Protocol
This release introduces protocol version 38
On alphanet, this protocol version can be enabled no earlier than 2026-10-10 01:04 UTC (start of epoch 197). Please ensure that you update your validators before this epoch change. Otherwise, if the upgrade threshold is reached, the protocol will remove you from the committee, and both you and your delegators will lose rewards.
#12913: System Move packages are bound by the new max_move_system_package_size (200 KiB) rather than the limit that applies to user packages.
#13062: new protocol feature flag - iota::account::create_immutable_account_v1 aborts immutable account creation.
#13125: A transaction whose PTB uses an out-of-bounds input index, or a result index that points at its own or a later command, is now rejected at signing instead of failing at execution and being charged gas.
Nodes (Validators and Full nodes)
#13049: admission.max_commit_fetches_total no longer caps a peer's first concurrent commit fetch, only its further ones, so a node may serve up to max_commit_fetches_total plus one commit fetch per peer at once; the new counter inbound_admission_reclaimed counts responses given up because the peer stopped reading them.
#12853: Full nodes that publish formal state snapshots now scan the running database instead of a db_checkpoints copy. An epoch whose snapshot fails is no longer retried, and an epoch reached while the previous snapshot is still being written is skipped; alert on first_missing_state_snapshot_epoch and epoch_end_db_snapshots_skipped.
#12977: On the first start after the upgrade, nodes delete the db_checkpoints directory that earlier releases wrote for state snapshots, freeing the disk it used.
#13104: new connection metrics of the JSON-RPC (json_rpc_*) and validator gRPC (authority_grpc_*) listeners: accepted connections, open connections and their peak, connection lifetime, and on the validator listener the TLS handshake time and result and the peak of pending handshakes. The authority_grpc_* metrics are shown by default; the json_rpc_* metrics are hidden and shown with metrics.groups.overrides: {iota_http: info}.
#13105: new hidden metrics of the gRPC API response sizes, node_grpc_response_message_bytes{method}, node_grpc_response_item_bytes_peak{kind} and node_grpc_requested_max_message_bytes (enable with metrics.groups.overrides: {iota_grpc_server: info}).
Indexer
#13026: analytical-worker now shuts down on CTRL+C or SIGTERM signals.
#13013: the analytical worker now makes progress on a database restored from a snapshot or pruned past its cursor, resuming from the first available checkpoint. Cumulative address metrics on such a database count addresses seen from that point on.
JSON-RPC
#12926: a system package larger than the user package size limit can be converted back into an Object again.
#13058: ⚠️iota-json-rpc-types conversions from SDK enums (IotaArgument, IotaCommand, IotaExecutionStatus, IotaTransactionKind, IotaTransactionBlockEffectsV1, schema types and from_native_with_clever_error) are now TryFrom / return Result instead of an infallible From implementation, and return an error instead of panicking on unknown variants. ⚠️
CLI
#12926: iota move build reports a system package against the system package size limit instead of the user one.
#12913: iota move build reports a system package against the system package size limit instead of the user one.
#13083: iota move build keeps #[view] functions by default when no network is resolved; pass --allow-view-function false to drop them.
Rust SDK
#12926: building a transaction that calls into a system package no longer fails once that package exceeds the user package size limit.