v5.0.0

Highlighted Features

This release improves client stability and sync ergonomics, introduces a new certificate generation tool, and strengthens code safety with arithmetic overflow checks.

• IPC timeout handling - Client IPC timeouts have been increased to prevent timeouts during long-running operations like sync_now.
• Hello sync ergonomics - Replaced individual duration parameters in sync_hello_subscribe with a HelloSubscriptionConfig builder pattern with sensible defaults, including a longer default subscription duration.
• Client API improvements - aranya-id-based IDs are now exposed directly through the client API.
• KeyBundle renamed to PublicKeyBundle - Better reflects the type's purpose. The old name is deprecated but still available.
• New aranya-certgen crate - A CLI tool and library for generating PEM-formatted root CA certificates and signed certificates using P-256 ECDSA keys. This lays groundwork for the upcoming migration from PSKs to mTLS for QUIC sync authentication.
• C API test suite - A ctest-based test suite for the C API enables testing individual C API functions without requiring lengthy example applications exercising the entire API.
• Syncer reorganization - Internal syncer restructuring (SyncPeers -> SyncHandle, Syncer -> SyncManager) to prepare for upcoming transport traits and parallel sync.

Coming Soon

• Custom roles rank-based hierarchy checks.
• Migration from PSKs to mTLS certs for authenticating QUIC connections.

Security Patches

• Added clippy::arithmetic_side_effects workspace lint to catch unchecked integer arithmetic, pushing toward checked/saturating operations to prevent potential overflow panics.
• Updated time to resolve RUSTSEC-2026-0009.

Breaking Changes

• Sync wire protocol changed: The aranya-core sync protocol now includes graph_id in more message types — Subscribe, Unsubscribe, Hello, Push, and Poll messages all carry an explicit graph_id field (renamed from storage_id). This ensures the protocol itself handles graph identification rather than relying on the transport or application layer to track it. Additionally, the return address is now sent as just a port (2 bytes) instead of the full serialized address, with the server deriving the IP from the QUIC connection. This fixes an issue where a server's bind address (e.g. 0.0.0.0) did not match the outgoing client address, causing peers to receive an unusable return address. Nodes running previous versions will not be able to sync with 5.0.0 nodes.
• Daemon config toggle parsing fixed: The Toggle deserializer had swapped boolean matching — False was accepting true and vice versa. Configs that relied on the buggy behavior may parse differently after the fix. Empty or missing toggle sections now correctly default to disabled.
• Minimum supported Rust version updated to 1.90.

What's Changed

• syncer: Reorganize Syncer for Future Changes by @nikki-aranya in #674
• client: expose aranya-id based IDs by @jdygert-spok in #682
• certgen by @gknopf-aranya in #681
• Combine ClientWithState with Client and encapsulate fields by @jdygert-spok in #543
• implement ctest suite for capi by @jnewell-spok in #632
• chore: update aranya-core dependencies by @jdygert-spok in #691
• chore: remove nightly rust usage by @jdygert-spok in #697
• chore: update to Rust 1.90 by @jdygert-spok in #698
• claude: run unit tests in memory by @gknopf-aranya in #694
• daemon: fix config toggles by @jdygert-spok in #695
• fix(syncer): replace return address with just port by @jdygert-spok in #702
• sync: fix hello sync flake and implement builder pattern by @gknopf-aranya in #699
• Update bytes to resolve security vulnerability warning by @ssweetney-spok in #703
• Update time to resolve failing CI check by @ssweetney-spok in #712
• chore: claude code settings by @djohnson-spideroak in #678
• docs: update AGENTS.md with more focused guidance by @djohnson-spideroak in #714
• (client) - IPC timeout handling by @ssweetney-spok in #685
• chore: update aranya-core dependencies by @jdygert-spok in #726
• Rename KeyBundle to PubKeyBundle by @jdygert-spok in #710
• chore: add clippy::arithmetic_side_effects workspace lint by @djohnson-spideroak in #720
• release: 5.0.0 by @gknopf-aranya in #728

Full Changelog: v4.1.1...v5.0.0