v4.12.0

Mainnet consensus version (V22) activation height: 22,962,000 — estimated Mon 2026-10-19 ~22:00 UTC (~3:00 pm PT) at current block times.
Testnet V22 activated at height 20,415,000 on 2026-10-12.

Network: mainnet. This is the mainnet release of Aleo Stack v4.12.0; the same code shipped to testnet as testnet-v4.12.0. ConsensusVersion::V22 raises the maximum number of mappings in a program to 128. This release also carries everything merged to staging through snarkOS #4531 and snarkVM #3485.

Who needs to act

All mainnet validators and node operators need to upgrade before the activation height.

ATTENTION: Validators and clients that do not upgrade in time will be at risk of forking. V22 activates at height 22,962,000 on mainnet and is already live on testnet since height 20,415,000.

Built against snarkVM v4.12.0 (56b6c6025).

The Aleo maintainers are excited to announce Aleo Stack v4.12.0. This release introduces the V22 consensus version, continues the hardening and performance work from v4.10.0, and brings a large set of improvements for node operators: more resilient BFT participation, new REST range endpoints, better observability, and faster CPU proving.

Highlights

• Consensus V22: programs may declare up to 128 mappings. (On testnet, V22 also lowers the certificate limit to 40, matching mainnet.)
• BFT resilience: validators no longer let peer-reported sync status silence them, proposals fan out to peers concurrently, and certificates propagate before local commit work.
• Deployment verification hardening: deterministic deployment checks, cyclic struct guards, and tighter wire-format parsing.
• Faster, more observable nodes: an 8% faster private transfer on CPU, committer keys that share the SRS, RocksDB secondary mode, and new metrics and REST routes.

Consensus upgrade: introducing V22

• Up to 128 mappings per program. The mapping limit becomes a versioned consensus value: 31 through V21, 128 from V22. Deployment verification enforces the active limit. (snarkVM#3428)
• Testnet certificate limit lowered to 40 at V22, matching mainnet’s existing bound; no change on mainnet. (snarkVM#3386, snarkVM#3484)
• Message version 33 accompanies V22; the latest message version now ignores consensus versions that have no scheduled height. (snarkOS#4511)

For node operators

BFT resilience

• Consensus participation no longer depends on peer-reported sync status. is_synced() was derived from peer locator messages, so a single peer claiming to be far ahead could silence a validator. Proposing, signing and certifying now rely on the node’s own view. (snarkOS#4461)
• Batch proposals fan out concurrently, and sends scoped to a round are cancelled when the round advances, so one rate-limited peer no longer delays delivery to the rest. (snarkOS#4487)
• Certificates are broadcast before waiting on local consensus, so local commit work does not hold up propagation. (snarkOS#4527)
• Batches that reference aborted transactions are no longer certified. (snarkOS#4412)
• Concurrent duplicate certificate inserts are ignored rather than treated as errors. (snarkOS#4479)
• Cached signer addresses on batch certificates are used instead of re-deriving them. (snarkOS#4434)
• Clients may fetch a single missing block at the tip, improving transaction and mapping visibility. (snarkOS#4529)
• The expired gateway challenge-response handshake has been removed; validators speak only the Noise handshake. (snarkOS#4506)

Hardening the wire format and network layer

• Trailing bytes inside length-delimited sub-objects, repeated entries in count-prefixed collections, and oversized preallocations from wire-declared counts are rejected. (snarkVM#3409, snarkVM#3410, snarkVM#3419)
• Non-canonical curve point encodings (Short Weierstrass y = 0 sign flag, Edwards x = 0) are rejected, and every serialized curve point is asserted to round-trip. (snarkVM#3422, snarkVM#3425, snarkVM#3405)
• MAX_PING_MESSAGE_SIZE is tightened from 16 MiB to 2 MiB, and Ping block locators are optional for clients and validators. (snarkOS#4426, snarkOS#4425)
• Remote parameter downloads and REST queries are bounded, with retries for lost requests. (snarkVM#3436, snarkVM#3435)
• A cached parameter file that fails its checksum is removed rather than reused. (snarkVM#3469)

Storage, history and observability

• RocksDB secondary mode: a store can be opened read-only alongside a running node. (snarkVM#3452)
• --history-json: snarkos start can write credits.aleo history as JSON while finalizing blocks (clients and validators only; not combinable with --history-compat-mode). (snarkVM#3485, snarkOS#4521)
• Metrics: a snarkos_consensus_version gauge, subdag/DAG-density metrics, p2p event and REST request counts by type, RocksDB compaction byte counters, standardized units and histogram buckets, and a fixed inbound-queue gauge. (snarkOS#4469, snarkOS#4453, snarkOS#4512, snarkVM#3482, snarkOS#4454, snarkOS#4436, snarkOS#4486)
• Local devnets provision the incident-response Grafana dashboard, and devnet.sh handles compose failures. (snarkOS#4473, snarkOS#4530)
• The dev_genesis_state_root feature is available for test networks. (snarkVM#3448, snarkOS#4476)
• Unused slipstream plugin support has been removed. (snarkVM#3442, snarkOS#4468)

For external developers

REST API

• New range routes: /blocks/hashes, /blocks/headers, /blocks/stateRoots and /blocks/transactions over a height range (up to 160 blocks), with allow_partial to clamp ranges to the tip. (snarkOS#4447, snarkOS#4455, snarkOS#4467, snarkOS#4510)
• Missing resources return 404, v1 errors are identifiable, and the rate limiter’s Retry-After header is forwarded on a 429. (snarkOS#4450, snarkOS#4472)
• Transaction verification on broadcast?check_transaction=true runs in a blocking task, and operators can cap REST verification concurrency at startup. (snarkOS#4530, snarkOS#4459)
• The request body limit matches the current maximum transaction size, block lookups no longer fill the block cache, and developer endpoints accept static queries. (snarkOS#4444, snarkOS#4485, snarkOS#4478)

Deployment verification hardening

• Deterministic deployment checks. A non-deterministic signer sampled during check_deployment could make nodes disagree; the remaining ambient RNG sources are now seeded. (snarkVM#3346, snarkVM#3365)
• Cyclic struct equivalence is rejected instead of overflowing the stack, guarding legacy cyclic graphs that reach type checking. (snarkVM#3447)
• The rand.chacha instruction is now costed. (snarkVM#3356)
• Beacon blocks apply a conservative spend limit, matching production environments. (snarkVM#3386)

Performance

• CPU proving is about 8% faster on a private transfer, from a set of algorithmic improvements to polynomial arithmetic. (snarkVM#3399)
• Committer keys share the SRS instead of copying the powers of β·G. (snarkVM#3474)
• Off-thread speculative reads no longer stall atomic_speculate, and the sequential VM worker is released after the final external clone. (snarkVM#3438, snarkVM#3444)
• Tokio pools are sized from measured demand, duplicate deserialization allocations are avoided, and a path hasher’s Merkle empty hash is computed once. (snarkOS#4464, snarkVM#3398, snarkVM#3458)
• Eager error creation is avoided in cost calculation. (snarkVM#3486)

For snarkVM and snarkOS developers

Toolchain and dependencies

• Rust 1.96 is now the MSRV for both snarkVM and snarkOS. (snarkVM#3395, snarkOS#4432)
• aleo-std 1.0.4: StorageMode::Custom takes an optional secondary path; use StorageMode::from(path) for the common case.
• cargo-deny replaces cargo-audit in CI, the unmaintained fxhash is replaced with ahash, and dependencies past the yanked chacha20 and wnaf releases are used. (snarkVM#3453, snarkOS#4470, snarkVM#3454, snarkVM#3406)
• The macOS release build is fixed (libclang). (snarkOS#4398)