Canton 3.4.9

Canton 3.4.9 has been released on December 01, 2025.

Summary

This is a maintenance release focused on critical stability improvements and bugfixes for participant nodes, primarily related to data pruning and the Ledger API's Interactive Submission Service.

What’s New

Minor Improvements

• Made the config option ...topology.use-time-proofs-to-observe-effective-time to work and changed the default to false. Disabling this option activates a more robust time advancement broadcast mechanism on the sequencers, which however still does not tolerate crashes or big gaps in block sequencing times. The parameters can be configured in the sequencer via canton.sequencers.<sequencer>.parameters.time-advancing-topology.
• Batching configuration now allows setting different parallelism for pruning (currently only for Sequencer pruning): New option canton.sequencers.sequencer.parameters.batching.pruning-parallelism (defaults to 2) can be used separately from the general canton.sequencers.sequencer.parameters.batching.parallelism setting.
• The PrepareSubmission RPC in the InteractiveSubmissionService now rejects requests with multiple commands. Such requests were never and are still not supported, but previously failed later in the transaction processing. This provides earlier feedback and better UX. This behavior can be reverted by setting ledger-api.interactive-submission-service.enforce-single-root-node = false in the participant node config object.
• The ExecuteSubmission RPC in the InteractiveSubmissionService now rejects requests with transactions containing multiple root nodes. Such requests were never and are still not supported, but previously failed later in the transaction processing. This provides earlier feedback and better UX. This behavior can be reverted by setting ledger-api.interactive-submission-service.enforce-single-root-node = false in the participant node config object.
• Fixed an issue preventing clearing of the onboarding flag for new external parties created on Canton 3.4.8 using the clearPartyOnboardingFlag endpoint.

Bugfixes

(25-012, Low): Ledger prune call erroneously emits an UNSAFE_TO_PRUNE error

Issue Description

Pruning bug that wrongly issues errors, but does not delete data that is not safe to prune. When no offset is safe to prune, i.e., the first unsafe offset is 1 (the first ledger offset), Canton pruning indicates in logs that it is safe to prune up to ledger end, which is wrong. However, the prune call subsequently logs an UNSAFE_TO_PRUNE error and the pruning call fails. Note that this is not a safety bug: validation checks still prevent Canton from actually pruning unsafe data.

Affected Deployments

Participant nodes

Affected Versions

All 3.x < 3.4.9

Impact

Minor: An error is logged when calling prune, which may alert an operator.

Symptom

Pruning logs that it is safe to prune up to some offset, but the pruning call fails when it tries to prune at that offset.

Workaround

Calls to prune eventually succeed when the unsafe to prune boundary advances.

Likelihood

Possible

Recommendation

Upgrade to >= 3.4.9

(25-013, Critical): Incorrect contract-store pruning related to immediately divulged events

Issue Description

Participant pruning is incorrectly removing stored contracts if certain conditions are met. Pruning of participant events which are immediately divulged to the participant (create events with no locally hosted stakeholders) leads to unconditional removal of the contract instance from the participant contract store. This is problematic for the following scenario (the 3 steps need to be after each other in real time):

• Participant observes Immediately divulged contract C at offset O1.
• Participant starts hosting one of the stakeholders at offset O3 (this leads to offline party replication, which adds the same created event again).
• Participant is being pruned at offset O2.

Offset conditions: O1 < O2 < O3.

Affected Deployments

Participant nodes

Affected Versions

All 3.4.x < 3.4.9

Impact

Grave: Ledger API operations (command submission, pointwise/streaming update retrieval) related to the respective contracts fail with internal error due to the contract being removed from the store.

Symptom

If the conditions are met, the respective contract is removed from the participant contract store leading to (non-exhaustive list):

• Ledger API pointwise/streaming endpoints (Update, ACS) fail with internal error in case the respective import event is included in the results.
• Ledger API command submission fails with "contract not found" for interpretations that have the respective contract as an input.

Workaround

Not using ACS import/repair service which adds contracts after bootstrapping, or not pruning the participant.

Likelihood

Possible

Recommendation

Upgrade to >= 3.4.9

Compatibility

The following Canton protocol versions are supported:

Dependency	Version
Canton protocol versions	34

Canton has been tested against the following versions of its dependencies:

Dependency	Version
Java Runtime	OpenJDK 64-Bit Server VM (build 21.0.5+1-nixos, mixed mode, sharing)
Postgres	Recommended: PostgreSQL 17.7 (Debian 17.7-3.pgdg13+1) – Also tested: PostgreSQL 14.20 (Debian 14.20-1.pgdg13+1), PostgreSQL 15.15 (Debian 15.15-1.pgdg13+1), PostgreSQL 16.11 (Debian 16.11-1.pgdg13+1)