Merge recent main for 0.22.0 rc3 (inc. ledger 8-rc.4)#761
Merged
gilescope merged 43 commits intorelease/node-0.22.0from Feb 25, 2026
Merged
Merge recent main for 0.22.0 rc3 (inc. ledger 8-rc.4)#761gilescope merged 43 commits intorelease/node-0.22.0from
gilescope merged 43 commits intorelease/node-0.22.0from
Conversation
* protect against missing t and c values at genesis * change file * fix: add default T+C Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: fmt Signed-off-by: Giles Cope <gilescope@gmail.com> * fix string scope --------- Signed-off-by: Giles Cope <gilescope@gmail.com> Co-authored-by: Giles Cope <gilescope@gmail.com>
* feat: add unsafe RPC to unban peers Useful for node operators to use when a peer is banned but has since corrected it’s behaviour. Without this RPC, the only way to reset peer reputation is to restart the node (reputation exists in memory only). * docs: add pr link to change file
* add govnet to ephemeral envs * change file
* fix: remove unnecesary GITHUB_TOKEN dependency * done * chore: add change file
* fix: add --bundle flag to cosign sign-blob for cosign v2.4+ compatibility Cosign v2.4+ (installed via cosign-installer@v4.0.0) requires the --bundle flag with sign-blob. Without it, signing fails with "must provide --bundle with --signing-config or --use-signing-config". * fix: checkout signing script from workflow branch, not input ref The signing script checkout was using inputs.ref (the release branch), which still had the old script without --bundle. CI utilities should come from the workflow's own branch to pick up fixes immediately. * fix: use Sigstore bundle format instead of separate .sig/.pem files Cosign v2.4+ only writes the .bundle file and silently ignores --output-signature/--output-certificate. Switch to .bundle as the sole signing artifact, which is the standard Sigstore format. * fix: remove duplicated "node-" in release asset filenames Use IMAGE_TAG instead of RELEASE_TAG for filenames to avoid "midnight-node-node-" and "midnight-node-toolkit-node-" prefixes. * fix: checkout image signing script from workflow branch, not input ref Same fix as for the binary signing script checkout — CI utilities should come from the workflow's own branch to pick up fixes.
* fix: prevent duplicate inherent execution within same block * chore: change file and cargo fmt * fmt: cargo check * fix: add weights to hook calls * fix: rebuild metadata * fix: move inherent deduplication storage kill back to on_finalize * chore: rebuild metadata * chore: rebuild metadata
* switch to collection with deterministic iteration. Signed-off-by: Giles Cope <gilescope@gmail.com> * fix: keep existing preview ordering Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: add changelog Signed-off-by: Giles Cope <gilescope@gmail.com> --------- Signed-off-by: Giles Cope <gilescope@gmail.com>
* chore: remove not used vars from local-env MainChain variables are sourced from mc.env file * fix: don't wait for contracts if active Changed: - calculate contracts active epoch in contract-compiler container to avoid waiting in midnight-setup container when resetting local-env nodes' state Refs: PM-21897 * Apply suggestion from @gilescope --------- Co-authored-by: Squirrel <giles.cope@shielded.io>
changed: - bumped indexer to 4.0.0-alpha.1 - node5 rpc port to 9944 (lace wallet support) Refs: PM-21916
* feat: add binary verification script and documentation Add tooling for SPOs and operators to verify signed binary releases: - scripts/verify-binary.sh: Wrapper script for cosign verify-blob - docs/security/binary-verification.md: Documentation with prerequisites, examples, manual verification commands, and troubleshooting - Update release checklist with binary verification step * chore: add change file for binary verification PR * chore: add JIRA link to change file
* fix: local-env prefers indexer tag instead of sha * fix: indexer passing sbom scan
* feat: add deterministic runtime builds * chore: update change file * fix: srtool target clean-up * fix: remove unnecessary removal
* invert is_spend * change file * jira link
* feat: add fetch-only-cached option to toolkit Allows a user to reduce the toolkit start-up time by skipping fetching from RPC if the chain is already cached. * docs: add pr link to change file * chore: fix PR link in change file * fix: off-by-one error in read_blocks_from_cache * test: fix compile errors in local-env tests * fix: upgrade eslint and fix lint errors to resolve npm audit high vulnerabilities Upgrade eslint (^4.0.0 → ^9.29.0), typescript-eslint (^7.3.1 → ^8.33.0), and minimatch override (10.1.2 → 10.2.1) to resolve all 11 high severity npm audit vulnerabilities. Fix switch fallthrough bug in run.ts and suppress no-require-imports in standalone JS worker script.
* build: fetch compactc from public repo (no GITHUB_TOKEN); update to 0.29.0 * build: rebuild package-lock.json to use public repo * chore: rebuild undeployed genesis * ci: fix usage of --secret * docs: add change file for updating compact to 0.29.0 * test: fix contract for compact 0.29.0 --------- Co-authored-by: justinfrevert <81839854+justinfrevert@users.noreply.github.com>
Bumps the cargo group with 1 update in the / directory: [keccak](https://github.com/RustCrypto/sponges). Updates `keccak` from 0.1.5 to 0.1.6 - [Commits](RustCrypto/sponges@keccak-v0.1.5...keccak-v0.1.6) --- updated-dependencies: - dependency-name: keccak dependency-version: 0.1.6 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Squirrel <giles.cope@shielded.io>
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.67.27 to 2.68.0. - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@1e67ded...f8d25fb) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.68.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Squirrel <giles.cope@shielded.io>
Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 5.1.1 to 6.0.0. - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@61815dc...8df5847) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Squirrel <giles.cope@shielded.io>
* docs: add docs for image signing * docs: made docs less wordy, removed unnecessary details * docs: removed some unnecessary sections * docs: add org naming note to verification guide * docs: add image signing verification steps to release checklist
* chore: Debug logs * chore: More debug logs * chore: changes improve-ledger-logging.md * fixup! chore: changes improve-ledger-logging.md
…updates (#740) Bumps the npm_and_yarn group with 6 updates in the /ui directory: | Package | From | To | | --- | --- | --- | | [webpack](https://github.com/webpack/webpack) | `5.101.0` | `5.104.1` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.14.0` | | [bn.js](https://github.com/indutny/bn.js) | `4.12.2` | `4.12.3` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [qs](https://github.com/ljharb/qs) | `6.14.1` | `6.15.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.6` | `7.5.9` | Bumps the npm_and_yarn group with 3 updates in the /ui/tests directory: [bn.js](https://github.com/indutny/bn.js), [lodash](https://github.com/lodash/lodash) and [tar](https://github.com/isaacs/node-tar). Updates `webpack` from 5.101.0 to 5.104.1 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.101.0...v5.104.1) Updates `ajv` from 6.12.6 to 6.14.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.14.0) Updates `bn.js` from 4.12.2 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v4.12.2...v4.12.3) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `qs` from 6.14.1 to 6.15.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.15.0) Updates `tar` from 7.5.6 to 7.5.9 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.6...v7.5.9) Updates `bn.js` from 5.2.2 to 5.2.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v4.12.2...v4.12.3) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `tar` from 7.5.6 to 7.5.9 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.6...v7.5.9) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.104.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 5.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.9 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Squirrel <giles.cope@shielded.io>
* ci: checkout script from main if missing * ci: checkout CI scripts from workflow ref, not input branch Ensure sign-image.sh and free-disk-space.sh are checked out from $GITHUB_REF (the workflow commit) rather than the inputs.branch ref, so CI infrastructure always comes from the workflow version even when building a different branch. * fix: fetch workflow ref before checking out CI scripts GITHUB_REF doesn't exist as a local ref when actions/checkout checked out a different branch via inputs.branch. Fetch it from origin first, then checkout files from FETCH_HEAD. * ci: push to midnightntwrk if missing * ci: fix docker re-tagging to prevent platform clobbering * fix: always re-mirror images to midnightntwrk Remove the existence check so images are always re-pushed with proper single-arch manifests, overwriting any broken manifest lists from previous imagetools create runs. * fix: skip mirroring if image already exists in midnightntwrk Re-add existence check before mirroring. The previous broken manifest lists were caused by using imagetools create, which has been replaced with pull+tag+push to preserve proper single-arch manifests. * ci: disable indexer sbom checks for now
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.22.1 to 0.22.2. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@deef08a...28d7154) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.22.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Squirrel <giles.cope@shielded.io>
Signed-off-by: Giles Cope <gilescope@gmail.com>
* Add a fetch-compute-concurrency option for toolkit * add change file md * Add fetch_compute_concurrency option to sources of all relevant operations Signed-off-by: chrispalaskas <chris.palaskas@gmail.com> * add fetch_compute_concurrency in e2e/tests/lib.rs
* feat: finer grained error codes Signed-off-by: Giles Cope <gilescope@gmail.com> * feat: ensure error codes are unique. A bit brute force but will run pretty quickly. Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: fmt Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: add change file for finer grained error codes Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: fix clippy Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: fmt Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: update metadata Signed-off-by: Giles Cope <gilescope@gmail.com> * fix: pin nextest so that rustc version it uses is fixed Signed-off-by: Giles Cope <gilescope@gmail.com> --------- Signed-off-by: Giles Cope <gilescope@gmail.com>
…up (#737) (#748) * fix: add TTL to soft tx validation cache for relay node mempool cleanup (#737) * fix: add TTL to soft tx validation cache to evict stale entries on relay nodes The soft validation cache only had time-to-idle (TTI), which resets on every access. On relay nodes (non-block-producers), pool revalidation continuously accesses cached entries, preventing TTI expiry. Since relay nodes never call do_validate_guaranteed_execution (block authoring only), the soft cache is never explicitly invalidated either — causing invalid transactions to persist in the mempool indefinitely. Adding a 60-second time-to-live (TTL) ensures entries are unconditionally evicted, forcing a fresh apply() check against current ledger state on the next revalidation cycle. JIRA: PM-21787 * chore: add change file for soft cache TTL fix * fix: upgrade eslint and fix lint errors to resolve npm audit high vulnerabilities Upgrade eslint (^4.0.0 → ^9.29.0), typescript-eslint (^7.3.1 → ^8.33.0), and minimatch override (10.1.2 → 10.2.1) to resolve all 11 high severity npm audit vulnerabilities. Fix switch fallthrough bug in run.ts and suppress no-require-imports in standalone JS worker script. * chore: update change file with new PR link
…update (#743) Bumps the npm_and_yarn group with 1 update in the /ui directory: [minimatch](https://github.com/isaacs/minimatch). Bumps the npm_and_yarn group with 1 update in the /ui/tests directory: [minimatch](https://github.com/isaacs/minimatch). Updates `minimatch` from 3.1.2 to 3.1.3 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.3) Updates `minimatch` from 5.1.6 to 5.1.7 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.3) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 5.1.7 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix runtime upgrade call for governance upgrade script * dont hardcode threshold * changes file * jira link * pr comments --------- Co-authored-by: Squirrel <giles.cope@shielded.io>
* bump ledger to 7.0.2 * change file * correct change file * fix: flaky test possibly due to contention on shared dirs Signed-off-by: Giles Cope <gilescope@gmail.com> --------- Signed-off-by: Giles Cope <gilescope@gmail.com> Co-authored-by: Giles Cope <gilescope@gmail.com>
…ut [PM-20208] (#668) * chore: initialize branch for PM-20208 Placeholder commit to establish draft PR for tracked work on unsafe usize-to-u32 conversion in utxos_info_from_output. Ref: PM-20208 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ledger): replace unsafe usize-to-u32 cast with checked conversion in utxos_info_from_output Replace `output_no as u32` with `u32::try_from(output_no)?` to prevent silent truncation when output indices exceed u32::MAX. The function now returns Result<Vec<UtxoInfo>, TryFromIntError>, with callers in unshielded_utxos logging the error and returning a default value. Addresses Least Authority audit Issue AA (PM-20208). Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ledger): use checked conversion in test assertions for consistency Co-authored-by: Cursor <cursoragent@cursor.com> * change file * jira in change file --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Justin Frevert <justinfrevert@gmail.com>
* fix: prevent panics Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: add change file for yamux panic fix Signed-off-by: Giles Cope <gilescope@gmail.com> --------- Signed-off-by: Giles Cope <gilescope@gmail.com>
* use take instead of get in handle_spend function Signed-off-by: B. Yap <2826165+b-yap@users.noreply.github.com> * add changes file Signed-off-by: B. Yap <2826165+b-yap@users.noreply.github.com> * use take instead of get in handle_redemption_spend function This completes the audit fix PM-19770 by also removing the UtxoOwners key after spending in handle_redemption_spend, matching the fix already applied to handle_spend. --------- Signed-off-by: B. Yap <2826165+b-yap@users.noreply.github.com> Co-authored-by: Mike Clay <mike.clay@shielded.io> Co-authored-by: justinfrevert <81839854+justinfrevert@users.noreply.github.com>
* fix cngd utxo insertion order * change file
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.68.0 to 2.68.8. - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@f8d25fb...cfdb446) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.68.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Contributor
|
Wait - missing ledger-8 rc.4 - coming soon: #765 UPDATE: We're good now. RC.4 is in now. |
…are empty (#758) * fix(toolkit): do not create dust actions if spends and registrations are empty * docs: add change file --------- Co-authored-by: Oscar Bailey <79094698+ozgb@users.noreply.github.com>
Signed-off-by: Giles Cope <gilescope@gmail.com>
* feat: upgrade ledger 8 to rc.4 Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: add change file for ledger 8.0.0-rc.4 upgrade Signed-off-by: Giles Cope <gilescope@gmail.com> * chore: update issue Signed-off-by: Giles Cope <gilescope@gmail.com> * fix: refer to ledger via version numbers Signed-off-by: Giles Cope <gilescope@gmail.com> * fix: clippy Signed-off-by: Giles Cope <gilescope@gmail.com> --------- Signed-off-by: Giles Cope <gilescope@gmail.com> Co-authored-by: justinfrevert <81839854+justinfrevert@users.noreply.github.com>
Signed-off-by: Giles Cope <gilescope@gmail.com>
gilescope
changed the title
gilescope
approved these changes
Feb 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Merge changes from main for new rc to be generated from release/node-0.22.0
🗹 TODO before merging
📌 Submission Checklist
🧪 Testing Evidence
Please describe any additional testing aside from CI:
🔱 Fork Strategy
Links