[adrienlacombe]

Summary

Prepare Krusty 0.14.0 from the security fixes merged since 0.13.0. The minor bump is for the tip-pin behavior change: transactions signed without a ceiling bid no priority fee instead of the network median, so this must not flow to dependents still on ^0.13.0.

Design

All workspace packages inherit 0.14.0. Internal krusty-kms-* path requirements move from 0.13.0 to 0.14.0 because pre-1.0 caret ranges exclude the next minor. See docs/design/2026-10-28-release-0.14.0.md.

The release notes are the former ## [Unreleased] security items: the V3 tip pin (#180), the rustls-webpki advisory bump (#180), and crypto-bigint 0.7.10 / ctutils 0.4.6 / tokio 1.54.1 (#184).

Verification

• Workspace version on main is 0.13.0, matching the latest published krusty-kms on crates.io. The last Publish to crates.io run for v0.13.0 succeeded.
• cargo metadata reports krusty-kms 0.14.0.
• check-release-version-base.sh, verify-release-changelog.sh, and the design-note check passed.
• cargo check --workspace --all-targets refreshed Cargo.lock.
• cargo package --locked succeeded for all eight publishable crates: krusty-kms-common, krusty-kms-crypto, krusty-kms, krusty-kms-sdk, krusty-kms-wallet-api, krusty-kms-client, krusty-kms-domain, and krusty-kms-gateway.
• bash tools/check.sh all passed on Rust 1.99.1: formatting, Clippy, native tests, guardrails, and wasm-pack 0.15.0 Node tests (103 WASM tests plus the copy-getter test).

Publication

Merging this pull request does not publish. After merge, tag only that main commit as v0.14.0 and push the tag. publish.yml then waits for approval in the protected crates-io environment (required reviewers, prevent self-review, administrator bypass, and a single v* tag deployment policy, checked live). The npm workflow publishes @starknetfoundation/krusty-kms-wasm 0.14.0 from the merge to main, behind the npm environment's own approval. Do not publish from this branch, and do not move the tag if a later source fix is required.

  

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 1

• coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: starknet-innovation/krusty-kms
• Branch: cursor/release-0-14-0-26ef
• File: .coderabbit.yaml
• Commit: c090fe5
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 07e7fab0-5377-4b8a-922d-c9dd6f254773

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T07:01:42.758391Z	c090fe5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.