Testnet consensus version (V22) activation height: 20,415,000 (estimated Tue 2026-10-13 ~08:00 UTC, the evening of Mon 2026-10-12 PT).

Network: testnet. ConsensusVersion::V22 raises the maximum number of mappings in a program to 128 and lowers the testnet maximum number of certificates to 40. This release also carries everything merged to staging through snarkOS #4531 and snarkVM #3485.

Who needs to act

All testnet validators and node operators need to upgrade before the activation height.

Built against snarkVM testnet-v4.12.0 (532d8fdf7).

The Aleo maintainers are excited to announce Aleo Stack testnet-v4.12.0. This release introduces the V22 consensus version, continues the hardening and performance work from v4.10.0, and brings a large set of improvements for node operators: more resilient BFT participation, new REST range endpoints, better observability, and faster CPU proving.

Highlights

• Consensus V22: programs may declare up to 128 mappings, and the testnet certificate limit is lowered to 40.
• BFT resilience: validators no longer let peer-reported sync status silence them, proposals fan out to peers concurrently, and certificates propagate before local commit work.
• Deployment verification hardening: deterministic deployment checks, cyclic struct guards, and tighter wire-format parsing.
• Faster, more observable nodes: an 8% faster private transfer on CPU, committer keys that share the SRS, RocksDB secondary mode, and new metrics and REST routes.

Consensus upgrade: introducing V22

• Up to 128 mappings per program. The mapping limit becomes a versioned consensus value: 31 through V21, 128 from V22. Deployment verification enforces the active limit. (snarkVM#3428)
• Testnet certificate limit lowered to 40 at V22, matching mainnet’s committee bound. (snarkVM#3386, snarkVM#3484)
• Message version 33 accompanies V22; the latest message version now ignores consensus versions that have no scheduled height. (snarkOS#4511)

For node operators

BFT resilience

• Consensus participation no longer depends on peer-reported sync status. is_synced() was derived from peer locator messages, so a single peer claiming to be far ahead could silence a validator. Proposing, signing and certifying now rely on the node’s own view. (snarkOS#4461)
• Batch proposals fan out concurrently, and sends scoped to a round are cancelled when the round advances, so one rate-limited peer no longer delays delivery to the rest. (snarkOS#4487)
• Certificates are broadcast before waiting on local consensus, so local commit work does not hold up propagation. (snarkOS#4527)
• Batches that reference aborted transactions are no longer certified. (snarkOS#4412)
• Concurrent duplicate certificate inserts are ignored rather than treated as errors. (snarkOS#4479)
• Cached signer addresses on batch certificates are used instead of re-deriving them. (snarkOS#4434)
• Clients may fetch a single missing block at the tip, improving transaction and mapping visibility. (snarkOS#4529)
• The expired gateway challenge-response handshake has been removed; validators speak only the Noise handshake. (snarkOS#4506)

Hardening the wire format and network layer

• Trailing bytes inside length-delimited sub-objects, repeated entries in count-prefixed collections, and oversized preallocations from wire-declared counts are rejected. (snarkVM#3409, snarkVM#3410, snarkVM#3419)
• Non-canonical curve point encodings (Short Weierstrass y = 0 sign flag, Edwards x = 0) are rejected, and every serialized curve point is asserted to round-trip. (snarkVM#3422, snarkVM#3425, snarkVM#3405)
• MAX_PING_MESSAGE_SIZE is tightened from 16 MiB to 2 MiB, and Ping block locators are optional for clients and validators. (snarkOS#4426, snarkOS#4425)
• Remote parameter downloads and REST queries are bounded, with retries for lost requests. (snarkVM#3436, snarkVM#3435)
• A cached parameter file that fails its checksum is removed rather than reused. (snarkVM#3469)

Storage, history and observability

• RocksDB secondary mode: a store can be opened read-only alongside a running node. (snarkVM#3452)
• --history-json: snarkos start can write credits.aleo history as JSON while finalizing blocks (clients and validators only; not combinable with --history-compat-mode). (snarkVM#3485, snarkOS#4521)
• Metrics: a snarkos_consensus_version gauge, subdag/DAG-density metrics, p2p event and REST request counts by type, RocksDB compaction byte counters, standardized units and histogram buckets, and a fixed inbound-queue gauge. (snarkOS#4469, snarkOS#4453, snarkOS#4512, snarkVM#3482, snarkOS#4454, snarkOS#4436, snarkOS#4486)
• Local devnets provision the incident-response Grafana dashboard, and devnet.sh handles compose failures. (snarkOS#4473, snarkOS#4530)
• The dev_genesis_state_root feature is available for test networks. (snarkVM#3448, snarkOS#4476)
• Unused slipstream plugin support has been removed. (snarkVM#3442, snarkOS#4468)

For external developers

REST API

• New range routes: /blocks/hashes, /blocks/headers, /blocks/stateRoots and /blocks/transactions over a height range (up to 160 blocks), with allow_partial to clamp ranges to the tip. (snarkOS#4447, snarkOS#4455, snarkOS#4467, snarkOS#4510)
• Missing resources return 404, v1 errors are identifiable, and the rate limiter’s Retry-After header is forwarded on a 429. (snarkOS#4450, snarkOS#4472)
• Transaction verification on broadcast?check_transaction=true runs in a blocking task, and operators can cap REST verification concurrency at startup. (snarkOS#4530, snarkOS#4459)
• The request body limit matches the current maximum transaction size, block lookups no longer fill the block cache, and developer endpoints accept static queries. (snarkOS#4444, snarkOS#4485, snarkOS#4478)

Deployment verification hardening

• Deterministic deployment checks. A non-deterministic signer sampled during check_deployment could make nodes disagree; the remaining ambient RNG sources are now seeded. (snarkVM#3346, snarkVM#3365)
• Cyclic struct equivalence is rejected instead of overflowing the stack, guarding legacy cyclic graphs that reach type checking. (snarkVM#3447)
• The rand.chacha instruction is now costed. (snarkVM#3356)
• Beacon blocks apply a conservative spend limit, matching production environments. (snarkVM#3386)

Performance

• CPU proving is about 8% faster on a private transfer, from a set of algorithmic improvements to polynomial arithmetic. (snarkVM#3399)
• Committer keys share the SRS instead of copying the powers of β·G. (snarkVM#3474)
• Off-thread speculative reads no longer stall atomic_speculate, and the sequential VM worker is released after the final external clone. (snarkVM#3438, snarkVM#3444)
• Tokio pools are sized from measured demand, duplicate deserialization allocations are avoided, and a path hasher’s Merkle empty hash is computed once. (snarkOS#4464, snarkVM#3398, snarkVM#3458)
• Eager error creation is avoided in cost calculation. (snarkVM#3486)

For snarkVM and snarkOS developers

Toolchain and dependencies

• Rust 1.96 is now the MSRV for both snarkVM and snarkOS. (snarkVM#3395, snarkOS#4432)
• aleo-std 1.0.4: StorageMode::Custom takes an optional secondary path; use StorageMode::from(path) for the common case.
• cargo-deny replaces cargo-audit in CI, the unmaintained fxhash is replaced with ahash, and dependencies past the yanked chacha20 and wnaf releases are used. (snarkVM#3453, snarkOS#4470, snarkVM#3454, snarkVM#3406)
• The macOS release build is fixed (libclang). (snarkOS#4398)