Merge branch 'main' into mraszyk/max-wasm-memory-threshold

Author: mraszyk

.sources/VERSIONS

@@ -57,9 +57,9 @@ chain-fusion-signer   v0.4.0
 papi                  v0.1.1                                                    168bc9d
 ic-pub-key            v1.0.1                                                    f89fa55
 icp-cli               v1.0.0                                                    9eed60c
-motoko                v1.9.0                                                     e7c78d7
+motoko                v1.11.0                                                     c3a6eb3
 motoko-core           v2.4.0                                                    cd37dbf
 cdk-rs                ic-cdk v0.20.1 / ic-cdk-timers v1.0.0 / ic-cdk-executor v2.0.0  317f55c
 candid                2025-12-18  # candid v0.10.20, didc v0.5.4                2e4a2cf
 response-verification v3.1.0                                                    18c5a37
-internetidentity      release-2026-06-15                                         1f4104b5
+internetidentity      release-2026-06-29                                         5fe49cfd

.sources/internetidentity

@@ -121,6 +121,12 @@ type NervousSystemParameters = record {
 };
 ```
 
+:::caution[Changing the SNS token transfer fee]
+Do not use `ManageNervousSystemParameters.transaction_fee_e8s` to change the SNS token transfer fee. This field updates only Governance's stored parameter, not the SNS ledger canister. Worse, because Governance uses this stored value as the fee for its own neuron-operation transfers (disbursing, splitting, staking maturity, and so on), setting it to a value that differs from the ledger's actual fee will cause those transfers to be rejected by the ledger (`BadFee`), breaking neuron operations.
+
+To change the actual ledger transfer fee, submit a [`ManageLedgerParameters`](#manageledgerparameters) proposal with `transfer_fee` set. On successful execution, the ledger fee is updated and Governance's `transaction_fee_e8s` is synced to the same value automatically.
+:::
+
 For a description of each parameter and its effect, see the [SNS settings reference](../../references/sns-settings.md).
 
 ### ManageSnsMetadata
@@ -155,6 +161,8 @@ quill send message.json
 
 Updates ledger parameters: transfer fee, token name, token symbol, or token logo. Fields set to `null` remain unchanged.
 
+Use `transfer_fee` here to change the SNS token transfer fee; this is the only proposal that updates the actual fee charged by the ledger. On successful execution, it also syncs Governance's `NervousSystemParameters.transaction_fee_e8s` to the same value, so a separate `ManageNervousSystemParameters` proposal is not needed.
+
 ```bash
 quill sns \
   make-proposal $PROPOSAL_NEURON_ID \

.sources/motoko

@@ -8,6 +8,50 @@ sidebar:
 
 # Motoko compiler changelog
 
+## 1.11.0 (2026-06-29)
+
+* motoko (`moc`)
+
+  * feat: `moc` now emits the standardized `target_features` Wasm custom section, so `binaryen`-based tools (`wasm-opt`, `ic-wasm optimize`, `dfx`'s `optimize`) accept and optimize Motoko output without per-tool feature flags. Previously these tools defaulted to MVP and rejected the `multivalue`/`bulk-memory`/`memory64` features moc relies on (#6214).
+
+  * feat: a `Float32` literal written with more precision than the type can hold now warns (M0266), suggesting the shortest equivalent: e.g. `0.123456789 : Float32` → `0.12345679`. The surplus digits were already silently discarded by rounding; the warning fires only on genuine excess (minimal literals like `0.1`/`3.14` stay quiet) (#6198).
+
+  * feat: allow requiring `system` capability for `mixin` definitions (#6211).
+    This makes the capability available in initializers and the `mixin` body.
+    `<system>` then needs to appear on the corresponding `include`.
+
+  * feat: allow effectful code in transient `let`s and in `actor`/`mixin` bodies with `--enhanced-migration` (#6191).
+
+  * bugfix: `--enhanced-migration` now also applies to `mixin`s and considers their stable fields when checking migrations (#6183).
+
+## 1.10.1 (2026-06-24)
+
+* motoko (`moc`)
+
+  * bugfix: M0223 ("redundant type instantiation") and M0237 ("implicit argument can be omitted") no longer emit suggestions that are individually valid but break compilation when applied together. In nested calls where an inner instantiation or implicit is only inferable thanks to an outer one (e.g. `List.fromArray(Array.tabulate(...))`), only a jointly-applicable subset is now suggested, so `mops check --fix` no longer rewrites the code into an M0098 type error. The check is conservative: a few genuinely-redundant cases may go unreported in exchange for soundness (#6209).
+
+## 1.10.0 (2026-06-19)
+
+* motoko (`moc`)
+
+  * feat: M0218 ("redundant `stable` keyword") now ships a machine-applicable edit, so `mops check --fix` removes the explicit `stable` keyword on fields of a `persistent actor` (#6175).
+
+  * feat: Permitting destructuring patterns against actor types: `let { foo } = a`, `func g({foo} : actor T) {}`, etc. (#6149).
+
+  * feat: `/// @deprecated M0235 <message>`: the caffeine deprecation warning (M0235) can now carry a free-text message, rendered as a `note:` sub-diagnostic at every use site. M0154 free-text deprecation messages now render the same way (#6153).
+
+  * perf: Multi-value Wasm codegen is now _on by default_, `--no-experimental-multi-value` flag disables (if not desired) (#6165).
+
+  * bugfix: M0237 (implicit argument can be omitted) only fires now when the suggested removal preserves the same type instantiation. Previously the edit could be rejected (M0098) (#6166).
+
+  * bugfix: M0236 dot-notation suggestion no longer fires for literal receivers: the `lit.f()` rewrite could misparse (`-1.1.isNaN()` → `-(1.1.isNaN())`), mis-lex (`0xff.abs` as a hex float), or fail to type-check when it lost a literal coercion (`Blob.isEmpty("\00")` → `"\00".isEmpty()`) (#6173).
+
+  * bugfix: M0236 dot-notation suggestion no longer fires when the receiver cannot be inferred or would infer to a different type causing the call to resolve to a different function (#6177).
+
+  * bugfix: Implicit argument derivation now resolves type variables that occur only in a covariant result position (e.g. JSON-style decoders `Text -> ?T`). Previously such a variable was solved to `None` (bottom), so the implicit had to be passed explicitly (#6186).
+
+  * bugfix: Diagnostic columns now count Unicode codepoints (matching editor displays and `rustc`), and JSON diagnostics gain `byte_start`/`byte_end` for encoding-independent edit anchors. Previously `mops check --fix` over-deleted on multi-byte lines (e.g. `Char.toNat32('京')` trimmed the trailing `)`) (#6168).
+
 ## 1.9.0 (2026-06-02)
 
 * motoko (`moc`)

docs/guides/governance/managing.md

@@ -348,7 +348,8 @@ SignedDelegation = {
   delegation : {
     pubkey : PublicKey;
     targets : [CanisterId] | Unrestricted;
-    expiration : Timestamp
+    expiration : Timestamp;
+    permissions : Queries | All | Unrestricted
   };
   signature : Signature
 }
@@ -692,14 +693,15 @@ that represents Candid encoding; this is implicitly taking the method types, as
 
 #### Envelope Authentication
 
-The following predicate describes when an envelope `E` correctly signs the enclosed request with a key belonging to a user `U`, at time `T`: It returns which canister ids this envelope may be used at (as a set of principals).
+The following predicate describes when an envelope `E` correctly signs the enclosed request with a key belonging to a user `U`, at time `T`: It returns which canister ids this envelope may be used at (as a set of principals). The predicate fails for update calls (requests of type `Request`) if any delegation in the chain restricts the sender to query calls and `read_state` requests (`permissions` field set to `Queries`, encoded as the text `"queries"`).
 ```
 verify_envelope({ content = C }, U, T)
   = { p : p is CanisterID } if U = anonymous_id
   ∧ C.sender_info = null
 verify_envelope({ content = C, sender_pubkey = PK, sender_sig = Sig, sender_delegation = DS}, U, T)
   = TS if U = mk_self_authenticating_id PK
   ∧ (PK', TS) = verify_delegations(DS, PK, T, { p : p is CanisterId })
+  ∧ (C is Request ⇒ ∀ D ∈ DS. D.delegation.permissions ≠ Queries)
   ∧ verify_signature PK' Sig ("\x0Aic-request" · hash_of_map(C))
   ∧ (if PK = canister_signature_pk Signing_canister_id _:
        C.sender_info = null

docs/languages/motoko/reference/changelog.md

@@ -8,9 +8,18 @@ sidebar:
 
 ## Changelog {#changelog}
 
-### 0.63.0 (2026-06-26) {$0_63_0}
+### 0.64.0 (2026-07-06) {$0_64_0}
+* New optional `permissions` field in request delegations restricting the kinds of requests
+  the delegation applies for: the value `"queries"` restricts the delegation to query calls
+  and `read_state` requests, so update calls carrying such a delegation in their chain of
+  delegations are not accepted; the value `"all"` permits all kinds of requests, same as
+  omitting the field. Requests of any kind carrying a delegation with any other value of
+  the `permissions` field are not accepted.
 * `wasm_memory_threshold` in canister settings is now bounded by 2<sup>48</sup>, analogously to `wasm_memory_limit`.
 
+### 0.63.0 (2026-06-29) {$0_63_0}
+* Support for the HTTP method `PATCH` in canister `http_request` in non-replicated mode.
+
 ### 0.62.0 (2025-05-26) {$0_62_0}
 * Inter-canister response callback messages might still be executed after the condition for `canister_on_low_wasm_memory` is triggered
   and before the function `canister_on_low_wasm_memory` is executed.

docs/references/ic-interface-spec/abstract-behavior.md

@@ -545,6 +545,14 @@ Signing transactions can be delegated from one key to another one. If delegation
 
     -   `targets` (`array` of `CanisterId`, optional): If this field is set, the delegation only applies for requests sent to the canisters in the list. The list must contain no more than 1000 elements; otherwise, the request will not be accepted by the IC.
 
+    -   `permissions` (`text`, optional): If this field is set, the delegation only applies for the kinds of requests permitted by its value. The following values are supported:
+
+        -   `"queries"`: the delegation only applies for query calls and `read_state` requests. Requests to `/call` endpoints (i.e., update calls, including calls to query methods submitted as update calls) are not accepted by the IC if any delegation in the chain carries this value: a subsequent delegation cannot lift the restriction imposed by a previous one.
+
+        -   `"all"`: the delegation applies for all kinds of requests; this is the same as omitting the field.
+
+        If this field is set to any other value, then the delegation is invalid and requests of any kind whose chain of delegations contains the delegation will not be accepted by the IC.
+
 -   `signature` (`blob`): Signature on the 32-byte [representation-independent hash](#hash-of-map) of the map contained in the `delegation` field as described in [Signatures](./index.md#signatures), using the 27 bytes `\x1Aic-request-auth-delegation` as the domain separator.
 
     For the first delegation in the array, this signature is created with the key corresponding to the public key from the `sender_pubkey` field, all subsequent delegations are signed with the key corresponding to the public key contained in the preceding delegation.
@@ -571,7 +579,7 @@ Field values are hashed as follows:
 
 -   Binary blobs (`canister_id`, `arg`, `nonce`, `module`) are hashed as-is.
 
--   Strings (`request_type`, `method_name`) are hashed by hashing their binary encoding in UTF-8, without a terminal `\x00`.
+-   Strings (`request_type`, `method_name`, `permissions`) are hashed by hashing their binary encoding in UTF-8, without a terminal `\x00`.
 
 -   Natural numbers (`compute_allocation`, `memory_allocation`, `ingress_expiry`) are hashed by hashing their binary encoding using the shortest form [Unsigned LEB128](https://en.wikipedia.org/wiki/LEB128#Unsigned_LEB128) encoding. For example, `0` should be encoded as a single zero byte `[0x00]` and `624485` should be encoded as byte sequence `[0xE5, 0x8E, 0x26]`.
 

docs/references/ic-interface-spec/changelog.md

@@ -640,7 +640,7 @@ In the replicated mode, the responses for all identical requests must match, too
 
 For this reason, the calling canister can supply a transformation function, which the IC uses to let the canister sanitize the responses from such unique values. The transformation function is executed separately on the corresponding response received for a request (both in replicated and non-replicated modes). Only the transformed response will be available to the calling canister.
 
-Currently, the `GET`, `HEAD`, and `POST` methods are supported for HTTP requests. Additionally, the `PUT` and `DELETE` methods are supported in non-replicated mode only. `PUT` and `DELETE` are restricted to non-replicated mode to avoid confusing race conditions that may occur with replicated execution.
+Currently, the `GET`, `HEAD`, and `POST` methods are supported for HTTP requests. Additionally, the `PUT`, `DELETE`, and `PATCH` methods are supported in non-replicated mode only. `PUT`, `DELETE`, and `PATCH` are restricted to non-replicated mode to avoid confusing race conditions that may occur with replicated execution.
 
 It is important to note the following for the usage of the `POST` method:
 
@@ -664,7 +664,7 @@ The following parameters should be supplied for the call:
 
 -   `max_response_bytes` - optional, specifies the maximal size of the response in bytes. If provided, the value must not exceed `2MB` (`2,000,000B`). The call will be charged based on this parameter. If not provided, the maximum of `2MB` will be used.
 
--   `method` - currently, `GET`, `HEAD`, and `POST` are supported. Additionally, `PUT` and `DELETE` are supported in non-replicated mode only.
+-   `method` - currently, `GET`, `HEAD`, and `POST` are supported. Additionally, `PUT`, `DELETE`, and `PATCH` are supported in non-replicated mode only.
 
 -   `headers` - list of HTTP request headers and their corresponding values
 

docs/references/ic-interface-spec/https-interface.md

@@ -43,7 +43,7 @@ For background, see [SNS framework](../concepts/sns-framework.md).
 
 | Parameter | Type | Description |
 |---|---|---|
-| `transaction_fee_e8s` | `nat64` | Per-transfer fee on the SNS ledger, in e8s. Does not apply to minting or burning. |
+| `transaction_fee_e8s` | `nat64` | Governance's stored copy of the per-transfer ledger fee, in e8s. Does not apply to minting or burning. Do not set this field via `ManageNervousSystemParameters` to change the fee: it updates only Governance's copy, not the ledger. Change the fee with a `ManageLedgerParameters` proposal instead, which updates the ledger and syncs this field automatically (see [Managing an SNS](../guides/governance/managing.md#manageledgerparameters)). |
 
 ## Voting reward settings