August 24–31, 2026
This update covers qualifying public-repository engineering activity during the previous seven days. Links to public changes appear directly beside the summaries they support.
DuskEVM SDK
Section titled “DuskEVM SDK”Documented the permanent withdrawal-recipient metadata boundary and the supported typed-helper path.
- Documented that raw withdrawal calldata cannot alter the recipient stored in the withdrawal envelope. (PR #4)
Hardened WebAssembly task execution, memory copying, failure settlement, and CI coverage.
- Fixed numeric WebAssembly memory copies with explicit bounds, count validation, and supported overloads. (PR #12)
- Standardized sandbox request settlement across success, failure, abort, timeout, and worker-exit paths. (PR #11)
- Added self-contained CI coverage for supported runtimes and browser-worker behavior. (PR #10)
- Rejected sandbox tasks when WebAssembly module compilation failed instead of leaving requests unresolved. (PR #9)
Connect
Section titled “Connect”Expanded provider coordination, transaction waiting, account encoding, and integration guidance for more reliable dApp connections.
- Added validated conversion between Base58 Moonlight accounts and their 96-byte hexadecimal public-key representation. (PR #36)
- Documented chain IDs, signature envelopes, transport-safe contract arguments, and unverified display metadata. (PR #34)
- Enforced active-provider selection for stateful wallet operations and event subscriptions. (PR #33)
- Added queued execution frames during subscription setup while keeping timeouts, aborts, and transport failures retryable. (PR #30)
- Prevented another object with the same UUID from replacing an explicitly selected provider. (PR #31)
- Clarified successful, failed, and unknown transaction outcomes instead of treating malformed payloads as success. (PR #32)
- Prevented Promise resolution from invoking generated contract methods by keeping contract facets non-thenable. (PR #29)
- Consolidated normalization helpers and removed dead internal typing without changing the public surface. (PR #22)
- Consolidated receipt waiting, transport-error normalization, theme tokens, and demo styles across repeated paths. (PR #21)
- Updated node state from wallet capabilities while preserving the existing node when capability data was absent. (PR #19)
Wallet
Section titled “Wallet”Strengthened wallet lifecycle, transaction processing, provider integration, and cross-platform consistency.
- Documented that the existing Moonlight account field carries the profile’s compressed public key. (PR #104)
- Added the installed wallet version to Settings across Chrome and Firefox builds. (PR #103)
- Standardized token-contract argument encoding as hexadecimal before Chrome extension messaging. (PR #102)
- Documented multi-wallet selection, chain parsing, byte conventions, signature limits, and display-metadata boundaries. (PR #100)
- Standardized wallet lifecycle and approval mutations so failures could not leave partially replaced state. (PR #95)
- Standardized transaction construction per wallet, network, and profile while reserving sequential Moonlight nonces. (PR #96)
- Added finalized block data and actual fees to transaction activity while preserving large integers. (PR #77)
- Supported current and legacy execution payloads while preserving stronger terminal evidence and later finalization. (PR #76)
- Removed unused internal helpers while preserving runtime behavior and public wallet surfaces. (PR #87)
- Consolidated equivalent UI command dispatch across extension and desktop runtimes while preserving platform-specific behavior. (PR #86)
- Consolidated engine messaging, retry, configuration, status, and gas-control paths across browser hosts. (PR #85)
- Normalized requested node URLs before comparison so equivalent spellings did not require another approval. (PR #83)
Web-wallet
Section titled “Web-wallet”Validated native bridge withdrawal recipients through the SDK to produce canonical Dusk recipient envelopes.
- Added native-withdrawal construction through the SDK’s validated builder and derived the recipient envelope from the active account key. (PR #955)
Merkle
Section titled “Merkle”Simplified native array handling in tree serialization while preserving existing roots and proofs.
- Replaced repeated array conversions with native handling while preserving tree roots and proof behavior. (PR #136)
Dependency audit refresh
Section titled “Dependency audit refresh”Updated transitive dependency baselines across Connect and Wallet while clearing their recorded dependency-audit findings.
- Updated transitive build dependencies and cleared the repository’s recorded dependency-audit findings. (PR #23, PR #88)
Benchmark tooling
Section titled “Benchmark tooling”Updated benchmark tooling across core libraries, keeping performance checks compatible with current dependencies and standard-library helpers.
- Consolidated repeated benchmark setup while preserving measured paths. (PR #292, PR #83)
- Updated Criterion benchmark dependencies and current black-box helper usage. (PR #171, PR #82, PR #954, PR #290, PR #130, PR #47)
Bls12_381
Section titled “Bls12_381”Hardened BLS12-381 serialization and dependency handling while preserving encoded formats and edge-case validation.
- Replaced byteorder with native integer conversion and removed the dependency while preserving committed compatibility vectors. (PR #173)
- Required boolean infinity flags and exactly 68 Miller-loop coefficients when decoding prepared G2 values. (PR #172)
Simplified sponge finalization and reduced output cloning for faster repeated finalization.
- Moved sponge output during finalization instead of cloning it and simplified repeated error branches. (PR #34)
Phoenix
Section titled “Phoenix”Reduced unused dependencies and made no-std WebAssembly checks self-contained without changing transaction behavior.
- Removed unused direct dependencies across Phoenix core and circuits. (PR #309)
- Removed the unused direct Base64 dependency and its Serde feature wiring. (PR #307)
- Added the WebAssembly target inside no-std checks so validation did not depend on runner state. (PR #305)
Rust 1.96 compatibility baseline
Section titled “Rust 1.96 compatibility baseline”Updated the supported Rust baseline across core libraries, keeping current toolchains aligned with tested no-std and documentation builds.
- Adopted Rust 1.96.1 as the declared minimum across the affected workspaces while retaining existing validation targets. (PR #165, PR #170, PR #303, PR #34, PR #80, PR #952, PR #128, PR #288, PR #33, PR #45)
Dusk-bytes
Section titled “Dusk-bytes”Updated serialization derives, toolchain support, documentation, and CI while preserving byte compatibility.
- Updated derive-hex 0.1.3 and dusk-bytes 0.1.8 metadata with final dependency pins. (PR #59)
- Updated derived Hex implementations to preserve generics and documented that HexDebug exposes the complete serialized value. (PR #49)
- Added a reconstructed dusk-bytes changelog and documented maintenance for both workspace crates. (PR #57)
- Simplified formatting, tests, and CI while expanding parsing and bidirectional golden-vector coverage. (PR #50)
- Updated derive-hex from Syn 1 to Syn 3. (PR #54)
- Updated the minimum supported Rust version to 1.96.1. (PR #52)
- Enforced unsafe-code rejection and warning-free documentation across feature configurations. (PR #48)
- Optimized checked-byte deserialization by borrowing input prefixes directly instead of copying them into temporary arrays. (PR #47)
Dependency policy checks
Section titled “Dependency policy checks”Expanded dependency-policy checks across the shared workflow and PLONK with reusable cargo-deny inputs and repository validation.
- Added cargo-deny configuration and validation to PLONK’s CI path. (PR #864)
- Added reusable cargo-deny toolchain inputs to the shared workflow. (PR #62)
Poseidon252
Section titled “Poseidon252”Replaced a direct test dependency with standard-library LazyLock while preserving test and benchmark behavior.
- Replaced once_cell with standard-library LazyLock in test and benchmark setup. (PR #286)
Added the August 17–24 developer update with its verified public source ledger.
- Added developer update for August 17–24, 2026 (PR #143)
Jubjub
Section titled “Jubjub”Reduced minimal-build and test-only dependencies while preserving curve behavior.
- Removed bitvec from minimal builds while retaining it only where bit-level support was required. (PR #161)
- Removed a legacy test-only Blake2 dependency and updated fixtures to the current hash implementation. (PR #163)
Jubjub-schnorr
Section titled “Jubjub-schnorr”Consolidated signature serialization paths while preserving encoded formats and error behavior.
- Consolidated duplicate Serde paths while preserving signature encodings and error handling. (PR #76)