v0.1.0-alpha.4

[0.1.0-alpha.4] - 2026-06-25

This release contains substantial upgrades from the previous alpha release.
It adds direct ReadStateService-backed access to Zebra state via a new
zebra-state backend, as well as adding this functionality to the zaino
backend. A significant number of important RPC methods have been
added, in particular z_shieldcoinbase and the functionality of several
of the existing RPC methods have been fixed or improved.

Added

• zallet generate-encryption-identity command, which generates the wallet's age
  encryption identity using the age library that Zallet already embeds. This
  removes the need for the external rage / rage-keygen tool when setting up a
  wallet. It supports both plain and passphrase-encrypted identities; in
  non-interactive contexts the passphrase is read from the
  ZALLET_IDENTITY_PASSPHRASE environment variable.
• Cookie file authentication for the JSON-RPC interface. A random credential
  is generated on startup and written to {datadir}/.cookie, enabling
  zallet rpc to authenticate automatically without manual password setup.
  Cookie auth coexists with configured [[rpc.auth]] users.
• RPC methods:
  • decoderawtransaction
  • decodescript
  • getwalletstatus
  • verifymessage
  • z_converttex
  • z_exportkey (Sapling extended spending keys only)
  • z_importaddress
  • z_importkey (Sapling extended spending keys only)
  • z_shieldcoinbase

Changed

• This release is not compatible with wallets created by earlier alpha
  releases. The embedded Zaino chain indexer made a backwards-incompatible
  change to its database format (zingolabs/zaino#914), which this release pulls
  in. Zallet now refuses to open wallet databases last used by 0.1.0-alpha.3
  or earlier; start again with a fresh Zallet wallet or a new data directory.
• Updated the Zaino chain indexer to a pre-release rc-0.4.0 build
  (zingolabs/zaino#1238) that retains NU 6.2 support and adds optional
  ("ephemeral") finalised state. The embedded indexer now runs in ephemeral
  mode, serving finalised chain data directly from the validator instead of
  maintaining a persistent finalised-state database.
• The wallet sync engine has been migrated to Zaino's ChainIndex interface,
  and now scans full blocks instead of compact blocks:
  • Shielded outputs are trial-decrypted by a batched decryption engine.
  • Transparent outputs are detected directly while scanning blocks, instead
    of by polling the backing node's address index on every chain tip change.
  • Chain queries made by RPC methods now operate against a stable snapshot of
    the chain state.
• getrawtransaction now correctly reports the fields asm, reqSigs, kind,
  and addresses for transparent outputs.
• z_viewtransaction: The outgoing field is now omitted on outputs that
  zcashd didn't include in its response.
• Significant performance improvements to zallet migrate-zcashd-wallet.
• zallet migrate-zcashd-wallet now accepts --no-scan to skip chain scanning
  during migration.
• zallet rpc now sends credentials via the Authorization header instead of
  embedding them in the HTTP URL.

Fixed

• listaddresses no longer returns an internal error when the wallet contains
  standalone imported transparent keys (e.g. from a zcashd migration).
• No longer crashes in regtest mode when a Sapling or NU5 activation height is
  not defined.
• Zallet now refuses to open wallet databases from incompatible earlier alpha
  releases instead of attempting to migrate them.
• The network-mismatch startup error now reports the path of the wallet database
  and explains that a database is permanently tied to one network, so the cause
  and the available remedies are clear.
• z_sendmany no longer drop standalone transparent signing keys when the same
  address backs multiple proposal inputs. Keys are now accumulated per address
  rather than overwritten.
• Transparent UTXO ingestion now records tx_index for coinbase transactions
  by routing each observed transaction through decrypt_and_store_transaction
  in addition to put_received_transparent_utxo. This enables
  z_shieldcoinbase (and any other consumer of
  TransparentOutputFilter::CoinbaseOnly) to correctly identify coinbase
  outputs.
• z_sendmany no longer fails with Query returned no rows when a proposal
  includes inputs at HD-derived transparent addresses.
  The keystore's standalone-key decryption is now invoked only for addresses
  that were imported standalone; HD-derived addresses are signed for using
  the account's unified spending key.
• zallet migrate-zcashd-wallet now migrates transparent addresses that were
  added to the zcashd wallet via importpubkey or importaddress <redeemScript>.
• zallet migrate-zcashd-wallet now migrates view-only Sapling keys that were
  added to the zcashd wallet via z_importviewingkey. Each imported viewing
  key becomes its own view-only account.

v0.1.0-alpha.3

Changed

• Finished implementing the following stubbed-out JSON-RPC methods:
  • z_listaccounts

Fixed

• zallet rpc can communicate with Zallet again, by using a username and password from zallet.toml if any are present.

PRs included in this release

• Release 0.1.0-alpha.2 by @str4d in #312
• CI: Fix incorrect permissions specification in build-and-push-docker-hub.yaml by @y4ssi in #314
• Migrate to zcash_client_sqlite 0.19.0 by @str4d in #318
• fix: helpful error msg on keystore initialization by @distractedm1nd in #319
• Full source bootstrapped and deterministic build by @antonleviathan in #301
• Prepare for refactoring the sync engine by @str4d in #335
• Add --locked flag to cargo install commands by @conradoplg in #342
• reduce deps in Dockerfile by @antonleviathan in #339
• cli: Use user/password auth if any passwords are configured by @str4d in #343
• Finish implementing z_listaccounts by @str4d in #345
• rpc: Add z_getaccount by @str4d in #347
• Dependency updates for alpha.3 by @str4d in #350

New Contributors

• @distractedm1nd made their first contribution in #319
• @antonleviathan made their first contribution in #301
• @conradoplg made their first contribution in #342

Full Changelog: v0.1.0-alpha.2...v0.1.0-alpha.3

v0.1.0-alpha.2

Added

• JSON-RPC authorization mechanisms, matching zcashd:
  • Multi-user (supporting both bare and hashed passwords in zallet.toml).

Fixed

• Several balance calculation bugs have been fixed.
• Bugs related to detection and selection of unspent outputs have been fixed.
• JSON-RPC 1.x responses now use the expected HTTP error codes.
• JSON-RPC error codes now match zcashd more often.

PRs included in this release

• Release 0.1.0-alpha.1 by @str4d in #286
• Migrate to zcash_client_sqlite 0.18.1 by @str4d in #293
• Start fixing JSON-RPC error responses by @str4d in #298
• Migrate to zcash_client_sqlite 0.18.4 by @str4d in #300
• Migrate to zcash_client_sqlite 0.18.9 by @str4d in #308
• Migrate to latest Zaino revision by @str4d in #307
• Add SLSA build-provenance attestations for .deb artifacts and publish to the tag’s Release by @y4ssi in #292
• Add RPC authorization methods to config by @str4d in #299
• Improve error message when user attempts to store keys before init by @str4d in #310
• Update and audit dependencies by @str4d in #309
• Add Docker Image Signing, SBOM & Provenance Attestations by @y4ssi in #295

Full Changelog: v0.1.0-alpha.1...v0.1.0-alpha.2

v0.1.0-alpha.1

What's Changed

• Initial wallet binary framework by @str4d in #8
• Migrate to abscissa_core by @str4d in #10
• Add zcashd-compatible JSON-RPC endpoint by @str4d in #12
• Add zallet migrate-zcash-conf command by @str4d in #13
• Functional alpha by @str4d in #14
• Call init_wallet_db in Wallet::open by @str4d in #19
• [#23] MacOS cargo test build fails by @pacu in #24
• Shell completions, localized manpages, Debian packaging by @str4d in #17
• Ensure that a JSON-RPC result is always present on success by @str4d in #29
• Add CI workflows by @str4d in #27
• Ignore password-based auth options from zcash.conf by @str4d in #28
• Rust updates by @str4d in #32
• Misc fixes by @str4d in #34
• Components refactor by @str4d in #35
• Account RPCs by @str4d in #33
• rpc: Permit JSON-RPC IDs to be non-strings by @str4d in #42
• Migrate to zcash_client_sqlite 0.16 by @str4d in #43
• Set up key material storage by @str4d in #45
• Replace Abscissa dependency injection with direct component construction by @str4d in #46
• Dependency updates by @str4d in #97
• Update to librustzcash 0489ed87940fc729963edb3cc5d59985b52b3326 by @nuttycom in #98
• Update dependencies and audit some of them by @str4d in #100
• Sync wallet using a full node via Zaino instead of a lightwalletd by @str4d in #39
• Add z_getnewaccount by @str4d in #47
• rpc: Add support for async operations by @str4d in #102
• Add support for storing pre-BIP39 zcashd HD seed data. by @nuttycom in #107
• Document and test the current workflow for setting up a new wallet by @str4d in #106
• Enable importing existing accounts by @str4d in #112
• Allow nuparams to be added to the config by @oxarbitrage in #118
• CLI tests by @str4d in #120
• Add a zallet example-config command by @str4d in #122
• rpc: Add help command by @str4d in #125
• rpc: Add OpenRPC support by @str4d in #129
• Ensure that clippy is available for running beta lints. by @nuttycom in #132
• Reverse bytes in seed fingerprint hex encoding to match zcashd by @str4d in #131
• rpc: Reduce duplication of param details in OpenRPC support by @str4d in #130
• rpc: Add z_sendmany by @str4d in #103
• sync: Process transaction data requests from the wallet by @str4d in #135
• rpc: Fix z_recoveraccounts error message when treestate fetch fails by @str4d in #143
• sync: Poll non-ephemeral transparent addresses for mined UTXOs by @str4d in #142
• rpc: Use RawValue in http_request_compatibility to avoid extra parsing by @str4d in #148
• Update Zaino and Zebra to bring in bugfixes by @str4d in #145
• Add z_viewtransaction by @str4d in #144
• feat(docker): Optimize build with cache mounts and .dockerignore by @gustavovalverde in #150
• Handle chain reorgs gracefully in sync. by @nuttycom in #157
• Explicitly depend on tracing with required feature flags by @str4d in #160
• feat(config): Use String for validator_address and do hostname resolution by @gustavovalverde in #151
• Add tokio-console support by @str4d in #155
• Create Dockerfile by @y4ssi in #133
• Detect TDR errors corresponding to TransactionStatus::TxidNotRecognized by @str4d in #162
• Rust updates by @str4d in #161
• Add partial support for z_gettotalbalance by @nuttycom in #158
• rpc: Fix z_listunspent memo output to not truncate null bytes by @str4d in #173
• rpc: Replace f64s with a type that wraps Decimal by @str4d in #172
• Update to zcash/librustzcash@bffbe51 by @nuttycom in #174
• Add a stop RPC method for regtest mode usage by @oxarbitrage in #168
• cli: Add zallet rpc by @str4d in #165
• Use signals for chain tip changes & notify backend of transaction data request service. by @nuttycom in #163
• Overhaul config by @str4d in #166
• Migrate to using a datadir by @str4d in #181
• Implement z_listunifiedreceivers by @oxarbitrage in #177
• Create an mdBook for Zallet documentation by @str4d in #196
• React correctly to shutdown signals by @str4d in #185
• Fix CI by @oxarbitrage in #197
• start: Warn when currently-unused config options are set by @str4d in #202
• Document RPCs with altered semantics from the zcashd wallet by @str4d in #204
• book: Fix some links that were causing pages to not be rendered by @str4d in #205
• Document workaround for Windows paths in config files by @str4d in #206
• Update to latest librustzcash, zaino and zebrad by @nuttycom in #203
• database: Store wallet and version metadata for Zallet by @str4d in #198
• Use the new ZIP 32 seed fingerprint encoding by @str4d in #213
• Update librustzcash to rev 796abb548fc8366738f16a5252fd026d5bd92652 by @nuttycom in #219
• Fix another spot where the old seed fingerprint encoding was exposed by @str4d in #214
• Prepare zallet rpc for the alpha by @str4d in #207
• Migrate to latest revision of Zaino crates by @str4d in #224
• Record database network type as part of the initial database migration. by @nuttycom in #226
• rpc: Add transparent information to z_viewtransaction by @str4d in #216
• rpc: Add getrawtransaction by @str4d in #227
• rpc: Ignore non-mnemonic zcashd seeds for numeric account parameters by @str4d in #238
• rpc (z_listunspent): support the same arguments as zcashds version of the RPC by @nuttycom in #193
• rpc: Add account_uuid fields to spends and outputs in z_viewtransaction by @str4d in #239
• Switch to ECC fork of Zaino by @str4d in #244
• rpc (z_listunspent): Add transparent UTXOs to z_listunspent results. by @nuttycom in #230
• rpc: Use correct index for z_viewtransaction input lookups by @str4d in #247
• Add zallet repair truncate-wallet by @str4d in #259
• Create a "merchant terminal" build that has none of the wallet logic by @str4d in #261
• Configure a shutdown timeout to ensure that tasks have a chance to end by @str4d in #246
• Add migrate_zcashd_wallet command. by @nuttycom in #152
• migrate_zcashd_wallet: Print legacy account seedfp & error on duplicate/multiple imports. by @nuttycom in #276
• rpc: Adjust JSON-RPC parameter names to match Bitcoin Core by @str4d in #277
• z_viewtransaction: Fix bugs for coinbase transactions by @str4d in #274
• Add / reference issues corresponding to TODOs in the code by @str4d in #258
• Migrate to latest revision of the Zcash crates by @str4d in #278
• Fill out documentation and adjust some commands by @str4d in #280
• migrate_zcashd_wallet: Allow users to configure the path to the zcashd installation dir for locating the db_dump utility. by @nuttycom in https://github.com/zcas...