[0.14.0] - 2026-06-02
=====================

Added
-----
- `orchard::action::ActionFromPartsError`
- `orchard::Proof::expected_proof_size`, the canonical byte length of a proof
  for a given number of actions.
- `orchard::bundle::BundleError`
- `impl From<orchard::action::ActionFromPartsError> for orchard::pczt::TxExtractorError`
- `impl From<orchard::bundle::BundleError> for orchard::pczt::TxExtractorError`
- `orchard::bundle::ProofSizeEnforcement`
- `orchard::Bundle::<Authorized, V>::try_from_parts`, which constructs an
  authorized bundle while rejecting a proof whose length is not the canonical
  size for the bundle's number of actions (GHSA-2x4w-pxqw-58v9). This is now the
  only way to construct a `Bundle<Authorized, _>`, so an authorized bundle can
  no longer hold a proof padded with arbitrary data when proof size enforcement
  is strict.
- `orchard::Bundle::<EffectsOnly, V>::from_parts`
- `orchard::circuit::OrchardCircuitVersion`, an enum selecting the Action circuit
  version, with variants `InsecurePreNu6_2` and `FixedPostNu6_2`.
- `orchard::circuit::ProvingKey::build_for_version` and
  `orchard::circuit::VerifyingKey::build_for_version`, which build the key for a
  given `OrchardCircuitVersion`; `build()` continues to build the fixed circuit.
  `ProvingKey::build_for_version` can build the proving key for the pre-NU6.2
  (insecure) circuit.
- `orchard::circuit::ProvingKey::circuit_version`, the version the proving key
  produces proofs for. `Proof::create` now returns an error if a circuit's
  version does not match the proving key's.
- `orchard::circuit::Circuit::from_action_context_for_version`, like
  `from_action_context` but building the circuit for a chosen
  `OrchardCircuitVersion`.
- `orchard::builder::Builder::new_for_version` (requires the `circuit` feature),
  which constructs a builder that produces proofs for a given
  `OrchardCircuitVersion` (`Builder::new` uses `FixedPostNu6_2`).
- `orchard::builder::bundle_for_version` (requires the `circuit` feature), like
  `bundle` but building the Action circuits for a given `OrchardCircuitVersion`.
- `orchard::Bundle::<InProgress<Unproven, S>, V>::circuit_version` (requires the
  `circuit` feature), the `OrchardCircuitVersion` the bundle's actions were built
  for, so a caller can select a matching `ProvingKey` without tracking it
  separately.

Changed
-------
- Updated to `halo2_gadgets 0.5.0`
- `orchard::action::Action::from_parts` now returns
  `Result<Self, orchard::action::ActionFromPartsError>` instead of `Option<Self>`.
- `orchard::pczt::TxExtractorError` has added variants `InvalidEpk` and
  `NonCanonicalProofSize`. The Transaction Extractor role now rejects a PCZT
  whose `zkproof` is not the canonical size for its number of actions
  (GHSA-2x4w-pxqw-58v9).
- `unstable-voting-circuits`-only:
  - `orchard::constants::OrchardFixedBases` is now a unit struct rather than a
    3-variant enum. It is a trait carrier for the halo2_gadgets `FixedPoints`
    impl and was never constructed as a value; the concrete fixed bases live
    in `OrchardFixedBasesFull`, `OrchardBaseFieldBases`, and
    `OrchardShortScalarBases`, which are unchanged.

Removed
-------
- `orchard::Bundle::from_parts`. Construct a bundle through the
  authorization-specific constructor instead: `Bundle::<EffectsOnly, V>::from_parts`,
  or `Bundle::<Authorized, V>::try_from_parts` for an authorized bundle.
- `unstable-voting-circuits`-only:
  - The five dead `From<X> for OrchardFixedBases` conversions (from
    `OrchardFixedBasesFull`, `NullifierK`, `ValueCommitV`,
    `OrchardBaseFieldBases`, `OrchardShortScalarBases`). None were reachable;
    in-circuit dispatch goes through the per-slot enums.
  - `impl FixedPoint<pallas::Affine> for NullifierK` and
    `impl FixedPoint<pallas::Affine> for ValueCommitV`. After the 0.13.1
    enum refactor, dispatch routes through `OrchardBaseFieldBases::NullifierK`
    and `OrchardShortScalarBases::ValueCommitV`, leaving the standalone
    unit-struct impls dead.

Fixed
-----
- The update to `halo2_gadgets 0.5.0` fixes a critical vulnerability related to
  its use in the Orchard circuit. Please see the release notes for
  `halo2_gadgets 0.5.0` for additional details.
- An authorized `Bundle` or a PCZT can no longer carry a `zkproof` padded with
  arbitrary trailing data, and an `Action` can no longer be constructed with an
  `epk` that does not encode a non-identity Pallas point (GHSA-2x4w-pxqw-58v9).
  See the `Bundle::<Authorized, V>::try_from_parts`,
  `Proof::expected_proof_size`, `Action::from_parts`, and `TxExtractorError`
  entries under `Added` and `Changed` above for the API surface of these checks.