Protocol
This release introduces protocol version 37
On alphanet, this protocol version can be enabled no earlier than 2026-09-25 13:03 UTC (start of epoch 168). Please ensure that you update your validators before this epoch change. Otherwise, if the upgrade threshold is reached, the protocol will remove you from the committee, and both you and your delegators will lose rewards.
#12879: Protocol version 37 enables validate_input_object_versions on all chains. The validity check rejects a transaction that names an object version at or above Version::MAX_VALID_EXCL, the range assigned to canceled transactions, or one below it, before any object is loaded.
#12751: version 36 rejects <SELF> as an identifier in published modules and makes the enum variant count limit explicit.
#12949: The package deny list also covers the package holding a Move authenticator's authenticate function, and that package's dependencies.
#12980: Reject a published module whose binary format version header is not the canonical encoding of its version.
#13014: a transaction whose sender or sponsor is authenticated by a Move authenticator with an immutable account object is rejected.
#12993: Enable disallow_randomness_in_move_authenticator on all chains, such that a MoveAuthenticator that names the randomness state object among its inputs is rejected from the transaction bytes alone.
#13027: Reject a published package whose module dependency graph contains a cycle.
#12981: A transaction publishing a package that uses the deprecated global storage instructions is no longer rejected at signing as a verifier timeout; it is executed and fails with IotaMoveVerificationError.
Nodes (Validators and Full nodes)
#12879: A transaction naming such a version is now rejected with InvalidSequenceNumber at submission and dropped by post-consensus validation instead of failing at the object load with ObjectNotFound.
#12937: Fixed validators rejecting valid certificates signed by a multisig with a passkey member when an invalid certificate was verified in the same batch.
#12955: the admin API /traffic-control also accepts connection_blocklist_ttl_sec and proxy_blocklist_ttl_sec, so operators can change the blocklist TTLs at runtime.
#12943: Validators no longer persist consensus quarantine state for a partially executed group of checkpoints built from one commit range, which could crash-loop a catching-up validator or leave it unable to rebuild checkpoints after a restart.
#12953: the validator gRPC listener now requires TLS; plaintext connections are refused, so clients older than v1.21 can no longer connect to validators. The listener allows up to 4096 concurrent TLS handshakes and closes HTTP/1 peers that do not complete their request headers within 30 s.
#12928: consensus_{inbound,outbound}_response_size now records one sample per gRPC message and consensus_*_excessive_size_responses can fire; consensus_*_request_size and consensus_*_excessive_size_requests are removed, so dashboards summing consensus_*_request_size_sum into bandwidth must drop that term; consensus_*_errors gains the truncated label; the consensus tonic parameter max_inbound_message_size is renamed max_request_message_size (the old key is still accepted).
#12949: Protocol version 36 - a package listed in a validator's transaction-deny-config also stops that validator signing for abstract accounts that authenticate through the package.
#12940: max_headers_per_bundle and max_shards_per_bundle above 1024 are now rejected at startup.
#12998: A simulated transaction (dry run, dev inspect, gRPC simulate and view calls) is now rejected with a user error when it is above max_tx_size_bytes, the same limit a submitted transaction has.
#12965: the consensus listener now allows at most 4 connections per committee peer, and exports inbound_connections and inbound_connections_refused per peer
#13002: Fixed checkpoint pruning deleting the contents shared by all empty checkpoints, which could stop pruning.
#12939: dropped_far_future_headers_total gains a peer label naming the validator that sent the dropped headers or blocks
#12946: max_headers_per_header_sync_fetch above 1024 is now rejected at startup.
#12966: Removed the enable-compaction-filter pruning config; object pruning always uses range deletes. A pruner database left over from the compaction filter is drained and deleted on the first start after the upgrade. Configs that still set the key keep working; the key is ignored.
#12950: a fast commit-sync response now carries at most max_fast_commit_sync_transaction_bytes (64 MiB) of transaction entries and covers the commits that fit; concurrent commit fetches are capped across all peers by the new admission.max_commit_fetches_total (16); inbound_admission_rejected gains a limit label (peer or all_peers) naming the cap that was reached.
#13015: checkpoint contents received over state sync are rejected unless each transaction carries the signatures the checkpoint pinned.
#12975: a client can no longer escape rate limiting with a malformed x-forwarded-for header, an allowlist now refuses a request whose client IP the node cannot resolve, and the new traffic_control_unresolved_client_requests counter reports how many such requests arrive.
#12952: the validator gRPC listener now enforces a 300 s server-side request deadline, a 60 s HTTP/2 keepalive, and a limit of 1000 concurrent streams per connection; TCP_NODELAY is always enabled on accepted connections.
Indexer
#12855: ⚠️ Drops the global_sequence_number column from the optimistic_transactions table in favor of optimistic_sequence_number. ⚠️
#12852: Added a first_optimistic_sequence_number column to the epochs table (backfilled by migration). optimistic_transactions is now pruned by optimistic_sequence_number, and the migration resets its watermarks row to match.
#12918: 🪛 Sanitize move-function filters in JSON-RPC payloads.
#12924: run-backfill now accepts a historical checkpoint store via --remote-store-url and a live checkpoint store via --live-checkpoints-store-url, instead of treating every URL as a fullnode gRPC endpoint.
#12942: rejects iota_tryMultiGetPastObjects, iotax_getStakesByIds and iotax_getTimelockedStakesByIds requests with more than QUERY_MAX_RESULT_LIMIT entries, matching the other multi-get methods.
#12973: Postgres errors are logged server-side with full detail and no longer carry a message.
#12998: dryRunTransactionBlock, devInspectTransactionBlock and viewFunctionCall now return a user error for a transaction above max_tx_size_bytes.
JSON-RPC
#12744: transaction execution errors now include a machine-readable data.reason field, and validator rejections are distinguishable from locally proven invalid transactions; ObjectsDoubleUsed keeps its existing conflicting-transactions data payload.
#12745: overload errors on the P-COOL submission path carry data.retry_after_secs.
#12973: Indexer database failures return a fixed message instead of the underlying Postgres error text. Unknown transaction cursors and missing packages return a not-found message. Error codes are unchanged.
#12998: dryRunTransactionBlock and devInspectTransactionBlock reject a transaction above max_tx_size_bytes with a user error.
GraphQL
#12880: An objectKeys filter can now return multiple versions of the same object; object cursors changed format, so cursors issued before the upgrade are invalid.
#12927: Sanitize cursor field arithmetics.
#12973: Database failures in queries and subscriptions return a fixed message instead of the underlying Postgres error text.
#12998: dryRunTransactionBlock now returns a user error for a transaction above max_tx_size_bytes.
#12982: dryRunTransactionBlock now returns balanceChanges, object state in objectChanges, suggestedGasPrice, and bcsUnsigned, matching iota_dryRunTransactionBlock in JSON-RPC
CLI
#13007: iota client ptb reports an unreachable gRPC endpoint as a single error naming the env and URL.
#12981: Modules that use the deprecated global storage instructions are now rejected when deserialized, for example by iota client verify-bytecode-meter --module-path.
Rust SDK
#12994: the iota-rust-sdk crate's txn-builder feature is renamed to transaction-builder.
gRPC
#12744: invalid-transaction errors now carry google.rpc.ErrorInfo, distinguishing locally proven invalid transactions from validator rejections.
#12745: RetryInfo retry hints are populated again on the P-COOL submission path during overload.
#12998: SimulateTransactions and ViewFunctionCalls reject a transaction above max_tx_size_bytes with a per-item InvalidArgument error.