Code

Remove the RUSTSEC-2026-0387 ignore once crypto-bigint 0.5.5 leaves the tree

Remove remaining responder-key compatibility shims

[SPICE data distribution] C1d — tracking from a sync point

Feature:

spice: Contract access records are not GCd

spice: Fake witness makes node ignore real witness

spice: CP can OOM validator with fake witness parts

spice: OOM from chunk producer repeatedly sending bogus partial data

spice: Unauthenticated amplification DoS

spice: OOM through unlimited contract-access messages

Release tracker: 2.14.0

[RFC] Lightweight pre-execution validation for AI agents interacting with NEAR DeFi

port indexer wedging sync to chain-gateway

Daily ironclaw failure taxonomy — 2026-10-22

Rename foreign-tx-validation -> Read RPC

Extend timeout for foreign tx validation requests

refactor(node): use subscription logic from the near contract transport crate instead of custom subscription

Hosted MCP: explicit 127.0.0.1 endpoint enrollment and private credential-account setup bridge

Daily ironclaw failure taxonomy — 2026-10-19

[BUG] The `send-ft-call` command outputs incorrect information regarding the executed transaction.

Use dcap-qvl's TCB level matching in attestation-cli instead of mirroring it

fix: stop polling the sync status forever once the NEAR client is gone

chore(backup-cli): build backup-cli with the reproducible profile

feat(backup-cli): add an init command for the embedded NEAR node's home directory

Add support for automatic node upgrades

Docs: "Refund a stuck BTC deposit" says 14 days without a refund address; the BTC connector's lock is 100 years since 16 Oct

Remove the zip advisory ignores once zip >= 9.0.0 resolves

Confidential swaps misroute deposits to wrong account — 0.039 ETH stuck, API reports SUCCESS, no refund

Confidential swaps (confidentiality: "basic") fail at execution on every route: /v0/deposit/submit → Empty AMQP response, status → REFUNDED / INTENT_SUBMIT_FAILED

Derive the expiry from the collateral in verify_locally