Komodo 0.9.2-2

⚠️ This is a mandatory upgrade. This release is primarily a security hardening update: it fixes several
remotely reachable memory-safety issues on the block and transaction validation paths. All node operators
and GUI wallet users must upgrade from 0.9.2-1.

What's Changed

• security: fix remote null-deref / use-after-free in block & script validation by @DeckerSU in #685

This release closes several remotely reachable memory-safety bugs in block and transaction validation,
hardens a few latent issues, and disables the unsafe NSPV message processing surface:

• Fixed a remote null-deref / use-after-free in block and script validation: guard zero-length push in
  IsCoinImport(), guard empty OP_RETURN in Heir CC _DecodeHeirOpRet(), and fix a use-after-free in
  ConnectBlock() (CVE-2024-52911 class) by joining script-check threads before txdata is destroyed.
• Hardened CheckBlock() against uninitialized pubkey33 and an out-of-bounds read in komodo_checkopret().
• Refuse to start with -nspv_msg: the getnSPV/nSPV P2P handlers are remotely memory-unsafe (stack overflow
  and out-of-bounds reads).

Full Changelog: v0.9.2-1...v0.9.2-2

Checksum & VirusTotal Analysis:

Link	SHA256
komodo-0.9.2-2-win.zip	1d80bb6361dd792a35534d174de4fa682661be1b793b9d4867a2f8688422d04b
komodo-0.9.2-2-linux.tar.gz	f296bb500b76140c0210d64fa8c127eeba00dcbffd09cefc93a05f6af9392572

This release was signed by https://keybase.io/deckersu (GPG fingerprint: FD9A 772C 7300 F4C8 94D1 A819 FE50 4808 62E6 451C).

CD Release bf209f2 dev

ci: disable OSX build in komodod_cd workflow

Turn off the osx-build job (if: false) and unwire it from the release
pipeline so Linux + Windows CD releases still publish:

- osx-build: if: false (kept in the file for easy re-enable)
- publish-release: drop osx-build from needs, remove the komodo-osx
  download step and the OSX release-asset upload step

Otherwise a skipped osx-build dependency would skip publish-release
entirely and no release would be produced.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CD Release ae588a9 master

Merge pull request #686 from GLEECBTC/dev

Release 0.9.2-2: memory-safety hardening + version bump

Komodo 0.9.2-1

This is a patch release that is mandatory only for node operators of the following chains:

• BCZERO
• RAPH
• MDX

Operators of these chains must upgrade to ensure correct checkpoint behavior.

ℹ️ For All Other Chains

Node operators running other chains can safely remain on v0.9.2.
For non-listed chains, this update does not introduce any breaking changes, consensus changes, or required upgrades.

What's Changed

• depends: update libsodium download path by @CHMEX in #674
• depends: fix libsodium download path and add dependency path validator script by @DeckerSU in #675
• feat(checkpoints): enable auto checkpoints for BCZERO, RAPH, MDX by @dimxy in #676

New Contributors

• @CHMEX made their first contribution in #674

Full Changelog: v0.9.2...v0.9.2-1

Checksum & VirusTotal Analysis:

Link	SHA256
komodo-0.9.2-1-win.zip	fd32cce58b9d32225ab3c8a202f15349b867e7dc8074133375c03a2f2cdac6c9
komodo-0.9.2-1-linux.tar.gz	d55014b92a1ebc092ac6df329f9359d14d1a244695b5e34154d9f4db312f251c

This release was signed by https://keybase.io/deckersu (GPG fingerprint: FD9A 772C 7300 F4C8 94D1 A819 FE50 4808 62E6 451C).

Komodo 0.9.2 (Draco Typhon)

What's Changed

• use ubuntu22 image by @smk762 in #660
• update dockerfile to ubuntu22 by @gcharang in #661
• Fix fetch script on macos by @gcharang in #662
• Avoid VLA in hash.h by @DeckerSU in #669
• feat(consensus): auto checkpointing mechanism with a master node by @dimxy in #670

Auto-Checkpointing (dPoW 2.0)

This release introduces an automatic checkpoint system to replace dPoW (Delayed Proof of Work) which is being sunset on January 4-5, 2026.

What's New:

The auto-checkpoint system (adapted from Gulden/PPCoin) allows a developer node to broadcast signed checkpoint messages that protect the chain against malicious reorganization attacks. Checkpoints are created 10 blocks behind the chain tip and all nodes validate incoming checkpoints.

Activation:

• KMD mainnet: Block height 4,771,595 (approx. Jan 5, 2026)
• Asset chains (CCL, CLC, GLEEC, THC, DOC, MARTY): Timestamp Jan 4, 2026 12:00 UTC

Key Changes:

• New P2P "checkpoint" message for broadcasting/receiving checkpoints
• Checkpoint state persisted to disk under datadir/sync_checkpoint/
• New RPC: getcheckpoint returns current sync checkpoint
• Enhanced getblockchaininfo with sync checkpoint status and dPoW status fields
• Transaction listings now include secured_by_checkpoint field
• Protocol version bumped to 170014
• KMD deprecation height extended to 5,895,951

NB: This is a mandatory update

---

Full Changelog: v0.9.1...v0.9.2

Checksum & VirusTotal Analysis:

Link	SHA256
komodo-0.9.2-mac.zip	a877aecc09b673d6e7006a4310870e839d71687f91caf3dd55f1d8876b100b00
komodo-0.9.2-win.zip	b2580ff25cc8b2f514e2efaa4cd53aa5efc4d41c5467f7798238e03793d98966
komodo-0.9.2-linux-xenial.tar.gz	5c16823c238b697ccff37703776a2ac4f24fc8d2bf48ea333cf1e70891e02b84
komodo-0.9.2-linux.tar.gz	ea39b72bc5352811dbdd07f66f46bdf33a585ca74997c300a12f6bdc6e9e4663

This release was signed by https://keybase.io/deckersu (GPG fingerprint: FD9A 772C 7300 F4C8 94D1 A819 FE50 4808 62E6 451C).

CD Release 6664bba dev

cd_release_6664bba_dev

Avoid VLA in hash.h (#669)

CD Release 635112d dev

cd_release_635112d_dev

Merge pull request #662 from KomodoPlatform/fix-fetch-params-macos

CD Release 07a8d5e dev

cd_release_07a8d5e_dev

Merge pull request #661 from KomodoPlatform/fix-dockerhub-glibc

Komodo 0.9.1

What's Changed

• fix old and new gleec checkpoints by @DeckerSU in #629
• cc: fix ed25519 signatures malleability by @DeckerSU in #632
• libsodium: don't update config.sub, congig.guess from git.savannah.gnu.org by @DeckerSU in #635
• GLEEC_OLD: exception to fix following the notarizations by @DeckerSU in #637
• use p2pkh vout instead of p2pk for change when -pubkey specified by @DeckerSU in #638
• update artifact actions to v4 by @DeckerSU in #639
• build: boost, prevent use of std::unary_function by @DeckerSU in #640
• build: use latest config.{guess,sub} in depends by @DeckerSU in #641
• allow to start without komodo.conf for KMD by @DeckerSU in #642
• ci/cd: update runner image ubuntu-20.04 -> ubuntu-22.04 by @DeckerSU in #643
• fix linkage on Xenial (16.04) by @DeckerSU in #627
• [CI/CD] fix Windows build by @DeckerSU in #645
• tests: fix global variable corruption, make tests execution order-independent by @DeckerSU in #646
• [ci/cd] save time on removal and upgrade packages by @DeckerSU in #648
• tests: fix multiple definition of TestCout d'tor by @DeckerSU in #649
• README.md: updating information by @DeckerSU in #647
• Update DEPRECATION_HEIGHT to 5 333 777 to extend node support window by @DeckerSU in #651
• 0.9.1 by @ca333 in #644

Full Changelog: v0.9.0...v0.9.1

Checksum & VirusTotal Analysis:

Link	SHA256
komodo-0.9.1-mac.zip	da60ff595d8541fe9bf9d9eab9060a7fe9f868b96c329523b3217886f03337f2
komodo-0.9.1-win.zip	a62c1d994db672b612c4d2c9a2740f9163c4310e0b695b7f6bf9ca4ed57e1b1d
komodo-0.9.1-linux-xenial.tar.gz	7f1d02d701e08507306348826813bb228a833f73defac3cdc56f62b9ea7a72da
komodo-0.9.1-linux.tar.gz	d5fa7076eec61b27c8844685fbec68061414cfb53f912e768865841f9f647f84

This release was signed by https://keybase.io/deckersu (GPG fingerprint: FD9A 772C 7300 F4C8 94D1 A819 FE50 4808 62E6 451C).

CD Release e9e37e1 dev

cd_release_e9e37e1_dev

ci/cd: Migrate from set-output to using $GITHUB_OUTPUT