Skip to content

v1.7.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Oct 18:18
· 83 commits to master since this release
v1.7.0
e4c2e7d
This commit was signed with the committer’s verified signature.
aeddi Antoine Eddi
SSH Key Fingerprint: IiEuCuB5rGISyQHKvYQepEUUKU7JHySgTPXxBbexJTs
Verified
Learn about vigilant mode.

v1.7.0

A coordinated upgrade. Every mainnet validator halts at block 1183000, around 09:05 UTC on 2026-10-30, set by GovDAO proposal 15, and restarts on v1.7.0: after the halt a node refuses an older binary, and before it this one (halt_min_version = v1.7.0). Cut on the same commit as v1.7.0-rc.1, which onyx runs since block 754001.

Released from chain/mainnet at e4c2e7d9f. Previous release: v1.5.1, which mainnet runs: mainnet skipped v1.6.0 (#6372), so v1.7.0 also carries its changes. Every release mainnet has run is in its upgrade ledger.

Who should run it: every mainnet validator, at the halt. Pull the image or download the binary now; keep running v1.5.1 until the halt, and leave halt_height at 0 in config.toml.

What changes

New since v1.6.0:

  • Realm params (#6358): a realm param name may contain :.
  • VM (#6129): a runtime panic in a package-level var initializer reports the Gno panic instead of a Go nil dereference.
  • Queries (#6383): a state query loads its height directly instead of scanning every stored version.
  • gpao (#6400, #6401, #6402): fetches less, keeps genesis imports, skips packages already live, verifies again the packages it left pending.
  • gnoweb (#6270): IPFS images load through a configurable gateway.
  • gno (#6061): gno test -p is capped at GOMAXPROCS.

From v1.6.0, which mainnet skipped:

  • Node (#6359): commit field checks, mempool and RPC bookkeeping, VM fixes.
  • Sanitizer (#6298): sanitize.Block* escapes <gno-button anywhere on a line, and gnoweb draws <gno-button /> as a call-to-action link.
  • Sync (#6308): BeginBlock takes the last validators from the state instead of reloading them.
  • gnoweb: page metadata and robots policy, a notice on packages outside a trusted list, an Ask AI menu, omnisearch with an optional indexer, listings as a map and a dependency graph, icons, frames, buttons and math, a new homepage, realm pages as markdown, and security fixes on file paths and links. The full list is in #6426.

Operators, watch for

  • gnoland: nothing to change. Keep v1.5.1 running and halt_height at 0 in config.toml; let the node halt, then restart it on this release.
  • gnoweb: new flags -ipfs-gateway (default https://ipfs.filebase.io; a reverse proxy that sets its own CSP must allow it), -canonical-origin, -index-community (default none), -trusted-paths, -no-realm-notice (the notice is on by default), -trusted-proxies, -no-index (never on mainnet), -indexer-url (empty: off). Aliases no longer chain. Move gnoweb after the halt, with the new static homepage (misc/deployments/home-alias/home.mainnet.md): its buttons are only safe behind the new sanitizer.
  • gpao: nothing to change; move it last, once every node runs this release.
  • gnodev: new flags -web-ipfs-gateway and -validator-key-file.

Docker images

Multi-arch (linux/amd64, linux/arm64), signed keylessly by the release / docker workflow, the index and each platform image.

Image Index digest
ghcr.io/gnolang/gno/gnoland:v1.7.0 sha256:6145f2bebebe24ae798ae5ffb5f2f348bfd70c538e6b3722152e8643b2880cb3
ghcr.io/gnolang/gno/gnoweb:v1.7.0 sha256:78b1701335c89e525254cd7e996cce4b808c4d95e5273e127c78fd1bda399f0f
ghcr.io/gnolang/gno/gnofaucet:v1.7.0 sha256:18e1d5314b7cb8158afd74af23abecbe53aef9c45bc342c5daf952a35d7a6cb3
ghcr.io/gnolang/gno/gnokey:v1.7.0 sha256:62ee18e2e3dd74823e829507d567589949596de25336b0193daecd80155ff421
ghcr.io/gnolang/gno/gno:v1.7.0 sha256:5ab582a5cc3392186fc4cdc434f6347f0ee5b6e1166fe1bdcac4591cf2ff4347
ghcr.io/gnolang/gno/gnodev:v1.7.0 sha256:c129bfadebf57f1e54ab4a009ea497495aceac2d980b12eb048873b95077fa3c
ghcr.io/gnolang/gno/gnocontribs:v1.7.0 sha256:ae9bd1aeeccf42d2a6ff5cc8e8bc23df101e06eab8bb86c6fa6a428e5cc7c5c8
ghcr.io/gnolang/gno/gpao:v1.7.0 sha256:e5484d887d99ba0848a79ef7da4b01c3e2410c52b42973c21f1924ec98ae8372

Binaries

Attached below: gno, gnokey, gnoland, gnoweb and gnodev for linux and darwin, amd64 and arm64, built by the release / chain-tag workflow from this tag. CHECKSUMS.txt covers all of them, and gnoland, gnokey and gno print v1.7.0 on version. The binaries and CHECKSUMS.txt carry a build-provenance attestation.

Verify before you run it

gh attestation verify gnoland_linux_amd64 --repo gnolang/gno \
  --signer-workflow gnolang/gno/.github/workflows/release-chain-tag.yml \
  --source-ref refs/tags/v1.7.0

# cosign v3 or later: the signatures are in the Sigstore bundle format
cosign verify ghcr.io/gnolang/gno/gnoland:v1.7.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity https://github.com/gnolang/gno/.github/workflows/release-docker.yml@refs/tags/v1.7.0

Changes since v1.5.1

Compare. Every commit is a cherry-pick from master; the full list, with what was left out and why, is in #6426.

Assets 23
Loading