envadiv/Passage3D v4.1.0-rc1

Passage v4.1.0-rc1

on GitHub

Release candidate. It is not for mainnet. Use it for the mainnet-state rehearsal of the v4.1.0 upgrade (scripts/rehearsal/README.md). The final v4.1.0 release follows once the rehearsal passes.

Contents

• CosmWasm security update:
  • wasmd v0.50.0 → v0.54.10 and wasmvm v1.5.0 → v2.2.9, which patch CWA-2026-006 (a Wasmer Singlepass sandbox escape) and CWA-2026-005.
  • Cosmos SDK v0.50.15 and ibc-go v8.8.0, as wasmd requires. The upgrade migrates the ibc module from 5 to 6.
• Fixes since v4.0.0 (#217):
  • Ledger and Amino-signed CosmWasm transactions are accepted again.
  • MsgClaim is accepted again.
  • The legacy governance router is restored.
  • The upgrade handler repairs the duplicate account number of the claim module account.
  • wasm gas register and blocked-multisig ante fixes.
• passage in-place-testnet (#219), the rehearsal tooling. It does not change consensus.
• Upgrade plan name: v4.1.0. Commit e5cb0c5, Go 1.25.14. The release was built from a clean checkout; each *.provenance.txt records it.

Assets

Per architecture there is a binary, the libwasmvm library it loads, and a bundle with both. Keep the binary and libwasmvm.<arch>.so in the same directory, because the binary loads it via rpath $ORIGIN. It needs glibc 2.35 or newer.

e35ae07ecf47c52469f0457d224e11e869cba6ce7fa9f7b492d58446d9d36ab4  passage-4.1.0-rc1-linux-amd64
bfd7157b96028037eb1bdf82b2b7cbf4ebd38a5ab6b1336f0d35c73cf569c783  libwasmvm.x86_64.so
d6d9666ed33122e2e80c2019f4424e7e2c42d2089cb12c1b7f46bd5a238cf5e0  passage-4.1.0-rc1-linux-arm64
248f92469e65eb0d334247287c5d68035873e4c89fb30fe49fe006c3bf4c97b6  libwasmvm.aarch64.so

Check: ./passage-4.1.0-rc1-linux-amd64 version prints v4.1.0-rc1, and query wasm libwasmvm-version prints 2.2.9.