crates.io: https://crates.io/crates/solana-keychain/2.0.0
Highlights
2.0.0 is a breaking release, and the first stable release of the Python and Go implementations.
- Audited. OtterSec audited the Rust, TypeScript, Python and Go implementations; all 27 findings are resolved. See the audit report and audit status.
- v1 transactions (SIMD-0385) sign correctly across all backends and languages. Rust needs the
sdk-v4feature; Go needs solana-go v2. - Capability is in the type.
SolanaSignerkeeps identity, message signing and health. Each backend implements exactly one transaction capability: sign, rewrite-and-sign, or sign-and-send. - Managed broadcast. Backends that broadcast on the provider side (Crossmint, Fordefi native auto) report honestly: a failure that may have landed is
BROADCAST_UNCONFIRMED, carrying the idempotency key and any provider transaction id. Crossmint is now sending-only. - Fordefi, the 14th backend, in all four languages, with three modes fixed at construction: black box, native auto, native manual.
- Python and Go at parity with Rust and TypeScript. Go module paths now end in
/v2. - Ledger hardware-wallet signer (Rust only, opt-in
ledgerfeature). Not covered by the audit.
Upgrading from 1.x: see the migration guide and the security model.
What's Changed
- chore(deps): bump actions/cache from 5 to 6.1.0 in the actions group by @dependabot[bot] in #176
- chore(deps): bump js-yaml from 3.14.2 to 3.15.0 in /typescript by @dependabot[bot] in #174
- chore(deps): bump cmov from 0.5.3 to 0.5.4 in /rust by @dependabot[bot] in #182
- fix(rust): make tokio optional so the memory signer builds on wasm32 by @lgalabru in #180
- chore(deps): bump ed25519-dalek from 2.2.0 to 3.0.0 in /rust by @dependabot[bot] in #183
- chore(deps): bump the npm-non-major group across 1 directory with 8 updates by @dependabot[bot] in #184
- chore(deps-dev): bump @types/node from 25.9.1 to 26.0.1 in /typescript by @dependabot[bot] in #178
- ci: switch dependabot to biweekly patch-only updates by @dev-jodee in #194
- Bump the "all-deps" group with 3 updates across multiple ecosystems by @dependabot[bot] in #195
- fix(ci): restore pnpm vulnerability audit by @dev-jodee in #198
- chore(ts): bump @solana/kit to v7 by @amilz in #200
- Bump the "all-deps" group with 3 updates across multiple ecosystems by @dependabot[bot] in #199
- Bump the "all-deps" group with 3 updates across multiple ecosystems by @dependabot[bot] in #204
- build(deps): bump rand in /rust by @dependabot[bot] in #206
- build(deps): bump serde_with from 3.17.0 to 3.21.0 in /rust by @dependabot[bot] in #207
- feat(python): Python implementation foundation — core + memory backend by @dev-jodee in #205
- Bump the "all-deps" group with 2 updates across multiple ecosystems by @dependabot[bot] in #209
- feat(python): remote signer core + Vault backend by @dev-jodee in #208
- feat(python): AWS KMS signer backend by @dev-jodee in #210
- feat(python): GCP KMS signer backend by @dev-jodee in #211
- feat(python): Turnkey signer backend by @dev-jodee in #213
- feat(python): Privy signer backend by @dev-jodee in #214
- feat(python): Para signer backend by @dev-jodee in #215
- feat(python): Fireblocks signer backend by @dev-jodee in #216
- feat(python): CDP signer backend by @dev-jodee in #217
- feat(python): Dfns signer backend by @dev-jodee in #218
- feat(python): Crossmint signer backend by @dev-jodee in #219
- feat(python): Openfort signer backend by @dev-jodee in #220
- feat(python): Utila signer backend by @dev-jodee in #221
- feat(python): keychain umbrella factory and integration test suite by @dev-jodee in #222
- test(python): drop tests that cannot fail, tighten the rest by @dev-jodee in #223
- chore(python): add publish workflow, dependency audit, changelog and docs by @dev-jodee in #224
- [Fordefi] Add Rust and TypeScript signer integrations by @hvbr1s in #202
- ci: wire fordefi into fork external live tests by @dev-jodee in #226
- feat(python): add Fordefi signer backend by @dev-jodee in #227
- feat(go): remote signer backends to thirteen-backend parity (stacked on #164) by @amilz in #179
- ci: wire python and go into fork external live tests by @dev-jodee in #228
- feat(go): add Fordefi signer backend by @dev-jodee in #229
- Use rustls in Openfort client by @n00m4d in #234
- fix(utila): keep access token cache writable on frozen signer instances by @dev-jodee in #235
- ci: run Go Fordefi live tests in the fork external-live workflow by @dev-jodee in #236
- fix(python): reject unsupported message versions in remote transaction checks by @dev-jodee in #243
- test(fordefi): read pem content from env and self-transfer on devnet by @dev-jodee in #242
- build(python): lock dependencies with a universal requirements.txt by @dev-jodee in #244
- Bump the "all-deps" group with 4 updates across multiple ecosystems by @dependabot[bot] in #246
- fix(turnkey): reject signatures from non-completed activities by @dev-jodee in #240
- fix(rust): refuse redirects and centralize the signer HTTP client builder by @dev-jodee in #249
- fix(memory): reject a CryptoKeyPair whose public key does not match its private key by @dev-jodee in #248
- fix(turnkey): sign transactions via the policy-aware sign_transaction activity by @dev-jodee in #250
- fix(privy): sign transactions via the policy-aware signTransaction RPC by @dev-jodee in #251
- fix(fireblocks): select the vault address by asset instead of taking the first by @dev-jodee in #252
- feat(signers)!: broadcast-managed signer capability and v1 transaction support by @dev-jodee in #269
- chore(skills): replace add-signer skill with add-signer-ci by @dev-jodee in #272
- refactor(rust)!: crate-wide cleanup with shared helpers and contract normalization by @dev-jodee in #273
- feat(ts)!: add abort support and signAndSend helper, drop deprecated classes by @amilz in #270
- refactor(go)!: share helpers and normalize backend contracts by @dev-jodee in #275
- refactor(python)!: package-wide cleanup with shared helpers and contract normalization by @dev-jodee in #274
- chore(ts): v2 branch cleanup by @amilz in #277
- build(go)!: move the Go modules to /v2 and add a publish workflow by @dev-jodee in #278
- feat(signers): sign-and-send parity for Rust, Python and Go by @dev-jodee in #276
- refactor!: adopt trusted-provider model and consolidate response handling by @dev-jodee in #281
- refactor(crossmint)!: make Crossmint a sending-only signer by @dev-jodee in #284
- docs: add a security model, tighten signer requirements, trim CLAUDE.md by @dev-jodee in #285
- refactor(traits)!: split SolanaSigner into capability traits by @dev-jodee in #287
- docs: add a contributing guide, trim CLAUDE.md, fix the release skills by @dev-jodee in #294
- feat(fordefi)!: native manual push mode for Rust by @dev-jodee in #279
- chore: release v2.0.0-beta.1 across Rust, TypeScript, Python and Go by @dev-jodee in #286
- docs: add 1.x to 2.0 migration guide for Rust and TypeScript by @dev-jodee in #295
- docs(rust): drop comments that restate the code by @dev-jodee in #296
- style(rust): apply cargo fmt to gcp_kms availability check by @dev-jodee in #298
- docs: streamline release guidance and remove stale migration docs by @amilz in #297
- fixes: security & audit finding fixes by @dev-jodee in #299
- style: remove redundant comments from typescript, python and go by @dev-jodee in #300
- ci: pin github actions to commit shas by @dev-jodee in #303
- Bump the "all-deps" group with 3 updates across multiple ecosystems by @dependabot[bot] in #302
- build(deps): bump google.golang.org/grpc from 1.81.1 to 1.83.1 in /go/signers/gcpkms in the go_modules group across 1 directory by @dependabot[bot] in #304
- ci: gate PRs on AI disclosure and flag unreviewed AI attribution by @dev-jodee in #308
- ci: cache rust builds and shrink dev debug info by @dev-jodee in #309
- ci: resolve the fork live-test head SHA in its own job by @dev-jodee in #311
- build: drop aws-lc-rs and prune unused dependencies by @dev-jodee in #310
- feat(ledger): add Ledger hardware-wallet signer backend by @ledgicr in #301
- Bump the "all-deps" group with 4 updates across multiple ecosystems by @dependabot[bot] in #312
- fix(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285 by @dev-jodee in #313
- fix(security): close code scanning and dependabot alerts by @dev-jodee in #316
- ci: gate pull requests on an accepted issue and signed commits by @dev-jodee in #318
- fix: improvements & hardening pre-release by @dev-jodee in #314
- ci: accept full issue URLs in the linked-issue check by @dev-jodee in #322
- fix(fireblocks): report sign-only PROGRAM_CALL failures as plain errors by @dev-jodee in #323
- fix(ts): don't report BROADCAST_UNCONFIRMED when aborted before the create (DEV-1165) by @amilz in #324
- docs: add OtterSec audit report and update audit status by @dev-jodee in #326
- chore: release v2.0.0 by @dev-jodee in #327
- docs: list unaudited backends in audit status by @dev-jodee in #328
- docs: refresh READMEs and guides for 2.0.0 by @dev-jodee in #331
New Contributors
Full Changelog: v1.4.0...v2.0.0