Skip to content

V438 Release - #2970

Merged
UnArbosFive merged 82 commits into
mainfrom
v438-release
Jul 23, 2026
Merged

V438 Release#2970
UnArbosFive merged 82 commits into
mainfrom
v438-release

Conversation

@UnArbosSix

@UnArbosSix UnArbosSix commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator

v438 Release

Summary

This release brings together 10 PRs spanning runtime functionality, security and correctness fixes, EVM compatibility, limit-order signing, testnet synchronization, Python 3.14 support, and hardened release infrastructure.

Included PRs

PR Change Author
#2944 — Fix stable PyPI publication retries Separates GitHub release completion from stable Python publication and makes partial or failed PyPI publication safely retryable. @UnArbosFive
#2952 — Publish the main Docker image on merge Publishes ghcr.io/raofoundation/subtensor:main from main while keeping latest tied to deployed releases. @UnArbosFive
#2954 — Add staking precompile views Adds bounded stake-position lookup and DefaultMinStake views, including ABI updates and gas accounting. @UnArbosSix
#2955 — Fix log decoding Updates dependency configuration to correct log decoding. @UnArbosSix
#2959 — Fix testnet GRANDPA warp sync checkpoints Adds testnet-specific trusted checkpoints and pins the compatible Polkadot SDK warp-proof implementation. @UnArbosFive
#2962 — Fix mechanism emission split Requires one emission-split entry for every active mechanism. @UnArbosFour
#2964 — Bound BlocksSinceLastStep Prevents the observable counter from exceeding the subnet-specific tempo + 1 bound during deferred or inconsistent epochs. @UnArbosFour
#2966 — Support Ledger-friendly limit-order signatures Adds ed25519 and wrapped-hash signature support while continuing to reject ECDSA signatures. @UnArbosSix
#2972 — Fix stable Python release publishing Hardens release provenance, artifact and finalized-runtime verification, immutable tag handling, and retryable trusted PyPI publication for bittensor 11.0.1 and bittensor-core 0.1.1. @UnArbosFive
#2974 — Support Python 3.14 in bittensor 11.0.1 Extends the unified SDK and btcli to Python 3.14 while retaining support for Python 3.10 through 3.13. @UnArbosFive

lorismoulin and others added 30 commits June 10, 2026 18:12
Default-branch-only workflow that deploys sealed artifacts from the
secret-free Request Docs Preview PR workflow. Never checks out PR code.

Co-authored-by: Cursor <cursoragent@cursor.com>
Do not embed toJSON(pull_requests) into a shell-quoted node -e body while
deploy secrets are present; read event fields from the environment instead.

Co-authored-by: Cursor <cursoragent@cursor.com>
Install vercel into RUNNER_TEMP and invoke it by absolute path with a
sanitized PATH so PR-built website/node_modules/.bin cannot hijack the
secret-bearing deploy step. Pin setup-node to an immutable SHA.

Co-authored-by: Cursor <cursoragent@cursor.com>
…ives

Trusted deploy extracts only regular files under .vercel/ and
website/node_modules/, blocking PR-controlled link escapes on the runner.

Co-authored-by: Cursor <cursoragent@cursor.com>

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

Self::TestnetCheckpoints(checkpoints) => {
HardForks::new_hard_forked_authorities(checkpoints)
}
Self::InitialSetId(set_id) => HardForks::new_initial_set_id(set_id),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Apply the Finney set-ID correction only once

HardForks::new_initial_set_id(3) applies the offset to every proof fragment, so a Finney warp proof spanning authority rotations over-counts subsequent set IDs and fails verification. Scope the correction to the Finney genesis and apply it only when verification begins at set ID 0, as implemented and tested by PR #2971.

@github-actions

Copy link
Copy Markdown
Contributor

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

Self::TestnetCheckpoints(checkpoints) => {
HardForks::new_hard_forked_authorities(checkpoints)
}
Self::InitialSetId(set_id) => HardForks::new_initial_set_id(set_id),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Apply the Finney set-ID correction only once

new_initial_set_id(3) applies the offset to every warp-proof fragment, so a proof spanning authority-set rotations over-counts subsequent set IDs and warp sync fails. Integrate PR #2971’s Finney-genesis-scoped provider, which substitutes set ID 3 only when verification starts at set 0 and preserves the set IDs returned by later fragments.

@github-actions

Copy link
Copy Markdown
Contributor

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

Self::TestnetCheckpoints(checkpoints) => {
HardForks::new_hard_forked_authorities(checkpoints)
}
Self::InitialSetId(set_id) => HardForks::new_initial_set_id(set_id),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Apply the Finney set-ID correction only once

HardForks::new_initial_set_id(3) applies the offset to every warp-proof fragment, so a proof spanning later authority rotations over-counts the set ID and fails verification. Integrate PR #2971: scope the correction to the Finney genesis and wrap the provider so set ID 3 replaces only the initial set ID 0; subsequent fragments must use the set ID returned by the preceding proof.

@github-actions

Copy link
Copy Markdown
Contributor

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

Self::TestnetCheckpoints(checkpoints) => {
HardForks::new_hard_forked_authorities(checkpoints)
}
Self::InitialSetId(set_id) => HardForks::new_initial_set_id(set_id),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Apply the Finney set-ID correction only once

Finney is still routed through HardForks::new_initial_set_id(3), whose correction is applied to every proof fragment. Once a warp proof spans an authority-set rotation, this repeatedly adds three and verifies against the wrong set. Integrate PR #2971's genesis-scoped provider wrapper so the correction is applied only when warp sync starts at set zero, with subsequent set IDs passed through unchanged.

@github-actions

Copy link
Copy Markdown
Contributor

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

Self::TestnetCheckpoints(checkpoints) => {
HardForks::new_hard_forked_authorities(checkpoints)
}
Self::InitialSetId(set_id) => HardForks::new_initial_set_id(set_id),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Apply the Finney set-ID correction only once

new_initial_set_id(3) adds the correction while verifying every proof fragment, so a multi-fragment Finney warp proof over-counts the authority-set ID after the first fragment and fails verification. Integrate PR #2971's genesis-scoped provider wrapper, which substitutes set ID 3 only when warp sync starts at set 0 and preserves subsequent IDs returned by verification.

@github-actions

Copy link
Copy Markdown
Contributor

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

Self::TestnetCheckpoints(checkpoints) => {
HardForks::new_hard_forked_authorities(checkpoints)
}
Self::InitialSetId(set_id) => HardForks::new_initial_set_id(set_id),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Apply the Finney set-ID correction only once

Finney still uses HardForks::new_initial_set_id(3), which permanently offsets GRANDPA set IDs rather than applying the historical correction once. Integrate PR #2971’s one-time provider correction before releasing; otherwise warp-sync proofs can use incorrect set IDs after the affected historical range.

@github-actions

Copy link
Copy Markdown
Contributor

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

@UnArbosFive
UnArbosFive self-requested a review July 23, 2026 20:11
@UnArbosFive
UnArbosFive merged commit c1463f2 into main Jul 23, 2026
108 of 109 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants