Release 3.16.0 · near/mpc

This release primarily contains nearcore 2.14.0-rc.2, SVM chain support for Read RPC (foreign tx validation) and some security fixes.

#4371(@kevindeforth): (contract) ProposalHash allows for user-defined serializers and hashers (#4371)
#4386(@gilcu3): Add presign+sign online phase in Cait-Sith (#4386)
#4417(@netrome): Allow participants to remove their update proposals (#4417)
#4137(@frolvanya): (foreign-tx) Svm inspector (#4137)
#4138(@frolvanya): (foreign-tx) Wire svm chains into node (#4138)
#4455(@barakeinav1): (contract) Bound the participant url with a BoundedString type (#4455)
#4258(@haiyuechen-nearone): (node) Export foreign chain provider metrics on the verify path (#4258)

#4474(@netrome): (test) Retain more blocks in sandbox tests to fix GC race condition (#4474)

#4396(@kevindeforth): (contract) Unify participant membership checks (#4396)
#4407(@kevindeforth): Typed sandbox views (#4407)
#4403(@kevindeforth): (contract) Use generic votes for mpc node docker hash votes (#4403)
#4447(@kevindeforth): Rename "vote_code_hash" method to "vote_mpc_node_manifest_digest" (#4447)
#4410(@kevindeforth): (tee-context) Subscribe to allowed hashes through MpcContractHandle (#4410)

#4368(@kevindeforth): Organize docs assets and explain rules in AGENTS.md (#4368)
#4370(@netrome): Add audit reports (#4370)
#4372(@netrome): Drop repo links from audit README (#4372)
#4394(@barakeinav1): Un-archive and refresh the TDX cloud providers list (#4394)
#4392(@gilcu3): Document how host unattended upgrades should be handled in TDX (#4392)
#4476(@kevindeforth): Formalize bandwidth requirements for node operators (#4476)

#4366(@haiyuechen-nearone): (inspector) Cover the not found verdict in the fan out mismatch test (#4366)
#4435(@gilcu3): (contract) Make test check contract storage keys properly (#4435)
#4439(@gilcu3): (node) Make sure assets are warm before running integration tests (#4439)
#4457(@anodar): Implement test for malicious RPC provider (#4457)

#4375(@dependabot[bot]): Bump the github-actions group across 1 directory with 2 updates (#4375)
#4376(@dependabot[bot]): Bump the rust-minor-and-patch group with 3 updates (#4376)
#4398(@barakeinav1): (attestation) Explain why the image hash payload is hex-decoded (#4398)
#4400(@kevindeforth): (contract) Update contract migrations after 3.15.0 release (#4400)
#4409(@dependabot[bot]): Bump the github-actions group across 1 directory with 2 updates (#4409)
#4412(@dependabot[bot]): Bump the rust-minor-and-patch group with 7 updates (#4412)
#4413(@dependabot[bot]): Bump rstest from 0.26.1 to 0.27.0 (#4413)
#4422(@kevindeforth): (ci) Ignore RUSTSEC-2026-0285 (#4422)
#4414(@dependabot[bot]): Bump zstd from 0.13.3 to 0.14.0 (#4414)
#4404(@anodar): Drop legacy foreign chain API (#4404)
#4438(@gilcu3): (contract) Update migrations after 3.15.1 rollout (#4438)
#4452(@netrome): Bump nearcore to 2.14.0-rc.2 (#4452)

Docker images

nearone/mpc-node:3.16.0
Manifest digest: sha256:a6beae87e398f5b16d923193753a57b0985098be04d06e82b3fdad78fe41ed2d
nearone/mpc-node-gcp:3.16.0
Manifest digest: sha256:e3b596326c6983752e35731e524e0a79f6cd5a3b585566675f82382e928da14a
nearone/mpc-launcher:3.16.0
Manifest digest: sha256:02faadb1c82adda9e96ef15eb606c8655f09121980b46211f1fabf6901914a4c

digest: sha256:a0f8987e771844528fe71952f9c5598dd9f0d1b677c47d718bd71ac441283a30