MPC (Chain Signatures) 3.18.0

This release adds

• leader failover for signing
• enforces RPC quorum for foreign chains in the node
• adds online presign for foreign chain transactions
• a configurable triple batch size
• bumps nearcore to 2.14.0.

The contract upgrade removes latest_key_version. Contract migration also lowers every foreign chain RPC quorum by one for safe rollout of RPC quorum enforcement.

Note: Nearcore 2.14 comes with compatibility breaking changes that prevents rollbacks.

🚀 Features

• #4729(@kevindeforth): Allow wait_for on subscription (#4729)

• #4759(@pbeza): (backup-cli) Read the contract state through an embedded NEAR node (#4759)

• #4837(@barakeinav1): Bound the participant url in the contract interface (#4837)

• #4850(@gilcu3): Show commit version for all CLIs (#4850)

• #4855(@anodar): (foreign-chain-inspector) Make FanOut RPC quorum aware (#4855)

• #4833(@kevindeforth): (node) Gossip the connected-peers info (#4833)

• #4885(@anodar): (node) Label mpc_num_requests_without_refined_leader_total with chain (#4885)

• #4792(@gilcu3): (node) Use online presign for foreign chain tx (#4792)

• #4715(@netrome): Leader failover (#4715)

• #4904(@gilcu3): (backup-cli) Fetch hourly to ensure node's are aware of backup (#4904)

• #4863(@gilcu3): (node) Support configurable triple batch size (#4863)

• #4915(@anodar): Implement whitelist gate in fake indexer, gate availability based on it (#4915)

• #4917(@anodar): Enforce RPC quorum in the node (#4917)

• #4933(@anodar): (node) Register only the foreign chains whose RPC quorum the node reaches (#4933)

🐛 Bug Fixes

• #4719(@barakeinav1): (tee-verifier) Take collateral dates only from verified certificates (#4719)

• #4811(@kevindeforth): (node) Node should emit network metrics in all protocol states (#4811)

• #4842(@gilcu3): (node) Set reference height from majority of peers and avoid crashing (#4842)

• #4878(@gilcu3): (node) Update ca certificates (#4878)

• #4858(@pbeza): (contract) Reject attestations for a TLS key assigned to another account (#4858)

• #4943(@gilcu3): (node) Avoid keeping stale participant gauges (#4943)

• #4849(@barakeinav1): (node) Fsync the directory after replacing node files on disk (#4849)

💼 Other

• #4942(@haiyuechen-nearone): Drop the Rosetta cache from the reproducible image layers (#4942)

• #4969(@gilcu3): Ignore unreachable zstd advisories and bump yanked crypto-bigint (#4969)

🚜 Refactor

• #4745(@pbeza): Gate test-only code behind #[cfg(test)] (#4745)

• #4701(@pbeza): (threshold-signatures) Drop four redundant dependencies to shrink the supply-chain attack surface (#4701)

• #4714(@kevindeforth): (node) Split OutgoingConnection::new into helper functions (#4714)

• #4758(@gilcu3): Move recovery id functionality as a crypto helper (#4758)

• #4626(@kevindeforth): (e2e) Route contract views through MpcContractHandle (#4626)

• #4754(@kevindeforth): (sandbox) Use MpcContractHandle for remaining function calls (#4754)

• #4819(@kevindeforth): (sandbox) Use typed view calls in sandbox tests (#4819)

• #4774(@kevindeforth): (contract) Replace LauncherHashVotes with the generic Votes struct (#4774)

• #4834(@kevindeforth): (contract) Replace MeasurementVotes with the generic Votes Registry (#4834)

• #4672(@haiyuechen-nearone): (node) Rework whitelist verifier to match providers by URL host (#4672)

• #4246(@SimonRastikian): Getting rid of threshold terminology in running.rs and key_resharing.rs (#4246)

• #4862(@gilcu3): (crypto) Support non-constant batch size for generating triples (#4862)

• #4689(@haiyuechen-nearone): (node) Move the foreign chain whitelist monitor out of tee.rs (#4689)

• #4794(@pbeza): (node) Simplify attestation submission by dropping the landing check (#4794)

• #4884(@kevindeforth): (node) View mpc contract through MpcContractHandle (#4884)

• #4854(@pbeza): (contract) Require accepted_at_seconds on stored attestations (#4854)

• #4888(@haiyuechen-nearone): (node-config) Shared foreign chain whitelist matching and quorum counting logic (#4888)

• #4923(@netrome): Re-intorduce WatchContractState port, specializing the upstream WatchContractState trait (#4923)

• #4928(@SimonRastikian): (contract) Use DomainId for next_domain_id instead of raw u64 (#4928)

• #4930(@SimonRastikian): (contract) Introduce ParticipantCount and drop the count casts (#4930)

• #4931(@SimonRastikian): Reconstruction threshold value (#4931)

• #4893(@pbeza): (contract) Replace NodeAttestation with Node and unify node lookups (#4893)

📚 Documentation

• #4705(@barakeinav1): (migration-guide) Run backup-cli run as a persistent service (#4705)

• #4757(@gilcu3): Explain how to verify the contract ECDSA response recovery id (#4757)

• #4808(@barakeinav1): Document the checkout needed to reproduce the node image digest (#4808)

• #4812(@barakeinav1): Rename the release draft and add a summary before publishing (#4812)

• #4853(@netrome): Add helpful docstrings to ckd types (#4853)

• #4322(@barakeinav1): (design) TDX CI runner design (#4322)

• #4956(@anodar): Add whitelist & quorum section in onboarding guide (#4956)

🧪 Testing

• #4864(@anodar): (contract) Reject vote_new_parameters from a non-participant caller (#4864)

• #4868(@anodar): Cover voter authorization in process_new_parameters_proposal (#4868)

⚙️ Miscellaneous Tasks

• #4736(@anodar): Update localnet script for testing embedded foreign chain configs (#4736)

• #4755(@gilcu3): Improve performance of nix-build-mpc-node workflow (#4755)

• #4704(@pbeza): Update the transitive dependencies that dependabot does not cover (#4704)

• #4761(@dependabot[bot]): Bump the github-actions group across 1 directory with 2 updates (#4761)

• #4766(@kdeforth-bot): (contract) Update contract migrations after 3.17.0 release (#4766)

• #4803(@pbeza): (ci) Ignore rustls advisories RUSTSEC-2026-0346, RUSTSEC-2026-0348 and RUSTSEC-2026-0349 (#4803)

• #4805(@gilcu3): Handle wasmtime new advisories (#4805)

• #4810(@gilcu3): Remove the gcp node image and gcp secrets support (#4810)

• #4746(@anodar): Pin repo in cliff config so that it doesn't require upstream (#4746)

• #4815(@anodar): Update onboarding doc with updated full foreign chain config for mainnet (#4815)

• #4816(@pbeza): Keep tokio's test-util feature out of production builds (#4816)

• #4825(@anodar): Drop bitcoin support (#4825)

• #4840(@barakeinav1): (ci) Ignore zip advisories RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 (#4840)

• #4856(@dependabot[bot]): Bump the github-actions group across 1 directory with 4 updates (#4856)

• #4866(@netrome): Ignore RUSTSEC-2026-0379 advisory (#4866)

• #4887(@netrome): Add foreign tx validation report (#4887)

• #4880(@anodar): Add tests from node image for distrusted certs (#4880)

• #4892(@gilcu3): Upgrade debian images to properly fix ca certificate issue (#4892)

• #4877(@dependabot[bot]): Bump the rust-minor-and-patch group across 1 directory with 8 updates (#4877)

• #4826(@pbeza): Make the workflows pass zizmor's strictest audit (#4826)

• #4900(@pbeza): Bump tokio to 1.54.1 for RUSTSEC-2026-0384 (#4900)

• #4902(@gilcu3): (contract) [breaking] Remove support for latest_key_version (#4902)

• #4906(@gilcu3): Tiny fix for the ci-other filter that went stale (#4906)

• #4907(@anodar): Bump gas for cleanup_orphaned_node_migrations and clean_foreign_chain_data (#4907)

• #4925(@gilcu3): (contract) Make default key event timeout blocks higher (#4925)

• #4922(@gilcu3): Remove support for dev measurements (#4922)

• #4936(@dependabot[bot]): Bump the github-actions group across 1 directory with 2 updates (#4936)

• #4937(@dependabot[bot]): Bump libc from 0.2.190 to 0.2.191 in the rust-minor-and-patch group (#4937)

• #4940(@dependabot[bot]): Bump rstest from 0.27.0 to 0.28.0 (#4940)

• #4938(@dependabot[bot]): Bump lru from 0.18.5 to 0.19.0 (#4938)

• #4939(@dependabot[bot]): Bump near-kit from 0.18.3 to 0.19.0 (#4939)

• #4935(@haiyuechen-nearone): Bump nearcore to 2.14.0 (#4935)

• #4973(@anodar): Relax quorum of rpc providers in contract migration (#4973)

• #4963(@barakeinav1): Bump localnet genesis protocol version to 88 (#4963)

Docker images

• nearone/mpc-node:3.18.0 Manifest digest: sha256:536d528f19cff6a45f384fb225e8a331e5554b9da45196d0fae148d191e8b36d

• nearone/mpc-launcher:3.18.0 Manifest digest: sha256:f9c98d3b3daa3bacf6ab3acddaa6edce881a6a767981ebb802e2d2380fe8ac28

MPC contract

• digest: sha256:af8c66fd218f88bc6223d9d11eea7b6b1911ffd891d37ae3179f15cdf4a94955