AztecProtocol/aztec-packages v5.2.0 on GitHub

  ▁▂▃▅▇█▇▅▃▂▁▁▂▃▅▇█▇▅▃▂▁▁▂▃▅▇█▇▅▃▂▁▁▂▃▅▇█▇▅▃▂▁▁▂▃▅▇█▇▅▃▂▁

                   A Z T E C  ·  5 · 2 · 0

Date: 2026-08-17 · Tag: v5.2.0 · Baseline: v5.1.0 · Minor release

Install: aztec-up install 5.2.0 · Docker: aztecprotocol/aztec:5.2.0

Summary

A maintenance release focused on running nodes: prover nodes use much less memory, epoch proving recovers from faults instead of giving up, p2p and mempool handling is hardened, and several L1 interactions stop wasting gas and RPC calls. Contract developers get a new Noir compiler with one breaking change (a one-line fix per note type). Wallets and PXE get faster sync with no API changes.

Protocol constants are unchanged, so v5.1.0 and v5.2.0 nodes interoperate. Upgrading needs no coordination, no downtime window, and no contract redeployment.

Should you upgrade?

Node operators — recommended. Not strictly required, but this release carries substantial p2p hardening and prover reliability and memory improvements. It is drop-in against the current rollup: upgrade the image and restart, in any order across your fleet.
Contract developers — upgrade when ready; one breaking change when you do. Contracts built with v5.1.0 keep working. When you move to the v5.2.0 toolchain, note types declared inside a contract block need pub — see below.
Wallet / PXE developers — a plain version bump. No breaking API changes, and sync gets faster.

Breaking changes

[Aztec.nr] Note types declared inside a contract must be pub — the new Noir compiler enforces visibility more strictly. If a #[note] struct is declared directly inside your contract block without pub, compilation fails with Function `get_id` is private. Add pub; that's the whole fix. Notes declared in their own module are already pub and unaffected (#24907).
```
  #[derive(Packable, Eq)]
  #[note]
- struct MyNote {
+ pub struct MyNote {
      owner: AztecAddress,
  }
```

For contract developers

Noir compiler: v1.0.0-beta.22 → v1.0.0-beta.25 (#24907). Besides the pub change above, Noir itself removed some long-deprecated stdlib items (the as_slice methods and the std::hash::keccak module) and reports previously-silent ambiguous method calls as errors. If your contract used none of these, it compiles as before.
The getTxEffects oracle now works — reading an element of the array it returns previously failed to compile, because TxEffect did not implement Deserialize. It now does (#25109).

For node operators

The bulk of the release. There are no consensus or protocol changes: v5.1.0 and v5.2.0 nodes interoperate, so roll your fleet at your own pace.

Prover nodes

Much lower memory use. The prover stack kept large data in memory long after it was needed — every checkpoint's transactions, circuit inputs, and proofs, some of it duplicating what was already on disk; one duplication alone accounted for ~7.6 GiB in a 5 TPS test. This data is now released promptly and read back from disk when needed (#24982, #24983, #24990, #25027).
Epoch proving retries instead of giving up. An epoch is declared failed only when its submission window expires, not on the first fault; a chain prune during proving no longer counts as a failure; and stuck epochs aren't pointlessly re-proved. Diagnostics for each failed checkpoint are uploaded as they happen (#24678).

Mempool and p2p

Incoming gossiped transactions are no longer held up by the pool's background archiving work (#25148).
A node whose p2p service fails to start now exits at startup instead of running in a broken state (#25177). While a node has zero peers it warns periodically (#25183) and holds off proposing, slash voting, and accepting transactions until it reconnects (#25185).

Event watching switched from eth_newFilter to polling getLogs. Server-side filters break behind load-balanced RPC providers — nodes were re-polling dead filters at 30–40 req/s and silently missing slashing and governance events (#25176).
A stale governance payload setting no longer wastes gas. A sequencer left with an outdated GOVERNANCE_PROPOSER_PAYLOAD kept signalling a payload that had already executed, burning ~100k gas per slot. It now detects this and stops (#24764).
Spurious "insufficient funds" errors when simulating L1 calls are fixed (#25202).
The KZG trusted setup loads at startup rather than stalling the first blob operation (#24775).

Validators and sync

You are warned when the network votes to slash your validators. The node now logs warnings and exposes metrics when its own validators appear as slash targets — previously operators found out only after stake was lost (#25058).
Block proposals containing invalid transactions are correctly flagged as slashable. An error in transaction validation previously let such proposers escape accountability (#25031).
A sync race causing spurious block_not_available errors is fixed (#25206).
Reorged blocks are fully cleaned from the archiver, including blocks whose transactions were re-included elsewhere (#24765); a related race when reading L2→L1 message proofs is fixed (#24754).
Transactions dropped from the mempool now log the reason at warn level (#25000).

For wallet / PXE developers

No breaking API changes.

Faster sync. Data fetched from the node is cached and reused instead of re-fetched on every sync (#24969, #25074, #25076), and note discovery does less scanning work (#24275, #25045, #24667).
Contracts built against the v5.0.1 handshake registry keep working — the client and release image now ship the historical registry artifacts (#25032, #25155).
One failing write no longer aborts unrelated writes running alongside it (#25208).
aztec.js waits briefly before the first receipt poll after sending a transaction, removing a round trip that could never succeed (#25089).

Security & correctness

Everything the node parses from untrusted input now has explicit size bounds, closing memory-exhaustion holes. Most of this lives in shared serialization code, so clients that talk to a node they don't trust get the same protection.

Tree sibling paths and vectors are bounded (#25028); arrays in the Tx and HashedValues schemas are capped (#25029); simulation overrides and checkpoint queries on the RPC surface are capped (#25026).
Gaps in checkpoint block-shape and block-count validation are closed (#25229).
JSON-RPC responses always include a result key, as the spec requires, so an empty result can't be confused with a malformed response (#24840).

New in this release

Declarative deployments at @aztec/aztec/deploy — describe a deployment as data (contracts, dependencies, bridging, fees) and let the runner work out the order and execute it, instead of hand-written deploy scripts (#24685).

Also in this release

JSON-RPC servers report metrics (#25159), and log levels map to AWS severity (#25022).
JSON-RPC clients accept and send cookies, so load balancers that use session affinity work (#25231). The RPC server's HTTP timeouts and CORS headers are configurable via RPC_HTTP_KEEP_ALIVE_TIMEOUT_MS, RPC_HTTP_HEADERS_TIMEOUT_MS and RPC_CORS_ALLOWED_HEADERS; defaults are unchanged (#25242).
Browser: an undersized CRS no longer fails to load (#24894), and wasm load settings are respected when opening SQLite (#24937).
snappy is pinned to 7.2.2 and the aztec-up local-network wait no longer hangs forever (#25198); bb's socket startup no longer times out while the bb process is alive (#24802).

Protocol constants

Unchanged from v5.1.0:

vk root               0x2b3b6ea4412b9c8f6457a37f91a2870306f8641e07e16a49b68bda6f8bc02892
protocol contracts    0x2c075866eafc88a1f6f9addc7e337c6e64e45d1cb7fd7c0d612ebcec72aab2ca

Protocol circuits and protocol contracts ship as pinned, pre-built artifacts that are byte-identical to v5.1.0's — they are not recompiled, so the Noir compiler upgrade cannot change them. Compatibility tests re-enabled in this release assert both values against the live mainnet and testnet rollups (#25136). This is why the upgrade is drop-in.

Reference

v5.1.0 release notes — the previous minor release and this release's baseline.
v5.0.0 release notes — the first stable v5 release and full v4→v5 migration reference.
Migration notes — per-change migration reference. Note that entries under the "TBD" heading are staged for a future release and do not all apply to v5.2.0; the only breaking change in this release is the one listed above.