vspd v1.5.0 contains all development work completed since v1.4.0 (November 2025). +All commits included in this release can be viewed +[on GitHub](https://github.com/decred/vspd/compare/release-v1.4.0...release-v1.5.0). + +## Dependencies + +vspd 1.5.0 must be built with go 1.26 or later, and requires: + +- dcrd 2.1.6 +- dcrwallet 2.1.6 + +Always use release versions of all binaries when deploying vspd to production. +Neither vspd nor its dependencies should be built from master when handling +mainnet tickets. + +## Recommended Upgrade Procedure + +The upgrade procedure below includes vspd downtime, during which clients will +not be able to register new tickets, check their ticket status, or update their +voting preferences. You may wish to put up a temporary maintenance webpage or +announce downtime in public channels. Voting on tickets already registered with +the VSP will not be interrupted. + +1. Build vspd from the `release-v1.5.0` tag, and build dcrwallet and dcrd from + their `release-v2.1.6` tags. +1. Stop vspd. +1. **Make a backup of the vspd database file in case rollback is required.** +1. Stop the instance of dcrd running on the vspd server. +1. Install new dcrd binary on the vspd server and start it to begin any required + database upgrades. You can proceed with the following steps while the + upgrades run. +1. Upgrade voting wallets one by one so at least two wallets remain online for + voting at all times. On each server: + 1. Stop dcrwallet. + 1. Stop dcrd. + 1. Install new dcrd binary and start. + 1. Wait for any dcrd database upgrades to complete. + 1. Check dcrd log file for warnings or errors. + 1. Install new dcrwallet binary and start. + 1. Wait for any dcrwallet database upgrades to complete. + 1. Check dcrwallet log file for warnings or errors. +1. Ensure dcrd on the vspd server has completed all database upgrades. +1. Check dcrd log file for warnings or errors. +1. Install new vspd binary and start it. +1. Check vspd log file for warnings or errors. +1. Log in to the admin webpage and check the VSP Status tab for any issues. + +## Notable Changes + +- VSP revenue is now displayed on the admin page. + + Revenue figures are displayed in DCR and provided for the lifetime of the VSP, + the previous 28 days, and the previous 24 hours. + +- More strict dcrd/dcrwallet version checks. + + Previously only the RPC version of dcrd and dcrwallet was checked to ensure + API compatability, however this was not enough to ensure the VSP was running + the latest binary versions. Now the binary version is checked too, helping + to ensure the VSP is using the latest voting agendas and running the + latest security updates. + +- SPV wallets explicitly prohibited. + + SPV mode voting wallets have never been supported by vspd, however this was + not documented and not enforced. vspd will no longer connect to a wallet if it + detects it is running in SPV mode and an error will be logged. + +### Config Changes + +No config changes since version 1.4.0. + +### API changes + +No API changes since version 1.4.0. + +### Security + +- Admin passwords are now checked using constant time comparison to reduce the + risk of brute-forcing the password via a side-channel/timing attack. + +- HTTP requests readers are now limited to 1 MiB to reduce the likelihood of + memory exhaustion attacks. + +- All HTTP endpoints now implement CSRF protection. + +- A limit of 16 concurrent transaction broadcasts mitigates a potential DoS + vector. + +- Status JSON endpoint is now subject to the same rate limit as the login page + to prevent password brute-forcing. + +### Bug Fixes + +- Fix handling of invalid tspend/treasury vote options + ([#511](https://github.com/decred/vspd/pull/511)). + +- Give webserver time for graceful shutdown + ([#514](https://github.com/decred/vspd/pull/514)). + +- Minor logging fixes + ([#515](https://github.com/decred/vspd/pull/515), + [#525](https://github.com/decred/vspd/pull/525)). + +- Fix orphan transaction detection + ([#517](https://github.com/decred/vspd/pull/517)). + +- Delete vote changes for tickets which never got mined + ([#526](https://github.com/decred/vspd/pull/526)).