v0.18.3

Patch release on the Miden 0.17 line, covering everything since v0.18.2. It publishes the server image (ghcr.io/openzeppelin/guardian:v0.18.3), the Rust crates and the npm packages (dist-tag latest). Accounts and stored data carry over from v0.18.2: no reset, no database migration.

⚠️ Security: redeploy the server image

The eMudhra intermediate CA compromise (disclosed Oct 20, 2026) exposed eight intermediate CA keys that chain to roots in the major trust stores, so anyone holding one can issue a certificate for any hostname. Every Guardian image up to and including v0.18.2 ships Debian ca-certificates 20250419~deb12u1, which still trusts them. The server trusts the system store for its Miden RPC connection and for AWS KMS / Secrets Manager.

Deploy the v0.18.3 image. It requires ca-certificates 20250419~deb12u2, which distrusts the compromised intermediates (#566). Restarting a container from an older image keeps the old trust store. Check a running container with dpkg-query -W ca-certificates.

SDK upgrade notes

• No SDK code change. The SDK packages are republished at 0.18.3 to keep the coordinated version line; 0.18.2 SDKs keep working against a 0.18.3 server and the wire contract is unchanged.
• Rust applications keep their own lockfile. Run cargo update -p rustls-webpki there to pick up 0.103.16; upgrading the Guardian crates alone does not change it.
• TypeScript clients use the host's TLS. Browsers are already patched; use a Node.js release with the fix once it ships.
• Miden pins unchanged. miden-protocol / miden-standards 0.17.1, miden-client 0.17.3, @miden-sdk/miden-sdk 0.17.3. The auth_tx procedure root is unchanged, so accounts and client stores carry over.
• Install pins. npm install @openzeppelin/miden-multisig-client@0.18.3 @miden-sdk/miden-sdk@0.17.3. Rust: miden-multisig-client = "=0.18.3" with miden-client = "=0.17.3".

Highlights

• Patched CA trust store (#566). Minimum ca-certificates version enforced in every Docker stage; workspace lockfile on rustls-webpki 0.103.16 and webpki-roots / webpki-root-certs 1.0.10.
• First configuration claims the account first (#558). Two concurrent first /configure requests for one account can no longer both write state; the loser is judged as a reconfiguration, so a replayed first configuration is refused.
• Fewer account decodes (#523). push_delta and canonicalization promotion decode the account once, and push_delta_proposal verification runs under the reconstruction gate instead of on the async runtime.
• Observability (#522). Client-caused auth and configure rejections log at WARN instead of ERROR; gRPC server-fault statuses produced by tonic are now logged.
• Qualification (#551). Live runs consume waiting treasury notes before the balance check.
• Dependency updates: postcss (#557), source-map-js (#555, #556).

Guardian operations

Required: deploy the v0.18.3 image to every stack. There is no database migration and no new required setting; the image runs on the current task definition.

Optional: apply infra/ to pick up the infra half of #522 (ALB p99 latency alarm and dashboard widget, per-operation storage-error metrics). aws-deploy.yml only swaps the image. On prod, keep cloudwatch_log_alarms_enabled=false until the v0.18.3 image is running.

The production guide now requires v0.18.3 or later. See Upgrading from 0.18.2 to 0.18.3.