v6.2.0 (2026-10-19)
⚠️ Breaking Changes
This release changes on-disk database behaviour, and wallet export behaviour. Review before upgrading:
What's Changed
Features
- feat(mempool): add bans for gossip transactions in #8127
- feat(offline-signing): render payload summaries before signing and show recipient output features in #8130
- feat(base_node): use mimalloc as the global allocator in #8111
- feat(jellyfish): make the JMT hash scheme an explicit parameter in #8096
- feat(jellyfish): native minicbor encoding, inline NibblePath and bitmap InternalNode children in #8101
Bug Fixes
- fix(cli): merge duplicate test modules in common_cli_args in #8121
- fix(cli): parse key-value overrides using split_once to preserve values with equals and whitespace in #8114
- fix(cli): use resolved network when computing common.base_path in #8113
- fix(common): replace serde_yaml with serde-saphyr to drop unsafe-libyaml in #8116
- fix(comms): admit liveness by token, bound inbound handshakes and cap inbound connections in #8119
- fix(comms): bound messaging queues, fair inbound delivery, yamux window cap in #8125
- fix(comms): lossless peer DB addresses, row cap and GC, direction-aware reaper, persisted bans in #8124
- fix(comms): stop culled and idle RPC sessions promptly and bound internal channel sends in #8118
- fix: harden validation in #8132
- fix(identity): prevent secret key leakage from malformed identity errors in #8115
- fix(sidechain): weigh quorum certificates by signer voting power in #8128
- fix(validation): require the canonical script on side-chain claimable burns in #8126
- fix(wallet): derive imported transaction details from recovered output data in #8133
- fix(wallet): reject coin_split_even when fee exceeds total input value in #8112
- fix(common_sqlite): owner-only database files, WAL set in create_pool, per-database profiles in #8107
- fix(comms/dht): bound per-peer flood-ban metrics and drop stale entries in #8110
- fix(comms): bound memory held for stalled yamux peers, RPC/sync streams and gRPC GetBlocks in #8108
- fix(key_manager): low-impact hardening from the key manager security analysis in #8106
- fix(ledger): sign device sender-offset keys only through the reviewed metadata instruction in #8104
- fix(node): enable HTTP/2 and TCP keepalives on the base node gRPC server in #8109
- fix: bound protobuf decode on every peer-reachable path in #8095
- fix(jellyfish): reject non-monotonic versions in batch_put_value_set in #8092
- fix(jellyfish): remove public-API panics, bound traversal, check store integrity in #8094
- fix(key_manager): refuse degenerate nonces in #8103
- fix(ledger): keep alpha out of reach of the legacy host-indexed nonce instruction in #8098
- fix: refuse root-bearing key ids as commitment masks and in offline signing payloads in #8099
- fix: refuse to sign offline transactions that leave no change output in #8093
- fix(wallet): remove private-key UTXO export, which leaked the spend key in #8102
Full Changelog: v6.1.0...v6.2.0