Rusk v1.7.0-rc.0

⚠️ TESTNET ONLY ⚠️

1.7.0-rc.0 - 2026-05-06

Added

• Add HARDFORK_BOREAS VM feature wiring and version-aware transaction ingress decoding. [dusk-rusk]
• Add configurable http.policy settings for ACL rules and class-based rps/burst/concurrency limits. [dusk-rusk]
• Add static wallet-core driver endpoint /static/drivers/wallet-core-1.6.1.wasm. [dusk-rusk]
• Add contract_owner to /on/contract:{entity}/metadata. [dusk-rusk]
• Add a bounded pre-admission retry queue for non-consecutive Moonlight transactions [dusk-node]
• Add hardfork-governed transaction format selection for ledger replay and ingress decoding. [dusk-node-data]
• Add a regression test covering historical pre-Aegis transaction decoding in block serialization. [dusk-node-data]
• Add explicit CanonicalTransaction and LedgerTransaction boundaries to separate canonical transaction data from persisted ledger envelopes. [dusk-node-data]
• Add call hook to enforce Phoenix withdrawal replay token nullifier count [dusk-vm]
• Add canonical contract deployment helpers for bytecode hashing and contract-id derivation [dusk-core]
• Add a stable client-facing transaction network serializer that stays fork-agnostic across supported envelopes [dusk-core]
• Add FFI support for serializing contract deployment transaction data and deriving contract IDs. [dusk-wallet-core]
• Add a ContractDeployment builder and BookEntry.deploy() API for programmatic smart contract deployment. [w3sper.js]

Fixed

• Fix panic during invalid tx refund processing (P1.2-7) [dusk-rusk]
• Queue future-nonce Moonlight transactions during HTTP propagation instead of rejecting them on local admission gaps [dusk-rusk]
• Emit deferred transaction lifecycle events when HTTP propagation queues future-nonce Moonlight transactions [dusk-rusk]
• Accept Aegis transaction bytes during Boreas HTTP ingress by normalizing live transaction envelopes [dusk-rusk]
• Map invalid transaction ingress format rejections to HTTP invalid-input errors instead of failing exhaustiveness checks in preverify handling [dusk-rusk]
• Canonicalize locally sealed transactions to the active ledger format before committing them into blocks [dusk-rusk]
• Remove unsafe consensus spin-time environment mutation during node initialization [dusk-node]
• Require a higher gas price to replace conflicting mempool transactions [dusk-node]
• Reject non-improving mempool transactions before VM preverification [dusk-node]
• Reject deploy transactions whose gas charge overflows during mempool admission. [dusk-node]
• Reject blob transactions whose gas charge overflows during mempool admission [dusk-node]
• OutOfSync: stop consensus task on entry [dusk-node]
• OutOfSync: ensure sync attempts do not exceed SYNC_ATTEMPTS [dusk-node]
• InSync: reject implausible far-future Quorum sync targets [dusk-node]
• OutOfSync: add early recovery on valid next-round Candidates [dusk-node]
• OutOfSync: rotate sync peers on retry [dusk-node]
• Reject historical transaction formats during live mempool admission while preserving ledger replay compatibility [dusk-node]
• Reject candidate transactions whose ledger encoding does not match the canonical ledger format for the block height. [dusk-consensus]
• Re-encode canonical transaction bytes from semantic transaction data during hashing and serialization instead of preserving stale decoded input bytes [dusk-node-data]
• Preserve deploy/init events in pre-Boreas replay so historical event blooms remain stable when deployment receipts are returned from Piecrust [dusk-vm]
• Reuse a shared secp256k1 context in secp256k1_recover to avoid per-call allocations (P1.2-6) [dusk-vm]
• Gate the deploy gas sufficiency check behind Boreas so historical deploy semantics remain unchanged before the hard fork (P1.2-5) [dusk-vm]
• Fail transaction refunds gracefully instead of panicking (P1.2-7) [dusk-vm]
• Fail deploy-charge overflow checks explicitly instead of wrapping the gas requirement [dusk-vm]
• Reject deploy transactions whose required gas charge overflows during precondition checking [dusk-core]
• Reject blob transactions whose required gas charge overflows during precondition checking [dusk-core]
• Restore historical pre-Aegis transaction decode compatibility for ledger replay while keeping ingress decoding format-gated [dusk-core]
• Reject transaction decodes with trailing bytes instead of accepting and canonicalizing them away [dusk-core]
• Prevent phoenix balance aggregation from wrapping on u64 overflow by using saturating sums [dusk-wallet-core]
• Reject unsafe ZIP entry paths during state recovery extraction to prevent path traversal writes [rusk-recovery]
• Reject insecure http:// base state downloads during recovery [rusk-recovery]
• Add missing decode_input_fn support for stakes so query inputs are round-trip decodable. [dusk-stake-contract-dd]
• Add prev_state_changes feeder query mapping to schema, input decoding, and output decoding. [dusk-stake-contract-dd]
• Batch existing_nullifiers sync queries to avoid large restore failures. [w3sper.js]

Changed

• Link Boreas DuskEVM host-query activations on mainnet/testnet and enable Boreas from genesis on devnet/localnet [dusk-rusk]
• Consolidate node config resolution and chain-upgrade policy into a single internal path. [dusk-rusk]
• Gate Boreas deployment gas rules (deploy_remaining_gas_check and charge_init_gas) behind feature activation so pre-fork replay semantics remain unchanged. [dusk-rusk]
• Pass the Boreas hardfork context through to dusk-vm so Boreas-specific VM host-query pricing can activate independently of backend changes. [dusk-rusk]
• Pass a unified host-query execution policy into dusk-vm so memoized VM cache keys stay aligned with the active verifier and hard-fork semantics. [dusk-rusk]
• Enforce HTTP ingress policy with ACL and endpoint-class global limits (http.policy), returning 403 on ACL deny and 429 with Retry-After on limit rejections. [dusk-rusk]
• Split HTTP server routing into dedicated graphql_http and rues_http modules while keeping API behavior unchanged. [dusk-rusk]
• Route transaction ingress and node execution through explicit canonical ledger transaction boundaries. [dusk-rusk]
• Extract transaction admission checks from the mempool service and validate canonical transactions without re-encoding ledger envelopes on the hot path. [dusk-node]
• Accept Aegis and Boreas envelopes during live mempool admission and normalize them to the active ingress format [dusk-node]
• Switch transaction validation call sites to use the explicit LedgerTransaction ledger wrapper. [dusk-consensus]
• Make canonical transaction construction infallible, remove the test-only ingress helper, and move ledger reformatting onto LedgerTransaction [dusk-node-data]
• Accept Aegis and Boreas transaction envelopes for live ingress decoding and normalize them to the active ingress format [dusk-node-data]
• Extend host-query memoization to deterministic calls: hash, poseidon_hash, verify_schnorr, verify_bls_multisig, keccak256, sha256, verify_kzg_proof, and secp256k1_recover. [dusk-vm]
• Raise the default PLONK, Groth16, and BLS memoization cache sizes from 512 to 2048. [dusk-vm]
• Add deterministic Boreas host-query pricing, including size-based pricing for hash, keccak256, and sha256, and key-count pricing for verify_bls_multisig. [dusk-vm]
• Split host-query internals into host_queries/ modules and make memoized cache keys semantics-aware through a unified execution-policy context, preventing stale cache reuse across future fork or verifier changes. [dusk-vm]
• Delegate contract-id derivation to the canonical dusk-core deployment helper [dusk-vm]
• Change FFI ABI to explicit use "C" repr [dusk-wallet-core]
• Delegate contract deployment assembly and contract-id derivation to the canonical dusk-core helpers [dusk-wallet-core]
• Serialize exported transaction bytes with the stable client network encoding instead of selecting hardfork-specific envelopes downstream [dusk-wallet-core]
• Adapt genesis contract deployment calls to piecrust's updated Session::deploy return type. [rusk-recovery]
• Rename deterministic test proving feature to unsafe_deterministic_rng and remove the no_random alias [rusk-prover]
• Update to edition 2024 [dusk-data-driver]
• Document intentional partial coverage of transfer contract data-driver mappings: external API surface is supported while internal management entrypoints and selected feeder outputs remain unsupported by design. [dusk-transfer-contract-dd]
• Add entrypoint type declarations and symbol documentation. [w3sper.js]
• Parallelize Phoenix note ownership scanning during sync based on available logical cores. [w3sper.js]
• Use the canonical /graphql endpoint for Network.query() requests instead of the legacy RUES GraphQL route. [w3sper.js]
• Build ledger transactions in test helpers through the explicit canonical transaction constructors. [dusk-rusk-test]

Removed

• Remove deprecated [chain] VM override fallback; [vm] is the canonical path for VM execution settings. [dusk-rusk]
• Remove deprecated RuskNodeBuilder VM setter shims in favor of with_vm_config. [dusk-rusk]
• Deprecate the legacy /on/account:{entity}/{topic} status route. [dusk-rusk]
• Deprecate the legacy /on/contract:{entity}/status route. [dusk-rusk]
• Deprecate the legacy /on/contract_owner:{entity}/{topic} route. [dusk-rusk]