node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.5

Git tag: node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.5

Components

• 📦 node-1.0.0
• 🧰 toolkit-1.0.0
• ⚙️ runtime-1.0.0

⏺ Subxt Runtime Diff: 0.22.5 → 1.0.0-rc.3 — major upgrade

Versions: spec 22000 → 1000000, tx_version 2 → 3.

Summary:

Compatible: ❌ no
Requires transaction_version bump: ❌ no (subwasm view)
Requires storage migration: ✅ yes
New host-fn imports: 6 (old node binaries will fail)

Pallet changes

Pallet 0 — System ❌ NOT COMPATIBLE

• Constants:
  • BlockLength — different number of fields (12 → 13 bytes)
  • Version — value changed (spec_version field bumped)
• Storages:
  • • BlockSize: u32
  • • BlocksTillUpgrade: u8
  • − AllExtrinsicsLen removed

Pallet 5 — Midnight ❌ NOT COMPATIBLE

• NetworkId: Optional BoundedVec → Default BoundedString
• StateKey: Optional BoundedVec → Default Vec
  (Modifier flips Optional→Default in both — needs migration to populate.)

Pallet 17 — PalletSession

• • ExternallySetKeys map (AccountId32 → ())

Pallet 21 — Beefy (error renumbering)

• Error 5 renamed DuplicateOffenceReport → InvalidEquivocationProofSessionMember
• Error 6 renamed InvalidConfiguration → DuplicateOffenceReport
• • Error 7 InvalidConfiguration
    (Net effect: a new error variant inserted; old indices reshuffled — clients matching by index will be wrong.)

Pallet 32 — Bridge ❌ NOT COMPATIBLE

• Calls (signatures changed — same param names, different inner types):
  • handle_transfers — BridgeTransferV1 shape changed; BridgeDataCheckpoint is now UtxoId
  • set_main_chain_scripts — BridgeDataCheckpoint → UtxoId
• Events: + Transfer (mc_tx_hash, amount, result, recipient)
• Errors: + InherentAlreadyExecuted
• Storages:
  • DataCheckpoint type changed (BridgeDataCheckpoint → UtxoId)
  • • InherentExecutedThisBlock: bool

Pallet 44 — FederatedAuthority ❌ NOT COMPATIBLE

• Call motion_close gained proposal_weight_bound: Weight param
• • Error 9 MotionWeightBoundTooLow

Pallet 51 — Throttle ❌ NOT COMPATIBLE

• Constants:
  • • MaxTxs = 100
  • WindowSize: 14400 → 600 (≈ 24h → 1h block window, assuming 6s slots)
• Storages:
  • AccountUsage value type (u64, u32) → UsageStats (4 → 20 bytes default; needs migration)

New WASM host-function imports — node must support these ⚠️

These are net-new host fns the runtime now calls. A node-0.22.5 binary running this runtime will fail at first call:

env.ext_crypto_ecdsa_sign_version_1
env.ext_crypto_ed25519_sign_version_1
env.ext_crypto_sr25519_sign_version_1
env.ext_ledger_8_bridge_construct_distribute_night_cardano_bridge_system_tx_version_1
env.ext_ledger_8_bridge_construct_distribute_reserve_system_tx_version_1
env.ext_ledger_8_bridge_construct_distribute_treasury_system_tx_version_1

Added

Upgrade ledger from 8.0.2 to 8.1.0-rc.1 (#1301) (#node)

Bumps the midnight-ledger dependency from 8.0.2 to 8.1.0-rc.1, picking up
new ledger types and conversion support.

PR: #1301
Issue: #1296

Changed

Add regression tests for nonce/nullifier distinction in zswap serialization (#1128, PM-22025) (#toolkit)

Add unit tests verifying that serialized zswap local state uses the coin
nonce (randomness), not the nullifier (spend identifier), for the nonce
field. Addresses Least Authority Q1 2026 Node DIFF audit Issue E.

PR: #1128
JIRA: https://shielded.atlassian.net/browse/PM-22025

Redact database connection details from error logs (#1067, PM-19904) (#node)

Database connection error messages no longer include the host, port, or database name at error level. Full connection details are available at debug log level for authorized troubleshooting.

PR: #1067
JIRA: https://shielded.atlassian.net/browse/PM-19904

Implements handler for C-to-M brige (#1188) (#node, #runtime)

Updates bridge to emit events.
Updates call by adding McTxHash to each transfer.
Updates handler API: handler is expected to return a value that is attached to events.

Implements the handler in Midnight runtime.

PR: #1188
Required for #1083

Add validation for `networkId` on node boot to avoid mismatch with genesis state (#1265, PM-22422) (#node, #binary)

Adds validation to ensure the networkId set in the chainspec matches the
networkId used to generate the genesis state.

PR: #1265
Fix for: https://shielded.atlassian.net/browse/PM-22422

Speed up cNight db-sync observation queries (#1365) (#node)

Pre-query coarse tx / tx_out / ma_tx_out id bounds for the requested
block-range window, then constrain the four cNight observation queries
(registration, deregistration, asset create, asset spend) by primary-key
range so postgres can prune rows before doing expensive joins. Extends the
same tx.id bounding to the tx_in-keyed spend/deregistration queries.

PR: #1365

Fix DustWallet spend state propagation (#877, PM-20016) (#toolkit)

Fix DustWallet::speculative_spend to return the updated DustLocalState
alongside spends, and extend mark_spent to commit the state atomically
with nullifier recording. This ensures DustLocalState::spend's
pending_until flags are propagated, preventing utxos() from returning
already-spent outputs in consecutive spend operations.

Addresses Least Authority audit finding Issue AO.

PR: #877
JIRA: https://shielded.atlassian.net/browse/PM-20016

Align node and runtime with polkadot-stable2512-3 SDK (#1262) (#node, #runtime)

Bumps Substrate dependencies to the polkadot-stable2512-3 tag and updates call sites for breaking API changes: Core::execute_block and BlockBuilder::check_inherents now use LazyBlock; SpawnTasksParams requires tracing_execute_block (set to None unless trace RPC is wired); MmrApi v3 gains generate_ancestry_proof while BeefyApi no longer exposes it; pallet-version test mock implements Core with LazyBlock. Partner-chains and lockfiles are updated in line with the same SDK line.

PR: #1262
Required for #1244

Align node, runtime, relay, and partner-chains with polkadot-stable2603 SDK (#1299) (#node, #runtime, #partner-chains)

Bumps Substrate dependencies to the polkadot-stable2603 tag and updates call sites for breaking API changes:

• Workspace: All polkadot-stable2512-3 git deps moved to polkadot-stable2603; tracing-subscriber pinned to =0.3.19 (required by sp-tracing on this line) with toolkit using the workspace entry.
• Node: sc_service::build_network gains spawn_essential_handle; new_full_parts_with_genesis_builder keeps the six-argument signature (no Grandpa pruning filters argument—unlike new_full_parts).
• Runtime: sp_session::SessionKeys::generate_session_keys now takes owner: Vec<u8> and returns OpaqueGeneratedSessionKeys; opaque key generate calls pass &owner.
• Partner-chains (vendored subtree): Aura Proposer uses ProposeArgs; demo node uses GrandpaPruningFilter with new_full_parts and spawn_essential_handle; toolkit inherent errors use Debug instead of sp_runtime::RuntimeDebug where needed.
• Ledger / primitives: RuntimeDebug derives replaced with core::fmt::Debug where sp_runtime::RuntimeDebug / frame_support::RuntimeDebug were removed.
• Pallets: RuntimeDebugNoBound replaced with DebugNoBound (e.g. federated-authority, throttle).
• Relay (BEEFY): BeefySignatureHasher removed; SignedCommitment::verify_signatures called with a single inferred authority type parameter.

Partner-chains Cargo.toml / README / changelog are aligned with the same SDK tag where applicable.

PR: https://github.com/midnightntwrk/midnight-node/pull...

node-1.0.0-toolkit-1.0.0-rc.4

Midnight Node 1.0.0-toolkit-1.0.0-rc.4 Release Notes

Release date: 2026-04-27

Git tag: node-1.0.0-toolkit-1.0.0-rc.4

Tree hash: 530e9d26709c0ed163dcc4fb91f586c6774da3f2

Environment: All public networks (dev, qanet, preview, preprod).

Docker Images

docker pull midnightntwrk/midnight-node:1.0.0-rc.4
docker pull midnightntwrk/midnight-node-toolkit:1.0.0-rc.4

Summary

Fourth 1.0.0 release candidate for the node and toolkit. This RC ships node-only changes since rc.3: a postgres query-planner improvement for the cNight observation data source, an opt-in symlink-allowance flag for config loading, and a bump of midnight-storage-core to 1.2.0-rc.2. No runtime upgrade is part of this release line — the runtime variant is published separately as node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.4.

Audience

• Node operators — node binary update; no runtime upgrade required for this tag

• Toolkit users — no toolkit-only changes in this RC (delta vs rc.3)

• DApp developers — no API changes

What Changed

Change	Upgrade Type	PR
Speed up cNight db-sync observation queries via primary-key range bounding	Node upgrade	#1365
Add unsafe_allow_symlinks config option for file loading (off by default)	Node upgrade	#1372
Bump midnight-storage-core to 1.2.0-rc.2	Node upgrade	#1388

New Features

unsafe_allow_symlinks config option (#1372) — Node upgrade

A new opt-in unsafe_allow_symlinks flag permits symlinks when loading configuration files at node boot. Disabled by default to preserve the symlink-rejection hardening landed in #832; operators who need symlinked configuration must set this flag explicitly.

Features Requiring Configuration Updates

• Symlinked config files: operators that previously relied on symlinks pointing to genesis/config files must now set unsafe_allow_symlinks in their config to retain that behaviour. Without it, node boot will continue to reject symlinks as before.

Improvements

• Faster cNight observation queries: pre-queries coarse tx / tx_out / ma_tx_out id bounds for the requested block-range window, then constrains the four cNight observation queries (registration, deregistration, asset create, asset spend) and the tx_in-keyed spend/deregistration queries by primary-key range so postgres prunes rows before doing expensive joins (#1365).
• midnight-storage-core upgraded to 1.2.0-rc.2, picking up the latest storage-core fixes (#1388, tracking issue #1358).

Fixed Defects

No defect tickets are closed by the delta in this RC. Audit findings and bug fixes resolved in earlier 1.0.0 RCs (rc.1, rc.2/rc.3) carry through unchanged.

Links and References

• Pull requests: #1365, #1372, #1388
• Tracking issues: #1358
• Prior RC notes: rc.1, rc.2, rc.3
• Sibling release with runtime upgrade: node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.4

Full Change Details

The following content is preserved verbatim from the auto-generated release body (covering the full set of 1.0.0 PRs to date, not just the rc.3 -> rc.4 delta).

Git tag: node-1.0.0-toolkit-1.0.0-rc.4

Components

• 📦 node-1.0.0
• 🧰 toolkit-1.0.0

Added

Upgrade ledger from 8.0.2 to 8.1.0-rc.1 (#1301) (#node)

Bumps the midnight-ledger dependency from 8.0.2 to 8.1.0-rc.1, picking up
new ledger types and conversion support.

PR: #1301
Issue: #1296

Changed

Add regression tests for nonce/nullifier distinction in zswap serialization (#1128, PM-22025) (#toolkit)

Add unit tests verifying that serialized zswap local state uses the coin
nonce (randomness), not the nullifier (spend identifier), for the nonce
field. Addresses Least Authority Q1 2026 Node DIFF audit Issue E.

PR: #1128
JIRA: https://shielded.atlassian.net/browse/PM-22025

Redact database connection details from error logs (#1067, PM-19904) (#node)

Database connection error messages no longer include the host, port, or database name at error level. Full connection details are available at debug log level for authorized troubleshooting.

PR: #1067
JIRA: https://shielded.atlassian.net/browse/PM-19904

Implements handler for C-to-M brige (#1188) (#node, #runtime)

Updates bridge to emit events.
Updates call by adding McTxHash to each transfer.
Updates handler API: handler is expected to return a value that is attached to events.

Implements the handler in Midnight runtime.

PR: #1188
Required for #1083

Add validation for `networkId` on node boot to avoid mismatch with genesis state (#1265, PM-22422) (#node, #binary)

Adds validation to ensure the networkId set in the chainspec matches the
networkId used to generate the genesis state.

PR: #1265
Fix for: https://shielded.atlassian.net/browse/PM-22422

Speed up cNight db-sync observation queries (#1365) (#node)

Pre-query coarse tx / tx_out / ma_tx_out id bounds for the requested
block-range window, then constrain the four cNight observation queries
(registration, deregistration, asset create, asset spend) by primary-key
range so postgres can prune rows before doing expensive joins. Extends the
same tx.id bounding to the tx_in-keyed spend/deregistration queries.

PR: #1365

Fix DustWallet spend state propagation (#877, PM-20016) (#toolkit)

Fix DustWallet::speculative_spend to return the updated DustLocalState
alongside spends, and extend mark_spent to commit the state atomically
with nullifier recording. This ensures DustLocalState::spend's
pending_until flags are propagated, preventing utxos() from returning
already-spent outputs in consecutive spend operations.

Addresses Least Authority audit finding Issue AO.

PR: #877
JIRA: https://shielded.atlassian.net/browse/PM-20016

Align node and runtime with polkadot-stable2512-3 SDK (#1262) (#node, #runtime)

Bumps Substrate dependencies to the polkadot-stable2512-3 tag and updates call sites for breaking API changes: Core::execute_block and BlockBuilder::check_inherents now use LazyBlock; SpawnTasksParams requires tracing_execute_block (set to None unless trace RPC is wired); MmrApi v3 gains generate_ancestry_proof while BeefyApi no longer exposes it; pallet-version test mock implements Core with LazyBlock. Partner-chains and lockfiles are updated in line with the same SDK line.

PR: #1262
Required for #1244

Align node, runtime, relay, and partner-chains with polkadot-stable2603 SDK (#1299) (#node, #runtime, #partner-chains<...

node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.4

Git tag: node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.4

Components

• 📦 node-1.0.0
• 🧰 toolkit-1.0.0
• ⚙️ runtime-1.0.0

Added

Upgrade ledger from 8.0.2 to 8.1.0-rc.1 (#1301) (#node)

Bumps the midnight-ledger dependency from 8.0.2 to 8.1.0-rc.1, picking up
new ledger types and conversion support.

PR: #1301
Issue: #1296

Changed

Add regression tests for nonce/nullifier distinction in zswap serialization (#1128, PM-22025) (#toolkit)

Add unit tests verifying that serialized zswap local state uses the coin
nonce (randomness), not the nullifier (spend identifier), for the nonce
field. Addresses Least Authority Q1 2026 Node DIFF audit Issue E.

PR: #1128
JIRA: https://shielded.atlassian.net/browse/PM-22025

Redact database connection details from error logs (#1067, PM-19904) (#node)

Database connection error messages no longer include the host, port, or database name at error level. Full connection details are available at debug log level for authorized troubleshooting.

PR: #1067
JIRA: https://shielded.atlassian.net/browse/PM-19904

Implements handler for C-to-M brige (#1188) (#node, #runtime)

Updates bridge to emit events.
Updates call by adding McTxHash to each transfer.
Updates handler API: handler is expected to return a value that is attached to events.

Implements the handler in Midnight runtime.

PR: #1188
Required for #1083

Add validation for `networkId` on node boot to avoid mismatch with genesis state (#1265, PM-22422) (#node, #binary)

Adds validation to ensure the networkId set in the chainspec matches the
networkId used to generate the genesis state.

PR: #1265
Fix for: https://shielded.atlassian.net/browse/PM-22422

Speed up cNight db-sync observation queries (#1365) (#node)

Pre-query coarse tx / tx_out / ma_tx_out id bounds for the requested
block-range window, then constrain the four cNight observation queries
(registration, deregistration, asset create, asset spend) by primary-key
range so postgres can prune rows before doing expensive joins. Extends the
same tx.id bounding to the tx_in-keyed spend/deregistration queries.

PR: #1365

Fix DustWallet spend state propagation (#877, PM-20016) (#toolkit)

Fix DustWallet::speculative_spend to return the updated DustLocalState
alongside spends, and extend mark_spent to commit the state atomically
with nullifier recording. This ensures DustLocalState::spend's
pending_until flags are propagated, preventing utxos() from returning
already-spent outputs in consecutive spend operations.

Addresses Least Authority audit finding Issue AO.

PR: #877
JIRA: https://shielded.atlassian.net/browse/PM-20016

Align node and runtime with polkadot-stable2512-3 SDK (#1262) (#node, #runtime)

Bumps Substrate dependencies to the polkadot-stable2512-3 tag and updates call sites for breaking API changes: Core::execute_block and BlockBuilder::check_inherents now use LazyBlock; SpawnTasksParams requires tracing_execute_block (set to None unless trace RPC is wired); MmrApi v3 gains generate_ancestry_proof while BeefyApi no longer exposes it; pallet-version test mock implements Core with LazyBlock. Partner-chains and lockfiles are updated in line with the same SDK line.

PR: #1262
Required for #1244

Align node, runtime, relay, and partner-chains with polkadot-stable2603 SDK (#1299) (#node, #runtime, #partner-chains)

Bumps Substrate dependencies to the polkadot-stable2603 tag and updates call sites for breaking API changes:

• Workspace: All polkadot-stable2512-3 git deps moved to polkadot-stable2603; tracing-subscriber pinned to =0.3.19 (required by sp-tracing on this line) with toolkit using the workspace entry.
• Node: sc_service::build_network gains spawn_essential_handle; new_full_parts_with_genesis_builder keeps the six-argument signature (no Grandpa pruning filters argument—unlike new_full_parts).
• Runtime: sp_session::SessionKeys::generate_session_keys now takes owner: Vec<u8> and returns OpaqueGeneratedSessionKeys; opaque key generate calls pass &owner.
• Partner-chains (vendored subtree): Aura Proposer uses ProposeArgs; demo node uses GrandpaPruningFilter with new_full_parts and spawn_essential_handle; toolkit inherent errors use Debug instead of sp_runtime::RuntimeDebug where needed.
• Ledger / primitives: RuntimeDebug derives replaced with core::fmt::Debug where sp_runtime::RuntimeDebug / frame_support::RuntimeDebug were removed.
• Pallets: RuntimeDebugNoBound replaced with DebugNoBound (e.g. federated-authority, throttle).
• Relay (BEEFY): BeefySignatureHasher removed; SignedCommitment::verify_signatures called with a single inferred authority type parameter.

Partner-chains Cargo.toml / README / changelog are aligned with the same SDK tag where applicable.

PR: #1299
Required for #1245

Early weight check in midnight pallet pre_dispatch (#1305) (#node)

Add an early block weight check in ValidateUnsigned::pre_dispatch before
expensive ledger validation. Substrate's Bare extrinsic path runs the pallet's
pre_dispatch before the CheckWeight extension, which means transactions that
won't fit in the block still undergo costly ledger validation before being
rejected. The new check mirrors the logic in calculate_consumed_weight and
exits early with ExhaustsResources when the block is full.

PR: #1305

Speed up toolkit syncing (#1263) (#toolkit)

Batch block-number-to-hash RPC calls into a single request instead of one call per block, reducing round trips during sync. Also simplifies several function parameters across the fetcher.

PR: #1263

📦 Node

Git tag: node-1.0.0-rc.4

Docker Images

DockerHub

• midnight-node

$ docker pull midnightntwrk/midnight-node:1.0.0-rc.4

Added

Add per-SQL-query Prometheus timing for midnight data source queries (#904, PM-22100) (#node)

Midnight-specific data sources (cNight observation, federated authority,
candidates) now record individual Prometheus timing histograms for each
SQL query executed against DBSync. 13 sub-query timers provide per-query
latency visibility at :9615/metrics under the
midnight_data_source_query_time_elapsed metric with query_name labels.

PR: #904
JIRA: https://shielded.atlassian.net/browse/PM-22100

Add `rpc.discover` endpoint with OpenRPC v1.4 API specification (PM-6402, #869) (#client, #node, #rpc, #api)

Registers a standards-compliant rpc.discover JSON-RPC method that returns a complete OpenRPC v1.4 document describing the node's API. Enables client code generation, request validation, and developer discoverability without reading source code.

• 16 custom Midnight methods fully documented with parameter types, return types, error definitions, and descriptions
• 52 standard Substrate methods listed as reference entries
• JSON Schema type d...

node-0.22.5

Midnight Node 0.22.5

Release date: 2026-04-24
Git tag: node-0.22.5
Tree hash: b335248c509df1a853f98ac36554c2fe93614f62
Environment: All public networks at time of release. For the full compatibility matrix, see the release notes overview.

Docker Images

docker pull midnightntwrk/midnight-node:0.22.5
docker pull midnightntwrk/midnight-node-toolkit:0.22.5

High-level summary

A node-only patch release. Adds an optional transaction-pool filter so operators can cap the per-transaction gas cost their node will accept, and lands two cNight observation query optimisations that materially reduce db-sync load. Devnet's bundled chain spec is reset to runtime version 0.22.0 to match mainnet. No runtime upgrade — operators only need to roll the binary.

Audience

These release notes are intended for:

• Node operators (all networks): Recommended upgrade. Pick up the cNight observation perf improvements and the new optional --max-tx-gas-cost filter.
• Node operators (devnet): Required if you rely on the bundled devnet chain spec — it now targets runtime 0.22.0 to align with mainnet.
• DApp developers: No action required.
• Toolkit users: No action required.

What Changed

Change	Upgrade Type	PR
Transaction pool gas cost filtering (--max-tx-gas-cost, MAX_TX_GAS_COST)	Node upgrade	#1251
Cache multi_asset.id to avoid excessive db-sync joins	Node upgrade	#934
Speed up cNight db-sync observation queries with id-bound prefilter	Node upgrade	#1365
Reset devnet bundled chain spec to runtime version 0.22.0 to match mainnet	Node upgrade (chainspec)	#1341

New Features

Transaction pool gas cost filtering

Description: Adds a new --max-tx-gas-cost CLI argument and MAX_TX_GAS_COST environment variable. Midnight transactions whose estimated gas cost exceeds the configured limit are rejected at the pool gateway level before they enter the node's transaction pool. The CLI argument takes precedence over the environment variable when both are set.

This matters because expensive transactions can otherwise pin a node's resources during validation; allowing operators to cap acceptance gives them a direct lever to protect their node from abuse. Operators interact with it through the node CLI / systemd unit / docker run env. Leaving the flag unset preserves the previous (unbounded) behaviour, so this is non-breaking.

Node upgrade. — #1251

Improvements

• Cache multi_asset.id lookups for cNight observation queries, eliminating repeated JOIN multi_asset clauses across registration, deregistration, asset create/spend, and candidate token paths. Materially reduces postgres query complexity on busy db-sync deployments. (#934, PM-21995)
• Pre-query coarse tx / tx_out / ma_tx_out id bounds for the requested block-range window so the four cNight observation queries (registration, deregistration, asset create, asset spend) can be constrained by primary-key range, allowing postgres to prune rows before doing expensive joins. The same tx.id bounding is also extended to the tx_in-keyed spend / deregistration queries. (#1365)
• Devnet's bundled chain spec is regenerated to target runtime version 0.22.0, matching mainnet. (#1341)

Known Issues

Initial sync performance

Description: Initial sync times have improved in this release thanks to the cNight db-sync query optimisations (#934, #1365), but initial sync from genesis can still be slower than desired on some operator setups. Further sync performance work is scheduled for a later release.
Issue: #1298
Workaround: None at present. Track the issue for progress; faster bootstrap snapshots may be made available out-of-band.

Links and References

• PRs:
  • #1251 — Transaction pool gas cost filtering
  • #934 — Cache multi_asset.id to avoid excessive joins
  • #1365 — Speed up cNight db-sync observation queries
  • #1341 — Reset devnet to runtime version 0.22.0 to match mainnet
• Testing evidence: TODO: link QA sign-off — not yet provided at the time of writing.
• Known issues board: https://github.com/midnightntwrk/midnight-node/issues?q=is%3Aissue+is%3Aopen+label%3Abug

Full Change Details

Added

Transaction pool gas cost filtering (#1251) (#node)

Added --max-tx-gas-cost CLI arg and MAX_TX_GAS_COST env var to reject midnight
transactions whose estimated gas cost exceeds a configurable limit. This allows node
operators to protect their nodes from expensive transactions at the pool gateway level.
The CLI arg takes precedence over the env var when both are set.

PR: #1251

Changed

Cache multi_asset.id to avoid excessive joins (#934, PM-21995) (#node)

Add an in-memory cache for multi_asset.id lookups, replacing repeated JOIN multi_asset in
db-sync queries with a single cached lookup per (policy, name) pair. This eliminates the
multi_asset join from registration, deregistration, asset create/spend, and candidate token
queries, reducing query complexity and improving observation performance.

PR: #934
JIRA: https://shielded.atlassian.net/browse/PM-21995

Speed up cNight db-sync observation queries (#1365) (#node)

Pre-query coarse tx / tx_out / ma_tx_out id bounds for the requested
block-range window, then constrain the four cNight observation queries
(registration, deregistration, asset create, asset spend) by primary-key
range so postgres can prune rows before doing expensive joins. Extends the
same tx.id bounding to the tx_in-keyed spend/deregistration queries.

PR: #1365

Reset devnet to runtime version 0.22.0 to match mainnet (#1341) (#chainspec)

PR: #1341

---

Node 0.22.5 Patch Release Test Report

Smoke tests

Network-agnostic — applies on local, devnet, qanet, preview.

ID	Check	How
SMK-01	Node starts and stays up for ≥ 5 min	./target/release/midnight-node runs without panics
SMK-02	RPC reachable	curl -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","method":"sidechain_getStatus","params":[],"id":1}' https://rpc.<env>.midnight.network
SMK-03	Chain producing blocks	Best block height increases over a 6s window
SMK-04	Finality advancing	chain_getFinalizedHead block number increases
SMK-05	Runtime version expected	state_getRuntimeVersion returns the expected specVersion for the network
SMK-06	Sync from genesis	Wipe one node's data and let it sync
SMK-07	Peer connectivity	system_peers returns ≥ 1 peer on a non-isolated network
SMK-08	Submit a trivial signed extrinsic	Accepted into pool, included in a block, status becomes Finalized
SMK-09	No errors in logs	No ERROR / panic lines in logs over the smoke window
SMK-10	Dust generation	Register new wallet and receive tNIGHT, tDust starts generating

---

0.22.5 patch — concrete test cases

Three highest-signal-per-minute checks for this patch.

TC-1 · Gas-cost filter rejects an over-limit midnight tx

https://github.com/midnightntwrk/midnight-security/issues/29

---

TC-2 · cNight observation parity over a fixed block range

Why: both #934 (multi-asset cache) and #1365 (tx-id range bounding) change how observations are computed; the contract is they must change nothing about the result.

1. Pick a fixed Cardano block range with known registrations, deregistrations, asset creates, and asset spends.
2. Verify Dust generation.

Expected: event sets are equal; sync from genesis is faster (~20-30 bps).

---

TC-3 · Devnet runtime reports 0.22.0 after upgrade to node 0.22.5

Why: this is the only behavior change of the devnet reset (#1341); cheap to verify, catches a wrong chainspec being shipped.

1. Start a fresh devnet node from t...

node-0.22.5-rc.2

Midnight Node 0.22.5-rc.2 Release Notes

Release date: 2026-04-21
Git tag: node-0.22.5-rc.2
Tree hash: b335248c509df1a853f98ac36554c2fe93614f62
Environment: All public networks

Note: This is the second release candidate for 0.22.5. Changes already announced in 0.22.5-rc.1 (e.g. the --max-tx-gas-cost filter) are not repeated here. Version 0.22.4 was skipped; this release follows from 0.22.3.

Docker Images

docker pull midnightntwrk/midnight-node:0.22.5-rc.2
docker pull midnightntwrk/midnight-node-toolkit:0.22.5-rc.2

Summary

This release candidate adds two conservative performance improvements to the cNIGHT db-sync observation path — an in-memory multi_asset.id cache and primary-key-range bounding on the four observation queries — and rebuilds the devnet chainspec so devnet's runtime version matches mainnet. All changes are node-only; no runtime upgrade is required.

Audience

• Node operators running cNIGHT observation — pull the new image for faster Cardano db-sync queries
• Devnet users — pull the new image to pick up the regenerated devnet chainspec
• Mainnet / preview / preprod operators — no mandatory action beyond the optional perf bump
• DApp developers — no API changes
• End users — no user-facing changes

What Changed

Change	Upgrade Type	PR
Cache multi_asset.id lookups in cNIGHT observation	Node upgrade	#934
Speed up cNIGHT db-sync observation queries via pk-range bounds	Node upgrade	#1365
Reset devnet chainspec to runtime version 0.22.0	Chainspec (devnet only)	#1341

Improvements

• Added an in-memory cache for multi_asset.id lookups, replacing repeated JOIN multi_asset in db-sync queries with a single cached lookup per (policy, name) pair. Eliminates the multi_asset join from registration, deregistration, asset create/spend, and candidate token queries, reducing query complexity and improving observation performance. (#934, PM-21995)
• Pre-queried coarse tx / tx_out / ma_tx_out id bounds for the requested block-range window, then constrained the four cNIGHT observation queries (registration, deregistration, asset create, asset spend) by primary-key range so Postgres can prune rows before doing expensive joins. The same tx.id bounding is extended to the tx_in-keyed spend/deregistration queries. (#1365)
• Rebuilt devnet genesis and chain specifications with runtime version 0.22.0 so devnet matches mainnet's runtime, restoring indexer compatibility. (#1341)

Other Changes

• Pinned subxt version in the Earthfile for reproducible builds.
• Synced .grype.yaml vulnerability-scan config with main.
• Ran npm audit fix across local-environment/ and util/toolkit-js/ lockfiles to pick up patched transitive dependencies. No API changes.

Breaking Changes or Required Actions

No runtime upgrade is required. Node operators should restart their nodes with the new binary to pick up the cNIGHT db-sync performance improvements. Devnet operators should additionally pull the regenerated chainspec.

Links and References

• PR #934 — Cache multi_asset.id to avoid excessive joins
• PR #1365 — Speed up cNight db-sync observation queries
• PR #1341 — Reset devnet to runtime version 0.22.0 to match mainnet
• PM-21995

Full Change Details

Changed

Cache multi_asset.id to avoid excessive joins (#934, PM-21995) (#node)

Add an in-memory cache for multi_asset.id lookups, replacing repeated JOIN multi_asset in
db-sync queries with a single cached lookup per (policy, name) pair. This eliminates the
multi_asset join from registration, deregistration, asset create/spend, and candidate token
queries, reducing query complexity and improving observation performance.

PR: #934
JIRA: https://shielded.atlassian.net/browse/PM-21995

Speed up cNight db-sync observation queries (#1365) (#node)

Pre-query coarse tx / tx_out / ma_tx_out id bounds for the requested
block-range window, then constrain the four cNight observation queries
(registration, deregistration, asset create, asset spend) by primary-key
range so postgres can prune rows before doing expensive joins. Extends the
same tx.id bounding to the tx_in-keyed spend/deregistration queries.

PR: #1365

Reset devnet to runtime version 0.22.0 to match mainnet (#1341) (#chainspec)

PR: #1341

node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.3

Git tag: node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.3

Components

• 📦 node-1.0.0
• 🧰 toolkit-1.0.0
• ⚙️ runtime-1.0.0

Added

Upgrade ledger from 8.0.2 to 8.1.0-rc.1 (#1301) (#node)

Bumps the midnight-ledger dependency from 8.0.2 to 8.1.0-rc.1, picking up
new ledger types and conversion support.

PR: #1301
Issue: #1296

Changed

Add regression tests for nonce/nullifier distinction in zswap serialization (#1128, PM-22025) (#toolkit)

Add unit tests verifying that serialized zswap local state uses the coin
nonce (randomness), not the nullifier (spend identifier), for the nonce
field. Addresses Least Authority Q1 2026 Node DIFF audit Issue E.

PR: #1128
JIRA: https://shielded.atlassian.net/browse/PM-22025

Redact database connection details from error logs (#1067, PM-19904) (#node)

Database connection error messages no longer include the host, port, or database name at error level. Full connection details are available at debug log level for authorized troubleshooting.

PR: #1067
JIRA: https://shielded.atlassian.net/browse/PM-19904

Implements handler for C-to-M brige (#1188) (#node, #runtime)

Updates bridge to emit events.
Updates call by adding McTxHash to each transfer.
Updates handler API: handler is expected to return a value that is attached to events.

Implements the handler in Midnight runtime.

PR: #1188
Required for #1083

Add validation for `networkId` on node boot to avoid mismatch with genesis state (#1265, PM-22422) (#node, #binary)

Adds validation to ensure the networkId set in the chainspec matches the
networkId used to generate the genesis state.

PR: #1265
Fix for: https://shielded.atlassian.net/browse/PM-22422

Fix DustWallet spend state propagation (#877, PM-20016) (#toolkit)

Fix DustWallet::speculative_spend to return the updated DustLocalState
alongside spends, and extend mark_spent to commit the state atomically
with nullifier recording. This ensures DustLocalState::spend's
pending_until flags are propagated, preventing utxos() from returning
already-spent outputs in consecutive spend operations.

Addresses Least Authority audit finding Issue AO.

PR: #877
JIRA: https://shielded.atlassian.net/browse/PM-20016

Align node and runtime with polkadot-stable2512-3 SDK (#1262) (#node, #runtime)

Bumps Substrate dependencies to the polkadot-stable2512-3 tag and updates call sites for breaking API changes: Core::execute_block and BlockBuilder::check_inherents now use LazyBlock; SpawnTasksParams requires tracing_execute_block (set to None unless trace RPC is wired); MmrApi v3 gains generate_ancestry_proof while BeefyApi no longer exposes it; pallet-version test mock implements Core with LazyBlock. Partner-chains and lockfiles are updated in line with the same SDK line.

PR: #1262
Required for #1244

Align node, runtime, relay, and partner-chains with polkadot-stable2603 SDK (#1299) (#node, #runtime, #partner-chains)

Bumps Substrate dependencies to the polkadot-stable2603 tag and updates call sites for breaking API changes:

• Workspace: All polkadot-stable2512-3 git deps moved to polkadot-stable2603; tracing-subscriber pinned to =0.3.19 (required by sp-tracing on this line) with toolkit using the workspace entry.
• Node: sc_service::build_network gains spawn_essential_handle; new_full_parts_with_genesis_builder keeps the six-argument signature (no Grandpa pruning filters argument—unlike new_full_parts).
• Runtime: sp_session::SessionKeys::generate_session_keys now takes owner: Vec<u8> and returns OpaqueGeneratedSessionKeys; opaque key generate calls pass &owner.
• Partner-chains (vendored subtree): Aura Proposer uses ProposeArgs; demo node uses GrandpaPruningFilter with new_full_parts and spawn_essential_handle; toolkit inherent errors use Debug instead of sp_runtime::RuntimeDebug where needed.
• Ledger / primitives: RuntimeDebug derives replaced with core::fmt::Debug where sp_runtime::RuntimeDebug / frame_support::RuntimeDebug were removed.
• Pallets: RuntimeDebugNoBound replaced with DebugNoBound (e.g. federated-authority, throttle).
• Relay (BEEFY): BeefySignatureHasher removed; SignedCommitment::verify_signatures called with a single inferred authority type parameter.

Partner-chains Cargo.toml / README / changelog are aligned with the same SDK tag where applicable.

PR: #1299
Required for #1245

Early weight check in midnight pallet pre_dispatch (#1305) (#node)

Add an early block weight check in ValidateUnsigned::pre_dispatch before
expensive ledger validation. Substrate's Bare extrinsic path runs the pallet's
pre_dispatch before the CheckWeight extension, which means transactions that
won't fit in the block still undergo costly ledger validation before being
rejected. The new check mirrors the logic in calculate_consumed_weight and
exits early with ExhaustsResources when the block is full.

PR: #1305

Speed up toolkit syncing (#1263) (#toolkit)

Batch block-number-to-hash RPC calls into a single request instead of one call per block, reducing round trips during sync. Also simplifies several function parameters across the fetcher.

PR: #1263

📦 Node

Git tag: node-1.0.0-rc.3

Docker Images

DockerHub

• midnight-node

$ docker pull midnightntwrk/midnight-node:1.0.0-rc.3

Added

Add per-SQL-query Prometheus timing for midnight data source queries (#904, PM-22100) (#node)

Midnight-specific data sources (cNight observation, federated authority,
candidates) now record individual Prometheus timing histograms for each
SQL query executed against DBSync. 13 sub-query timers provide per-query
latency visibility at :9615/metrics under the
midnight_data_source_query_time_elapsed metric with query_name labels.

PR: #904
JIRA: https://shielded.atlassian.net/browse/PM-22100

Add `rpc.discover` endpoint with OpenRPC v1.4 API specification (PM-6402, #869) (#client, #node, #rpc, #api)

Registers a standards-compliant rpc.discover JSON-RPC method that returns a complete OpenRPC v1.4 document describing the node's API. Enables client code generation, request validation, and developer discoverability without reading source code.

• 16 custom Midnight methods fully documented with parameter types, return types, error definitions, and descriptions
• 52 standard Substrate methods listed as reference entries
• JSON Schema type definitions generated via schemars for all RPC response types
• Static docs/openrpc.json committed for offline access
• CI drift-detection tests ensure the schema stays in sync with registered methods

Jira: https://shielded.atlassian.net/browse/PM-6402
PR: #869

Point to midnightntwrk partner chains fork (#948, PM-22099) (#node)

Partner chains dependencies now reference th...

node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.2

Midnight Node 1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.2 Release Notes

Release date: 2026-04-15

Git tag: node-1.0.0-toolkit-1.0.0-runtime-1.0.0-rc.2

Tree hash: 5c3a1ed33865cc333fc4f24c44e41eb90cb2928b

Environment: All public networks (dev, qanet, preview, preprod).

Docker Images

docker pull midnightntwrk/midnight-node:1.0.0-rc.2
docker pull midnightntwrk/midnight-node-toolkit:1.0.0-rc.2

Summary

This is the second 1.0.0 release candidate. It bundles a runtime upgrade that migrates the extrinsic format from SignedExtension to TransactionExtension, adds Substrate SDK alignment with polkadot-stable2603, and extends the cNIGHT → Midnight bridge handler to emit events carrying Cardano transaction hashes. The toolkit gains a subxt v0.50 upgrade, faster syncing, and several robustness fixes.

⚠️ Runtime upgrade required. This release changes the on-chain transaction format. Collators, validators, and all signing clients must upgrade together — see Breaking Changes or Required Actions.

🚧 The cNIGHT → Midnight bridge is NOT complete and is currently disabled. The handler work in this release (#1188) lands plumbing only; do not rely on cross-chain transfers in this build.

Audience

• Node operators / validators
• Toolkit users
• Wallet and RPC-client developers
• Integrators signing extrinsics against the runtime

What Changed

Change	Upgrade Type	PR
Migrate runtime from SignedExtension to TransactionExtension	Runtime upgrade — transaction format change	#597
C-to-M bridge handler emits events with McTxHash (bridge still disabled)	Runtime upgrade (mixed runtime + node)	#1188
Align node and runtime with polkadot-stable2512-3 SDK	Runtime upgrade (mixed)	#1262
Align node, runtime, relay, and partner-chains with polkadot-stable2603 SDK	Runtime upgrade (mixed)	#1299
Early block-weight check in midnight pallet pre_dispatch	Runtime upgrade (pallet logic)	#1305
Upgrade ledger from 8.0.2 to 8.1.0-rc.1	Node upgrade	#1301
Validate networkId on node boot	Node upgrade	#1265
Redact database connection details from error logs	Node upgrade	#1067
Upgrade subxt from v0.44 to v0.50	Toolkit	#1229
Speed up toolkit syncing via batched RPC	Toolkit	#1263
Fix DustWallet spend state propagation	Toolkit	#877
Regression tests for nonce/nullifier distinction in zswap	Toolkit	#1128
checked_add on wallet seed increment	Toolkit	#1081
Use tracing for structured log fields	Toolkit	#1230
Toolkit images are versioned independently of node	Toolkit (infra)	#1261
Cardano hard fork script for local-env	Infrastructure	#1326

New Features

cNIGHT → Midnight bridge handler (#1188) — Runtime upgrade

🚧 Status: incomplete and disabled. The bridge is not yet usable end-to-end. The changes in this release ship handler plumbing only — do not depend on cNIGHT → DUST transfers in this build.

The bridge handler now emits runtime events for each transfer, and each transfer carries an McTxHash identifying the originating Cardano transaction. The handler API now returns a value that is attached to the emitted events. Once the bridge is re-enabled in a later release, downstream indexers will be able to follow cross-chain transfers end-to-end without reconciling against Cardano separately.

Ledger upgrade to 8.1.0-rc.1 (#1301) — Node upgrade

midnight-ledger is bumped from 8.0.2 to 8.1.0-rc.1. Same major version, accessed via host calls — the upgrade ships in the node binary.

networkId boot-time validation (#1265) — Node upgrade

The node now rejects startup if the networkId in the chainspec does not match the networkId used to generate the genesis state, preventing a class of misconfiguration that previously surfaced only later as opaque state errors.

Substrate SDK alignment: polkadot-stable2512-3 → polkadot-stable2603 (#1262, #1299) — Runtime upgrade

The runtime, node, relay, and vendored partner-chains are moved onto the polkadot-stable2603 SDK line. Notable API shifts handled by the runtime:

• Core::execute_block and BlockBuilder::check_inherents take LazyBlock.
• sp_session::SessionKeys::generate_session_keys now takes owner: Vec<u8> and returns OpaqueGeneratedSessionKeys.
• MmrApi v3 gains generate_ancestry_proof; BeefyApi no longer exposes it.
• tracing-subscriber pinned to =0.3.19 (required by sp-tracing).

subxt upgrade to v0.50 (#1229) — Toolkit

Toolkit, upgrader, relay, and e2e tests migrate to subxt's block-centric API, picking up new transaction types, granular error handling, and async metadata access.

Faster toolkit sync (#1263) — Toolkit

Block-number-to-hash lookups are batched into a single RPC request instead of one call per block, materially reducing round trips during initial sync and replay.

Features Requiring Configuration Updates

• networkId validation (#1265): operators must ensure the chainspec networkId matches the value used when the genesis state was built. A mismatch is now fatal at boot.

Improvements

• Early block-weight check in the midnight pallet's pre_dispatch rejects over-weight transactions before expensive ledger validation (#1305).
• DustWallet speculative_spend now returns the updated DustLocalState alongside spends, preventing utxos() from returning already-spent outputs on consecutive spends (Least Authority audit Issue AO) (#877).
• Database connection errors no longer leak host, port, or database name at error level; full details remain at debug for authorised troubleshooting (#1067).
• Wallet seed increment uses checked_add — overflow now returns an explicit error instead of producing a colliding seed (Least Authority audit Issue AL) (#1081).
• Regression tests confirm zswap serialization uses the coin nonce, not the nullifier (Least Authority audit Issue E) (#1128).
• Toolkit structured log fields are now routed through tracing instead of being silently dropped by log (#1230).
• Toolkit Docker images are versioned independently from the node via util/toolkit/Cargo.toml; toolkit-only releases use the toolkit-X.Y.Z tag format (#1261).
• New hardfork-pv11.sh script advances the local Cardano devnet from protocol version 10 to 11, with governance key generation and automated voting (#1326).

Breaking Changes or Required Actions

⚠️ This release contains a runtime upgrade AND changes the transaction format. Coordinated upgrade is required.

Transaction format change — SignedExtension → TransactionExtension (#597)

The runtime migrates from the deprecated SignedExtra type alias to the new TxExtension pattern and adds two extensions:

• AuthorizeCall
• WeightReclaim

The runtime now implements the offchain transaction-creation traits CreateTransaction, CreateBare, CreateSignedTransaction, and CreateAuthorizedTransaction. The benchmarking harness is updated to match.

Impact — any client that constructs or signs extrinsics against this runtime must be updated:

• Extrinsics built with the previous SignedExtension layout will be rejected by the new runtime.
• Wallets, SDKs, and any service that signs raw extrinsics must regenerate against the new metadata and use the TransactionExtension signing flow.
• The toolkit and upgrader in this release are already updated; third-party tooling is not.

Required actions for operators

1. Upgrade validators and collators to node-1.0.0-rc.2 before scheduling the runtime upgrade.
2. Schedule the runtime upgrade (`runtime-1.0.0-rc.2...

node-0.22.5-rc.1

Midnight Node 0.22.5-rc.1 Release Notes

Release date: 2026-04-09
Git tag: node-0.22.5-rc.1
Tree hash: 861d80c239d430037774169d5a965c07d7089fbb
Environment: All public networks

Note: Version 0.22.4 was skipped. This release follows directly from 0.22.3.

Docker Images

docker pull midnightntwrk/midnight-node:0.22.5-rc.1
docker pull midnightntwrk/midnight-node-toolkit:0.22.5-rc.1

Summary

This release adds a configurable transaction gas cost limit, allowing node operators to reject expensive transactions at the transaction pool level before they consume resources. This is a node-only change requiring a binary restart — no runtime upgrade is needed and this is an optional upgrade for FNOs.

Audience

• Node operators — new CLI flag / env var for gas cost filtering
• DApp developers — no API changes
• End users — no user-facing changes

What Changed

Change	Upgrade Type	PR
Transaction pool gas cost filtering	Node upgrade	#1251

New Features

Transaction Pool Gas Cost Filtering (Node upgrade)

Added --max-tx-gas-cost CLI argument and MAX_TX_GAS_COST environment variable to reject midnight transactions whose estimated gas cost exceeds a configurable limit. This allows node operators to protect their nodes from expensive transactions at the pool gateway level. The CLI argument takes precedence over the environment variable when both are set.

Breaking Changes or Required Actions

No runtime upgrade is required. Node operators should restart their nodes with the new binary to pick up the gas cost filtering capability. The feature is opt-in — nodes without the flag set will continue to accept all transactions as before.

Links and References

• PR: #1251 — Transaction pool gas cost filtering

Full Change Details

Added

Transaction pool gas cost filtering (#1251) (#node)

Added --max-tx-gas-cost CLI arg and MAX_TX_GAS_COST env var to reject midnight
transactions whose estimated gas cost exceeds a configurable limit. This allows node
operators to protect their nodes from expensive transactions at the pool gateway level.
The CLI arg takes precedence over the env var when both are set.

PR: #1251

node-1.0.0-rc.1

Midnight Node 1.0.0-rc.1 Release Notes

Release date: 2026-04-02
Git tag: node-1.0.0-rc.1
Tree hash: c0b6eef82d3de5f78b8e0798bd8d945d814a3526
Environment: All public networks (mainnet, preprod, preview, qanet)

Docker Images

docker pull midnightntwrk/midnight-node:1.0.0-rc.1
docker pull midnightntwrk/midnight-node-toolkit:1.0.0-rc.1

Summary

Midnight Node 1.0.0-rc.1 is the first release candidate for the 1.0.0 mainnet release. It includes two runtime changes — a governance weight-bound fix and a per-account transaction count throttle with storage migration — alongside significant node reliability improvements (chain-state truncation fix, graceful shutdown), security hardening across CI workflows and the toolkit, and a major toolkit overhaul with file-based caching, batch transaction generation, and performance improvements.

Audience

• Node operators — runtime upgrade with storage migration; node binary update required
• Toolkit users — new commands, breaking CLI and log format changes
• DApp developers — no direct API changes

What Changed

Change	Upgrade Type	PR
Add proposal_weight_bound parameter to motion_close	Runtime	#1032
Add per-account transaction count limit to throttle pallet (with migration)	Runtime	#1060
Add per-SQL-query Prometheus timing for data source queries	Node	#904
Add rpc.discover endpoint with OpenRPC v1.4 API specification	Node	#869
Point to midnightntwrk partner chains fork	Node	#948
Clean up Postgresql connection, add ssl_root_cert config	Node	#1029
Improve logging for ledger transaction errors	Node	#961
Cache multi_asset.id to avoid excessive joins	Node	#934
Fix chain-state truncation after unclean shutdown	Node	#1140
Drop ledger default storage on node shutdown	Node	#886
Reduce cNIGHT observation address logging level	Node	#905
Remove hard-fork test ledger version dependencies	Node	#1024
Reject unsupported system transaction types	Node	#840
Remove stale cost model stubs and re-enable integration test	Node	#839
Validate genesis file type and size before reading	Node	#832
Bump version to 1.0.0	Node	#919
Bump vulnerable dependencies	Node + Toolkit	#1079
Add --log-json structured logger flag, pretty log output by default	Toolkit	#859
Enable contract_custom builder for ledger 7	Toolkit	#864
Add batch-single-tx command for bulk transaction generation	Toolkit	#820, #939
Add show-block command to toolkit	Toolkit	#1068
Add option to write out contract on-chain state	Toolkit	#946
Add support for zswap state chaining	Toolkit	#879
File-based wallet and ledger state caching	Toolkit	#820, #939
Add support for fallible contract calls	Toolkit	#888
Add support for fallible inputs	Toolkit	#966
Support multiple shielded coin inputs in single-tx/batch-single-tx/batches	Toolkit	#1216
Improve block replay and transaction generation performance	Toolkit	#820, #939
Drop structured_logger for tracing_subscriber (breaking JSON log format)	Toolkit	#899
Fix Dust address format to match specification	Toolkit	#1059
Fix missing persist() on context fork / recursion depth	Toolkit	#881
Fix panic if first block has no midnight transactions	Toolkit	#1045
Fix nullifier used as nonce when encoding zswap state	Toolkit	#895
Change default cache location to ./toolkit_cache	Toolkit	#939
Restore long-form CLI flags for governance key arguments	Toolkit	#875
Harden bot workflows against TOCTOU and expression injection	Infrastructure	#848
CI/CD security hardening (permissions, data flow, actionlint)	Infrastructure	#861
Use content hashes for Docker image tags	Infrastructure	#783
Permissions hardening across all workflow files	Infrastructure	#855
Slim down node Docker image by ~200 MB	Infrastructure	#897
Migrate Renovate to org-wide hardened preset	Infrastructure	#1118

Known Issues

• Omission: RC.1 does not include the mainnet chainspecs.

New Features

Runtime

• Per-account transaction count throttle (Runtime, #1060) — Extends the existing per-account throttle to enforce a maximum number of transactions (MaxTxs) within each rolling block window, alongside the existing byte limit. Prevents governance committee members from filling blocks with small but high-weight transactions. Includes a storage migration from the 2-field AccountUsage tuple to a 3-field UsageStats struct.

• Proposal weight bound for motion_close (Runtime, #1032) — The motion_close extrinsic now requires a proposal_weight_bound parameter following the pallet_collective::close pattern, ensuring the declared weight includes the inner call's weight upfront. The extrinsic is also DispatchClass::Operational.

Node

• rpc.discover endpoint (Node, #869) — Standards-compliant OpenRPC v1.4 discovery method documenting 16 custom Midnight methods and 52 standard Substrate methods, with JSON Schema type definitions. Enables client code generation and request validation.

• Per-SQL-query Prometheus timing (Node, #904) — 13 sub-query timers provide per-query latency visibility at :9615/metrics under the midnight_data_source_query_time_elapsed metric with query_name labels.

• PostgreSQL ssl_root_cert configuration (Node, #1029) — New ssl_root_cert configuration option for PostgreSQL connections.

Toolkit

• Batch transaction generation (Toolkit, #820, #939) — New batch-single-tx subcommand generates multiple transactions from a JSON specification file with configurable concurrency and parallel ZK proving.

• File-based wallet and ledger state caching (Toolkit, #820, #939) — Two-tier file cache persists ledger snapshots and per-wallet state across runs, eliminating full chain replay on every invocation. New CLI flags: --ledger-state-db <path>, --fetch-only-cached, --seeds.

• Show-block command (Toolkit, #1068) — Diagnostic command to inspect individual blocks with human-readable and JSON output.

• Fallible contract calls and inputs (Toolkit, #888, #966) — Support for fallible contract calls and fallible inputs in transaction generation.

• **...

node-0.22.3

Midnight Node 0.22.3 Release Notes

Release date: 2026-03-25
Git tag: node-0.22.3
Tree hash: f99aa05d285b7576e4a4af564f54e3983b49fc4e
Environment: Preview network

Docker Images

docker pull midnightntwrk/midnight-node:0.22.3
docker pull midnightntwrk/midnight-node-toolkit:0.22.3

Summary

This is a config-only patch release that regenerates the preview network genesis state and chain specifications for 0.22.3, preserving existing cNightObservation data. No runtime, node binary, or toolkit code changes are included.

Audience

• Node operators (preview network): Must pull the new image to pick up updated genesis and chain spec files.
• Node operators (other networks): No action required.
• DApp developers: No action required.

What Changed

Change	Upgrade Type	PR
Regenerate preview genesis and chain spec for 0.22.3	Node upgrade (config only)	#1071

Improvements

• Regenerated preview network genesis state and chain specifications for the 0.22.3 release, preserving existing cNightObservation data (#1071, PM-22397)

Breaking Changes or Required Actions

Preview network operators must update to this image to use the regenerated genesis and chain spec files. No runtime upgrade is required.

Links and References

• PR #1071 — Regenerate preview for 0.22.3
• PM-22397

Full Change Details

Regenerate preview genesis and chain spec for 0.22.3 (#1071, PM-22397) (#node)

Regenerates preview network genesis state and chain specifications for 0.22.3, preserving existing cNightObservation data.

PR: #1071
JIRA: https://shielded.atlassian.net/browse/PM-22397