v0.18.0

First stable release on the Miden 0.17 line. It consolidates the 0.18.0-rc.1, rc.2 and rc.3 pre-releases; the notes below cover everything since v0.17.0. It publishes the server image (ghcr.io/openzeppelin/guardian:v0.18.0), the Rust crates and the npm packages (dist-tag latest).

⚠️ Breaking changes

This release is not backwards compatible with v0.17.x servers, SDKs, or existing multisig accounts. Servers and all SDK packages (Rust and npm) must be upgraded together to v0.18.0. Deploy the server before rolling out the SDKs: the 0.18.0 SDKs call an endpoint that v0.17.x servers do not serve.

• Miden 0.17 (stable). Pins miden-protocol / miden-standards / miden-client 0.17.0 and @miden-sdk/miden-sdk 0.17.0. Requires a node on 0.17.0 (devnet is; testnet still runs Miden 0.16 and stays on v0.17.0). A node accepts a client only when the pre-release label matches, so this build rejects an rc node and vice versa (accept header validation failed). See docs/MIDEN_COMPATIBILITY.md.
• Accounts must be recreated. Account, delta and transaction-summary encodings are versioned, procedure ordering and commitments changed, and the multisig auth argument is now a three-word commitment, so nothing created or signed under 0.16 verifies on 0.17. The first 0.18.x server start runs the irreversible migration 2026-09-22-000001_miden_017_irreversible_reset, which deletes all stored Miden account data (EVM accounts survive). Operator steps in docs/PRODUCTION.md.
• Client stores must be recreated. Rust SQLite and browser IndexedDB stores created under 0.16 do not open under 0.17. The 0.18.0 release candidates are not supported, and stores they wrote do not open either.
• TypeScript: Multisig.syncState() returns SyncStateResult, either { source: 'guardian', state } or { source: 'local', localNonce, guardianNonce }. Against a server without the canonical nonce endpoint, sync fails instead of falling back.
• TypeScript SDK runs only on the supplied MidenClient. WasmWebClient is no longer accepted by createMultisigAccount, the build*TransactionRequest builders or executeForSummary*, and midenRpcEndpoint is removed from those helpers and from SignatureOptions. Browser clients need useWorker: false until the web SDK fixes worker mode.
• Proposals execute at the chain tip. The SDK syncs before it verifies, signs or executes; a client behind the proposal's bound block fails with the retryable MultisigError::ChainBehindBoundBlock / ChainBehindBoundBlockError. Rust proposal_auth_args(client, summary) no longer takes a ChainAnchor.
• Private note relay requires inclusion proofs. Rust send_private_note_with_proof, TypeScript notes.sendPrivate({ inclusionProof }) or notes.sendPrivateOutput.
• Custom-proposal producers must serialize TransactionRequests with a client on the 0.17.0 pins. A request that binds a block without declaring it is refused with MultisigError::BoundBlockNotDeclared / BoundBlockNotDeclaredError.
• Rust: ClientBuilder::rng is available only under the testing feature; the SDK no longer supplies its own random generator.
• Install pins. npm install @openzeppelin/miden-multisig-client@0.18.0 @miden-sdk/miden-sdk@0.17.0. Rust: miden-multisig-client = "=0.18.0" with miden-client = "=0.17.0".

Highlights

• Proposals stay executable after the node prunes old state (#462). Cosigners verify, sign and execute at the chain tip instead of re-executing at the anchor block, which failed with block N has been pruned once the node dropped that block's account state (about 50 blocks on devnet). See Tip execution and the bound block.
• Canonical nonce endpoint and sync pre-check (#487). GET /state/nonce and gRPC GetCanonicalNonce return the latest canonical { account_id, nonce, commitment } without the state blob; both SDKs skip the full state fetch when GUARDIAN is not ahead. The migration 2026-09-30-000001_state_nonce is additive.
• Chain-driven release sweep (#484). The old GUARDIAN releases accounts whose SwitchGuardian delta never reached it. Its settings are reported in the dashboard server info as releaseSweep.
• TypeScript SDK uses the supplied MidenClient (#503), so SDK reads and syncs no longer drift from the caller's client.
• Stricter ECDSA lookup signatures (#508). Lookup auth accepts only 65-byte ECDSA signatures.

What's Changed

• chore(deps-dev): bump baseline-browser-mapping from 2.10.21 to 2.11.21 in /examples/operator-smoke-web by @dependabot[bot] in #466
• chore(deps): bump nanoid in /examples/web by @dependabot[bot] in #456
• chore(deps-dev): bump browserslist from 4.28.2 to 4.28.9 in /examples/evm-smoke-web by @dependabot[bot] in #447
• chore(deps): bump nanoid in /examples/smoke-web by @dependabot[bot] in #445
• chore(deps): bump nanoid from 3.3.11 to 3.3.18 in /examples/operator-smoke-web by @dependabot[bot] in #446
• chore(deps): bump @vitest/mocker and vitest in /packages by @dependabot[bot] in #459
• fix(multisig-client): authenticate consume-notes input notes before every summary (#409) by @haseebrabbani in #460
• chore(deps-dev): bump vite from 5.4.21 to 6.4.3 in /packages by @dependabot[bot] in #467
• fix(multisig-client): list unverifiable proposals instead of failing the whole listing (#462) by @haseebrabbani in #463
• chore(deps): bump postcss from 8.5.10 to 8.5.28 in /examples/operator-smoke-web by @dependabot[bot] in #470
• chore(deps): bump brace-expansion from 5.0.6 to 5.0.9 in /examples/_shared/multisig-browser by @dependabot[bot] in #472
• chore(deps): bump postcss from 8.4.49 to 8.5.28 in /examples/smoke-web by @dependabot[bot] in #471
• chore(deps): bump brace-expansion from 5.0.5 to 5.0.9 in /examples/operator-smoke-web by @dependabot[bot] in #473
• feat: Add production guide / production improvements by @zeljkoX in #302
• feat(infra): route CloudWatch alarms to per-environment Slack channels by @haseebrabbani in #474
• fix(multisig-client): reconcile the proposal cache with GUARDIAN on sync by @zeljkoX in #458
• feat(infra): alarm on ERROR-level server log lines via CloudWatch Logs metric filters by @haseebrabbani in #475
• fix(multisig-client): bind the endpoint commitment check to the account's scheme by @zeljkoX in #479
• feat(dashboard): bounded GET /dashboard/stats for account and Miden vault aggregates (#371) by @haseebrabbani in #469
• chore: Update subdomain references to match newly provisioned ones by @zeljkoX in #468
• infra: manage the AWS Deploy workflow's GitHub OIDC roles in this repo by @haseebrabbani in #477
• feat(qualification): black-box end-to-end qualification suite by @zeljkoX in #478
• feat: Support Miden v0.17. rc version by @zeljkoX in #485
• chore(release): v0.18.0-rc.1 by @zeljkoX in #492
• ci(publish): prebuild the multisig SDK example fixtures before the package tests by @haseebrabbani in #493
• feat: migrate to miden-client / web SDK 0.17.0-rc.4 and execute multisig proposals at the chain tip by @haseebrabbani in #498
• chore(release): v0.18.0-rc.2 by @haseebrabbani in #499
• feat(server): chain-driven release sweep for guardian switches that never reached the push path (#434) by @haseebrabbani in #484
• chore(deps): bump brace-expansion from 5.0.4 to 5.0.12 in /examples/smoke-web by @dependabot[bot] in #490
• chore(deps): bump postcss from 8.5.6 to 8.5.28 in /examples/web by @dependabot[bot] in #489
• ci(publish): build guardian-operator-client before the multisig SDK tests by @haseebrabbani in #494
• chore(deps): bump brace-expansion from 5.0.9 to 5.0.12 in /packages by @dependabot[bot] in #506
• chore(deps): bump brace-expansion from 5.0.9 to 5.0.12 in /examples/_shared/multisig-browser by @dependabot[bot] in #505
• feat: canonical nonce endpoint and sync pre-check by @haseebrabbani in #487
• ci(docker): build each platform natively and merge into one manifest list by @haseebrabbani in #496
• fix(multisig-client): use the supplied MidenClient instead of a second WASM client on its store by @haseebrabbani in #503
• fix(server): only accept 65-byte ECDSA lookup signatures by @haseebrabbani in #508
• chore(deps): bump Miden to protocol 0.17.0-rc.9, client and web SDK 0.17.0-rc.5 by @zeljkoX in #511
• chore(release): v0.18.0-rc.3 by @zeljkoX in #513
• chore(deps): bump brace-expansion from 5.0.9 to 5.0.12 in /examples/operator-smoke-web by @dependabot[bot] in #515
• chore: Fix operator client readme by @zeljkoX in #516
• chore: Bump miden deps by @zeljkoX in #520
• chore(release): v0.18.0 by @zeljkoX in #521

Full Changelog: v0.17.0...v0.18.0