CD Release 6e0ad9d dev

cd_release_6e0ad9d_dev

fix: update Twitter link to new handle on X.com

CD Release 558a174 master

cd_release_558a174_master

fix: update Twitter link to new handle on X.com

Komodo 0.9.2-2

⚠️ This is a mandatory upgrade. This release is primarily a security hardening update: it fixes several
remotely reachable memory-safety issues on the block and transaction validation paths. All node operators
and GUI wallet users must upgrade from 0.9.2-1.

What's Changed

• security: fix remote null-deref / use-after-free in block & script validation by @DeckerSU in #685

This release closes several remotely reachable memory-safety bugs in block and transaction validation,
hardens a few latent issues, and disables the unsafe NSPV message processing surface:

• Fixed a remote null-deref / use-after-free in block and script validation: guard zero-length push in
  IsCoinImport(), guard empty OP_RETURN in Heir CC _DecodeHeirOpRet(), and fix a use-after-free in
  ConnectBlock() (CVE-2024-52911 class) by joining script-check threads before txdata is destroyed.
• Hardened CheckBlock() against uninitialized pubkey33 and an out-of-bounds read in komodo_checkopret().
• Refuse to start with -nspv_msg: the getnSPV/nSPV P2P handlers are remotely memory-unsafe (stack overflow
  and out-of-bounds reads).

Full Changelog: v0.9.2-1...v0.9.2-2

Checksum & VirusTotal Analysis:

Link	SHA256
komodo-0.9.2-2-win.zip	1d80bb6361dd792a35534d174de4fa682661be1b793b9d4867a2f8688422d04b
komodo-0.9.2-2-linux.tar.gz	f296bb500b76140c0210d64fa8c127eeba00dcbffd09cefc93a05f6af9392572

This release was signed by https://keybase.io/deckersu (GPG fingerprint: FD9A 772C 7300 F4C8 94D1 A819 FE50 4808 62E6 451C).

CD Release bf209f2 dev

ci: disable OSX build in komodod_cd workflow

Turn off the osx-build job (if: false) and unwire it from the release
pipeline so Linux + Windows CD releases still publish:

- osx-build: if: false (kept in the file for easy re-enable)
- publish-release: drop osx-build from needs, remove the komodo-osx
  download step and the OSX release-asset upload step

Otherwise a skipped osx-build dependency would skip publish-release
entirely and no release would be produced.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CD Release ae588a9 master

Merge pull request #686 from GLEECBTC/dev

Release 0.9.2-2: memory-safety hardening + version bump

Komodo 0.9.2-1

This is a patch release that is mandatory only for node operators of the following chains:

• BCZERO
• RAPH
• MDX

Operators of these chains must upgrade to ensure correct checkpoint behavior.

ℹ️ For All Other Chains

Node operators running other chains can safely remain on v0.9.2.
For non-listed chains, this update does not introduce any breaking changes, consensus changes, or required upgrades.

What's Changed

• depends: update libsodium download path by @CHMEX in #674
• depends: fix libsodium download path and add dependency path validator script by @DeckerSU in #675
• feat(checkpoints): enable auto checkpoints for BCZERO, RAPH, MDX by @dimxy in #676

New Contributors

• @CHMEX made their first contribution in #674

Full Changelog: v0.9.2...v0.9.2-1

Checksum & VirusTotal Analysis:

Link	SHA256
komodo-0.9.2-1-win.zip	fd32cce58b9d32225ab3c8a202f15349b867e7dc8074133375c03a2f2cdac6c9
komodo-0.9.2-1-linux.tar.gz	d55014b92a1ebc092ac6df329f9359d14d1a244695b5e34154d9f4db312f251c

This release was signed by https://keybase.io/deckersu (GPG fingerprint: FD9A 772C 7300 F4C8 94D1 A819 FE50 4808 62E6 451C).

Komodo 0.9.2 (Draco Typhon)

What's Changed

• use ubuntu22 image by @smk762 in #660
• update dockerfile to ubuntu22 by @gcharang in #661
• Fix fetch script on macos by @gcharang in #662
• Avoid VLA in hash.h by @DeckerSU in #669
• feat(consensus): auto checkpointing mechanism with a master node by @dimxy in #670

Auto-Checkpointing (dPoW 2.0)

This release introduces an automatic checkpoint system to replace dPoW (Delayed Proof of Work) which is being sunset on January 4-5, 2026.

What's New:

The auto-checkpoint system (adapted from Gulden/PPCoin) allows a developer node to broadcast signed checkpoint messages that protect the chain against malicious reorganization attacks. Checkpoints are created 10 blocks behind the chain tip and all nodes validate incoming checkpoints.

Activation:

• KMD mainnet: Block height 4,771,595 (approx. Jan 5, 2026)
• Asset chains (CCL, CLC, GLEEC, THC, DOC, MARTY): Timestamp Jan 4, 2026 12:00 UTC

Key Changes:

• New P2P "checkpoint" message for broadcasting/receiving checkpoints
• Checkpoint state persisted to disk under datadir/sync_checkpoint/
• New RPC: getcheckpoint returns current sync checkpoint
• Enhanced getblockchaininfo with sync checkpoint status and dPoW status fields
• Transaction listings now include secured_by_checkpoint field
• Protocol version bumped to 170014
• KMD deprecation height extended to 5,895,951

NB: This is a mandatory update

---

Full Changelog: v0.9.1...v0.9.2

Checksum & VirusTotal Analysis:

Link	SHA256
komodo-0.9.2-mac.zip	a877aecc09b673d6e7006a4310870e839d71687f91caf3dd55f1d8876b100b00
komodo-0.9.2-win.zip	b2580ff25cc8b2f514e2efaa4cd53aa5efc4d41c5467f7798238e03793d98966
komodo-0.9.2-linux-xenial.tar.gz	5c16823c238b697ccff37703776a2ac4f24fc8d2bf48ea333cf1e70891e02b84
komodo-0.9.2-linux.tar.gz	ea39b72bc5352811dbdd07f66f46bdf33a585ca74997c300a12f6bdc6e9e4663

This release was signed by https://keybase.io/deckersu (GPG fingerprint: FD9A 772C 7300 F4C8 94D1 A819 FE50 4808 62E6 451C).

CD Release 6664bba dev

cd_release_6664bba_dev

Avoid VLA in hash.h (#669)

CD Release 635112d dev

cd_release_635112d_dev

Merge pull request #662 from KomodoPlatform/fix-fetch-params-macos

CD Release 07a8d5e dev

cd_release_07a8d5e_dev

Merge pull request #661 from KomodoPlatform/fix-dockerhub-glibc