Period: 2026-09-01 to 2026-09-30
Issues opened:
- #829 - [👷 Task]: Allow quorum or governance to force deployer graduation
- #828 - [👷 Task]: Clarify bridge trust and compromise risks
- #821 - [🐞 Bug]: Deployer authority cannot be rotated or recovered
- #814 - Replace Koios with Blockfrost throughout the repo
- #778 - [🐞 Bug]: The channel “validate and format” helpers silently change request semantics
- #777 - [🐞 Bug]: The dependency-audit CI check can report success when every audit fails
- #766 - Register bridged ADA metadata on Injective and decimals on Choice
- #765 - [🐞 Bug]: CI Erroneous runs
- #755 - [👷 Task]: Benchmark min-ADA funding and model relayer costs across the IBC lifecycle
PRs merged & closed:
- #842 - chore(deps-dev): bump js-yaml from 3.15.1 to 3.15.2 in /cardano/gateway
- #841 - docs: explain HostState IAVL prototype tradeoffs
- #839 - chore(deps): bump ip-address from 10.4.0 to 10.7.2 in /cardano/gateway
- #838 - chore(deps): bump multer from 2.3.0 to 2.4.0 in /cardano/gateway
- #837 - chore(deps): bump ip-address from 10.4.0 to 10.7.2 in /packages/cardano-ibc-tx-builder-runtime
- #836 - chore(deps-dev): bump ip-address from 10.4.0 to 10.7.2 in /packages/cardano-ibc-tx-builder
- #835 - chore(deps-dev): bump ip-address from 10.4.0 to 10.7.2 in /packages/cardano-ibc-trace-registry
- #834 - chore(deps): bump undici from 6.28.0 to 6.29.0 in /cardano/gateway
- #833 - Render verified Cardano voucher names in the dapp
- #832 - Update README.md
- #825 - feat: add deployment-time backup for HostState authority
- #824 - Docs/mechanics gifs
- #823 - Schedule idle HostState heartbeat at epoch midpoint
- #822 - fix: keep reference scripts until IBC state is drained
- #820 - feat: gate shutdown finalization on live IBC state
- #819 - chore(relayer): bump Hermes for transfer signer fix
- #818 - fix(gateway): encode ICS-20 sender as payment key hash
- #817 - fix(gateway): extend Tendermint finalization validity
- #816 - feat(caribic): pick the Yaci checkpoint 2161 blocks below the tip
- #815 - feat(cardano): use Blockfrost for public network history
- #813 - chore(deps): bump the github-actions group with 2 updates
- #812 - chore(relayer): bump Hermes for Ogmios error details
- #811 - chore(relayer): bump Hermes for Ogmios 401 retries
- #810 - perf(deployment): submit independent deployment transactions together
- #809 - chore: bump Hermes submodule to upstream main
- #807 - docs: explain deployer key compromise and loss
- #806 - feat(migration): support authorized state-preserving bridge redeployment
- #805 - feat(ibc): modularize light-client validation and routing
- #804 - fix(gateway): preserve channel request semantics
- #803 - docs: clarify chain upgrades and client migration risks
- #801 - fix(ci): reject failed npm audit reports
- #800 - docs: resolve remaining documentation drift (#694)
- #797 - docs: delete deployment testing and tendermint update capacity guides
- #796 - test/CI: deepen funds fuzzing and enforce complete CI coverage
- #795 - fix(ics23): accept single-step neighbor proofs
- #794 - fix: validate receive payout by payment-key balance delta
- #793 - chore: clarify proof verification marker mint
- #791 - fix: accept proto3 zero cursor in event queries
- #790 - docs: distinguish MsgUpgradeClient from host binary upgrades
- #789 - test: define probabilistic client software upgrade compatibility
- #788 - Test shutdown refunds and ADA reclamation with fuzzing
- #787 - fix: assert channel token identity in chan_open_ack
- #785 - Bump Hermes for Cardano session seed decoding
- #784 - perf(cardano): reduce multitx client reference script size
- #783 - Reduce transfer reference script size and test HostState invariants
- #782 - fix: correct gateway transaction handling and scope Aiken CI
- #780 - feat: chain first-seen voucher receives
- #779 - test(gateway): require split first-seen receive tx budgets
- #776 - Migrate Caribic local provisioning to Yaci DevKit
- #775 - fix(aiken): check search tree pivots before returning them
- #773 - fix(gateway): run container as non-root user
- #772 - fix(cardano): preserve state funds and reclaim them on shutdown
- #771 - fix(node): restore peer-checked backend installs
- #770 - fix(gateway): limit API request rate and concurrency
- #768 - chore(deps): bump the github-actions group with 11 updates
- #767 - fix(ci): run only the docs guard for docs branches
- #764 - docs: refresh Architectural Challenges
- #763 - fix(cardano): allow proof-backed transfer channel close-confirm
- #762 - fix(cardano): prevent backdated client processing times from bypassing delays
- #761 - fix(gateway): reject public-network live stake fallbacks
- #760 - fix(ci): isolate Gateway publishing permissions and pin actions
- #759 - fix(gateway): preserve consensus timestamp nanoseconds
- #758 - fix(cardano): align collateral with Hermes signing policy
- #757 - test: fuzz channel transactions through compiled validators
- #756 - fix(onchain): use mint handlers for channel operation markers
- #753 - chore(deps): bump next from 15.5.23 to 15.5.24 in /dapps/ibc-swap/client
- #752 - chore(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /dapps/ibc-swap/client
- #751 - chore(deps-dev): bump baseline-browser-mapping from 2.9.19 to 2.11.21 in /cardano/gateway
- #750 - chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /cosmos/cardano-mithril-light-client-v10
- #747 - fix(gateway): upgrade multer to clear security audit
- #746 - chore(deps): bump qs from 6.15.3 to 6.16.0 in /cardano/gateway
- #745 - chore(deps-dev): bump browserslist from 4.28.1 to 4.28.9 in /cardano/gateway
- #744 - chore(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /cardano/gateway
- #743 - chore(deps-dev): bump @humanfs/node from 0.16.6 to 0.16.8 in /cardano/gateway
- #742 - chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /cosmos/async-icq-v10
- #741 - feat(cardano): implement proof-backed consensus history
Issues closed:
- #821 - [🐞 Bug]: Deployer authority cannot be rotated or recovered
- #814 - Replace Koios with Blockfrost throughout the repo
- #778 - [🐞 Bug]: The channel “validate and format” helpers silently change request semantics
- #777 - [🐞 Bug]: The dependency-audit CI check can report success when every audit fails
- #765 - [🐞 Bug]: CI Erroneous runs
- #755 - [👷 Task]: Benchmark min-ADA funding and model relayer costs across the IBC lifecycle
Issues opened:
- #815 - Refactoring : Adding Yaci store as a dependency to API
- #811 - Validate retriable and HTTP status in golden error tests
- #810 - 11.1.3 node upgrade
- #809 - Refactor transaction size lookup to use Yaci Store’s transaction_cbor table
- #800 - build & dependency hygiene — Spotless in api, PostgreSQL driver bump, dependency review, alert triage
- #799 - Upgrade openapi-generator-maven-plugin 6.4.0 → 7.x (and silence the
Casereserved-word warning) - #797 - api.yaml: invalid
typesibling alongside$refmakes OpenAPI generation log an error - #794 - Add GitHub Action for Sonar Java code analysis
PRs merged & closed:
- #803 - chore: build & dependency hygiene — PostgreSQL driver, dependency review, Spotless
- #801 - chore: bump yaci-store 2.0.3-rc1 → 2.0.3
- #798 - fix(api): drop invalid
typesibling next to$refin api.yaml - #796 - chore: bump version to 2.3.1
- #795 - chore: backport cardano-node 11.1.2 and mithril 2630.1-hotfix to 1.x
- #792 - chore: bump cardano-node to 11.1.2, mithril to 2630.1-hotfix, yaci-core to 0.4.6
- #788 - ci: add prerelease verification workflows
- #784 - chore: bump yaci-store to 2.0.3-rc1 and drop local-snapshot build wor…
- #783 - refactor: replace REST token registry with DB-based assets-ext reads
- #777 - fix: wire LOG env vars through docker-compose and fix log path conflict (#514)
PRs merged & closed:
Issues opened:
- #680 - ByronAddress(String) accepts malformed input (no CBOR / CRC32 validation)
- #678 - QuickTx: opt-in UTxO unfracking (split change into well-shaped UTxOs)
- #674 - WebAssembly (GraalVM Web Image) and Native Image compatibility: required CCL changes
- #672 - Ship GraalVM reachability metadata in CCL jars (Native Image / WebAssembly compatibility)
- #658 - refactor(quicktx): migrate core intents to PlutusDataValue
PRs merged & closed:
- #675 - feat(nexus): map index and valid_contract instead of nulling them
- #671 - ci(0.7.x): harden workflows (release-ops standard 2026-09-14)
- #670 - ci: harden workflows (release-ops standard 2026-09-14)
- #669 - Bump version to 0.7.3-SNAPSHOT
- #668 - Update version to 0.7.2-dev1
- #667 - Change version to 0.8.0-pre6-SNAPSHOT
- #666 - ci(0.7.x): approval-gated release process (Gradle 7.5.1 / JDK 11)
- #665 - Update version to 0.8.0-pre6-dev2
- #664 - ci: release-owners team as code owners; approval before tagging
- #663 - Change version and enable GitHub release
- #662 - chore: rehearse release pipeline (0.8.0-pre6-dev1, no GitHub release)
- #661 - build: PR-gated release pipeline (nmcp, approval-gated Central publish, auto-tagging); load-tools jar on GitHub release
- #659 - fix: attach durable TxStream redelivery and reconcile stored outcomes
- #649 - feat: improve TxStream API developer experience
Issues opened:
PRs merged & closed:
- #190 - genesis: parse stabilityWindowFactor as a double and document it
- #189 - Slot leader time travel below f1
- #188 - companion: wait for relay sync progress; no 30s hard deadline
Issues opened:
- #191 - Expose native-script hashes calculated from original CBOR without recursive JSON parsing
- #187 - Fix raw redeemer and datum extraction for tagged CBOR arrays
- #186 - Handle deeply nested datums and metadata without losing the block
PRs merged & closed:
- #201 - Update gradle.properties
- #200 - [next] Fix raw datum and redeemer extraction without blocking sync
- #199 - [next] Preserve blocks when nested datum or metadata parsing fails
- #198 - [next] Fix block parsing with deeply nested native scripts
- #196 - Bump version from 0.3.10 to 0.3.11
- #195 - [0.3.x] Show full sync progress and always run opted-in tests
- #194 - [0.3.11] Backport exact datum and redeemer bytes (#189)
- #193 - [0.3.11] Backport datum and metadata recovery (#188)
- #192 - [0.3.11] Backport native script parsing fixes (#185)
- #190 - Update version from 0.4.6-SNAPSHOT to 0.4.6
- #189 - Fix raw datum and redeemer extraction without blocking sync
- #188 - Preserve blocks when nested datum or metadata parsing fails
- #185 - Fix block parsing with deeply nested native scripts
- #184 - ci: remove explanatory workflow comments
- #183 - ci: remove explanatory workflow comments
- #182 - Change version to 0.5.0-pre13-SNAPSHOT
- #181 - Change version from 0.4.6-dev1 to 0.4.6-SNAPSHOT
- #180 - Bump version to 0.4.6-dev1
- #179 - Bump version to 0.5.0-pre13-dev1
- #178 - ci(main): approval-gated release process (Gradle 7.5.1 / JDK 11, gradle-nexus)
- #177 - ci(next): approval-gated release pipeline with nmcp
Issues closed:
- #187 - Fix raw redeemer and datum extraction for tagged CBOR arrays
- #186 - Handle deeply nested datums and metadata without losing the block
Issues opened:
- #1194 - Add DROPPED status for governance proposals pruned as siblings/descendants
- #1190 - Blockfrost /txs/{hash}/utxos: collateral return output of valid txs returns dotted asset units and native assets not reported by Blockfrost
- #1187 - drep_deposit and gov_action_deposit are numbers in 2.0.x epochs/latest/parameters (fixed in 3.0)
- #1180 - [Blockfrost API] use persisted tx_index for asset ordering
- #1179 - [Assets Store] persist tx_index for mint and burn events
- #1178 - docs: fix documentation site and READMEs with Yaci Store 2.0.3, 3.0.0-beta4
- #1177 - Blockfrost /txs/{hash}/utxos returns data_hash: null for UTxOs carrying an inline datum
- #1176 - Blockfrost /txs/{hash} reports the wire CBOR size, not the ledger size — off by one from Alonzo on
- #1175 - Change release process to follow release-ops
- #1174 - GraalVM native image for 3.0.x
- #1173 - admin-cli rollback should also roll back analytics exports (export state + DuckLake/Parquet data)
- #1172 - Analytics store: make DuckLake re-exports idempotent (delete-before-insert per partition)
- #1171 - Blockfrost extension: read paths convert failures and missing prerequisites into empty/zero HTTP 200 responses
- #1170 - Blockfrost API: /accounts/{stake_address} returns 200 with rewards_sum=0 under concurrency (partition lock exhaustion swallowed into a zero)
- #1168 - Duplicate stake_address_balance(epoch) indexes after apply-indexes
- #1167 - Blockfrost API: /addresses/{address}/total returns 200 with empty sums when its query times out
- #1164 - Block and epoch total output include normal outputs from invalid Plutus transactions
- #1163 - Block and epoch total fees use declared fees instead of collateral fees for invalid Plutus transactions
- #1159 - CIP-68 parser drops metadata for constructor-valued properties and logs full stack traces
- #1158 - Java plugin docs: wrong init-plugin config key, and bean(String) javadoc example does not work
- #1155 - Native-script witnesses are not stored for transactions without redeemers; deep-script hashing needs follow-up
- #1150 - Block silently dropped during sync when a transaction carries a deeply nested native script (2.0.3-rc1)
- #1148 - [Governance] SPO default votes retain delegation after reward-account deregistration
- #1147 - [Governance] SPO voting stake excludes active proposal deposits
- #1146 - Release preparation tasks - 3.0.0-beta4
- #1145 - Release preparation tasks - 2.0.3
- #1144 - Make tx_index non-nullable and fold its migration into the create-table scripts
- #1138 - Auto-recovery executes a stale restart after block reception has resumed during backoff
- #1132 - Add rollback operations for asset-ext store in rollback cli
- #1129 - Auto-recovery can start overlapping sync sessions during long-running block processing
PRs merged & closed:
- #1191 - fix: Blockfrost compatibility for off-chain SDKs on 2.0.x (#1187)
- #1184 - docs: label 3.x-only features
- #1182 - docs: update branching info in readme
- #1181 - docs: update release versions to 2.0.3 and 3.0.0-beta4
- #1169 - docs(plugin): fix init config key and bean(String) javadoc example
- #1165 - fix(build): include application-mcp.yml in zip distributions
- #1161 - fix(ci): pin native-image builder heap on Linux runners
- #1160 - Update gradle.properties
- #1157 - chore: upgrade Yaci to 0.4.6 on release/2.0.x
- #1156 - chore: upgrade Yaci to 0.4.6
- #1154 - [2.0.x] fix(governance): include proposal deposits in SPO stake
- #1153 - [2.0.x] fix(governance): drop SPO default delegation after reward-account deregistration
- #1152 - fix(governance): drop SPO default delegation after reward-account deregistration
- #1151 - fix(admin-cli): add cip68_metadata to rollback tables
- #1149 - fix(governance): include proposal deposits in SPO stake
- #1143 - [merge to 2.0.x] chore(assets-ext): remove CIP-113 programmable token support
- #1142 - [merge to 2.0.x] feat(admin-cli): add generic index apply command
- #1141 - [merge to 2.0.x] fix(governance): select latest spo and committee votes
- #1140 - feat: add tx_index for exact intra-block ordering
- #1139 - fix(governance): select latest spo and committee votes
- #1137 - fix(analytics): keep stake_registration Parquet export backward compatible
- #1136 - fix(common): use byron genesis slotDuration for byron slot length (backport #1135)
- #1135 - fix(common): use byron genesis slotDuration for byron slot length
- #1134 - chore(assets-ext): remove CIP-113 programmable token support
- #1133 - fix(admin-cli): add cip68 rollback table
- #1130 - Disable auto-recovery by default for analytics profile
- #1128 - chore(docker): add missing assets extension section to docker config (backport #1127)
- #1127 - chore(docker): add missing assets extension section to docker config
- #1115 - fix(docs): generate sitemap from docs pages and fix doubled slash in URLs
Issues closed:
- #1158 - Java plugin docs: wrong init-plugin config key, and bean(String) javadoc example does not work
- #1150 - Block silently dropped during sync when a transaction carries a deeply nested native script (2.0.3-rc1)
- #1148 - [Governance] SPO default votes retain delegation after reward-account deregistration
- #1147 - [Governance] SPO voting stake excludes active proposal deposits
- #1132 - Add rollback operations for asset-ext store in rollback cli
Let's keep building! 🚀