Pearl v1.5 “Security hardening” and Wallet v3.0.0: what operators need to know

The v1.5.0 notes thank twelve researchers who reported issues through GitHub security advisories, and the security firm Zellic for a report on how the light client counts peers.

• Upgrade, miners and pools first. v1.5.0 tightens a script validation rule: OP_CHECKXMSSSIG now fails a script on a wrong-length key or signature instead of returning false. Standard wallet spends are unaffected.
• Long unconfirmed chains are capped at 25 transactions (counting ancestors or descendants) and 101,000 vbytes of ancestors, and rejected beyond that.
• Peers that fall behind are dropped: a node disconnects a peer when more than 16 MiB or 1,000 messages are waiting to be sent to it, or when it reads less than 64 KiB in 30 seconds. RPC requests over 16 MB are refused.
• Diagnostics stay local: the profiler now listens on 127.0.0.1 only.

The bundled node also ships a checkpoint at block 120,000, and the light client now checks peers against known filter headers.

Neither v1.5.1 nor v1.5.2 is labeled a fork, and Pearl hasn’t said whether the in-block ordering fix changes which blocks older nodes accept. If you run infrastructure, read the linked pull requests and stay on the current release.