v5.6.0

Security

⚠️ Critical — wallet cipher seed storage ([GHSA-wh49-x9c8-7jc8](GHSA-wh49-x9c8-7jc8))

This release patches a critical flaw in minotari_wallet (affected: < 5.6.0). A broken key-derivation bug meant the wallet's secondary encryption key and its stored verification commitment were derived over the same domain and input, making them byte-for-byte identical. Anyone with read access to the wallet SQLite file (stolen laptop, backup, cloud sync, or malware) could recover the secondary key straight from the stored hash, decrypt the main key, and recover the master cipher seed — bypassing passphrase protection entirely, with no Argon2 brute-force required. All users on versions before 5.6.0 are strongly encouraged to upgrade.

What's Changed

• feat: peer improvements in [#7927](#7927)
• feat: extra warning for printing seed words in [#7948](#7948)
• feat: optimize clones during validation in [#7923](#7923)
• fix: actually perform DNSSEC validation on DNS seed records in [#7941](#7941)
• fix: bound the number of signatures in a sidechain quorum certificate in [#7944](#7944)
• fix: enforce MAX_SIZE invariant when deserializing bounded types in [#7942](#7942)
• fix: ensure requests are clamped to max number in [#7938](#7938)
• fix: env leaking in logs in [#7929](#7929)
• fix: file permissions in [#7931](#7931)
• fix: gate grpc get_network_state behind the method allow-list in [#7939](#7939)
• fix: grpc auth max length in [#7934](#7934)
• fix: idle rpc timeout in [#7937](#7937)
• fix: ledger logs in [#7932](#7932)
• fix: libtor ports and passwords in [#7933](#7933)
• fix: protect the paper wallet import temporary database in [#7945](#7945)
• fix: tari transaction component security hardening in [#7940](#7940)
• fix: validate pre-mine session ID before using it as a path in [#7943](#7943)
• fix: RISC-V builds in [#7928](#7928)

Full Changelog: v5.5.0...v5.6.0