Skip to content

v24.3.0-rc.3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Apr 22:48
v24.3.0-rc.3
17a8431

Sapling no longer relies on postinstall

In 24.2.0, @taquito/sapling fetched Sapling proving parameters during postinstall. That was fragile in practice: installs depended on external network availability, CI and hermetic environments needed special handling, and browser deployments still had no clean supported runtime model.

This RC replaces that with an explicit runtime contract.

What changed from 24.2.0

  • The install-time fetch is gone. Sapling proving parameters are no longer downloaded during postinstall.
  • Proof-generating flows now lazy-load parameters at runtime. Shielding, private transfers, and unshielding load the proving parameters only when needed.
  • Remote parameters are hash-verified before use. The pinned SHA-256 digest is the trust anchor, not the hostname.
  • The default hosted source is first-party. The pinned default URLs now live under https://sapling.taquito.io/params/groth16-mainnet-1/....
  • Viewing-only flows stay lightweight. Key derivation, address generation, balances, and transaction history do not require parameter initialization.

New Sapling runtime APIs

@taquito/sapling now exports:

  • initSapling()
  • preloadSaplingParams()
  • SaplingParamsError

Use initSapling() to choose the source policy:

import { initSapling } from '@taquito/sapling';

await initSapling({
  params: {
    source: 'taquito',
  },
});

initSapling() does not eagerly download the proving parameters. If you want to hide first-use latency, call preloadSaplingParams() once.

Parameter source options

Taquito now supports four Sapling parameter source modes:

  • source: 'taquito', the default first-party mirror
  • source: 'zcash', which uses the Zcash-hosted mirror
  • custom remote URLs with explicit SHA-256 digests
  • local filesystem paths for Node.js and CI

Remote loading is always hash-verified before use. For local file paths, digests are optional in trusted environments.

Browser compatibility and release confidence

This RC also hardens the Sapling browser path operationally:

  • browser smoke coverage now includes a real hosted preload flow against sapling.taquito.io
  • obsolete Sapling browser shim paths were removed
  • release and preview workflows now explicitly verify the @taquito/sapling-wasm handoff before publication
Assets 2
Loading