v24.3.0-rc.2

Since 24.2.0, Taquito has focused on network reliability, testnet turnover, wallet integration hardening, browser compatibility, and internal modernization.

Upgrade checklist

Most of these are dependency bumps that require little or no code changes:

• Node.js >=22 is now required. Node 20 reaches EOL April 2026; Node 22 ships with native globalThis.fetch, which let us drop node-fetch.
• TypeScript upgraded from 5.5.4 to 5.9.3. Compilation target moved from es6 to es2020, and useUnknownInCatchVariables is now enabled. If you import Taquito's types, check that your TS version is compatible.
• bignumber.js upgraded to v10. Taquito normalizes at its own API boundary, so this is transparent for most consumers. If your code names BigNumber in its own type signatures, add a direct bignumber.js@^10 dependency to avoid TypeScript treating the transitive copy as a different type. (#3383)
• @taquito/sapling packaging changes. The postinstall network fetch is gone; proving parameters are vendored. Spend params have been split into @taquito/sapling-spend-params, and output params are externalized via globalThis.__taquitoVendoredParams. The wasm dependency moved from @airgap/sapling-wasm to @taquito/sapling-wasm@0.1.1. If you don't use sapling, none of this affects you. (#3380, #3389, #3402)
• @taquito/wallet-connect and WalletProvider type surface tweaks. getAllExistingSessionKeys() and configureWithExistingSessionKey() are now synchronous in the type surface, and WalletProvider requires the mapper methods used by Taquito's wallet pipeline. Runtime await still works; only typed consumers with custom wallet providers or local declaration shims need to update.
• Estimation gas/fee values may shift. See the gas patching section below. This is a correctness fix, not an API change.

Upgrading with AI assistance

If you use an AI coding assistant (Claude Code, Cursor, Copilot, etc.), you can paste the following prompt into your project to automate the upgrade. It is scoped to the changes in this release and will not make speculative modifications.

The latest RC of Taquito is 24.3.0-RC.1. Update this project to use it.

Start by reading package.json (and any lockfile) to understand which @taquito/* packages are currently installed, what version they're on, and whether bignumber.js appears as a direct dependency.

Then update all @taquito/* dependency ranges to ^24.3.0-RC.1 and run the package manager install.

Pay special attention to these areas, which are the most common sources of upgrade friction:

1. bignumber.js — Taquito now depends on v10. If this project names BigNumber in its own type signatures, add a direct bignumber.js@^10 dependency. If it only consumes BigNumber values returned by Taquito without annotating them, no change is needed.
2. TypeScript compatibility — Taquito now targets es2020 and enables useUnknownInCatchVariables. Check that this project's tsconfig.json target and lib are compatible (es2020 or later). If catch blocks use untyped e.message patterns, they may need unknown narrowing.
3. Node.js version — The minimum is now Node 22. Check engines in package.json, .nvmrc, Dockerfile, and CI configs for version pins below 22.
4. @taquito/sapling — If this project uses sapling, the wasm dependency moved from @airgap/sapling-wasm to @taquito/sapling-wasm. Spend params are now a separate @taquito/sapling-spend-params package. Update imports accordingly. If sapling is not used, skip this.
5. @taquito/wallet-connect — If this project uses WalletConnect, getAllExistingSessionKeys() and configureWithExistingSessionKey() are now synchronous in the type surface. Check for any await on these calls or custom WalletProvider implementations that may need their type definitions updated.
6. Ghostnet references — Ghostnet has been retired. If this project references Ghostnet RPC URLs or network names, migrate them to Shadownet.
7. Beacon relay nodes — Papers-operated Matrix relay defaults have been removed. If this project hardcodes Papers relay URLs, remove them. Taquito now defaults to Trilitech-operated relays on the octez.io domain.

After making changes:

• Run the project's TypeScript compiler (tsc --noEmit or equivalent) and fix any type errors.
• Run the test suite if one exists.
• List a summary of every change you made and why.
• List any recommendations for things that compiled fine but deserve manual review (e.g., custom gas/fee assertions that may need revalidation, custom WalletProvider implementations, or sapling usage patterns).

The expected result is a clean compile with all @taquito/* packages on 24.3.0-RC.1, no regressions in the test suite, and a short list of anything that needs human attention.

Estimation gas patching now aligns with protocol semantics

Taquito's estimation gas patching was reworked to match protocol and octez-client behavior. For batch estimation, Taquito now patches only operations missing gas limits, subtracts explicitly provided gas first, reserves reveal gas when a reveal will be prepended, and divides remaining block gas across the rest. This also fixes implicit-reveal estimation on networks where per-operation and per-block gas limits are equal (i.e. mainnet, shadownet).

This bug was historically masked because our long-running integration coverage ran against tallinnnet, which had hard_gas_limit_per_block (1_386_666) greater than hard_gas_limit_per_operation (1_040_000). Mainnet and shadownet use equal limits (1_040_000), so the faulty gas division would exceed limits there. Once CI moved to shadownet, the issue became visible.

User impact: exact estimated gas and fee values may change, especially for mixed batches and unrevealed accounts. Applications that added custom workarounds or brittle assertions around previous estimate values should revalidate those flows after upgrading. Most users should see more reliable estimation on mainnet-like networks.

Public references: #3352, #3353

RPC read consistency semantics finalized

The broader consistency hardening earlier in this series over-pinned ordinary contract handles, making op.contract() and at(..., block) behave like exact historical snapshots. Beta.3 settles the intended semantics:

• atExactBlock(...) keeps persistent pinning and exact historical reads.
• at(..., block) and op.contract() use the block only to bootstrap reliably, then return live head-tracking abstractions, preserving existing Taquito contract semantics.

Exact read context is propagated through contract, big map, sapling, and TZIP-16 read paths. Shadownet secret-key integration runs have also been normalized to the same rolling RPC as the ephemeral shadownet config. (#3381)

Network and testnet updates

• Ghostnet has been retired. Shadownet succeeds it.
• Papers-operated Matrix relay defaults have been removed from Taquito's wallet stack.
• Taquito's default relay configuration now points to nodes operated by Trilitech on the octez.io domain.
• If dApps still see wallet connection failures at the relay layer, those issues should be directed to octez.connect: https://github.com/trilitech/octez.connect/issues

Reliability and correctness

• Tezos X/Tezlink fee estimation was updated to use the live fee parameters exposed by mempool/filter, rather than relying on L1-style defaults. Tezos X pricing includes a higher per-byte data-availability cost and a congestion-sensitive gas price, so older L1-style assumptions can underprice operations.
• Simulation retries and origination reads were hardened around RPC edge cases.
• Wallet confirmation handling was fixed to avoid hanging indefinitely after a timeout.
• Subscription polling was fixed to avoid canceling in-flight RPC requests.
• The TZIP-16 metadata URI parser was rewritten to eliminate a CodeQL-flagged ReDoS pattern. (#3385)
• @taquito/beacon-wallet package exports conditions were reordered to fix bundler resolution. (#3390)

Browser compatibility

• @taquito/michelson-encoder no longer relies on Node.js Buffer for hex conversion. BLS12-381, chest, chest-key, bytes, and sapling-transaction token types now use buf2hex from @taquito/utils. (#3400)
• @taquito/utils dropped typedarray-to-buffer in favor of Buffer.from() in b58Encode. (#3400)
• @taquito/sapling now explicitly imports the buffer polyfill and re-exports @taquito/sapling-wasm through a shim that ensures globalThis.Buffer is available. (#3400)
• process.env access in @taquito/http-utils and @taquito/taquito is now guarded behind typeof process !== 'undefined', preventing crashes in browser environments that don't shim process. (#3400)
• crypto-browserify was dropped from @taquito/beacon-wallet dependencies. (#3394)
• A browser package smoke test suite now covers import and basic instantiation for all published packages under Vite/esbuild. (#3400)

Transport and dependency modernization

• HTTP transport was migrated to native fetch, with exponential backoff, injection retries, and structured transport error classification.
• Parts of the crypto stack were modernized toward @noble/* (blake2b, ed25519, hmac, sha512), and mnemonic handling moved from bip39 to @scure/bip39.
• Bundler and package compatibility improved, especially around Vite, esbuild, ESM resolution, and dependency declarations. The install-time Angular patch was removed, simplifying package installation.
• The shipped-package toolchain was refreshed across Rollup, Vitest, Ledger transport, and related build helpers. Several unused transitive dependencies (whatwg-url, request, tmp, lodash paths) were dropped from the root lockfile, and legacy signature.json files were removed from published package manifests. (#3379, #3386, #3387)
• Beacon fork pinned to @ecadlabs/beacon-* 4.8.1-ecad.6. (#3390, #3394)

Wallet integration improvements

• @taquito/wallet-connect was updated to the current WalletConnect sign stack.
• Session handling in @taquito/wallet-connect is now stricter and more resilient, especially around restored, updated, expired, and deleted sessions. Restored sessions are validated before being accepted, and local active-account and network state are reconciled more consistently as sessions change.
• WalletConnect docs were refreshed to match the current runtime behavior and modal plan.

Tooling and docs

• The repo is moving from Jest to Vitest.
• TypeDoc upgraded from 0.26 to 0.28, with 807 doc warnings fixed.
• Release version-sync now only rewrites dependency ranges for actual workspace packages, preserving external scoped packages like @taquito/sapling-wasm. Release and rehearsal workflows install the stamped graph before version-stamp, build, test, and publish. (#3391)
• Documentation and website content received a broad cleanup pass, including SECURITY.md, root README.md, and website doc drift. Security reporting now routes through GitHub private vulnerability reporting with email fallback. A repository CODEOWNERS file was added for @ecadlabs/taquito-team. (#3386, #3388)
• Website live code examples and Ledger documentation were fixed for browser compatibility. (#3404, #3405)
• Integration and CI coverage have shifted toward Shadownet, with sharded runs, updated keygen flows, and hardening for live-state behavior on current testnets.

What's Changed since RC 1?

• fix: harden bignumber browser ESM imports