Protocol
This release introduces protocol version 28
#11626: Move authenticator contracts can now inspect which authenticator function the sender and sponsor used during transaction execution via two new AuthContext accessors: sender_authenticator_function_info_v1() and sponsor_authenticator_function_info_v1().
#11708: Enable Move-based account authentication in mainnet Enable Move-based sponsor account authentication in testnet. The max_auth_gas parameter is set to 0.00002 IOTA in testnet and mainnet.
Nodes (Validators and Full nodes)
#11598: - DoS protection is enabled in dryRun mode by default for validators.
- A new admin API endpoint allows hot-reconfiguration of the traffic control policy without clearing blocklists.
- A new metric exposes whether dry-run is enabled, and the blocked-requests / blocklist-length metrics are now accurate.
#11680: Removed the unused PassthroughCache execution cache. WritebackCache is now the only supported implementation. The execution-cache config field and DISABLE_WRITEBACK_CACHE env var are no longer recognized and can be dropped from node configs.
#11569: Two new RocksDB column families are auto-created on epoch store open — scoring_metrics (on the starfish store) and received_reports_state (on AuthorityEpochTables) — used to persist Starfish misbehavior counts and per-validator received-reports tallies across restarts. No migration or operator action required.
Indexer
#11692: --epochs-to-keep scheduled for removal in v1.28, please migrate to --pruning-config-path
#11709: Removed the objects_snapshot ingestion pipeline; The CLI flags --objects-snapshot-min-checkpoint-lag and --objects-snapshot-sleep-duration, and the OBJECTS_SNAPSHOT_MIN_CHECKPOINT_LAG env var, are deprecated and will be removed in v1.31.0. They are now no-ops and will log a warning if set.
JSON-RPC
#11702: The following IotaValidatorSummary fields were incorrectly serialized as byte arrays and are now correctly serialized as Base64: next_epoch_authority_pubkey_bytes, next_epoch_proof_of_possession, next_epoch_network_pubkey_bytes, next_epoch_protocol_pubkey_bytes
GraphQL
#11635: Add Subscription support for Event and TransactionBlock.It does accept an optional startAfter
transaction digest to resume receiving transactions and events from a specific point. For more detailed information consult the graphql schema.
#11655: Includes the current epoch for validator APY calculation in consistency with the JSON-RPC API.
#11595: ⚠️ Removed TransactionBlockFilter.signAddress in favor of TransactionBlockFilter.sentAddress which behaves identically. Similarly AddressTransactionBlockRelationship.SIGN is removed in favor of AddressTransactionBlockRelationship.SENT.
CLI
#11684: Enable the creation of MoveAuthenticators for accounts where the authenticator function requires no additional args.
Rust SDK
#11633: iota_types::effects::TransactionEvents is now a re-export of
iota_sdk_types::events::TransactionEvents. The type is now a tuple struct
TransactionEvents(Vec<Event>) rather than a struct with a public data
field, so call sites that accessed events.data need to switch to
events.0, and constructors switch from
TransactionEvents { data: vec![..] } to TransactionEvents(vec![..]).
The BCS wire format is unchanged.
#11556: iota_types::transfer::Receiving::{struct_tag, type_tag} now take a TypeTag argument (the value's inner type). The dead MoveTypeTagTrait for Config impl is removed.
#11505: iota-types::multisig::MultiSig and MultiSigPublicKey are now re-exports of iota_sdk_types::crypto::MultisigAggregatedSignature and MultisigCommittee. Constructors and accessors changed: use MultiSigPublicKey::new(members: Vec<MultisigMember>, threshold) (instead of separate pks and weights vectors), MultiSig::new(...) (instead of MultiSig::combine(...)), and committee().members() / signatures() / get_indices() instead of pk_map / get_sigs() / get_pk().