nym-api moved default (#6624)

temporarily change binaries ci runner to 22.04

.github/workflows/ci-build-upload-binaries.yml

@@ -36,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [arc-linux-latest]
+        platform: [ubuntu-22.04]
 
     runs-on: ${{ matrix.platform }}
     env:

.github/workflows/ci-contracts.yml

@@ -35,7 +35,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Install cosmwasm-check
-        run: cargo install cosmwasm-check
+        run: cargo install cosmwasm-check --locked
 
       - name: Install wasm-opt
         uses: ./.github/actions/install-wasm-opt

.github/workflows/publish-nym-binaries.yml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: arc-linux-latest
+          - os: ubuntu-22.04
             target: x86_64-unknown-linux-gnu
     runs-on:  ${{ matrix.os }}
 

CHANGELOG.md

@@ -4,6 +4,54 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2026.6-stilton] (2026-03-25)
+
+- lp fixes ([#6601])
+- bugfix: allow deserialisation of LP data from either snake_case or lowercase ([#6586])
+- bugfix: make sure to run cargo install cosmwasm-check with --locked flag during CI ([#6568])
+- Add LP to NS UI ([#6562])
+- feat: nyxd watcher ([#6561])
+- Additional ticket for agent ([#6551])
+- bugfix: make sure to use old values from metrics debug config during v12 migration (#6546) ([#6547])
+- typo ([#6543])
+- rng changes for a Send variant ([#6541])
+- Add LP fields ([#6535])
+- enable LP registration in registration client ([#6534])
+- chore: rename LpMessage to LpFrame ([#6530])
+- chore: LP improvements ([#6526])
+- Remove dep leak of strum iterator ([#6522])
+- chore: update ts-rs dep ([#6517])
+- addressing LP PR comments ([#6513])
+- remove redundant LP state machine in favour of in place processing ([#6512])
+- chore: split up lp listener ([#6507])
+- feat: enable mutual KKT exchange ([#6505])
+- feat: introduce /v3/unstable/nym-nodes/semi-skimmed to aggregate LP information ([#6499])
+- Max/asyncread asyncwrite nym client ([#6318])
+- feat: localnet v2 ([#6277])
+
+[#6601]: https://github.com/nymtech/nym/pull/6601
+[#6586]: https://github.com/nymtech/nym/pull/6586
+[#6568]: https://github.com/nymtech/nym/pull/6568
+[#6562]: https://github.com/nymtech/nym/pull/6562
+[#6561]: https://github.com/nymtech/nym/pull/6561
+[#6551]: https://github.com/nymtech/nym/pull/6551
+[#6547]: https://github.com/nymtech/nym/pull/6547
+[#6543]: https://github.com/nymtech/nym/pull/6543
+[#6541]: https://github.com/nymtech/nym/pull/6541
+[#6535]: https://github.com/nymtech/nym/pull/6535
+[#6534]: https://github.com/nymtech/nym/pull/6534
+[#6530]: https://github.com/nymtech/nym/pull/6530
+[#6526]: https://github.com/nymtech/nym/pull/6526
+[#6522]: https://github.com/nymtech/nym/pull/6522
+[#6517]: https://github.com/nymtech/nym/pull/6517
+[#6513]: https://github.com/nymtech/nym/pull/6513
+[#6512]: https://github.com/nymtech/nym/pull/6512
+[#6507]: https://github.com/nymtech/nym/pull/6507
+[#6505]: https://github.com/nymtech/nym/pull/6505
+[#6499]: https://github.com/nymtech/nym/pull/6499
+[#6318]: https://github.com/nymtech/nym/pull/6318
+[#6277]: https://github.com/nymtech/nym/pull/6277
+
 ## [2026.5-raclette] (2026-03-10)
 
 - bugfix: correctly populate gateway probe LP data ([#6533])

Cargo.lock

@@ -5547,7 +5547,7 @@ dependencies = [
 
 [[package]]
 name = "nym-api"
-version = "1.1.75"
+version = "1.1.76"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5792,7 +5792,7 @@ dependencies = [
 
 [[package]]
 name = "nym-cli"
-version = "1.1.72"
+version = "1.1.73"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -5875,7 +5875,7 @@ dependencies = [
 
 [[package]]
 name = "nym-client"
-version = "1.1.72"
+version = "1.1.73"
 dependencies = [
  "bs58",
  "clap",
@@ -7279,7 +7279,7 @@ dependencies = [
 
 [[package]]
 name = "nym-network-requester"
-version = "1.1.73"
+version = "1.1.74"
 dependencies = [
  "addr",
  "anyhow",
@@ -7329,7 +7329,7 @@ dependencies = [
 
 [[package]]
 name = "nym-node"
-version = "1.27.0"
+version = "1.28.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -7875,7 +7875,7 @@ dependencies = [
 
 [[package]]
 name = "nym-socks5-client"
-version = "1.1.72"
+version = "1.1.73"
 dependencies = [
  "bs58",
  "clap",
@@ -8668,11 +8668,12 @@ dependencies = [
  "serde",
  "thiserror 2.0.12",
  "x25519-dalek",
+ "zeroize",
 ]
 
 [[package]]
 name = "nymvisor"
-version = "0.1.37"
+version = "0.1.38"
 dependencies = [
  "anyhow",
  "bytes",

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.72"
+version = "1.1.73"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.72"
+version = "1.1.73"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/http-api-client/src/dns/constants.rs

@@ -4,7 +4,7 @@ use std::collections::HashMap;
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
 pub const NYM_API_DOMAIN: &str = "validator.nymtech.net";
-pub const NYM_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(212, 71, 233, 232))];
+pub const NYM_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(92, 39, 63, 14))];
 
 pub const NYM_VPN_API_DOMAIN: &str = "nymvpn.com";
 pub const NYM_VPN_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 21))];

common/registration/src/lib.rs

@@ -7,6 +7,7 @@ use nym_crypto::asymmetric::{ed25519, x25519};
 use nym_ip_packet_requests::IpPair;
 use nym_kkt_ciphersuite::{Ciphersuite, KEM, KEMKeyDigests};
 use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PresharedKey;
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
@@ -44,11 +45,11 @@ pub struct WireguardRegistrationData {
     pub private_ipv6: Ipv6Addr,
 }
 
-#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize)]
+#[derive(Debug, PartialEq, Serialize, Deserialize)]
 pub struct WireguardConfiguration {
     #[serde(with = "bs58_x25519_pubkey")]
     pub public_key: x25519::PublicKey,
-    pub psk: Option<[u8; 32]>,
+    pub psk: Option<PresharedKey>,
     pub endpoint: SocketAddr,
     pub private_ipv4: Ipv4Addr,
     pub private_ipv6: Ipv6Addr,

common/wireguard-types/Cargo.toml

@@ -15,6 +15,7 @@ description = "Wireguard public key and config definitions"
 base64 = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
+zeroize.workspace = true
 
 x25519-dalek = { workspace = true, features = ["static_secrets"] }
 nym-crypto = { workspace = true, features = ["asymmetric"] }

common/wireguard-types/src/lib.rs

@@ -3,12 +3,14 @@
 
 pub mod config;
 pub mod error;
+pub mod preshared_key;
 pub mod public_key;
 
 use std::time::Duration;
 
 pub use config::Config;
 pub use error::Error;
+pub use preshared_key::PresharedKey;
 pub use public_key::PeerPublicKey;
 
 pub const DEFAULT_PEER_TIMEOUT_CHECK: Duration = Duration::from_secs(5); // 5 seconds

common/wireguard-types/src/preshared_key.rs

@@ -0,0 +1,26 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use serde::{Deserialize, Serialize};
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+#[derive(Debug, PartialEq, Serialize, Deserialize, Zeroize, ZeroizeOnDrop)]
+pub struct PresharedKey([u8; 32]);
+
+impl PresharedKey {
+    pub fn as_bytes(&self) -> &[u8; 32] {
+        &self.0
+    }
+}
+
+impl From<[u8; 32]> for PresharedKey {
+    fn from(key: [u8; 32]) -> PresharedKey {
+        PresharedKey(key)
+    }
+}
+
+impl From<PresharedKey> for [u8; 32] {
+    fn from(key: PresharedKey) -> [u8; 32] {
+        key.0
+    }
+}

nym-api/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.75"
+version = "1.1.76"
 authors.workspace = true
 edition = "2021"
 rust-version.workspace = true

nym-api/nym-api-requests/src/models/described/type_translation.rs

@@ -296,11 +296,14 @@ fn translate_digests(
     ToSchema,
     Ord,
 )]
-#[serde(rename_all = "snake_case")]
+#[serde(rename_all = "lowercase")]
 #[strum(serialize_all = "lowercase")]
 #[non_exhaustive]
 pub enum LPKEM {
+    #[serde(alias = "ml_kem768")]
     MlKem768,
+
+    #[serde(alias = "mc_eliece")]
     McEliece,
 }
 
@@ -320,7 +323,7 @@ pub enum LPKEM {
     ToSchema,
     Ord,
 )]
-#[serde(rename_all = "snake_case")]
+#[serde(rename_all = "lowercase")]
 #[strum(serialize_all = "lowercase")]
 #[non_exhaustive]
 pub enum LPHashFunction {
@@ -345,7 +348,7 @@ pub enum LPHashFunction {
     EnumString,
     ToSchema,
 )]
-#[serde(rename_all = "snake_case")]
+#[serde(rename_all = "lowercase")]
 #[strum(serialize_all = "lowercase")]
 #[non_exhaustive]
 pub enum LPSignatureScheme {

nym-gateway-probe/src/common/probe_tests.rs

@@ -234,7 +234,7 @@ pub async fn lp_registration_probe(
         "  - PSK: {:?}",
         gateway_data
             .psk
-            .map(|k| general_purpose::STANDARD.encode(k))
+            .map(|k| general_purpose::STANDARD.encode(k.as_bytes()))
     );
     info!("  - Private IPv4: {}", gateway_data.private_ipv4);
     info!("  - Private IPv6: {}", gateway_data.private_ipv6);

nym-node/Cargo.toml

@@ -3,7 +3,7 @@
 
 [package]
 name = "nym-node"
-version = "1.27.0"
+version = "1.28.0"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true

nym-node/nym-node-requests/src/api/v1/lewes_protocol/models.rs

@@ -71,11 +71,14 @@ impl LewesProtocol {
     EnumString,
     Ord,
 )]
-#[serde(rename_all = "snake_case")]
+#[serde(rename_all = "lowercase")]
 #[strum(serialize_all = "lowercase")]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub enum LPKEM {
+    #[serde(alias = "ml_kem768")]
     MlKem768,
+
+    #[serde(alias = "mc_eliece")]
     McEliece,
 }
 
@@ -113,7 +116,7 @@ impl From<nym_kkt_ciphersuite::KEM> for LPKEM {
     EnumIter,
     Ord,
 )]
-#[serde(rename_all = "snake_case")]
+#[serde(rename_all = "lowercase")]
 #[strum(serialize_all = "lowercase")]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub enum LPHashFunction {
@@ -160,7 +163,7 @@ impl From<nym_kkt_ciphersuite::HashFunction> for LPHashFunction {
     EnumString,
     EnumIter,
 )]
-#[serde(rename_all = "snake_case")]
+#[serde(rename_all = "lowercase")]
 #[strum(serialize_all = "lowercase")]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub enum LPSignatureScheme {

nym-registration-client/src/clients/lp.rs

@@ -7,7 +7,7 @@ use crate::config::RegistrationMode;
 use crate::error::RegistrationClientError;
 use crate::lp_client::helpers::to_lp_remote_peer;
 use crate::lp_client::{LpRegistrationClient, NestedLpSession};
-use crate::types::{LpRegistrationResult, RegistrationResult};
+use crate::types::{RegistrationResult, WireguardRegistrationResult};
 
 use nym_bandwidth_controller::BandwidthTicketProvider;
 use nym_credentials_interface::TicketType;
@@ -147,13 +147,13 @@ impl LpBasedRegistrationClient {
         // All data flows through WireGuard after this point.
         // Each LP packet used its own TCP connection which was closed after the exchange.
         // Exit registration was completed via forwarding through entry gateway.
-        Ok(RegistrationResult::Lp(Box::new(LpRegistrationResult {
+        Ok(RegistrationResult::wireguard_lp(
             entry_gateway_data,
             exit_gateway_data,
             entry_lp_keypair,
             exit_lp_keypair,
-            bw_controller: self.bandwidth_controller,
-        })))
+            self.bandwidth_controller,
+        ))
     }
 
     async fn register_wg(self) -> Result<RegistrationResult, RegistrationClientError> {

nym-registration-client/src/clients/mixnet.rs

@@ -1,6 +1,7 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::AuthenticatorRegistrationResult;
 use crate::config::RegistrationClientConfig;
 use crate::config::RegistrationMode;
 use crate::error::RegistrationClientError;
@@ -84,19 +85,17 @@ impl MixnetBasedRegistrationClient {
             }
         };
 
-        Ok(RegistrationResult::Mixnet(Box::new(
-            MixnetRegistrationResult {
-                mixnet_client: ipr_client.into_mixnet_client(),
-                assigned_addresses: AssignedAddresses {
-                    interface_addresses,
-                    exit_mix_address: ipr_address,
-                    mixnet_client_address: self.mixnet_client_address,
-                    entry_mixnet_gateway_ip,
-                    exit_mixnet_gateway_ip,
-                },
-                event_rx: self.event_rx,
+        Ok(RegistrationResult::mixnet(
+            ipr_client.into_mixnet_client(),
+            AssignedAddresses {
+                interface_addresses,
+                exit_mix_address: ipr_address,
+                mixnet_client_address: self.mixnet_client_address,
+                entry_mixnet_gateway_ip,
+                exit_mixnet_gateway_ip,
             },
-        )))
+            self.event_rx,
+        ))
     }
 
     async fn register_wg(self) -> Result<RegistrationResult, RegistrationError> {
@@ -199,16 +198,14 @@ impl MixnetBasedRegistrationClient {
             }
         };
 
-        Ok(RegistrationResult::Wireguard(Box::new(
-            WireguardRegistrationResult {
-                entry_gateway_client: entry_auth_client,
-                exit_gateway_client: exit_auth_client,
-                entry_gateway_data: entry,
-                exit_gateway_data: exit,
-                authenticator_listener_handle: mixnet_listener,
-                bw_controller: self.bandwidth_controller,
-            },
-        )))
+        Ok(RegistrationResult::wireguard_legacy(
+            entry_auth_client,
+            exit_auth_client,
+            entry,
+            exit,
+            mixnet_listener,
+            self.bandwidth_controller,
+        ))
     }
 
     pub(crate) async fn register(self) -> Result<RegistrationResult, RegistrationClientError> {

nym-registration-client/src/lib.rs

@@ -12,7 +12,8 @@ pub use lp_client::{
     LpRegistrationClient, LpRegistrationConfig, NestedLpSession, error::LpClientError,
 };
 pub use types::{
-    LpRegistrationResult, MixnetRegistrationResult, RegistrationResult, WireguardRegistrationResult,
+    AuthenticatorRegistrationResult, LpRegistrationResult, MixnetRegistrationResult,
+    RegistrationResult, WireguardRegistrationResult,
 };
 
 mod builder;

nym-registration-client/src/lp_client/client.rs

@@ -597,7 +597,7 @@ where
 
         Ok(WireguardConfiguration {
             public_key: final_response.public_key,
-            psk: Some(psk),
+            psk: Some(psk.into()),
             endpoint: SocketAddr::new(self.gateway_lp_address.ip(), final_response.port),
             private_ipv4: final_response.private_ipv4,
             private_ipv6: final_response.private_ipv6,

nym-registration-client/src/lp_client/nested_session/mod.rs

@@ -401,10 +401,9 @@ impl NestedLpSession {
             }
         };
 
-        // JS/SW TODO Adapt this to new gateway response
         Ok(WireguardConfiguration {
             public_key: final_response.public_key,
-            psk: Some(psk),
+            psk: Some(psk.into()),
             endpoint: SocketAddr::new(self.exit_address.ip(), final_response.port),
             private_ipv4: final_response.private_ipv4,
             private_ipv6: final_response.private_ipv6,

nym-registration-client/src/types.rs

@@ -11,7 +11,58 @@ use std::sync::Arc;
 pub enum RegistrationResult {
     Mixnet(Box<MixnetRegistrationResult>),
     Wireguard(Box<WireguardRegistrationResult>),
-    Lp(Box<LpRegistrationResult>),
+}
+
+impl RegistrationResult {
+    pub fn mixnet(
+        mixnet_client: MixnetClient,
+        assigned_addresses: AssignedAddresses,
+        event_rx: EventReceiver,
+    ) -> Self {
+        RegistrationResult::Mixnet(Box::new(MixnetRegistrationResult {
+            assigned_addresses,
+            mixnet_client,
+            event_rx,
+        }))
+    }
+
+    pub fn wireguard_legacy(
+        entry_gateway_client: AuthenticatorClient,
+        exit_gateway_client: AuthenticatorClient,
+        entry_gateway_data: WireguardConfiguration,
+        exit_gateway_data: WireguardConfiguration,
+        authenticator_listener_handle: AuthClientMixnetListenerHandle,
+        bw_controller: Box<dyn BandwidthTicketProvider>,
+    ) -> Self {
+        RegistrationResult::Wireguard(Box::new(WireguardRegistrationResult::Legacy(Box::new(
+            AuthenticatorRegistrationResult {
+                entry_gateway_client,
+                exit_gateway_client,
+                entry_gateway_data,
+                exit_gateway_data,
+                authenticator_listener_handle,
+                bw_controller,
+            },
+        ))))
+    }
+
+    pub fn wireguard_lp(
+        entry_gateway_data: WireguardConfiguration,
+        exit_gateway_data: WireguardConfiguration,
+        entry_lp_keypair: Arc<DHKeyPair>,
+        exit_lp_keypair: Arc<DHKeyPair>,
+        bw_controller: Box<dyn BandwidthTicketProvider>,
+    ) -> Self {
+        RegistrationResult::Wireguard(Box::new(WireguardRegistrationResult::LewesProtocol(
+            Box::new(LpRegistrationResult {
+                entry_gateway_data,
+                exit_gateway_data,
+                entry_lp_keypair,
+                exit_lp_keypair,
+                bw_controller,
+            }),
+        )))
+    }
 }
 
 pub struct MixnetRegistrationResult {
@@ -20,7 +71,28 @@ pub struct MixnetRegistrationResult {
     pub event_rx: EventReceiver,
 }
 
-pub struct WireguardRegistrationResult {
+pub enum WireguardRegistrationResult {
+    Legacy(Box<AuthenticatorRegistrationResult>),
+    LewesProtocol(Box<LpRegistrationResult>),
+}
+
+impl WireguardRegistrationResult {
+    pub fn entry_gateway_data(&self) -> &WireguardConfiguration {
+        match self {
+            Self::Legacy(res) => &res.entry_gateway_data,
+            Self::LewesProtocol(res) => &res.entry_gateway_data,
+        }
+    }
+
+    pub fn exit_gateway_data(&self) -> &WireguardConfiguration {
+        match self {
+            Self::Legacy(res) => &res.exit_gateway_data,
+            Self::LewesProtocol(res) => &res.exit_gateway_data,
+        }
+    }
+}
+
+pub struct AuthenticatorRegistrationResult {
     pub entry_gateway_client: AuthenticatorClient,
     pub exit_gateway_client: AuthenticatorClient,
     pub entry_gateway_data: WireguardConfiguration,

service-providers/network-requester/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-network-requester"
 license = "GPL-3.0"
-version = "1.1.73"
+version = "1.1.74"
 authors.workspace = true
 edition.workspace = true
 rust-version = "1.85"

tools/nym-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-cli"
-version = "1.1.72"
+version = "1.1.73"
 authors.workspace = true
 edition = "2021"
 license.workspace = true

tools/nymvisor/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nymvisor"
-version = "0.1.37"
+version = "0.1.38"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true