v0.16.0

Release v0.16.0

Breaking Changes

• Protocol: Updated miden-protocol dependencies to use the next branch (v0.16). Block and transaction account updates now use the absolute AccountPatch representation instead of the relative AccountDelta, and the miden-tx-batch-prover crate was renamed to miden-tx-batch. The per-transaction fee was also removed following its removal from the protocol transaction kernel (0xMiden/protocol#3108), so the fee field was dropped from the TransactionHeader gRPC message and from the store and validator transaction tables, and ProvenTransaction and TransactionId construction no longer take a fee. (#2282)
• Protocol: Upgraded miden-vm to v0.24 (#2320)
• Protocol: Upgraded miden-crypto to v0.27 (#2320)
• Node: Rocksdb large SMT on disk layout changed (#2320)
• Validator: Renamed the validator signing key options: --key.hex / MIDEN_VALIDATOR_KEY is now --signing-key.hex / MIDEN_VALIDATOR_SIGNING_KEY, and --key.kms-id / MIDEN_VALIDATOR_KEY_KMS_ID is now --signing-key.kms-id / MIDEN_VALIDATOR_SIGNING_KEY_KMS_ID. (#2342)
• Node: Added multiple Validator genesis bootstrap and tx/block validation (#2323)
• Protocol: Transaction submissions now carry sealed private inputs instead of plaintext inputs. (#2389)
• RPC: Transaction submission rejects missing or unsealed private inputs. (#2389)
• RPC: Changed NoteSyncRecord metadata to return raw values for single-word attachments and commitments for larger attachments, allowing clients to inspect compact attachments without an additional GetNotesById request. (#2423)
• Node: Updates recover command to involve all validators. (#2432)
• Validator: Native faucet changed to a network account controlled by a separate operator account (#2454)
• Validator: The genesis validator set is now passed to miden-validator genesis via repeatable --validator.key flags instead of the validators list in the genesis configuration file; configuration files containing validators are rejected. (#2484)
• RPC: Storage map proofs for multiple keys in AccountResponse are now represented as a batched PartialSmt. (#2439)
• RPC: Transactions which don't pay fees are rejected when fees are enabled (#2547)
• General: Bumped MSRV to 1.98.1 to avoid a miscompilation bug on 1.98.0 (#2560)

Migrations

• NTX Builder: NTX builder data must be bootstrapped again to store trusted validator keys from genesis. (#2389)
• Validator: Existing validator databases must be set up again for the new validated transaction record. (#2390)
• Validator: Validator databases must apply the private record migration before Golden storage is enabled. (#2393)
• NTX Builder: Adds sponsorship notes tracking and storing. (#2494)

Changes by Scope

General

• Breaking: Minimum Rust Version is now 1.96 (#2320)
• Breaking: Increased MSRV to 1.98 (#2553)
• Breaking: Bumped MSRV to 1.98.1 to avoid a miscompilation bug on 1.98.0 (#2560)
• Added: User visible log events have been added for startup and shutdown to all services. (#2359)
• Added: docker compose file for local development network is now published (#2387)
• Added: Local dev network now bundles the block explorer (#2398)
• Added: Official faucet is now deployed as part of the local dev network (#2400)
• Added: Local dev network now supports DNS e.g. http://rpc.localhost (#2401)
• Added: Local dev network now supports the note transaction layer (#2402)
• Added: User-visible warnings for unreachable external service endpoints have been added, making potential mis-configuration easier to spot. (#2360)
• Added: Enriched traces with service.version (#2498)
• Changed: Node submitters verify encryption keys against trusted validator signing keys. (#2389)
• Changed: Bump miden protocol dependencies to 0.16.0-rc.6. (#2526)
• Fixed: Account, note, storage and mempool lifecycle events are now logged on stdout. (#2358)
• Fixed: Protobuf Rust bindings now compile on Windows (#2506)

Protocol

• Breaking: Updated miden-protocol dependencies to use the next branch (v0.16). Block and transaction account updates now use the absolute AccountPatch representation instead of the relative AccountDelta, and the miden-tx-batch-prover crate was renamed to miden-tx-batch. The per-transaction fee was also removed following its removal from the protocol transaction kernel (0xMiden/protocol#3108), so the fee field was dropped from the TransactionHeader gRPC message and from the store and validator transaction tables, and ProvenTransaction and TransactionId construction no longer take a fee. (#2282)
• Breaking: Upgraded miden-vm to v0.24 (#2320)
• Breaking: Upgraded miden-crypto to v0.27 (#2320)
• Breaking: Transaction submissions now carry sealed private inputs instead of plaintext inputs. (#2389)
• Changed: Upgraded protocol crates to 0.16.0-alpha.1 (#2334)
• Changed: Upgraded miden-crypto to 0.28 (#2334)
• Changed: Upgrade to 0.16.0-alpha.2 (#2337)
• Changed: Upgraded to 0.16.0-rc.2 (#2421)
• Changed: Upgraded to 0.16.0-rc.3 and prepared release (#2448)
• Changed: Upgraded to 0.16.0-rc.4 and prepared release (#2472)
• Changed: Bumped to 0.16.0-rc.9 (#2553)

RPC

• Breaking: Transaction submission rejects missing or unsealed private inputs. (#2389)
• Breaking: Changed NoteSyncRecord metadata to return raw values for single-word attachments and commitments for larger attachments, allowing clients to inspect compact attachments without an additional GetNotesById request. (#2423)
• Breaking: Storage map proofs for multiple keys in AccountResponse are now represented as a batched PartialSmt. (#2439)
• Breaking: Transactions which don't pay fees are rejected when fees are enabled (#2547)
• Added: Added the GetTransactionEncryptionKey endpoint, returning the shared transaction encryption public key attested by a validator's signing key. (#2342)
• Added: Started logging gRPC request and response sizes (#2447)
• Changed: GetTransactionEncryptionKey responses are forwarded without a relay cache. (#2389)
• Fixed: Tokio worker threads no longer panic when connections reach maximum age. (#2350)
• Fixed: Transaction submission no longer records private request bodies in logs or traces. (#2389)
• Fixed: Subscription clients now receive terminal gRPC statuses when the stream buffer is full. (#2425)
• Removed: Removed node-level RPC rate limits (per-IP and max concurrent connections) and the max-connection-age closure, along with their CLI flags; rate limiting should be imposed at the load-balancer layer (see the operator guide). (#2493)

Node

• Breaking: Rocksdb large SMT on disk layout changed (#2320)
• Breaking: Added multiple Validator genesis bootstrap and tx/block validation (#2323)
• Breaking: Updates recover command to involve all validators. (#2432)
• Added: Mempool now tracks uncommitted transaction count (#2496)
• Changed: Applying blocks with changes to accounts having large storage maps is now significantly faster. (#2341)
• Changed: Store reads are lock-free: readers use atomically published in-memory snapshots and are no longer blocked while blocks are applied. (#2345)
• Changed: Add open_tree_storage and open_forest_storage spans for observing startup times. (#2465)
• Changed: Docker runtime images now run as a non-root miden user (uid 10001). (#2495)
• Changed: Improved node startup time by loading and verifying Merkle tree structures in parallel. (#2466)
• Fixed: History pruning no longer deletes account state rows still required to reconstruct historical vault, storage-map, or code state within the retention window. (#2438)
• Fixed: Mempool now correctly includes transactions in uncommitted batches in its capacity check (#2496)
• Fixed: Mempool chain tip no longer includes the pending block (#2496)
• Fixed: Mempool no longer includes recently committed blocks in its stats (#2496)
• Fixed: Pre-fund the generated native faucet operator with 1,000 MIDEN at genesis so it can pay transaction fees. (#2523)
• Fixed: Respect user batch's reference block instead of always using the chain tip (#2549)
• Fixed: Pre-fund the generated native faucet's own vault at genesis so its mint network transactions can pay fees. (#2526)

Prover

• Removed: Removed the miden-remote-prover-client crate (#2315)

NTX Builder

• Migration: NTX builder data must be bootstrapped again to store trusted validator keys from genesis. (#2389)
• Migration: Adds sponsorship notes tracking and storing. (#2494)
• Added: Network transactions now set an on-chain expiration delta (default 30 blocks, configurable via --tx-expiration-delta) using the canonical miden-standards expiration transaction script. Serviced network accounts must allowlist the script's root (ExpirationTransactionScript::script_root()) via AuthNetworkAccount::with_allowed_tx_scripts, or their network transactions will be rejected. (#2321)
• Added: Network transactions now bundle each feature note with the FEE_SPONSORSHIP notes that pay its fee, so a network note whose fee a sponsor covers is executed rather than left pending. (#2514)
• Added: RPC request timeout is now configurable via --rpc.timeout (#2537)
• Added: Transaction prover request timeout is now configurable via --tx-prover.timeout (#2537)
• Added: gRPC server timeout is now configurable via --grpc.timeout (#2537)
• Changed: Drive account actors from a per-account watch instead of a dataless Notify, eliminating per-block DB polling for landing checks and...

v0.16.0-rc.5

Release v0.16.0-rc.5

Breaking Changes

• General: Increased MSRV to 1.98 (#2553)

Changes by Scope

General

• Breaking: Increased MSRV to 1.98 (#2553)

Protocol

• Changed: Bumped to 0.16.0-rc.9 (#2553)

v0.16.0-rc.4

Release v0.16.0-rc.4

Breaking Changes

• RPC: Transactions which don't pay fees are rejected when fees are enabled (#2547)

Changes by Scope

RPC

• Breaking: Transactions which don't pay fees are rejected when fees are enabled (#2547)

Node

• Fixed: Respect user batch's reference block instead of always using the chain tip (#2549)

NTX Builder

• Added: RPC request timeout is now configurable via --rpc.timeout (#2537)
• Added: Transaction prover request timeout is now configurable via --tx-prover.timeout (#2537)
• Added: gRPC server timeout is now configurable via --grpc.timeout (#2537)

Network Monitor

• Added: Show note transport version, total notes and total tags on the status dashboard. (#2521)

v0.16.0-rc.3

Release v0.16.0-rc.3

Changes by Scope

Node

• Fixed: Pre-fund the generated native faucet operator with 1,000 MIDEN at genesis so it can pay transaction fees. (#2523)

v0.16.0-rc.2

Release v0.16.0-rc.2

Breaking Changes

• Validator: The genesis validator set is now passed to miden-validator genesis via repeatable --validator.key flags instead of the validators list in the genesis configuration file; configuration files containing validators are rejected. (#2484)
• RPC: Storage map proofs for multiple keys in AccountResponse are now represented as a batched PartialSmt. (#2439)

Migrations

• NTX Builder: Adds sponsorship notes tracking and storing. (#2494)

Changes by Scope

General

• Added: Enriched traces with service.version (#2498)
• Fixed: Protobuf Rust bindings now compile on Windows (#2506)

RPC

• Breaking: Storage map proofs for multiple keys in AccountResponse are now represented as a batched PartialSmt. (#2439)
• Removed: Removed node-level RPC rate limits (per-IP and max concurrent connections) and the max-connection-age closure, along with their CLI flags; rate limiting should be imposed at the load-balancer layer (see the operator guide). (#2493)

Node

• Added: Mempool now tracks uncommitted transaction count (#2496)
• Changed: Add open_tree_storage and open_forest_storage spans for observing startup times. (#2465)
• Changed: Docker runtime images now run as a non-root miden user (uid 10001). (#2495)
• Changed: Improved node startup time by loading and verifying Merkle tree structures in parallel. (#2466)
• Fixed: Mempool now correctly includes transactions in uncommitted batches in its capacity check (#2496)
• Fixed: Mempool chain tip no longer includes the pending block (#2496)
• Fixed: Mempool no longer includes recently committed blocks in its stats (#2496)

NTX Builder

• Migration: Adds sponsorship notes tracking and storing. (#2494)
• Added: Network transactions now bundle each feature note with the FEE_SPONSORSHIP notes that pay its fee, so a network note whose fee a sponsor covers is executed rather than left pending. (#2514)

Validator

• Breaking: The genesis validator set is now passed to miden-validator genesis via repeatable --validator.key flags instead of the validators list in the genesis configuration file; configuration files containing validators are rejected. (#2484)
• Added: decode and acquire_validation_permit spans on the validator's sign-block and transaction submission paths. (#2487)

Network Monitor

• Added: Mempool now tracks uncommitted transaction count (#2496)

v0.16.0-rc.1

Release v0.16.0-rc.1

Breaking Changes

• RPC: Changed NoteSyncRecord metadata to return raw values for single-word attachments and commitments for larger attachments, allowing clients to inspect compact attachments without an additional GetNotesById request. (#2423)
• Node: Updates recover command to involve all validators. (#2432)
• Validator: Native faucet changed to a network account controlled by a separate operator account (#2454)

Changes by Scope

General

• Added: User-visible warnings for unreachable external service endpoints have been added, making potential mis-configuration easier to spot. (#2360)

Protocol

• Changed: Upgraded to 0.16.0-rc.2 (#2421)
• Changed: Upgraded to 0.16.0-rc.3 and prepared release (#2448)
• Changed: Upgraded to 0.16.0-rc.4 and prepared release (#2472)

RPC

• Breaking: Changed NoteSyncRecord metadata to return raw values for single-word attachments and commitments for larger attachments, allowing clients to inspect compact attachments without an additional GetNotesById request. (#2423)
• Added: Started logging gRPC request and response sizes (#2447)
• Fixed: Subscription clients now receive terminal gRPC statuses when the stream buffer is full. (#2425)

Node

• Breaking: Updates recover command to involve all validators. (#2432)
• Changed: Store reads are lock-free: readers use atomically published in-memory snapshots and are no longer blocked while blocks are applied. (#2345)
• Fixed: History pruning no longer deletes account state rows still required to reconstruct historical vault, storage-map, or code state within the retention window. (#2438)

Validator

• Breaking: Native faucet changed to a network account controlled by a separate operator account (#2454)
• Added: Adds a genesis-bound DKG ceremony for validator storage keys. (#2433)
• Changed: Upgraded to golden-dkg 0.3.0 (#2475)

v0.16.0-alpha.3

Release v0.16.0-alpha.3

Breaking Changes

• Validator: Renamed the validator signing key options: --key.hex / MIDEN_VALIDATOR_KEY is now --signing-key.hex / MIDEN_VALIDATOR_SIGNING_KEY, and --key.kms-id / MIDEN_VALIDATOR_KEY_KMS_ID is now --signing-key.kms-id / MIDEN_VALIDATOR_SIGNING_KEY_KMS_ID. (#2342)
• Node: Added multiple Validator genesis bootstrap and tx/block validation (#2323)
• Protocol: Transaction submissions now carry sealed private inputs instead of plaintext inputs. (#2389)
• RPC: Transaction submission rejects missing or unsealed private inputs. (#2389)

Migrations

• NTX Builder: NTX builder data must be bootstrapped again to store trusted validator keys from genesis. (#2389)
• Validator: Existing validator databases must be set up again for the new validated transaction record. (#2390)
• Validator: Validator databases must apply the private record migration before Golden storage is enabled. (#2393)

Changes by Scope

General

• Added: User visible log events have been added for startup and shutdown to all services. (#2359)
• Added: docker compose file for local development network is now published (#2387)
• Added: Local dev network now bundles the block explorer (#2398)
• Added: Official faucet is now deployed as part of the local dev network (#2400)
• Added: Local dev network now supports DNS e.g. http://rpc.localhost (#2401)
• Added: Local dev network now supports the note transaction layer (#2402)
• Changed: Node submitters verify encryption keys against trusted validator signing keys. (#2389)
• Fixed: Account, note, storage and mempool lifecycle events are now logged on stdout. (#2358)

Protocol

• Breaking: Transaction submissions now carry sealed private inputs instead of plaintext inputs. (#2389)

RPC

• Breaking: Transaction submission rejects missing or unsealed private inputs. (#2389)
• Added: Added the GetTransactionEncryptionKey endpoint, returning the shared transaction encryption public key attested by a validator's signing key. (#2342)
• Changed: GetTransactionEncryptionKey responses are forwarded without a relay cache. (#2389)
• Fixed: Transaction submission no longer records private request bodies in logs or traces. (#2389)

Node

• Breaking: Added multiple Validator genesis bootstrap and tx/block validation (#2323)
• Changed: Applying blocks with changes to accounts having large storage maps is now significantly faster. (#2341)

NTX Builder

• Migration: NTX builder data must be bootstrapped again to store trusted validator keys from genesis. (#2389)
• Changed: Drive account actors from a per-account watch instead of a dataless Notify, eliminating per-block DB polling for landing checks and note availability. (#2301)
• Fixed: Network accounts no longer stop reactivating after idle periods: gRPC clients now use HTTP/2 keepalive to detect silently dropped block-subscription connections, plus a subscription stall watchdog and a liveness heartbeat. (#2369)
• Fixed: Reload account state from the database after a rejected submission so the actor stops re-submitting against a stale account commitment. (#2371)

Validator

• Breaking: Renamed the validator signing key options: --key.hex / MIDEN_VALIDATOR_KEY is now --signing-key.hex / MIDEN_VALIDATOR_SIGNING_KEY, and --key.kms-id / MIDEN_VALIDATOR_KEY_KMS_ID is now --signing-key.kms-id / MIDEN_VALIDATOR_SIGNING_KEY_KMS_ID. (#2342)
• Migration: Existing validator databases must be set up again for the new validated transaction record. (#2390)
• Migration: Validator databases must apply the private record migration before Golden storage is enabled. (#2393)
• Added: Validators are now provisioned with a shared transaction encryption key via --encryption-key.hex / MIDEN_VALIDATOR_ENCRYPTION_KEY and serve it through the new GetTransactionEncryptionKey endpoint. (#2342)
• Added: Validators can store validated private inputs under a Golden threshold key and issue local decryption shares for those records. (#2393)
• Added: Operators can list stored private inputs and issue Golden decryption shares through a private admin API. (#2407)
• Changed: The validator decrypts sealed inputs before validation and rejects plaintext inputs. (#2389)
• Changed: The validator stores sealed transaction inputs only after all validation checks pass. (#2390)
• Fixed: The docker-compose network now gives each validator a distinct Golden storage-key share, so 2-of-3 threshold recovery of stored transaction inputs works. (#2411)

Network Monitor

• Changed: Network transaction checks require a trusted validator signing public key. (#2389)

v0.15.2

Release v0.15.2

Changes by Scope

NTX Builder

• Fixed: Network accounts no longer stop reactivating after idle periods: gRPC clients now use HTTP/2 keepalive to detect silently dropped block-subscription connections, plus a subscription stall watchdog and a liveness heartbeat. (#2362)

v0.16.0-alpha.2

Changes by Scope

RPC

• Fixed: Tokio worker threads no longer panic when connections reach maximum age. (#2350)

NTX Builder

• Added: Network transactions now set an on-chain expiration delta (default 30 blocks, configurable via --tx-expiration-delta) using the canonical miden-standards expiration transaction script. Serviced network accounts must allowlist the script's root (ExpirationTransactionScript::script_root()) via AuthNetworkAccount::with_allowed_tx_scripts, or their network transactions will be rejected. (#2321)
• Fixed: Network notes are no longer punished for tipping a transaction over its cycle capacity. (#2322)

Network Monitor

• Fixed: Fixed network monitor increment transactions failing under the 0.16 transaction kernel by creating notes through the account context (#2344)

Internal

• Added: Bespoke SQLite framework aimed at replacing Diesel (#2265)
• Changed: Validator now uses our own SQLite framework instead of Diesel (#2265)
• Changed: Crates are now published using trusted publishing (#2346)

v0.16.0-alpha.1

Release v0.16.0-alpha.1

Breaking Changes

• Protocol: Updated miden-protocol dependencies to use the next branch (v0.16). Block and transaction account updates now use the absolute AccountPatch representation instead of the relative AccountDelta, and the miden-tx-batch-prover crate was renamed to miden-tx-batch. The per-transaction fee was also removed following its removal from the protocol transaction kernel (0xMiden/protocol#3108), so the fee field was dropped from the TransactionHeader gRPC message and from the store and validator transaction tables, and ProvenTransaction and TransactionId construction no longer take a fee. (#2282)
• Protocol: Upgraded miden-vm to v0.24 (#2320)
• Protocol: Upgraded miden-crypto to v0.27 (#2320)
• General: Minimum Rust Version is now 1.96 (#2320)
• Node: Rocksdb large SMT on disk layout changed (#2320)

Changes by Scope

General

• Breaking: Minimum Rust Version is now 1.96 (#2320)

Protocol

• Breaking: Updated miden-protocol dependencies to use the next branch (v0.16). Block and transaction account updates now use the absolute AccountPatch representation instead of the relative AccountDelta, and the miden-tx-batch-prover crate was renamed to miden-tx-batch. The per-transaction fee was also removed following its removal from the protocol transaction kernel (0xMiden/protocol#3108), so the fee field was dropped from the TransactionHeader gRPC message and from the store and validator transaction tables, and ProvenTransaction and TransactionId construction no longer take a fee. (#2282)
• Breaking: Upgraded miden-vm to v0.24 (#2320)
• Breaking: Upgraded miden-crypto to v0.27 (#2320)
• Changed: Upgraded protocol crates to 0.16.0-alpha.1 (#2334)
• Changed: Upgraded miden-crypto to 0.28 (#2334)
• Changed: Upgrade to 0.16.0-alpha.2 (#2337)

Node

• Breaking: Rocksdb large SMT on disk layout changed (#2320)

Prover

• Removed: Removed the miden-remote-prover-client crate (#2315)