bugfix: clippy issues (#6876)

* feat: expose nym-nodes' on-chain address on v2 auxiliary endpoint

* moved swagger page outside the v1 route

* fixed swagger endpoint for nym-api

* post rebasing fixes

* remove redundant impl OfflineSigner for Arc<DirectSecp256k1HdWallet>

.cargo/config.toml

@@ -0,0 +1,2 @@
+[target.wasm32-unknown-unknown]
+rustflags = ["--cfg=getrandom_backend=\"wasm_js\""]

.github/workflows/build-deb-meta.yml

@@ -25,14 +25,14 @@ jobs:
           echo "file2=$(ls nym-vpn*.deb)" >> $GITHUB_ENV
 
       - name: Upload nym-repo-setup
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ env.file1 }}
           path: ppa/packages/nym-repo-setup*.deb
           retention-days: 10
 
       - name: Upload nym-vpn
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ env.file2 }}
           path: ppa/packages/nym-vpn*.deb

.github/workflows/cd-docs.yml

@@ -7,7 +7,7 @@ jobs:
   build:
     runs-on: arc-ubuntu-22.04
     env:
-      NEXT_PUBLIC_SITE_URL: https://nymtech.net/docs
+      NEXT_PUBLIC_SITE_URL: https://nym.com/docs
     defaults:
       run:
         working-directory: documentation/docs
@@ -15,20 +15,18 @@ jobs:
       - uses: actions/checkout@v6
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
-      - name: Install pip3
-        run: sudo apt install -y python3-pip
       - name: Install Python3 modules
-        run: sudo pip3 install pandas tabulate
+        run: sudo apt install -y python3-pandas python3-tabulate
       - name: Install rsync
         run: sudo apt-get install -y rsync
       - uses: rlespinasse/github-slug-action@v3.x
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4.2.0
+        uses: pnpm/action-setup@v5.0.0
         with:
-          version: 9
+          version: 11.1.2
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
       - name: Install Rust toolchain
         uses: actions-rs/toolchain@v1
         with:
@@ -39,8 +37,13 @@ jobs:
           command: build
           args: --workspace --release
 
+      - name: Verify doc versions
+        run: ${{ github.workspace }}/documentation/scripts/verify-doc-versions.sh
+        working-directory: ${{ github.workspace }}
       - name: Install project dependencies
         run: pnpm i
+      - name: Generate llms-full.txt
+        run: pnpm run generate:llms
       - name: Build project
         run: pnpm run build
       - name: Generate sitemap

.github/workflows/ci-build-ts.yml

@@ -17,13 +17,16 @@ jobs:
       run: sudo apt-get install rsync
       continue-on-error: true
     - uses: rlespinasse/github-slug-action@v3.x
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v5.0.0
+      with:
+        version: 11.1.2
     - uses: actions/setup-node@v4
       with:
-        node-version: 20
+        node-version: 24
-    - name: Setup yarn
+        cache: pnpm
-      run: npm install -g yarn
     - name: Build
-      run: yarn && yarn build && yarn build:ci:storybook
+      run: pnpm install && pnpm build && pnpm build:ci:storybook
     - name: Deploy branch to CI www (storybook)
       continue-on-error: true
       uses: easingthemes/ssh-deploy@main

.github/workflows/ci-build-upload-binaries.yml

@@ -36,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [arc-linux-latest]
+        platform: [arc-ubuntu-22.04]
 
     runs-on: ${{ matrix.platform }}
     env:
@@ -110,7 +110,7 @@ jobs:
 
       - name: Upload Artifact
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: nym-binaries-artifacts
           path: |

.github/workflows/ci-build-upload-network-monitor-agent.yml

@@ -0,0 +1,63 @@
+name: ci-build-upload-network-monitor-agent
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build-and-upload:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [arc-ubuntu-22.04]
+
+    runs-on: ${{ matrix.platform }}
+    env:
+      CARGO_TERM_COLOR: always
+      RUSTUP_PERMIT_COPY_RENAME: 1
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Prepare build output directory
+        shell: bash
+        env:
+          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
+        run: |
+          rm -rf ci-builds || true
+          mkdir -p "$OUTPUT_DIR"
+
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get -y install libudev-dev
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+
+      - name: Build nym-network-monitor-agent
+        shell: bash
+        run: cargo build -p nym-network-monitor-agent --release
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: nym-network-monitor-agent
+          path: target/release/nym-network-monitor-agent
+          retention-days: 30
+
+      - name: Prepare build output
+        shell: bash
+        env:
+          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
+        run: cp target/release/nym-network-monitor-agent "$OUTPUT_DIR"
+
+      - name: Deploy to CI www
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "ci-builds/"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/
+          EXCLUDE: "/dist/, /node_modules/"

.github/workflows/ci-build.yml

@@ -23,7 +23,6 @@ on:
       - 'sdk/ffi/**'
       - 'sdk/rust/**'
       - 'service-providers/**'
-      - 'nym-browser-extension/storage/**'
       - 'tools/**'
       - 'wasm/**'
       - 'Cargo.toml'
@@ -90,7 +89,7 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: clippy
-          args: --workspace --all-targets --exclude nym-gateway-probe --exclude nym-node-status-api -- -D warnings
+          args: --workspace --all-targets --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client -- -D warnings
 
       - name: Clippy (non-macos)
         if: contains(matrix.os, 'linux') || contains(matrix.os, 'windows')
@@ -104,14 +103,15 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: build
+          args: --workspace --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client
 
-        # only build on linux because of wg FFI bindings of its dependency (network probe)
+        # Build Go FFI-dependent crates separately (requires Go, only available on Linux CI)
-      - name: Build nym-node-status-api (linux only)
+      - name: Build nym-node-status-api and nym-node-status-agent (linux only)
         if: runner.os == 'Linux'
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: -p nym-node-status-api
+          args: -p nym-node-status-api -p nym-node-status-agent
 
       - name: Build all examples
         if: contains(matrix.os, 'linux')

.github/workflows/ci-contracts.yml

@@ -35,7 +35,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Install cosmwasm-check
-        run: cargo install cosmwasm-check
+        run: cargo install cosmwasm-check --locked
 
       - name: Install wasm-opt
         uses: ./.github/actions/install-wasm-opt

.github/workflows/ci-crates-preflight.yml

@@ -0,0 +1,19 @@
+name: ci-crates-preflight
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'Cargo.toml'
+      - '**/Cargo.toml'
+      - 'tools/internal/check_publish_preflight.py'
+      - '.github/workflows/ci-crates-preflight.yml'
+
+jobs:
+  preflight:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Preflight publish checks
+        run: python3 tools/internal/check_publish_preflight.py

.github/workflows/ci-crates-publish-dry-run.yml

@@ -15,6 +15,9 @@ env:
 jobs:
   publish-dry-run:
     runs-on: arc-linux-latest
+    timeout-minutes: 35
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -37,7 +40,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: 24
 
       - name: Validate version format
         run: |
@@ -54,25 +57,66 @@ jobs:
 
       - name: Update workspace dependencies
         run: |
-          sed -i '/path = /s/version = "${{ steps.current_version.outputs.version }}"/version = "${{ inputs.version }}"/g' Cargo.toml
+          # Match any semver version on lines with `path = `, not just the current workspace version.
+          sed -i '/path = /s/version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "${{ inputs.version }}"/g' Cargo.toml
 
       - name: Bump versions (local only)
         run: |
           cargo workspaces version custom ${{ inputs.version }} \
-            --allow-branch ${{ github.ref_name }} \
             --no-git-commit \
+            --yes
+
+      - name: Preflight publish checks
+        run: |
+          python3 tools/internal/check_publish_preflight.py
 
       # Dry run may show cascading dependency errors because packages aren't
       # actually uploaded - these are expected and ignored. We check for real
       # errors like packaging failures, missing metadata, or invalid Cargo.toml.
       - name: Publish (dry run)
         run: |
-          output=$(cargo workspaces publish --dry-run --allow-dirty 2>&1) || true
+          set +e
-          echo "$output"
+          publish_status=1
+          max_attempts=2
+          attempt=1
+          rm -f /tmp/publish-dry-run.log
 
-          # Check for real errors (not cascading dependency errors)
+          while [ "$attempt" -le "$max_attempts" ]; do
-          # Cascading errors mention "crates.io index", real errors mention "Cargo.toml"
+            echo "Dry-run publish attempt ${attempt}/${max_attempts}"
-          echo "$output" | grep -i "Cargo.toml" && exit 1 || true
+            cargo workspaces publish --dry-run --allow-dirty 2>&1 | tee /tmp/publish-dry-run.log
+            publish_status=${PIPESTATUS[0]}
+
+            if [ "$publish_status" -eq 0 ]; then
+              break
+            fi
+
+            # Retry once for interruption/runner issues.
+            if [ "$attempt" -lt "$max_attempts" ] && \
+              { [ "$publish_status" -eq 130 ] || [ "$publish_status" -eq 137 ]; }; then
+              echo "Publish dry-run interrupted (exit ${publish_status}), retrying in 10s..."
+              sleep 10
+              attempt=$((attempt + 1))
+              continue
+            fi
+
+            break
+          done
+          set -e
+
+          if grep -Eiq \
+            "failed to verify manifest|failed to parse manifest|invalid Cargo.toml|error: package .* has no (description|license|repository)" \
+            /tmp/publish-dry-run.log; then
+            echo "Detected real packaging/manifest errors"
+            exit 1
+          fi
+
+          # In dry-run mode, non-zero publish status is expected due to
+          # dependency-cascade failures against crates.io index.
+          if [ "$publish_status" -ne 0 ]; then
+            echo "Dry-run publish returned non-zero (${publish_status}) but no real manifest blockers were detected."
+          fi
+
+          echo "Only expected dry-run dependency cascade errors detected (if any)."
 
       # Show the list of packages published
       - name: Show package versions

.github/workflows/ci-crates-publish-resume.yml

@@ -17,6 +17,8 @@ on:
 jobs:
   publish:
     runs-on: arc-linux-latest
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6

.github/workflows/ci-crates-publish.yml

@@ -17,6 +17,8 @@ on:
 jobs:
   publish:
     runs-on: arc-linux-latest
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -31,7 +33,11 @@ jobs:
       - name: Install cargo-workspaces
         run: cargo install cargo-workspaces
 
-      # `--publish-as-is` skips version bumping since that's done in a separate CI job.
+      - name: Preflight publish checks
+        run: |
+          python3 tools/internal/check_publish_preflight.py
+
+      # --publish-as-is skips version bumping since that's done in a separate CI job.
       - name: Publish
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/ci-crates-version-bump.yml

@@ -15,8 +15,11 @@ env:
 jobs:
   version-bump:
     runs-on: arc-linux-latest
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     permissions:
       contents: write
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -39,7 +42,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: 24
 
       - name: Validate version format
         run: |
@@ -56,7 +59,9 @@ jobs:
 
       - name: Update workspace dependencies
         run: |
-          sed -i '/path = /s/version = "${{ steps.current_version.outputs.version }}"/version = "${{ inputs.version }}"/g' Cargo.toml
+          # Match any semver version on lines with `path = `, not just the current workspace version.
+          # This catches entries whose version has drifted (e.g. nym-sqlx-pool-guard at 1.2.0).
+          sed -i '/path = /s/version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "${{ inputs.version }}"/g' Cargo.toml
 
       - name: Bump versions
         run: |
@@ -66,9 +71,33 @@ jobs:
 
       - name: Commit and push version bump
         run: |
+          set -euo pipefail
+          BASE_BRANCH="${GITHUB_REF_NAME}"
+          PR_BRANCH="ci/crates-version-bump-${{ inputs.version }}-${GITHUB_RUN_ID}"
+
+          git checkout -b "$PR_BRANCH"
           git add -A
           git commit -m "crates release: bump version to ${{ inputs.version }}"
-          git push
+          git push -u origin "$PR_BRANCH"
+
+          cat > /tmp/crates-version-bump-pr-body.md <<'EOF'
+          This PR was created by CI because direct pushes to the release branch are blocked by branch protection rules.
+
+          ## Summary
+          - Bump workspace crate versions to the requested release version.
+          - Update workspace dependency versions accordingly.
+
+          ## Notes
+          - Merge this PR to proceed with crates.io publishing.
+          EOF
+
+          gh pr create \
+            --base "$BASE_BRANCH" \
+            --head "$PR_BRANCH" \
+            --title "crates release: bump version to ${{ inputs.version }}" \
+            --body-file /tmp/crates-version-bump-pr-body.md
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Show package versions
         run: cargo workspaces list --long

.github/workflows/ci-docs.yml

@@ -6,6 +6,11 @@ on:
     branches-ignore: [master]
     paths:
       - "documentation/docs/**"
+      - "sdk/typescript/packages/sdk/src/**"
+      - "sdk/typescript/packages/mix-tunnel/src/**"
+      - "sdk/typescript/packages/mix-fetch/src/**"
+      - "sdk/typescript/packages/mix-dns/src/**"
+      - "sdk/typescript/packages/mix-websocket/src/**"
       - ".github/workflows/ci-docs.yml"
 
 jobs:
@@ -20,20 +25,18 @@ jobs:
       - uses: actions/checkout@v6
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
-      - name: Install pip3
-        run: sudo apt install -y python3-pip
       - name: Install Python3 modules
-        run: sudo pip3 install pandas tabulate
+        run: sudo apt install -y python3-pandas python3-tabulate
       - name: Install rsync
         run: sudo apt-get install -y rsync
       - uses: rlespinasse/github-slug-action@v3.x
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4.2.0
+        uses: pnpm/action-setup@v5.0.0
         with:
-          version: 9
+          version: 11.1.2
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
       - name: Install Rust toolchain
         uses: actions-rs/toolchain@v1
         with:
@@ -44,10 +47,37 @@ jobs:
           command: build
           args: --workspace --release
 
+      - name: Check if TypeScript SDK source changed
+        id: check-ts-sdk
+        run: |
+          if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -qE '^sdk/typescript/packages/(sdk|mix-tunnel|mix-fetch|mix-dns|mix-websocket)/src/'; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "changed=false" >> $GITHUB_OUTPUT
+          fi
+        working-directory: ${{ github.workspace }}
+
+      - name: Regenerate TypeDoc API reference
+        if: steps.check-ts-sdk.outputs.changed == 'true'
+        run: |
+          npm install -g typedoc@0.25.13 typedoc-plugin-markdown@4.0.3
+          cd ${{ github.workspace }}/sdk/typescript/packages/sdk          && typedoc --skipErrorChecking
+          cd ${{ github.workspace }}/sdk/typescript/packages/mix-tunnel   && typedoc --skipErrorChecking
+          cd ${{ github.workspace }}/sdk/typescript/packages/mix-fetch    && typedoc --skipErrorChecking
+          cd ${{ github.workspace }}/sdk/typescript/packages/mix-dns      && typedoc --skipErrorChecking
+          cd ${{ github.workspace }}/sdk/typescript/packages/mix-websocket && typedoc --skipErrorChecking
+
+      - name: Verify doc versions
+        run: ${{ github.workspace }}/documentation/scripts/verify-doc-versions.sh
+        working-directory: ${{ github.workspace }}
       - name: Install project dependencies
         run: pnpm i
+      - name: Generate llms-full.txt
+        run: pnpm run generate:llms
       - name: Build project
         run: pnpm run build
+      - name: Generate sitemap
+        run: npx next-sitemap
       - name: Move files to /dist/
         run: ../scripts/move-to-dist.sh
 

.github/workflows/ci-lint-typescript.yml

@@ -20,12 +20,14 @@ jobs:
       - uses: actions/checkout@v6
       - uses: rlespinasse/github-slug-action@v3.x
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v5.0.0
+        with:
+          version: 11.1.2
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
-
+          cache: pnpm
-      - name: Setup yarn
-        run: npm install -g yarn
 
       - name: Install Rust toolchain
         uses: actions-rs/toolchain@v1
@@ -38,22 +40,24 @@ jobs:
       - name: Install wasm-opt
         run: cargo install wasm-opt
 
-      - name: Set up Go
+      # Produce wasm/smolmix/pkg/package.json before any pnpm step. The
-        uses: actions/setup-go@v6
+      # `pnpm dev:on` in `prebuild:ci` adds wasm/smolmix/pkg to the dynamic
-        with:
+      # workspace; mix-tunnel's `workspace:*` lookup against @nymproject/
-          go-version: "1.24.6"
+      # smolmix-wasm needs the package.json to be present.
+      - name: Build smolmix wasm
+        run: make -C wasm/smolmix
 
       - name: Install
-        run: yarn
+        run: pnpm i
 
       - name: Build packages
-        run: yarn build:ci
+        run: pnpm build:ci
 
       - name: Install again
-        run: yarn
+        run: pnpm i
 
       - name: Lint
-        run: yarn lint
+        run: pnpm lint
 
       - name: Typecheck with tsc
-        run: yarn tsc
+        run: pnpm tsc

.github/workflows/ci-nym-wallet-frontend.yml

@@ -0,0 +1,46 @@
+name: ci-nym-wallet-frontend
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'nym-wallet/**'
+      - '.github/workflows/ci-nym-wallet-frontend.yml'
+
+jobs:
+  types-lint:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v5.0.0
+        with:
+          version: 11.1.2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: nym-wallet/.nvmrc
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install
+
+      - name: Build TypeScript packages (wallet depends on @nymproject/types, etc.)
+        run: pnpm build:types
+
+      - name: Build @nymproject/mui-theme and @nymproject/react (wallet imports subpaths)
+        run: pnpm build:packages
+
+      - name: Typecheck nym-wallet
+        run: pnpm --filter @nymproject/nym-wallet-app tsc
+
+      - name: Lint nym-wallet
+        run: pnpm --filter @nymproject/nym-wallet-app lint
+
+      - name: pnpm audit (workspace lockfile; informational)
+        run: pnpm audit --audit-level critical
+        continue-on-error: true
+
+      - name: Unit tests (nym-wallet)
+        run: pnpm --filter @nymproject/nym-wallet-app test

.github/workflows/ci-nym-wallet-rust.yml

@@ -41,6 +41,9 @@ jobs:
           sed -i.bak '1s/^/\[profile.dev\]\ndebug = false\n\n/' Cargo.toml
           git diff
 
+      - name: Ensure nym-wallet/dist exists for Tauri
+        run: mkdir -p nym-wallet/dist
+
       - name: Build all binaries
         uses: actions-rs/cargo@v1
         with:
@@ -71,3 +74,16 @@ jobs:
         with:
           command: clippy
           args: --manifest-path nym-wallet/Cargo.toml --workspace --all-features --all-targets -- -D warnings
+
+      - name: Install cargo-audit
+        uses: actions-rs/cargo@v1
+        with:
+          command: install
+          args: cargo-audit --locked
+
+      - name: Cargo audit (nym-wallet workspace)
+        uses: actions-rs/cargo@v1
+        with:
+          command: audit
+        working-directory: nym-wallet
+        continue-on-error: true

.github/workflows/ci-nym-wallet-storybook.yml

@@ -1,53 +0,0 @@
-name: ci-nym-wallet-storybook
-
-on:
-  pull_request:
-    paths:
-      - 'nym-wallet/**'
-      - '.github/workflows/ci-nym-wallet-storybook.yml'
-
-jobs:
-  build:
-    runs-on: arc-linux-latest-dind
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install rsync
-        run: sudo apt-get install rsync
-        continue-on-error: true
-
-      - uses: rlespinasse/github-slug-action@v3.x
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-
-      - name: Setup yarn
-        run: npm install -g yarn
-
-      - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
-
-      - name: Build dependencies
-        run: yarn && yarn build
-
-      - name: Build storybook
-        run: yarn storybook:build
-        working-directory: ./nym-wallet
-
-      - name: Deploy branch to CI www (storybook)
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-rltgoDzvO --delete"
-          SOURCE: "nym-wallet/storybook-static/"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/wallet-${{ env.GITHUB_REF_SLUG }}
-          EXCLUDE: "/dist/, /node_modules/"

.github/workflows/ci-sdk-wasm.yml

@@ -20,7 +20,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
 
       - uses: actions-rs/toolchain@v1
         with:
@@ -30,11 +30,6 @@ jobs:
           override: true
           components: rustfmt, clippy
 
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: "1.24.6"
-
       - name: Install wasm-pack
         run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
 

.github/workflows/ci-sonar.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   sonarqube:
     name: SonarQube
-    runs-on: ubuntu-latest
+    runs-on: arc-linux-latest
     steps:
       - uses: actions/checkout@v6
         with:

.github/workflows/nightly-build.yml

@@ -2,8 +2,6 @@ name: nightly-build
 
 on:
   workflow_dispatch:
-  schedule:
-    - cron: '14 1 * * *'
 
 jobs:
   build:

.github/workflows/nightly-nym-wallet-build.yml

@@ -21,7 +21,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
         if: matrix.os == 'ubuntu-22.04'
 
       - name: Install rust toolchain

.github/workflows/nightly-security-audit.yml

@@ -20,7 +20,7 @@ jobs:
           find . -name Cargo.toml -exec cargo deny --manifest-path {} check \
             advisories -A advisory-not-detected  --hide-inclusion-graph \; &> \
             >(uniq  &> .github/workflows/support-files/notifications/deny.message )
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: report
           path: .github/workflows/support-files/notifications/deny.message

.github/workflows/nym-api-integration-tests.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   integration-tests:
-    runs-on: ubuntu-latest
+    runs-on: arc-linux-latest
     env:
       API_BASE_URL: http://localhost:8000
 

.github/workflows/pr-validation.yml

@@ -23,7 +23,7 @@ env:
 jobs:
   check-milestone:
     name: Check Milestone
-    runs-on: ubuntu-latest
+    runs-on: arc-linux-latest
     steps:
       - if: github.event.pull_request.milestone == null && contains( env.LABELS, 'no-milestone' ) == false
         run: exit 1

.github/workflows/publish-nym-binaries.yml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: arc-linux-latest
+          - os: arc-ubuntu-22.04
             target: x86_64-unknown-linux-gnu
     runs-on:  ${{ matrix.os }}
 
@@ -66,7 +66,7 @@ jobs:
           args: --workspace --release ${{ env.CARGO_FEATURES }}
   
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: my-artifact
           path: |

.github/workflows/publish-nym-contracts.yml

@@ -27,14 +27,14 @@ jobs:
         run: make contracts
 
       - name: Upload Mixnet Contract Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: mixnet_contract.wasm
           path: contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm
           retention-days: 5
 
       - name: Upload Vesting Contract Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: vesting_contract.wasm
           path: contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm

.github/workflows/publish-nym-wallet-macos.yml

@@ -23,10 +23,13 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Node
+      - name: Setup pnpm
-        uses: actions/setup-node@v4
+        uses: pnpm/action-setup@v5.0.0
         with:
-          node-version: 21
+          version: 11.1.2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
           
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -68,17 +71,17 @@ jobs:
           fileName: '.env'
           encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}
 
-      - name: Yarn cache clean
+      - name: pnpm cache clean
         shell: bash
-        run: cd .. && yarn cache clean
+        run: cd .. && pnpm cache delete
 
       - name: Install project dependencies
         shell: bash
-        run: cd .. && yarn --network-timeout 100000
+        run: cd .. && pnpm i
 
-      - name: Yarn build
+      - name: Build
         shell: bash
-        run: cd .. && yarn build
+        run: cd .. && pnpm build
 
       - name: Install dependencies and build it
         env:
@@ -97,7 +100,7 @@ jobs:
           TAURI_NOTARIZATION_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           TAURI_NOTARIZATION_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: |
-          yarn build-macx86 
+          pnpm build-macx86 
 
       - name: Create app tarball
         run: |
@@ -108,7 +111,7 @@ jobs:
           cd -
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: nym-wallet.app.tar.gz
           path: nym-wallet/target/x86_64-apple-darwin/release/bundle/macos/nym-wallet.app.tar.gz

.github/workflows/publish-nym-wallet-ubuntu.yml

@@ -26,12 +26,17 @@ jobs:
             libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev jq \
             libgtk-3-dev squashfs-tools libayatana-appindicator3-dev make libfuse2 unzip librsvg2-dev file \
             libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
-      
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v5.0.0
+        with:
+          version: 11.1.2
+
       - name: Node
         uses: actions/setup-node@v4
         with:
-          node-version: 21
+          node-version: 24
-          cache: 'yarn'
+          cache: 'pnpm'
       
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -40,10 +45,10 @@ jobs:
       
       - name: Install project dependencies
         shell: bash
-        run: cd .. && yarn --network-timeout 100000
+        run: cd .. && pnpm i
       
       - name: Install app dependencies
-        run: yarn
+        run: pnpm i
       
       - name: Create env file
         uses: timheuer/base64-to-file@v1.2
@@ -52,7 +57,7 @@ jobs:
           encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}
       
       - name: Build app
-        run: yarn build
+        run: pnpm build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
@@ -72,6 +77,41 @@ jobs:
             find target/release/bundle -type d -name "*appimage*" -o -name "*AppImage*" || echo "No AppImage directories found"
             find target/release/bundle -name "*.AppImage" -o -name "*.appimage" || echo "No AppImage files found"
           fi
+
+      - name: Inspect AppImage (hook + bundled graphics libs)
+        shell: bash
+        run: |
+          set -euo pipefail
+          APPIMAGE_REL=$(find target/release/bundle -name '*.AppImage' | head -n 1)
+          if [ -z "${APPIMAGE_REL}" ]; then
+            echo "No AppImage under target/release/bundle"
+            exit 1
+          fi
+          APPIMAGE_ABS="${GITHUB_WORKSPACE}/nym-wallet/${APPIMAGE_REL}"
+          chmod +x "${APPIMAGE_ABS}"
+          EXTRACT_DIR=$(mktemp -d)
+          cd "${EXTRACT_DIR}"
+          "${APPIMAGE_ABS}" --appimage-extract
+          # Tauri only stages appimage "files" under /usr/ into the AppDir; paths like /apprun-hooks/ never reach the image.
+          # Wayland + WEBKIT_DISABLE_DMABUF_RENDERER defaults are applied in main() instead (see configure_linux_wayland_defaults).
+          HOOK=$(find squashfs-root -name '99-nym-wayland.sh' 2>/dev/null | head -n 1)
+          if [ -n "${HOOK}" ]; then
+            echo "Found legacy apprun hook at ${HOOK}"
+          else
+            echo "No apprun-hooks/99-nym-wayland.sh (expected): Wayland defaults are set in-process."
+          fi
+          find squashfs-root/usr/lib -maxdepth 6 \
+            \( -name 'libwayland-client.so*' -o -name 'libEGL.so*' -o -name 'libgbm.so*' \) \
+            2>/dev/null | sort > "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
+          wc -l "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
+          head -50 "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt" || true
+
+      - name: Upload AppImage graphics lib inventory
+        uses: actions/upload-artifact@v6
+        with:
+          name: nym-wallet-appimage-lib-inventory
+          path: nym-wallet/appimage-bundled-graphics-libs.txt
+          retention-days: 30
       
       - name: Create AppImage tarball if needed
         run: |
@@ -97,7 +137,7 @@ jobs:
           fi
       
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: nym-wallet-appimage.tar.gz
           path: |

.github/workflows/publish-nym-wallet-win11.yml

@@ -26,6 +26,9 @@ jobs:
     outputs:
       release_tag: ${{ github.ref_name }}
 
+    env:
+      SIGN_WINDOWS: ${{ github.event_name == 'release' || inputs.sign }}
+
     steps:
       - uses: actions/checkout@v6
 
@@ -35,57 +38,88 @@ jobs:
           toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
 
       - name: Setup MSBuild.exe
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
 
-      - name: Node
+      - name: Setup pnpm
-        uses: actions/setup-node@v4
+        uses: pnpm/action-setup@v5.0.0
         with:
-          node-version: 21
+          version: 11.1.2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Strip Authenticode thumbprint (avoid signtool on runner)
+        working-directory: nym-wallet/src-tauri
+        if: ${{ env.SIGN_WINDOWS == 'true' || (github.event_name == 'workflow_dispatch' && !inputs.sign) }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v yq >/dev/null 2>&1; then
+            echo "yq is required on this runner to edit tauri.conf.json"
+            exit 1
+          fi
+          yq eval --inplace '
+            del(.bundle.windows.certificateThumbprint) |
+            del(.bundle.windows.digestAlgorithm) |
+            del(.bundle.windows.timestampUrl)
+          ' tauri.conf.json
 
       - name: Download EV CodeSignTool from ssl.com
         working-directory: nym-wallet/src-tauri
-        if: ${{ inputs.sign }}
+        if: env.SIGN_WINDOWS == 'true'
         shell: bash
         run: |
           curl -L0 https://www.ssl.com/download/codesigntool-for-linux-and-macos/ -o codesigntool.zip
           unzip codesigntool.zip
       - name: Get EV certificate credential id
         working-directory: nym-wallet/src-tauri
-        if: ${{ inputs.sign }}
+        if: env.SIGN_WINDOWS == 'true'
         id: get_credential_ids
         shell: bash
         run: |
           echo "SSL_COM_CREDENTIAL_ID=$(./CodeSignTool.sh get_credential_ids -username=${{ secrets.SSL_COM_USERNAME }} -password=${{ secrets.SSL_COM_PASSWORD }} | sed -n '1!p' | sed 's/- //')" >> "$GITHUB_OUTPUT"
       - name: Add custom sign command to tauri.conf.json
         working-directory: nym-wallet/src-tauri
-        if: ${{ inputs.sign }}
+        if: env.SIGN_WINDOWS == 'true'
         shell: bash
+        env:
+          SSL_SIGN_USER: ${{ secrets.SSL_COM_USERNAME }}
+          SSL_SIGN_PASS: ${{ secrets.SSL_COM_PASSWORD }}
+          SSL_SIGN_CRED: ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
+          SSL_SIGN_TOTP: ${{ secrets.SSL_COM_TOTP_SECRET }}
         run: |
-          yq eval --inplace '.bundle.windows +=
+          set -euo pipefail
-          {
+          if ! command -v cygpath >/dev/null 2>&1; then
-            "signCommand": {
+            echo "cygpath not found; install Git for Windows or use bash from Git SDK"
-              "cmd": "C:\Program Files\Git\bin\bash.EXE",
+            exit 1
-              "args": [
+          fi
-                "/c/actions-runner/_work/nym/nym/nym-wallet/src-tauri/CodeSignTool.sh",
+          export SCRIPT_UNIX="$(cygpath -u "$GITHUB_WORKSPACE/nym-wallet/src-tauri/CodeSignTool.sh")"
-                "sign",
+          yq eval --inplace '
-                "-username ${{ secrets.SSL_COM_USERNAME }}",
+            .bundle.windows += {
-                "-password ${{ secrets.SSL_COM_PASSWORD }}",
+              "signCommand": {
-                "-credential_id ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}",
+                "cmd": "C:/Program Files/Git/bin/bash.exe",
-                "-totp_secret ${{ secrets.SSL_COM_TOTP_SECRET }}",
+                "args": [
-                "-program_name NymWallet",
+                  strenv(SCRIPT_UNIX),
-                "-input_file_path",
+                  "sign",
-                "%1",
+                  ("-username " + strenv(SSL_SIGN_USER)),
-                "-override"
+                  ("-password " + strenv(SSL_SIGN_PASS)),
-              ]
+                  ("-credential_id " + strenv(SSL_SIGN_CRED)),
+                  ("-totp_secret " + strenv(SSL_SIGN_TOTP)),
+                  "-program_name NymWallet",
+                  "-input_file_path",
+                  "%1",
+                  "-override"
+                ]
+              }
             }
-          }' tauri.conf.json
+          ' tauri.conf.json
       - name: Install project dependencies
         shell: bash
-        run: cd .. && yarn --network-timeout 100000
+        run: cd .. && pnpm i
 
       - name: Install app dependencies
         shell: bash
-        run: yarn --network-timeout 100000
+        run: pnpm i
 
       - name: Build and sign it
         shell: bash
@@ -93,13 +127,13 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
-          SSL_COM_USERNAME: ${{ inputs.sign && secrets.SSL_COM_USERNAME }}
+          SSL_COM_USERNAME: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_USERNAME }}
-          SSL_COM_PASSWORD: ${{ inputs.sign && secrets.SSL_COM_PASSWORD }}
+          SSL_COM_PASSWORD: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_PASSWORD }}
-          SSL_COM_CREDENTIAL_ID: ${{ inputs.sign && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
+          SSL_COM_CREDENTIAL_ID: ${{ env.SIGN_WINDOWS == 'true' && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
-          SSL_COM_TOTP_SECRET: ${{ inputs.sign && secrets.SSL_COM_TOTP_SECRET }}
+          SSL_COM_TOTP_SECRET: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_TOTP_SECRET }}
         run: |
           echo "Starting build process..."
-          yarn build
+          pnpm build
 
       - name: Check bundle directory
         shell: bash
@@ -128,7 +162,7 @@ jobs:
           find . -name "*.msi" -type f
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: nym-wallet.msi
           path: |
@@ -167,4 +201,4 @@ jobs:
     needs: publish-tauri
     with:
       release_tag: ${{ needs.publish-tauri.outputs.release_tag || github.ref_name }}
-    secrets: inherit
+    secrets: inherit

.github/workflows/publish-nyms5-android-apk.yml

@@ -76,7 +76,7 @@ jobs:
             apk/nyms5-arch64-release.apk
 
       - name: Upload APKs
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: nyms5-apk-arch64
           path: |
@@ -91,7 +91,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
       - name: Download binary artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: nyms5-apk-arch64
           path: apk

.github/workflows/publish-sdk-npm.yml

@@ -1,6 +1,19 @@
 name: publish-sdk-npm
 on:
   workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Rehearse the publish (pnpm publish --dry-run, no tarballs uploaded). Untick to publish for real."
+        type: boolean
+        default: true
+      dist_tag:
+        description: "Tag mode. 'auto' picks per package: new packages and same-major releases -> latest; a breaking major (e.g. mix-fetch v2 over v1) -> next, promote later with `npm dist-tag add`. 'next'/'latest' force that tag on all four."
+        type: choice
+        options:
+          - auto
+          - next
+          - latest
+        default: auto
 
 jobs:
   publish:
@@ -8,15 +21,17 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v5.0.0
+        with:
+          version: 11.1.2
+
       - name: Install Node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           registry-url: "https://registry.npmjs.org"
 
-      - name: Setup yarn
-        run: npm install -g yarn
-
       - name: Install rust toolchain
         uses: actions-rs/toolchain@v1
         with:
@@ -31,18 +46,15 @@ jobs:
       - name: Install wasm-opt
         run: cargo install wasm-opt
 
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: "1.24.6"
-
       - name: Install dependencies
-        run: yarn
+        run: pnpm i
 
       - name: Build WASM and Typescript SDK
-        run: yarn sdk:build
+        run: pnpm sdk:build
 
       - name: Publish to NPM
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
+          DRY_RUN: ${{ inputs.dry_run && '1' || '0' }}
+          NPM_DIST_TAG: ${{ inputs.dist_tag }}
         run: ./sdk/typescript/scripts/publish.sh

.github/workflows/push-credential-proxy.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: arc-linux-latest-dind
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/push-data-observatory.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: arc-linux-latest-dind
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/push-network-monitor-agent.yaml

@@ -0,0 +1,61 @@
+name: Build and upload Network Monitor Agent container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_image:
+        description: 'Tag image as a release (prefix with golden-)'
+        required: true
+        default: false
+        type: boolean
+
+env:
+  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-agent"
+  CONTAINER_NAME: "network-monitor-agent"
+
+jobs:
+  build-container:
+    runs-on: arc-linux-latest-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from Cargo.toml
+        id: get_version
+        run: |
+          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
+          echo "result=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+ 
+      - name: Initialize RELEASE_TAG
+        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
+
+      - name: Set RELEASE_TAG for release
+        if: github.event.inputs.release_image == 'true'
+        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
+
+      - name: Set IMAGE_NAME_AND_TAGS variable
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+
+      - name: New env vars
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
+
+      - name: Build and push image to Harbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
+          

.github/workflows/push-network-monitor-orchestrator.yaml

@@ -0,0 +1,57 @@
+name: Build and upload Network Monitor Orchestrator container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_image:
+        description: 'Tag image as a release (prefix with golden-)'
+        required: true
+        default: false
+        type: boolean
+
+env:
+  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-orchestrator"
+  CONTAINER_NAME: "network-monitor-orchestrator"
+
+jobs:
+  build-container:
+    runs-on: arc-linux-latest-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from Cargo.toml
+        id: get_version
+        run: |
+          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
+          echo "result=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Initialize RELEASE_TAG
+        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
+
+      - name: Set RELEASE_TAG for release
+        if: github.event.inputs.release_image == 'true'
+        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
+
+      - name: Set IMAGE_NAME_AND_TAGS variable
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+
+      - name: Log image name
+        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
+
+      - name: Build and push image to Harbor
+        run: |
+          docker build  -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-network-monitor.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/push-node-status-agent.yaml

@@ -18,7 +18,7 @@ jobs:
     runs-on: arc-linux-latest-dind
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/push-node-status-api.yaml

@@ -17,7 +17,7 @@ jobs:
     runs-on: arc-linux-latest-dind
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/push-nym-api.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/push-nym-node.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/push-nym-statistics-api.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: arc-linux-latest-dind
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/push-nyx-chain-watcher.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/push-validator-rewarder.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: harbor.nymte.ch
           username: ${{ secrets.HARBOR_ROBOT_USERNAME }}

.github/workflows/release-calculate-hash.yml

@@ -23,14 +23,14 @@ jobs:
         uses: actions/checkout@v6
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
       - uses: nymtech/nym/.github/actions/nym-hash-releases@develop
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           release-tag-or-name-or-id: ${{ inputs.release_tag }}
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: Asset Hashes
           path: hashes.json

.github/workflows/resume-publish-crates-io.yml

@@ -25,6 +25,10 @@ jobs:
       - name: Install cargo-workspaces
         run: cargo install cargo-workspaces
 
+      - name: Preflight publish checks
+        run: |
+          python3 tools/internal/check_publish_preflight.py
+
       - name: Publish remaining crates
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.gitignore

@@ -27,6 +27,7 @@ v6-topology.json
 /explorer/public/downloads/mixmining.json
 /explorer/public/downloads/topology.json
 /nym-wallet/dist/*
+/nym-wallet/appimage-bundled-graphics-libs.txt
 /clients/validator/examples/nym-driver-example/current-contract.txt
 validator-api/v4.json
 validator-api/v6.json
@@ -77,3 +78,11 @@ CLAUDE.md
 
 /notes
 /target-otel
+test-tutorials/
+
+# pnpm
+.pnpm-store/
+
+tmp/
+# operator tools
+scripts/nym-node-setup/auto-bond/nodes.csv

.npmrc

@@ -0,0 +1,9 @@
+shamefully-hoist=false
+prefer-workspace-packages=true
+hoist-pattern[]=*eslint*
+hoist-pattern[]=*prettier*
+hoist-pattern[]=*typescript*
+hoist-pattern[]=*@types*
+
+auto-install-peers=true
+strict-peer-dependencies=false

CHANGELOG.md

@@ -4,6 +4,284 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2026.11-xynomizithra] (2026-06-08)
+
+- bugfix: allow re-inviting expired members ([#6863])
+- feat: disable Nagle's algorithm for LP between nym-nodes ([#6857])
+- Keep peer in wg table when updating psk ([#6856])
+- chore: minor nym-node improvements ([#6850])
+- chore: LP registration adjustments ([#6845])
+- crates release: bump version to 1.21.1 ([#6844])
+- fix gateways being penalised for no stress testing ([#6843])
+- fix score inflation for throttled nodes ([#6842])
+- Bugfix/cherry pick/waterloo stres testing floats ([#6841])
+- bugfix: NMv3 race condition ([#6837])
+- feat: implement UpdateFamily for the node families contract ([#6834])
+- Bugfix/cherry pick/waterloo ns api ([#6833])
+- experiment: attempt to retroactively generate specs for node families and ecash contracts ([#6813])
+- moving lp packets in lp-data crate ([#6810])
+- upgrade axum to 0.8.9 (and side deps) ([#6808])
+- chore: expose admin method for migrating vesting delegations/mixnodes ([#6795])
+- [chore] fix clippy 1.95 lints for future version update ([#6794])
+- Handle Rate Limit Challenge Response ([#6786])
+- NYM-583: Avoid corrupted database on Windows. ([#6785])
+- Max/smolmix wasm ([#6784])
+- Chore/bugfixes ([#6783])
+- Switch from yarn to pnpm ([#6779])
+- feat: Node Families: expose stake information inside DVpnGateway ([#6778])
+- feat: Node Families: expose family information for NS API consumers ([#6777])
+- feat: Node Families: cache and expose family data within nym API ([#6774])
+- Re-order default API urls for network details ([#6767])
+- add ci for NM agent binary ([#6764])
+- feat/refactor: introduce shared contract caches within Nym API ([#6760])
+- chore: removed dead code for redundant mixnet-vesting integration tests ([#6759])
+- feat: Node Families: remove nodes upon unbonding ([#6752])
+- feat: Node Families: contract transactions ([#6750])
+- feat: Node Families: contract queries ([#6731])
+- feat: Node Families: initial contract storage ([#6717])
+- start node families topic branch ([#6715])
+- Bump rand from 0.8.5 to 0.8.6 in /contracts ([#6702])
+- Testing port checks in NS Agents ([#6694])
+- build(deps): bump microsoft/setup-msbuild from 2 to 3 ([#6602])
+- build(deps): bump tar from 0.4.44 to 0.4.45 ([#6595])
+- build(deps): bump quinn-proto from 0.11.12 to 0.11.14 ([#6549])
+- build(deps): bump docker/login-action from 3 to 4 ([#6518])
+- build(deps): bump actions/download-artifact from 7 to 8 ([#6497])
+- build(deps): bump actions/upload-artifact from 6 to 7 ([#6496])
+
+[#6863]: https://github.com/nymtech/nym/pull/6863
+[#6857]: https://github.com/nymtech/nym/pull/6857
+[#6856]: https://github.com/nymtech/nym/pull/6856
+[#6850]: https://github.com/nymtech/nym/pull/6850
+[#6845]: https://github.com/nymtech/nym/pull/6845
+[#6844]: https://github.com/nymtech/nym/pull/6844
+[#6843]: https://github.com/nymtech/nym/pull/6843
+[#6842]: https://github.com/nymtech/nym/pull/6842
+[#6841]: https://github.com/nymtech/nym/pull/6841
+[#6837]: https://github.com/nymtech/nym/pull/6837
+[#6834]: https://github.com/nymtech/nym/pull/6834
+[#6833]: https://github.com/nymtech/nym/pull/6833
+[#6813]: https://github.com/nymtech/nym/pull/6813
+[#6810]: https://github.com/nymtech/nym/pull/6810
+[#6808]: https://github.com/nymtech/nym/pull/6808
+[#6795]: https://github.com/nymtech/nym/pull/6795
+[#6794]: https://github.com/nymtech/nym/pull/6794
+[#6786]: https://github.com/nymtech/nym/pull/6786
+[#6785]: https://github.com/nymtech/nym/pull/6785
+[#6784]: https://github.com/nymtech/nym/pull/6784
+[#6783]: https://github.com/nymtech/nym/pull/6783
+[#6779]: https://github.com/nymtech/nym/pull/6779
+[#6778]: https://github.com/nymtech/nym/pull/6778
+[#6777]: https://github.com/nymtech/nym/pull/6777
+[#6774]: https://github.com/nymtech/nym/pull/6774
+[#6767]: https://github.com/nymtech/nym/pull/6767
+[#6764]: https://github.com/nymtech/nym/pull/6764
+[#6760]: https://github.com/nymtech/nym/pull/6760
+[#6759]: https://github.com/nymtech/nym/pull/6759
+[#6752]: https://github.com/nymtech/nym/pull/6752
+[#6750]: https://github.com/nymtech/nym/pull/6750
+[#6731]: https://github.com/nymtech/nym/pull/6731
+[#6717]: https://github.com/nymtech/nym/pull/6717
+[#6715]: https://github.com/nymtech/nym/pull/6715
+[#6702]: https://github.com/nymtech/nym/pull/6702
+[#6694]: https://github.com/nymtech/nym/pull/6694
+[#6602]: https://github.com/nymtech/nym/pull/6602
+[#6595]: https://github.com/nymtech/nym/pull/6595
+[#6549]: https://github.com/nymtech/nym/pull/6549
+[#6518]: https://github.com/nymtech/nym/pull/6518
+[#6497]: https://github.com/nymtech/nym/pull/6497
+[#6496]: https://github.com/nymtech/nym/pull/6496
+
+## [2026.10-waterloo] (2026-05-27)
+
+- Re-order default API urls for network details - Waterloo release ([#6799])
+- [bugfix] IPR v8<->v9 mismatch on Waterloo ([#6772])
+- Migrate to hickory 0.26.1 ([#6751])
+- add workflows for NM3 ([#6729])
+- credential proxy pool ([#6726])
+- chore: made sphinx version threshold assertion a compile time check ([#6718])
+- Feat/nmv3 updated performance calculation ([#6714])
+- feat: NMv3: submission of stress testing result into nym-api ([#6709])
+- feat: NMv3: Prometheus metrics for network monitor ([#6693])
+- feat: NMv3: add read-only results API to orchestrator ([#6689])
+- feat: NMv3: Eviction of stale testrun data ([#6685])
+- feat: NMv3: Wire up testrun assignment and result submission flow ([#6680])
+- feat: NMv3: Support multiple network monitor agents per host ([#6679])
+- Feat/nmv3 agent announcement ([#6673])
+- add node refresher for periodic scraping of bonded nym-node details ([#6626])
+- Feat/nmv3 orchestrator queue ([#6597])
+- feat: network monitor agent - standalone node stress-testing ([#6582])
+- [feat] propagate NM agent noise keys to nym-node routing ([#6577])
+- start mix stress testing topic branch ([#6575])
+- Feat/nmv3 agents subscription ([#6567])
+- Feat/nmv3 agents contract ([#6555])
+
+[#6799]: https://github.com/nymtech/nym/pull/6799
+[#6772]: https://github.com/nymtech/nym/pull/6772
+[#6751]: https://github.com/nymtech/nym/pull/6751
+[#6729]: https://github.com/nymtech/nym/pull/6729
+[#6726]: https://github.com/nymtech/nym/pull/6726
+[#6718]: https://github.com/nymtech/nym/pull/6718
+[#6714]: https://github.com/nymtech/nym/pull/6714
+[#6709]: https://github.com/nymtech/nym/pull/6709
+[#6693]: https://github.com/nymtech/nym/pull/6693
+[#6689]: https://github.com/nymtech/nym/pull/6689
+[#6685]: https://github.com/nymtech/nym/pull/6685
+[#6680]: https://github.com/nymtech/nym/pull/6680
+[#6679]: https://github.com/nymtech/nym/pull/6679
+[#6673]: https://github.com/nymtech/nym/pull/6673
+[#6626]: https://github.com/nymtech/nym/pull/6626
+[#6597]: https://github.com/nymtech/nym/pull/6597
+[#6582]: https://github.com/nymtech/nym/pull/6582
+[#6577]: https://github.com/nymtech/nym/pull/6577
+[#6575]: https://github.com/nymtech/nym/pull/6575
+[#6567]: https://github.com/nymtech/nym/pull/6567
+[#6555]: https://github.com/nymtech/nym/pull/6555
+
+## [2026.9-venaco] (2026-05-06)
+
+- Fix for v9 IPR  ([#6710])
+- Only init SHARED_CLIENT if requested ([#6708])
+- Fixes to crates and CI ([#6686])
+- Return ipv6 addresses as well ([#6684])
+- Fix invalid ticket spend ([#6683])
+- Block non-public IPR/NR checks ([#6670])
+
+[#6710]: https://github.com/nymtech/nym/pull/6710
+[#6708]: https://github.com/nymtech/nym/pull/6708
+[#6686]: https://github.com/nymtech/nym/pull/6686
+[#6684]: https://github.com/nymtech/nym/pull/6684
+[#6683]: https://github.com/nymtech/nym/pull/6683
+[#6670]: https://github.com/nymtech/nym/pull/6670
+
+## [2026.8-urda] (2026-04-20)
+
+- Include all gateways in the returned list ([#6649])
+- Optimize GW probe in NS agent ([#6636])
+- Max/sdk docrs ([#6566])
+- Max/sdk stream wrapper ([#6320])
+
+[#6649]: https://github.com/nymtech/nym/pull/6649
+[#6636]: https://github.com/nymtech/nym/pull/6636
+[#6566]: https://github.com/nymtech/nym/pull/6566
+[#6320]: https://github.com/nymtech/nym/pull/6320
+
+## [2026.7-tola] (2026-04-07)
+
+- Simon/ecash contract serde fix ([#6634])
+- Update Fallback IP for Nym API ([#6622])
+- Nym Node spam logging ([#6621])
+- feat: multiple deposit prices ([#6608])
+- move format_debug_bytes in common crate ([#6580])
+- bugfix: make sure client keys are generated before requesting credentials ([#6579])
+- Fix socks5 GW probe regression ([#6576])
+- Max/lp stream framing ([#6573])
+- HTTP domain rotation conditions ([#6570])
+
+[#6634]: https://github.com/nymtech/nym/pull/6634
+[#6622]: https://github.com/nymtech/nym/pull/6622
+[#6621]: https://github.com/nymtech/nym/pull/6621
+[#6608]: https://github.com/nymtech/nym/pull/6608
+[#6580]: https://github.com/nymtech/nym/pull/6580
+[#6579]: https://github.com/nymtech/nym/pull/6579
+[#6576]: https://github.com/nymtech/nym/pull/6576
+[#6573]: https://github.com/nymtech/nym/pull/6573
+[#6570]: https://github.com/nymtech/nym/pull/6570
+
+## [2026.6-stilton] (2026-03-25)
+
+- lp fixes ([#6601])
+- bugfix: allow deserialisation of LP data from either snake_case or lowercase ([#6586])
+- bugfix: make sure to run cargo install cosmwasm-check with --locked flag during CI ([#6568])
+- Add LP to NS UI ([#6562])
+- feat: nyxd watcher ([#6561])
+- Additional ticket for agent ([#6551])
+- bugfix: make sure to use old values from metrics debug config during v12 migration (#6546) ([#6547])
+- typo ([#6543])
+- rng changes for a Send variant ([#6541])
+- Add LP fields ([#6535])
+- enable LP registration in registration client ([#6534])
+- chore: rename LpMessage to LpFrame ([#6530])
+- chore: LP improvements ([#6526])
+- Remove dep leak of strum iterator ([#6522])
+- chore: update ts-rs dep ([#6517])
+- addressing LP PR comments ([#6513])
+- remove redundant LP state machine in favour of in place processing ([#6512])
+- chore: split up lp listener ([#6507])
+- feat: enable mutual KKT exchange ([#6505])
+- feat: introduce /v3/unstable/nym-nodes/semi-skimmed to aggregate LP information ([#6499])
+- Max/asyncread asyncwrite nym client ([#6318])
+- feat: localnet v2 ([#6277])
+
+[#6601]: https://github.com/nymtech/nym/pull/6601
+[#6586]: https://github.com/nymtech/nym/pull/6586
+[#6568]: https://github.com/nymtech/nym/pull/6568
+[#6562]: https://github.com/nymtech/nym/pull/6562
+[#6561]: https://github.com/nymtech/nym/pull/6561
+[#6551]: https://github.com/nymtech/nym/pull/6551
+[#6547]: https://github.com/nymtech/nym/pull/6547
+[#6543]: https://github.com/nymtech/nym/pull/6543
+[#6541]: https://github.com/nymtech/nym/pull/6541
+[#6535]: https://github.com/nymtech/nym/pull/6535
+[#6534]: https://github.com/nymtech/nym/pull/6534
+[#6530]: https://github.com/nymtech/nym/pull/6530
+[#6526]: https://github.com/nymtech/nym/pull/6526
+[#6522]: https://github.com/nymtech/nym/pull/6522
+[#6517]: https://github.com/nymtech/nym/pull/6517
+[#6513]: https://github.com/nymtech/nym/pull/6513
+[#6512]: https://github.com/nymtech/nym/pull/6512
+[#6507]: https://github.com/nymtech/nym/pull/6507
+[#6505]: https://github.com/nymtech/nym/pull/6505
+[#6499]: https://github.com/nymtech/nym/pull/6499
+[#6318]: https://github.com/nymtech/nym/pull/6318
+[#6277]: https://github.com/nymtech/nym/pull/6277
+
+## [2026.5-raclette] (2026-03-10)
+
+- bugfix: correctly populate gateway probe LP data ([#6533])
+- chore: introduce additional prometheus metrics for registration times ([#6532])
+- bugfix: lp information to have proper snake_case on API endpoints ([#6531])
+- removed redundant LP states ([#6509])
+- chore: removed all matrix notifications from github actions ([#6495])
+- feat: Lewes Protocol with PSQv2 ([#6491])
+- build(deps): bump minimatch from 3.1.2 to 3.1.4 in /documentation/docs ([#6486])
+- build(deps): bump bn.js from 4.12.2 to 4.12.3 in /documentation/docs ([#6484])
+- build(deps): bump bn.js from 4.12.2 to 4.12.3 ([#6483])
+- build(deps): bump ajv from 8.17.1 to 8.18.0 in /clients/native/examples/js-examples/websocket ([#6478])
+- build(deps): bump ajv from 6.12.6 to 6.14.0 in /documentation/docs ([#6477])
+- build(deps): bump minimatch and glob in /documentation/scripts/post-process ([#6476])
+- build(deps): bump hono from 4.11.9 to 4.12.0 ([#6475])
+- build(deps): bump keccak from 0.1.5 to 0.1.6 ([#6472])
+- build(deps-dev): bump qs from 6.14.1 to 6.14.2 in /clients/native/examples/js-examples/websocket ([#6466])
+- build(deps): bump mikefarah/yq from 4.52.2 to 4.52.4 ([#6465])
+- Otel minimal v2 ([#6464])
+- build(deps): bump qs and express in /wasm/client/internal-dev ([#6461])
+- bugfix: restore 'latest_measurement' field for nym-node /verloc endpoint ([#6452])
+- build(deps-dev): bump webpack from 5.77.0 to 5.104.1 in /wasm/node-tester/internal-dev ([#6451])
+- Max/mixfetch concurrent test ([#6417])
+
+[#6533]: https://github.com/nymtech/nym/pull/6533
+[#6532]: https://github.com/nymtech/nym/pull/6532
+[#6531]: https://github.com/nymtech/nym/pull/6531
+[#6509]: https://github.com/nymtech/nym/pull/6509
+[#6495]: https://github.com/nymtech/nym/pull/6495
+[#6491]: https://github.com/nymtech/nym/pull/6491
+[#6486]: https://github.com/nymtech/nym/pull/6486
+[#6484]: https://github.com/nymtech/nym/pull/6484
+[#6483]: https://github.com/nymtech/nym/pull/6483
+[#6478]: https://github.com/nymtech/nym/pull/6478
+[#6477]: https://github.com/nymtech/nym/pull/6477
+[#6476]: https://github.com/nymtech/nym/pull/6476
+[#6475]: https://github.com/nymtech/nym/pull/6475
+[#6472]: https://github.com/nymtech/nym/pull/6472
+[#6466]: https://github.com/nymtech/nym/pull/6466
+[#6465]: https://github.com/nymtech/nym/pull/6465
+[#6464]: https://github.com/nymtech/nym/pull/6464
+[#6461]: https://github.com/nymtech/nym/pull/6461
+[#6452]: https://github.com/nymtech/nym/pull/6452
+[#6451]: https://github.com/nymtech/nym/pull/6451
+[#6417]: https://github.com/nymtech/nym/pull/6417
+
 ## [2026.4-quark] (2026-02-24)
 
 - Enhance CI workflow with feature inputs ([#6462])

Cargo.toml

@@ -31,7 +31,6 @@ members = [
     "common/client-libs/mixnet-client",
     "common/client-libs/validator-client",
     "common/commands",
-    "common/nym-common",
     "common/config",
     "common/cosmwasm-smart-contracts/coconut-dkg",
     "common/cosmwasm-smart-contracts/contracts-common",
@@ -41,9 +40,11 @@ members = [
     "common/cosmwasm-smart-contracts/group-contract",
     "common/cosmwasm-smart-contracts/mixnet-contract",
     "common/cosmwasm-smart-contracts/multisig-contract",
+    "common/cosmwasm-smart-contracts/node-families-contract",
     "common/cosmwasm-smart-contracts/nym-performance-contract",
     "common/cosmwasm-smart-contracts/nym-pool-contract",
     "common/cosmwasm-smart-contracts/vesting-contract",
+    "common/cosmwasm-smart-contracts/network-monitors-contract",
     "common/credential-proxy",
     "common/credential-storage",
     "common/credential-utils",
@@ -70,11 +71,15 @@ members = [
     "common/node-tester-utils",
     "common/nonexhaustive-delayqueue",
     "common/nym-cache",
+    "common/nym-common",
     "common/nym-connection-monitor",
     "common/nym-id",
     "common/nym-kcp",
-    "common/nym-lp",
     "common/nym-kkt",
+    "common/nym-kkt-ciphersuite",
+    "common/nym-kkt-context",
+    "common/nym-lp",
+    "common/nym-lp-data",
     "common/nym-metrics",
     "common/nym_offline_compact_ecash",
     "common/nymnoise",
@@ -90,9 +95,9 @@ members = [
     "common/nymsphinx/params",
     "common/nymsphinx/routing",
     "common/nymsphinx/types",
-    "common/nyxd-scraper-sqlite",
     "common/nyxd-scraper-psql",
     "common/nyxd-scraper-shared",
+    "common/nyxd-scraper-sqlite",
     "common/pemstore",
     "common/registration",
     "common/serde-helpers",
@@ -122,13 +127,14 @@ members = [
     "common/zulip-client",
     "documentation/autodoc",
     "gateway",
+    "integration-tests",
     "nym-api",
     "nym-api/nym-api-requests",
     "nym-authenticator-client",
-    "nym-browser-extension/storage",
     "nym-credential-proxy/nym-credential-proxy",
     "nym-credential-proxy/nym-credential-proxy-requests",
     "nym-data-observatory",
+    "nym-gateway-probe",
     "nym-ip-packet-client",
     "nym-network-monitor",
     "nym-node",
@@ -140,6 +146,7 @@ members = [
     "nym-outfox",
     "nym-registration-client",
     "nym-signers-monitor",
+    "nym-sqlx-pool-guard",
     "nym-statistics-api",
     "nym-validator-rewarder",
     "nyx-chain-watcher",
@@ -150,15 +157,15 @@ members = [
     "service-providers/common",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
-    "nym-sqlx-pool-guard",
+    "smolmix/core",
     "tools/echo-server",
     "tools/internal/contract-state-importer/importer-cli",
     "tools/internal/contract-state-importer/importer-contract",
+    "tools/internal/localnet-orchestrator",
+    "tools/internal/localnet-orchestrator/dkg-bypass-contract",
     "tools/internal/mixnet-connectivity-check",
     #    "tools/internal/sdk-version-bump",
     "tools/internal/ssl-inject",
-    "tools/internal/testnet-manager",
-    "tools/internal/testnet-manager/dkg-bypass-contract",
     "tools/internal/validator-status-check",
     "tools/nym-cli",
     "tools/nym-id-cli",
@@ -167,30 +174,30 @@ members = [
     "tools/nymvisor",
     "tools/ts-rs-cli",
     "wasm/client",
-    # "wasm/full-nym-wasm",  # If we uncomment this again, remember to also uncomment the profile settings below
+    "wasm/smolmix",
-    "wasm/mix-fetch",
-    "wasm/node-tester",
     "wasm/zknym-lib",
-    #    "nym-gateway-probe",
+    "nym-network-monitor-v3/nym-network-monitor-orchestrator",
-    "integration-tests",
+    "nym-network-monitor-v3/nym-network-monitor-agent",
-    "common/nym-kkt-ciphersuite", "common/nym-kkt-context",
+    "nym-network-monitor-v3/nym-network-monitor-orchestrator-requests",
 ]
 
 default-members = [
     "clients/native",
     "clients/socks5",
-    "nym-authenticator-client",
     "nym-api",
+    "nym-authenticator-client",
     "nym-credential-proxy/nym-credential-proxy",
     "nym-node",
-    "nym-node-status-api/nym-node-status-agent",
+    "nym-registration-client",
     "nym-statistics-api",
     "nym-validator-rewarder",
     "nyx-chain-watcher",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
+    "tools/internal/localnet-orchestrator",
     "tools/nymvisor",
-    "nym-registration-client"
+    "nym-network-monitor-v3/nym-network-monitor-orchestrator",
+    "nym-network-monitor-v3/nym-network-monitor-agent",
 ]
 
 exclude = ["contracts", "nym-wallet", "cpu-cycles"]
@@ -202,9 +209,9 @@ homepage = "https://nymtech.net"
 documentation = "https://nymtech.net"
 edition = "2024"
 license = "Apache-2.0"
-rust-version = "1.85"
+rust-version = "1.87.0"
 readme = "README.md"
-version = "1.20.4"
+version = "1.21.1"
 
 [workspace.dependencies]
 addr = "0.15.6"
@@ -218,20 +225,22 @@ anyhow = "1.0.98"
 arc-swap = "1.7.1"
 argon2 = "0.5.0"
 async-trait = "0.1.88"
-axum = "0.7.5"
+async-tungstenite = { version = "0.24", default-features = false }
-axum-client-ip = "0.6.1"
+axum = "0.8.9"
-axum-extra = "0.9.4"
+axum-client-ip = "1.3.1"
-axum-test = "16.2.0"
+axum-extra = "0.12.6"
+axum-test = "20.0.0"
 base64 = "0.22.1"
 base85rs = "0.1.3"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 bitvec = "1.0.0"
-blake3 = "1.7.0"
+blake3 = ">=1.7, <1.8.4"  # blake3 1.8.4+ requires digest 0.11; workspace is on 0.10
 bloomfilter = "3.0.1"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
 bytes = "1.11.1"
+cargo-edit = "0.13.8"
 cargo_metadata = "0.19.2"
 celes = "2.6.0"
 cfg-if = "1.0.0"
@@ -245,7 +254,7 @@ clap_complete_fig = "4.5"
 colored = "2.2"
 comfy-table = "7.1.4"
 console = "0.16.0"
-console-subscriber = "0.4.1"
+console-subscriber = "0.5.0"
 console_error_panic_hook = "0.1"
 const-str = "0.5.6"
 const_format = "0.2.34"
@@ -270,23 +279,27 @@ eyre = "0.6.9"
 fastrand = "2.1.1"
 flate2 = "1.1.1"
 futures = "0.3.31"
+futures-rustls = { version = "0.26", default-features = false }
 futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
 getrandom03 = { package = "getrandom", version = "=0.3.3" }
+getrandom04 = { package = "getrandom", version = "0.4" }
 glob = "0.3"
 handlebars = "3.5.5"
 hex = "0.4.3"
-hickory-resolver = "0.25.2"
+hickory-proto = { version = "0.26.1", default-features = false }
+hickory-resolver = "0.26.1"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
 http-body-util = "0.1"
+httparse = "1.10"
 httpcodec = "0.2.3"
 human-repr = "1.1.0"
 humantime = "2.2.0"
 humantime-serde = "1.1.1"
-hyper = "1.6.0"
+hyper = { version = "1.6.0", default-features = false }
 hyper-util = "0.1"
 indicatif = "0.18.0"
 inquire = "0.6.2"
@@ -321,7 +334,7 @@ pnet_packet = "0.35.0"
 publicsuffix = "2.3.0"
 proc_pidinfo = "0.1.3"
 quote = "1"
-rand = "0.8.5"
+rand = "0.8.6"
 rand09 = { package = "rand", version = "=0.9.2" }
 rand_chacha = "0.3"
 rand_chacha09 = { package = "rand_chacha", version = "=0.9.0" }
@@ -331,12 +344,15 @@ rayon = "1.5.1"
 regex = "1.10.6"
 reqwest = { version = "0.13.1", default-features = false }
 rs_merkle = "1.5.0"
+rustls = { version = "0.23.37", default-features = false }
+rustls-pki-types = "1"
+rustls-rustcrypto = "0.0.2-alpha"
 schemars = "0.8.22"
 semver = "1.0.26"
 serde = "1.0.219"
 serde_bytes = "0.11.17"
 serde_derive = "1.0"
-serde_json = "1.0.140"
+serde_json = { version = "1.0.140", features = ["float_roundtrip"] }
 serde_json_path = "0.7.2"
 serde_repr = "0.1"
 serde_with = "3.9.0"
@@ -344,16 +360,18 @@ serde_yaml = "0.9.25"
 serde_plain = "1.0.2"
 sha2 = "0.10.3"
 si-scale = "0.2.3"
+simple-dns = "0.7"
+smoltcp = "0.12"
 snow = "0.9.6"
 sphinx-packet = "=0.6.0"
 sqlx = "0.8.6"
-strum = "0.27.2"
+strum = "0.28.0"
-strum_macros = "0.27.2"
+strum_macros = "0.28.0"
 subtle-encoding = "0.5"
 syn = "2"
-sysinfo = "0.37.0"
+sysinfo = "0.38.4"
 tap = "1.0.1"
-tar = "0.4.44"
+tar = "0.4.45"
 test-with = { version = "0.15.4", default-features = false }
 tempfile = "3.20"
 thiserror = "2.0"
@@ -364,7 +382,9 @@ tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
 tokio-tun = "0.11.5"
-tokio-tungstenite = { version = "0.20.1" }
+tokio-rustls = "0.26"
+tokio-smoltcp = "0.5"
+tokio-tungstenite = "0.20.1"
 tokio-util = "0.7.15"
 toml = "0.8.22"
 tower = "0.5.2"
@@ -375,137 +395,148 @@ tracing-opentelemetry = "0.32.1"
 tracing-subscriber = "0.3.20"
 tracing-indicatif = "0.3.9"
 tracing-test = "0.2.5"
-ts-rs = "10.1.0"
+ts-rs = "12.0.1"
 tungstenite = { version = "0.20.1", default-features = false }
 typed-builder = "0.23.0"
 uniffi = "0.29.2"
 uniffi_build = "0.29.0"
 url = "2.5"
 utoipa = "5.2"
-utoipa-swagger-ui = "8.1"
+utoipa-swagger-ui = "9.0.2"
 utoipauto = "0.2"
 uuid = "1.19.0"
 vergen = { version = "=8.3.1", default-features = false }
-vergen-gitcl = { version = "1.0.8", default-features = false }
 walkdir = "2"
 x25519-dalek = "2.0.0"
 zeroize = "1.7.0"
 
 prometheus = { version = "0.14.0" }
 
+# recreating lioness
+# we don't care about particular versions - just pull whatever is used by sphinx
+lioness = "*"
+arrayref = "*"
 
 # libcrux
-libcrux-kem = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-kem = "0.0.7"
-libcrux-ecdh = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-ecdh = "0.0.6"
-libcrux-curve25519 = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-curve25519 = "0.0.6"
-libcrux-chacha20poly1305 = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-chacha20poly1305 = "0.0.7"
-libcrux-psq = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-psq = "0.0.8"
-libcrux-ml-kem = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-ml-kem = "0.0.8"
-libcrux-sha3 = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-sha3 = "0.0.8"
-libcrux-traits = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-traits = "0.0.6"
 
 # Workspace dep definitions required by crates.io publication - we need a workspace version since `cargo workspaces` doesn't work with path imports from crate manifests
-nym-api-requests = { version = "1.20.4", path = "nym-api/nym-api-requests" }
+nym-api-requests = { version = "1.21.1", path = "nym-api/nym-api-requests" }
-nym-authenticator-requests = { version = "1.20.4", path = "common/authenticator-requests" }
+nym-authenticator-requests = { version = "1.21.1", path = "common/authenticator-requests" }
-nym-async-file-watcher = { version = "1.20.4", path = "common/async-file-watcher" }
+nym-async-file-watcher = { version = "1.21.1", path = "common/async-file-watcher" }
-nym-authenticator-client = { version = "1.20.4", path = "nym-authenticator-client" }
+nym-authenticator-client = { version = "1.21.1", path = "nym-authenticator-client" }
-nym-bandwidth-controller = { version = "1.20.4", path = "common/bandwidth-controller" }
+nym-bandwidth-controller = { version = "1.21.1", path = "common/bandwidth-controller" }
-nym-bin-common = { version = "1.20.4", path = "common/bin-common" }
+nym-bin-common = { version = "1.21.1", path = "common/bin-common" }
-nym-cache = { version = "1.20.4", path = "common/nym-cache" }
+nym-cache = { version = "1.21.1", path = "common/nym-cache" }
-nym-client-core = { version = "1.20.4", path = "common/client-core", default-features = false }
+nym-client-core = { version = "1.21.1", path = "common/client-core", default-features = false }
-nym-client-core-config-types = { version = "1.20.4", path = "common/client-core/config-types" }
+nym-client-core-config-types = { version = "1.21.1", path = "common/client-core/config-types" }
-nym-client-core-gateways-storage = { version = "1.20.4", path = "common/client-core/gateways-storage" }
+nym-client-core-gateways-storage = { version = "1.21.1", path = "common/client-core/gateways-storage" }
-nym-client-core-surb-storage = { version = "1.20.4", path = "common/client-core/surb-storage" }
+nym-client-core-surb-storage = { version = "1.21.1", path = "common/client-core/surb-storage" }
-nym-client-websocket-requests = { version = "1.20.4", path = "clients/native/websocket-requests" }
+nym-client-websocket-requests = { version = "1.21.1", path = "clients/native/websocket-requests" }
-nym-common = { version = "1.20.4", path = "common/nym-common" }
+nym-common = { version = "1.21.1", path = "common/nym-common" }
-nym-compact-ecash = { version = "1.20.4", path = "common/nym_offline_compact_ecash" }
+nym-compact-ecash = { version = "1.21.1", path = "common/nym_offline_compact_ecash" }
-nym-config = { version = "1.20.4", path = "common/config" }
+nym-config = { version = "1.21.1", path = "common/config" }
-nym-contracts-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/contracts-common" }
+nym-contracts-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/contracts-common" }
-nym-coconut-dkg-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/coconut-dkg" }
+nym-coconut-dkg-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/coconut-dkg" }
-nym-credential-storage = { version = "1.20.4", path = "common/credential-storage" }
+nym-credential-storage = { version = "1.21.1", path = "common/credential-storage" }
-nym-credential-utils = { version = "1.20.4", path = "common/credential-utils" }
+nym-credential-utils = { version = "1.21.1", path = "common/credential-utils" }
-nym-credential-proxy-lib = { version = "1.20.4", path = "common/credential-proxy" }
+nym-credential-proxy-lib = { version = "1.21.1", path = "common/credential-proxy" }
-nym-credentials = { version = "1.20.4", path = "common/credentials", default-features = false }
+nym-credentials = { version = "1.21.1", path = "common/credentials", default-features = false }
-nym-credentials-interface = { version = "1.20.4", path = "common/credentials-interface" }
+nym-credentials-interface = { version = "1.21.1", path = "common/credentials-interface" }
-nym-credential-proxy-requests = { version = "1.20.4", path = "nym-credential-proxy/nym-credential-proxy-requests", default-features = false }
+nym-credential-proxy-requests = { version = "1.21.1", path = "nym-credential-proxy/nym-credential-proxy-requests", default-features = false }
-nym-credential-verification = { version = "1.20.4", path = "common/credential-verification" }
+nym-credential-verification = { version = "1.21.1", path = "common/credential-verification" }
-nym-crypto = { version = "1.20.4", path = "common/crypto", default-features = false }
+nym-crypto = { version = "1.21.1", path = "common/crypto", default-features = false }
-nym-dkg = { version = "1.20.4", path = "common/dkg" }
+nym-dkg = { version = "1.21.1", path = "common/dkg" }
-nym-ecash-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/ecash-contract" }
+nym-ecash-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/ecash-contract" }
-nym-ecash-signer-check = { version = "1.20.4", path = "common/ecash-signer-check" }
+nym-ecash-signer-check = { version = "1.21.1", path = "common/ecash-signer-check" }
-nym-ecash-signer-check-types = { version = "1.20.4", path = "common/ecash-signer-check-types" }
+nym-ecash-signer-check-types = { version = "1.21.1", path = "common/ecash-signer-check-types" }
-nym-ecash-time = { version = "1.20.4", path = "common/ecash-time" }
+nym-ecash-time = { version = "1.21.1", path = "common/ecash-time" }
-nym-exit-policy = { version = "1.20.4", path = "common/exit-policy" }
+nym-exit-policy = { version = "1.21.1", path = "common/exit-policy" }
-nym-ffi-shared = { version = "1.20.4", path = "sdk/ffi/shared" }
+nym-ffi-shared = { version = "1.21.1", path = "sdk/ffi/shared" }
-nym-gateway-client = { version = "1.20.4", path = "common/client-libs/gateway-client", default-features = false }
+nym-gateway-client = { version = "1.21.1", path = "common/client-libs/gateway-client", default-features = false }
-nym-gateway-requests = { version = "1.20.4", path = "common/gateway-requests" }
+nym-gateway-probe = { version = "1.21.1", path = "nym-gateway-probe" }
-nym-gateway-storage = { version = "1.20.4", path = "common/gateway-storage" }
+nym-gateway-requests = { version = "1.21.1", path = "common/gateway-requests" }
-nym-gateway-stats-storage = { version = "1.20.4", path = "common/gateway-stats-storage" }
+nym-gateway-storage = { version = "1.21.1", path = "common/gateway-storage" }
-nym-group-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/group-contract" }
+nym-gateway-stats-storage = { version = "1.21.1", path = "common/gateway-stats-storage" }
-nym-http-api-client = { version = "1.20.4", path = "common/http-api-client" }
+nym-group-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/group-contract" }
-nym-http-api-client-macro = { version = "1.20.4", path = "common/http-api-client-macro" }
+nym-http-api-client = { version = "1.21.1", path = "common/http-api-client" }
-nym-http-api-common = { version = "1.20.4", path = "common/http-api-common", default-features = false }
+nym-http-api-client-macro = { version = "1.21.1", path = "common/http-api-client-macro" }
-nym-id = { version = "1.20.4", path = "common/nym-id" }
+nym-http-api-common = { version = "1.21.1", path = "common/http-api-common", default-features = false }
-nym-ip-packet-client = { version = "1.20.4", path = "nym-ip-packet-client" }
+nym-id = { version = "1.21.1", path = "common/nym-id" }
-nym-ip-packet-requests = { version = "1.20.4", path = "common/ip-packet-requests" }
+nym-ip-packet-client = { version = "1.21.1", path = "nym-ip-packet-client" }
-nym-kkt = { version = "0.1.0", path = "common/nym-kkt" }
+nym-ip-packet-requests = { version = "1.21.1", path = "common/ip-packet-requests" }
-nym-kkt-ciphersuite = { version = "1.20.4", path = "common/nym-kkt-ciphersuite" }
+nym-lp = { version = "1.21.1", path = "common/nym-lp" }
-nym-metrics = { version = "1.20.4", path = "common/nym-metrics" }
+nym-lp-data = { version = "1.21.1", path = "common/nym-lp-data" }
-nym-mixnet-client = { version = "1.20.4", path = "common/client-libs/mixnet-client" }
+nym-kkt = { version = "1.21.1", path = "common/nym-kkt" }
-nym-mixnet-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/mixnet-contract" }
+nym-kkt-ciphersuite = { version = "1.21.1", path = "common/nym-kkt-ciphersuite" }
-nym-multisig-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/multisig-contract" }
+nym-kkt-context = { version = "1.21.1", path = "common/nym-kkt-context" }
-nym-network-defaults = { version = "1.20.4", path = "common/network-defaults" }
+nym-metrics = { version = "1.21.1", path = "common/nym-metrics" }
-nym-node-tester-utils = { version = "1.20.4", path = "common/node-tester-utils" }
+nym-mixnet-client = { version = "1.21.1", path = "common/client-libs/mixnet-client" }
-nym-noise = { version = "1.20.4", path = "common/nymnoise" }
+nym-mixnet-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/mixnet-contract" }
-nym-noise-keys = { version = "1.20.4", path = "common/nymnoise/keys" }
+nym-multisig-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/multisig-contract" }
-nym-nonexhaustive-delayqueue = { version = "1.20.4", path = "common/nonexhaustive-delayqueue" }
+nym-network-defaults = { version = "1.21.1", path = "common/network-defaults" }
-nym-node-requests = { version = "1.20.4", path = "nym-node/nym-node-requests", default-features = false }
+nym-node-tester-utils = { version = "1.21.1", path = "common/node-tester-utils" }
-nym-node-metrics = { version = "1.20.4", path = "nym-node/nym-node-metrics" }
+nym-noise = { version = "1.21.1", path = "common/nymnoise" }
-nym-ordered-buffer = { version = "1.20.4", path = "common/socks5/ordered-buffer" }
+nym-noise-keys = { version = "1.21.1", path = "common/nymnoise/keys" }
-nym-outfox = { version = "1.20.4", path = "nym-outfox" }
+nym-nonexhaustive-delayqueue = { version = "1.21.1", path = "common/nonexhaustive-delayqueue" }
-nym-registration-common = { version = "1.20.4", path = "common/registration" }
+nym-node-requests = { version = "1.21.1", path = "nym-node/nym-node-requests", default-features = false }
-nym-pemstore = { version = "1.20.4", path = "common/pemstore" }
+nym-node-metrics = { version = "1.21.1", path = "nym-node/nym-node-metrics" }
-nym-performance-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/nym-performance-contract" }
+nym-node-families-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/node-families-contract" }
-nym-sdk = { version = "1.20.4", path = "sdk/rust/nym-sdk" }
+nym-ordered-buffer = { version = "1.21.1", path = "common/socks5/ordered-buffer" }
-nym-serde-helpers = { version = "1.20.4", path = "common/serde-helpers" }
+nym-outfox = { version = "1.21.1", path = "nym-outfox" }
-nym-service-providers-common = { version = "1.20.4", path = "service-providers/common" }
+nym-registration-common = { version = "1.21.1", path = "common/registration" }
-nym-service-provider-requests-common = { version = "1.20.4", path = "common/service-provider-requests-common" }
+nym-pemstore = { version = "1.21.1", path = "common/pemstore" }
-nym-socks5-client-core = { version = "1.20.4", path = "common/socks5-client-core" }
+nym-performance-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/nym-performance-contract" }
-nym-socks5-proxy-helpers = { version = "1.20.4", path = "common/socks5/proxy-helpers" }
+nym-sdk = { version = "1.21.1", path = "sdk/rust/nym-sdk" }
-nym-socks5-requests = { version = "1.20.4", path = "common/socks5/requests" }
+nym-serde-helpers = { version = "1.21.1", path = "common/serde-helpers" }
-nym-sphinx = { version = "1.20.4", path = "common/nymsphinx" }
+nym-service-providers-common = { version = "1.21.1", path = "service-providers/common" }
-nym-sphinx-acknowledgements = { version = "1.20.4", path = "common/nymsphinx/acknowledgements" }
+nym-service-provider-requests-common = { version = "1.21.1", path = "common/service-provider-requests-common" }
-nym-sphinx-addressing = { version = "1.20.4", path = "common/nymsphinx/addressing" }
+nym-socks5-client-core = { version = "1.21.1", path = "common/socks5-client-core" }
-nym-sphinx-anonymous-replies = { version = "1.20.4", path = "common/nymsphinx/anonymous-replies" }
+nym-socks5-proxy-helpers = { version = "1.21.1", path = "common/socks5/proxy-helpers" }
-nym-sphinx-chunking = { version = "1.20.4", path = "common/nymsphinx/chunking" }
+nym-socks5-requests = { version = "1.21.1", path = "common/socks5/requests" }
-nym-sphinx-cover = { version = "1.20.4", path = "common/nymsphinx/cover" }
+nym-sphinx = { version = "1.21.1", path = "common/nymsphinx" }
-nym-sphinx-forwarding = { version = "1.20.4", path = "common/nymsphinx/forwarding" }
+nym-sphinx-acknowledgements = { version = "1.21.1", path = "common/nymsphinx/acknowledgements" }
-nym-sphinx-framing = { version = "1.20.4", path = "common/nymsphinx/framing" }
+nym-sphinx-addressing = { version = "1.21.1", path = "common/nymsphinx/addressing" }
-nym-sphinx-params = { version = "1.20.4", path = "common/nymsphinx/params" }
+nym-sphinx-anonymous-replies = { version = "1.21.1", path = "common/nymsphinx/anonymous-replies" }
-nym-sphinx-routing = { version = "1.20.4", path = "common/nymsphinx/routing" }
+nym-sphinx-chunking = { version = "1.21.1", path = "common/nymsphinx/chunking" }
-nym-sphinx-types = { version = "1.20.4", path = "common/nymsphinx/types" }
+nym-sphinx-cover = { version = "1.21.1", path = "common/nymsphinx/cover" }
-nym-statistics-common = { version = "1.20.4", path = "common/statistics" }
+nym-sphinx-forwarding = { version = "1.21.1", path = "common/nymsphinx/forwarding" }
-nym-store-cipher = { version = "1.20.4", path = "common/store-cipher" }
+nym-sphinx-framing = { version = "1.21.1", path = "common/nymsphinx/framing" }
-nym-task = { version = "1.20.4", path = "common/task" }
+nym-sphinx-params = { version = "1.21.1", path = "common/nymsphinx/params" }
-nym-tun = { version = "1.20.4", path = "common/tun" }
+nym-sphinx-routing = { version = "1.21.1", path = "common/nymsphinx/routing" }
-nym-test-utils = { version = "1.20.4", path = "common/test-utils" }
+nym-sphinx-types = { version = "1.21.1", path = "common/nymsphinx/types" }
-nym-ticketbooks-merkle = { version = "1.20.4", path = "common/ticketbooks-merkle" }
+nym-statistics-common = { version = "1.21.1", path = "common/statistics" }
-nym-topology = { version = "1.20.4", path = "common/topology" }
+nym-store-cipher = { version = "1.21.1", path = "common/store-cipher" }
-nym-types = { version = "1.20.4", path = "common/types" }
+nym-task = { version = "1.21.1", path = "common/task" }
-nym-upgrade-mode-check = { version = "1.20.4", path = "common/upgrade-mode-check" }
+nym-tun = { version = "1.21.1", path = "common/tun" }
-nym-validator-client = { version = "1.20.4", path = "common/client-libs/validator-client", default-features = false }
+nym-test-utils = { version = "1.21.1", path = "common/test-utils" }
-nym-vesting-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/vesting-contract" }
+nym-ticketbooks-merkle = { version = "1.21.1", path = "common/ticketbooks-merkle" }
-nym-verloc = { version = "1.20.4", path = "common/verloc" }
+nym-topology = { version = "1.21.1", path = "common/topology" }
-nym-wireguard = { version = "1.20.4", path = "common/wireguard" }
+nym-types = { version = "1.21.1", path = "common/types" }
-nym-wireguard-types = { version = "1.20.4", path = "common/wireguard-types" }
+nym-upgrade-mode-check = { version = "1.21.1", path = "common/upgrade-mode-check" }
-nym-wireguard-private-metadata-shared = { version = "1.20.4", path = "common/wireguard-private-metadata/shared" }
+nym-validator-client = { version = "1.21.1", path = "common/client-libs/validator-client", default-features = false }
-nym-wireguard-private-metadata-client = { version = "1.20.4", path = "common/wireguard-private-metadata/client" }
+nym-vesting-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/vesting-contract" }
-nym-wireguard-private-metadata-server = { version = "1.20.4", path = "common/wireguard-private-metadata/server" }
+nym-network-monitors-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/network-monitors-contract" }
-nym-sqlx-pool-guard = { version = "1.2.0", path = "nym-sqlx-pool-guard" }
+nym-verloc = { version = "1.21.1", path = "common/verloc" }
-nym-wasm-client-core = { version = "1.20.4", path = "common/wasm/client-core" }
+nym-wireguard = { version = "1.21.1", path = "common/wireguard" }
-nym-wasm-storage = { version = "1.20.4", path = "common/wasm/storage" }
+nym-wireguard-types = { version = "1.21.1", path = "common/wireguard-types" }
-nym-wasm-utils = { version = "1.20.4", path = "common/wasm/utils", default-features = false }
+nym-wireguard-private-metadata-shared = { version = "1.21.1", path = "common/wireguard-private-metadata/shared" }
-nyxd-scraper-shared = { version = "1.20.4", path = "common/nyxd-scraper-shared" }
+nym-wireguard-private-metadata-client = { version = "1.21.1", path = "common/wireguard-private-metadata/client" }
+nym-wireguard-private-metadata-server = { version = "1.21.1", path = "common/wireguard-private-metadata/server" }
+nym-sqlx-pool-guard = { version = "1.21.1", path = "nym-sqlx-pool-guard" }
+nym-wasm-client-core = { version = "1.21.1", path = "common/wasm/client-core" }
+nym-wasm-storage = { version = "1.21.1", path = "common/wasm/storage" }
+nym-wasm-utils = { version = "1.21.1", path = "common/wasm/utils", default-features = false }
+nyxd-scraper-shared = { version = "1.21.1", path = "common/nyxd-scraper-shared" }
+
+smolmix = { version = "1.21.1", path = "smolmix/core" }
 
 # coconut/DKG related
 # unfortunately until https://github.com/zkcrypto/nym-bls12_381-fork/issues/10 is resolved, we have to rely on the fork
@@ -553,6 +584,7 @@ wasm-bindgen = "0.2.99"
 wasm-bindgen-futures = "0.4.49"
 wasm-bindgen-test = "0.3.49"
 wasmtimer = "0.4.1"
+webpki-roots = "0.26"
 web-sys = "0.3.76"
 
 # for local development:
@@ -571,18 +603,7 @@ opt-level = 3
 # lto = true
 opt-level = 'z'
 
-[profile.release.package.nym-node-tester-wasm]
+[profile.release.package.smolmix-wasm]
-# lto = true
-opt-level = 'z'
-
-# Commented out since the crate is also commented out from the inclusion in the
-# workspace above. We should uncomment this if we re-include it in the
-# workspace
-#[profile.release.package.nym-wasm-sdk]
-## lto = true
-#opt-level = 'z'
-
-[profile.release.package.mix-fetch-wasm]
 # lto = true
 opt-level = 'z'
 

Makefile

@@ -104,30 +104,30 @@ $(eval $(call add_cargo_workspace,wallet,nym-wallet))
 sdk-wasm: sdk-wasm-build sdk-wasm-test sdk-wasm-lint
 
 sdk-wasm-build:
-# 	$(MAKE) -C nym-browser-extension/storage wasm-pack
 	$(MAKE) -C wasm/client
-	$(MAKE) -C wasm/node-tester
+	$(MAKE) -C wasm/smolmix
-	$(MAKE) -C wasm/mix-fetch
 # 	$(MAKE) -C wasm/zknym-lib
-	# $(MAKE) -C wasm/full-nym-wasm
 
 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
+#
+# `mix-tunnel` must build before the three feature packages — they import it
+# via `workspace:*` and the lerna topological sort will respect that as long
+# as we keep them in the same `--scope` invocation.
 sdk-typescript-build:
 	npx lerna run --scope @nymproject/sdk build --stream
-	npx lerna run --scope @nymproject/mix-fetch build --stream
+	npx lerna run --scope '{@nymproject/mix-tunnel,@nymproject/mix-fetch,@nymproject/mix-dns,@nymproject/mix-websocket}' build --stream
-	npx lerna run --scope @nymproject/node-tester build --stream
+	pnpm --pwd sdk/typescript/codegen/contract-clients build
-	yarn --cwd sdk/typescript/codegen/contract-clients build
 
 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
-# WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm zknym-lib
+
-WASM_CRATES = nym-client-wasm nym-node-tester-wasm
+WASM_CRATES = nym-client-wasm
 
 sdk-wasm-test:
 	#cargo test $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings
 
 sdk-wasm-lint:
 	RUSTFLAGS='--cfg getrandom_backend="wasm_js"' cargo clippy $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings
-	$(MAKE) -C wasm/mix-fetch check-fmt
+	$(MAKE) -C wasm/smolmix check-fmt
 
 # Add to top-level targets
 build: sdk-wasm-build
@@ -223,7 +223,7 @@ build-nym-cli:
 
 generate-typescript:
 	cd tools/ts-rs-cli && cargo run && cd ../..
-	yarn types:lint:fix
+	pnpm types:lint:fix
 
 # Run the integration tests for public nym-api endpoints
 run-api-tests:

README.md

@@ -30,8 +30,11 @@ client ───► Gateway ──┘  mix  │  mix  ┌─►mix ───►
 
 ```
 
+<!-- This is broken 
 [![Build Status](https://img.shields.io/github/actions/workflow/status/nymtech/nym/build.yml?branch=develop&style=for-the-badge&logo=github-actions)](https://github.com/nymtech/nym/actions?query=branch%3Adevelop)
+-->
 
+> This project integrates with the Midnight Network
 
 ### Building
 
@@ -71,9 +74,9 @@ Nym Node Operators and Validators Terms and Conditions can be found [here](https
 ## Getting Started
 
 ```bash
-yarn install
+pnpm install
 ```
 
 ```bash
-yarn build
+pnpm build
 ```

ansible/nym-node/playbooks/auto-bond.yml

@@ -0,0 +1,8 @@
+---
+- name: Nym node auto-bonding
+  hosts: all
+  gather_facts: false
+  serial: 1
+
+  roles:
+    - role: postinstall-auto

ansible/nym-node/playbooks/group_vars/all.yml

@@ -1,33 +1,47 @@
 ---
-ansible_ssh_private_key_file: ~/.ssh/<SSH_KEY>
+###############################################################################
+## GLOBAL VARS
+## These values will be used globally unless overwritten per node in inventory/all
+## Set these vars only if you want them globally for all nodes
+## Per node changes in inventory/all will overwrite these global vars
+###############################################################################
 
-# nym_version: "v2025.21-mozzarella"
+## MANDATORY - uncomment & define
-#
-# NOTE:
-# if you want to pin Nym to a specific version instead of using the
-# latest release from GitHub in /tasks/main.yml then
-# uncomment the line above and set the tag
 
-cli_url: "https://github.com/nymtech/nym/releases/download/nym-binaries-{{ nym_version }}/nym-cli"
+## --SSH--
+#ansible_user: root                                  # used for ssh, like `ssh root@nym-exit.ch-1.mynodes.net`
+# ansible_ssh_private_key_file: ~/.ssh/<SSH_KEY>    
+
+## --Operator info--
+# email: "<EMAIL>"                                  # used in certbot, description.toml and landing page
+# website: "<WEBSITE>"                              # it is used in the description.toml
+# description: "<NODE_PUBLIC_DESCRIPTION>"          # or define per node in inventory/all
+# moniker: "<MONIKER>" 
+
+## --Node defaults (can override per node in inventory/all)--
+# accept_operator_terms: true                       # controls --accept-operator-terms-and-conditions, read: https://nym.com/docs/operators/nodes/nym-node/setup#terms--conditions
+# mode: exit-gateway                                # entry-gateway/exit-gateway/mixnode
+# wireguard_enabled: true                           # true/false
+hostname: ""                                        # keep this fallback, keep it and setup hostname per node in inventory/all
+
+## OPTIONAL - uncomment & define
+
+# operator_name: "<OPERATOR_NAME>"          # used in landing page if provided
+# nym_version: "nym-binaries-v2026.7-tola"  # to use particular version instead of Latest, provide in such form: 
+
+## alternative SSH key var setting, instead of a hardcoded path
+## useful if the playbook is shared in a repo by more admins with each having own local key
+# ansible_ssh_private_key_file: "{{ lookup('env', '<YOUR_ANSIBLE SSH_KEY_ENV_VAR>') }}"
+
+###############################################################################
+## GLOBAL PACKAGES & URLs
+## These will be installed during deployment
+###############################################################################
+
+nym_cli_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-cli"
 tunnel_manager_url: "https://github.com/nymtech/nym/raw/refs/heads/develop/scripts/nym-node-setup/network-tunnel-manager.sh"
 quic_bridge_deployment_url: "https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh"
 
-# NOTE: These values will be used globally unless overwritten per node in inventory/all
-ansible_user: root                         # used for ssh, like `ssh root@nym-exit.ch-1.mynodes.net`
-email: "<EMAIL>"                           # used in certbot, description.toml and landing page
-website: "<WEBSITE>"                       # it is used in the description.toml
-description: "<NODE_PUBLIC_DESCRIPTION>"   # or define per node in inventory/all
-
-# NOTE: Set these vars if you want them globally for all nodes
-# Per node changes in inventory/all will overwrite these global ones:
-hostname: ""                                # this is a fallback, keep it and setup hostname per node in inventory/all
-# moniker: "<MONIKER>"                      # if not setup here not in inventory/all it get's derived from the hostname
-# mode: <MODE>                              # entry-gateway/exit-gateway/mixnode
-# wireguard_enabled: <WIREGUARD_ENABLED>    # true/false
-
-# NOTE: Possible vars to incule on landing page, etc.
-# operator_name: "<OPERATOR_NAME>"
-
 packages:
   - tmux
   - speedtest-cli
@@ -42,3 +56,56 @@ packages:
   - jq
   - wget
   - ufw
+
+
+###############################################################################
+## SYSTEM MAINTENANCE PLAYBOOK KNOBS
+###############################################################################
+
+## JOURNALD LIMITS
+
+# journald_system_max_use: "100M"        # max persistent journal size
+# journald_runtime_max_use: "50M"        # max runtime journal size
+# journald_system_max_file_size: "25M"   # max single journal file
+# journald_runtime_max_file_size: "10M"  # max runtime journal file
+# journald_max_retention_sec: "3day"     # retention time
+
+# journald_rate_limit_interval: "30s"    # rate limit window
+# journald_rate_limit_burst: "1000"      # rate limit burst
+
+
+## NYM-NODE LOG CONTROL
+
+# nymnode_log_level_max: "warning"       # drop INFO logs
+# nymnode_rate_limit_interval: "30s"     # per nym-node rate limit window
+# nymnode_rate_limit_burst: "200"        # per nym-node rate limit burst
+
+
+## JOURNAL VACUUM TARGETS
+
+# journal_vacuum_size: "100M"
+# journal_vacuum_time: "3days"
+
+
+## RSYSLOG
+
+# disable_rsyslog: true
+
+
+## FSTRIM SCHEDULE
+
+# fstrim_every_calendar: "*:0/15"        # Aggressive
+# fstrim_every_calendar: "hourly"        # Less aggressive
+
+
+## OPTIONAL CLEANUPS
+
+# enable_apt_cleanup: true
+# enable_snap_cleanup: true
+
+
+## WRITEBACK TUNING
+
+# enable_writeback_tuning: true
+# writeback_dirty_writeback_centisecs: 1500
+# writeback_dirty_expire_centisecs: 6000

ansible/nym-node/playbooks/inventory/all

@@ -1,34 +1,39 @@
 [nym_nodes]
-# READ CONFIGURATION GUIDE:
+## READ CONFIGURATION GUIDE:
-# https://nym.com//docs/operators/orchestration/ansible#configuration
+## https://nym.com/docs/operators/orchestration/ansible#configuration
 
-# VARIABLES INFO
+##############
-# required vars to set values per node: 
+## TEMPLATE ##
-# `ansible_host`, `hostname`, `location`
+##############
+## uncomment and exchange the <VARIABLES> with your real values for each node without the <> brackets
 
-# global vars can be set in the group_vars/all.yml, for example:
-# `email`, `ansible_user`, `moniker`, `description`,  `mode`, `wireguard_enabled`
-# othersise they must be set per node!
-
-############
-# TEMPLATE #
-############
 # node1 ansible_host=<YOUR_SERVER_IP> ansible_user=<USER> hostname=<HOSTNAME> location=<LOCATION> email=<EMAIL> mode=<MODE> wireguard_enabled=<true/false> moniker=<MONIKER> description=<DESCRIPTION>
 
-# remove all comments and exchange the <VARIABLES> with your real values for each node
+####################
-# without <> brackets
+## VARIABLES INFO ##
+####################
 
-# PRIORITY ORDER
+## --REQUIRED VARS--
-# anything setup globaly can be overwritten in this file per node  
+## required per node: 
-# if provided here, it takes priority over the global setting
+## ansible_host, hostname, location
 
-# EXAMPLES
+## --OPTIONAL VARS--
-# exit + wireguard gateway:
+## can be set in the group_vars/all.yml or per node here:
+## email, ansible_user, moniker, description,  mode, wireguard_enabled
+
+## --PRIORITY ORDER--
+## anything setup globaly can be overwritten in this file per node  
+## if provided here, it takes priority over the global setting
+
+## --EXAMPLES--
+## exit + wireguard gateway:
 # node2 ansible_host=11.12.13.14 hostname=nym-exit.ch-1.mydomain.net mode=exit-gateway location=CH wireguard_enabled=true
 
-# entry gateway, no wireguard:
+## entry gateway, no wireguard:
 # node3 ansible_host=12.13.14.15 hostname=nym-entry.ch-2.mydomain.net mode=entry-gateway location=CH wireguard_enabled=false
 
-# NOTE:
+## mixnode (comment out tunnel+quic roles in deploy.yml for these)
-# all examples above don't have defined user, email nor description as we use the definition from group_vars/main.yml without an attempt of overwriting it
+# mix-de-1   ansible_host=13.14.15.16  hostname=nym-mix.de-1.example.net  location=DE  mode=mixnode  wireguard_enabled=false
-# all examples above don't have moniker defined as there is a function in /templates/description.toml.j2 deriving it from the hostname
+
+## NOTE:
+## all examples above don't have defined user, email nor description as we use global vars from playbooks/group_vars/all.yml

ansible/nym-node/playbooks/mitigate_kernel_CVE.yml

@@ -0,0 +1,42 @@
+# Mitigation playbook for CopyFail (CVE-2026-31431) and DirtyFrag (CVE-2026-43284 / CVE-2026-43500)
+# This playbook applies interim module blacklists only
+# Kernel patches are not yet available (May 2026)
+# Once patched kernels ship, use remove_kernel_CVE_mitigations.yml to reverse everything
+# This playbook is idempotent - safe to re-run if mitigations were already applied
+
+- name: Mitigate Copy Fail + Dirty Frag
+  hosts: all
+  become: true
+  tasks:
+    - name: Blacklist algif_aead (Copy Fail)
+      copy:
+        dest: /etc/modprobe.d/disable-algif_aead.conf
+        content: "install algif_aead /bin/false\n"
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Blacklist esp4, esp6, rxrpc (Dirty Frag)
+      copy:
+        dest: /etc/modprobe.d/dirtyfrag.conf
+        content: |
+          install esp4 /bin/false
+          install esp6 /bin/false
+          install rxrpc /bin/false
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Unload all affected modules
+      modprobe:
+        name: "{{ item }}"
+        state: absent
+      loop:
+        - algif_aead
+        - esp4
+        - esp6
+        - rxrpc
+      ignore_errors: true
+
+    - name: Drop page cache to clear any contamination
+      shell: echo 3 > /proc/sys/vm/drop_caches

ansible/nym-node/playbooks/remove_kernel_CVE_mitigations.yml

@@ -0,0 +1,111 @@
+############################################################################################
+############################################################################################
+############################################################################################
+#### THIS PLAYBOOK IS NOT MEANT TO BE RUN YET, IT IS NOT REFERRED IN ANY DOCUMENTATION! ####
+############################################################################################
+############################################################################################
+############################################################################################
+#
+# Reversal playbook for mitigate_kernel_CVE.yml (CopyFail CVE-2026-31431 / DirtyFrag CVE-2026-43284 / CVE-2026-43500).
+#
+# Run this AFTER your distro has shipped the patched kernel.
+# This playbook:
+#   1. Updates the kernel via apt
+#   2. Reboots and waits for reconnect
+#   3. Verifies the running kernel is newer than the pre-patch version
+#   4. Removes the interim module blacklists
+#   5. Re-enables the affected modules live (no second reboot needed)
+#
+# Debian family only (Debian, Ubuntu). Tested on Debian 11, Debian 12, Ubuntu 20.04, 22.04, 24.04.
+#
+# For exit-gateway nodes with --wireguard-enabled true:
+# After this playbook completes, run the networking restore step on each node via:
+#   ansible-playbook deploy.yml -t ntm
+# See the CVE patch documentation for details.
+
+- name: Remove CVE mitigations and apply patched kernel
+  hosts: all
+  become: true
+
+  tasks:
+    - name: Verify OS is Debian family
+      assert:
+        that:
+          - ansible_os_family == "Debian"
+        fail_msg: "This playbook supports Debian-family distros only (Debian, Ubuntu). For other distros, apply the kernel update and mitigation removal manually."
+
+    - name: Update apt cache
+      apt:
+        update_cache: true
+        cache_valid_time: 0
+
+    - name: Upgrade kernel packages
+      apt:
+        upgrade: full
+        only_upgrade: false
+      register: apt_upgrade_result
+
+    - name: Record pre-reboot kernel version
+      command: uname -r
+      register: kernel_before
+      changed_when: false
+
+    - name: Reboot to load patched kernel
+      reboot:
+        msg: "Rebooting to apply patched kernel (CVE-2026-31431 / CVE-2026-43284 / CVE-2026-43500)"
+        reboot_timeout: 300
+        pre_reboot_delay: 5
+        post_reboot_delay: 15
+
+    - name: Record post-reboot kernel version
+      command: uname -r
+      register: kernel_after
+      changed_when: false
+
+    - name: Show kernel versions before and after reboot
+      debug:
+        msg:
+          - "Kernel before reboot: {{ kernel_before.stdout }}"
+          - "Kernel after reboot:  {{ kernel_after.stdout }}"
+
+    - name: Warn if kernel did not change after reboot
+      debug:
+        msg: >
+          WARNING: kernel version did not change after reboot ({{ kernel_after.stdout }}).
+          The patched kernel may not have been selected by GRUB, or no kernel update was available.
+          Do NOT remove the interim mitigations until you have confirmed the running kernel is patched.
+          Check: apt-cache policy linux-image-amd64   # Debian
+          Check: apt-cache policy linux-image-generic  # Ubuntu
+      when: kernel_before.stdout == kernel_after.stdout
+
+    - name: Remove algif_aead blacklist
+      file:
+        path: /etc/modprobe.d/disable-algif_aead.conf
+        state: absent
+
+    - name: Remove DirtyFrag blacklist (esp4, esp6, rxrpc)
+      file:
+        path: /etc/modprobe.d/dirtyfrag.conf
+        state: absent
+
+    - name: Re-enable affected modules live
+      modprobe:
+        name: "{{ item }}"
+        state: present
+      loop:
+        - esp4
+        - esp6
+        - rxrpc
+        - algif_aead
+      ignore_errors: true
+
+    - name: Confirm nym-node service is still running
+      systemd:
+        name: nym-node
+        state: started
+      register: nym_node_status
+      failed_when: false
+
+    - name: Show nym-node status
+      debug:
+        msg: "nym-node service state: {{ nym_node_status.state | default('unknown - service may not exist on this node') }}"

ansible/nym-node/playbooks/system-maintenance.yml

@@ -0,0 +1,38 @@
+---
+- name: Restrict logging, vacuum journals, and enable periodic trim
+  hosts: all
+  become: true
+  gather_facts: false
+
+  # global knobs - override in inventory/group_vars/host_vars as needed
+  vars:
+    journald_system_max_use: "100M"
+    journald_runtime_max_use: "50M"
+    journald_system_max_file_size: "25M"
+    journald_runtime_max_file_size: "10M"
+    journald_max_retention_sec: "3day"
+    journald_rate_limit_interval: "30s"
+    journald_rate_limit_burst: "1000"
+
+    # per nym-node rate limit + level cap
+    nymnode_log_level_max: "warning"
+    nymnode_rate_limit_interval: "30s"
+    nymnode_rate_limit_burst: "200"
+
+    # journal vacuum targets
+    journal_vacuum_size: "100M"
+    journal_vacuum_time: "3days"
+
+    # fstrim cadence (note: the systemd override uses cron-like calendar)
+    fstrim_every_calendar: "*:0/15"
+
+  roles:
+    - role: journald_limits
+    - role: nymnode_logging
+    - role: rsyslog_disable
+    - role: journal_vacuum
+    - role: classic_log_cleanup
+    - role: apt_cleanup
+    - role: snap_cleanup
+    - role: fstrim_15min
+    - role: report

ansible/nym-node/roles/apt_cleanup/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+- name: Clean apt cache
+  command: apt-get clean
+  ignore_errors: true
+
+- name: Autoremove unused packages
+  command: apt-get -y autoremove
+  ignore_errors: true
+
+- name: Remove apt lists to reclaim space (they will be re-fetched on update)
+  file:
+    path: /var/lib/apt/lists
+    state: absent
+  ignore_errors: true
+
+- name: Recreate apt lists directory
+  file:
+    path: /var/lib/apt/lists
+    state: directory
+    mode: "0755"
+  ignore_errors: true

ansible/nym-node/roles/classic_log_cleanup/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+- name: Remove classic /var/log files if present (optional)
+  file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /var/log/syslog
+    - /var/log/syslog.1
+    - /var/log/kern.log
+    - /var/log/kern.log.1
+    - /var/log/auth.log
+    - /var/log/auth.log.1
+    - /var/log/ufw.log
+    - /var/log/ufw.log.1
+  ignore_errors: true
+
+# This is best-effort and may still fail if other packages' postrotate scripts assume services exist.
+- name: Force logrotate (best-effort)
+  command: "logrotate --force /etc/logrotate.conf"
+  ignore_errors: true

ansible/nym-node/roles/fstrim_15min/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+fstrim_timer_dropin_dir: "/etc/systemd/system/fstrim.timer.d"
+fstrim_every_calendar: "*:0/15"

ansible/nym-node/roles/fstrim_15min/tasks/main.yml

@@ -0,0 +1,31 @@
+---
+- name: Ensure systemd drop-in dir for fstrim.timer exists
+  file:
+    path: "{{ fstrim_timer_dropin_dir }}"
+    state: directory
+    mode: "0755"
+
+- name: Override fstrim.timer schedule
+  copy:
+    dest: "{{ fstrim_timer_dropin_dir }}/override.conf"
+    mode: "0644"
+    content: |
+      [Timer]
+      OnCalendar=
+      OnCalendar={{ fstrim_every_calendar }}
+      Persistent=true
+      RandomizedDelaySec=0
+
+- name: Reload systemd after fstrim override
+  systemd:
+    daemon_reload: true
+
+- name: Enable and start fstrim timer
+  systemd:
+    name: fstrim.timer
+    enabled: true
+    state: started
+
+- name: Run fstrim now (best-effort)
+  command: fstrim -av
+  ignore_errors: true

ansible/nym-node/roles/journal_vacuum/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+journal_vacuum_size: "100M"
+journal_vacuum_time: "3days"

ansible/nym-node/roles/journal_vacuum/tasks/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Vacuum journal to size cap (hard)
+  command: "journalctl --vacuum-size={{ journal_vacuum_size }}"
+
+- name: Vacuum journal older than retention window (time)
+  command: "journalctl --vacuum-time={{ journal_vacuum_time }}"

ansible/nym-node/roles/journald_limits/defaults/main.yml

@@ -0,0 +1,8 @@
+---
+journald_system_max_use: "100M"
+journald_runtime_max_use: "50M"
+journald_system_max_file_size: "25M"
+journald_runtime_max_file_size: "10M"
+journald_max_retention_sec: "3day"
+journald_rate_limit_interval: "30s"
+journald_rate_limit_burst: "1000"

ansible/nym-node/roles/journald_limits/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart journald
+  systemd:
+    name: systemd-journald
+    state: restarted

ansible/nym-node/roles/journald_limits/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+- name: Configure journald limits (persistent, capped, rate-limited)
+  copy:
+    dest: /etc/systemd/journald.conf
+    mode: "0644"
+    content: |
+      [Journal]
+      Storage=persistent
+      Compress=yes
+      Seal=yes
+
+      SystemMaxUse={{ journald_system_max_use }}
+      RuntimeMaxUse={{ journald_runtime_max_use }}
+      SystemMaxFileSize={{ journald_system_max_file_size }}
+      RuntimeMaxFileSize={{ journald_runtime_max_file_size }}
+      MaxRetentionSec={{ journald_max_retention_sec }}
+
+      RateLimitIntervalSec={{ journald_rate_limit_interval }}
+      RateLimitBurst={{ journald_rate_limit_burst }}
+  notify: Restart journald

ansible/nym-node/roles/nginx/tasks/main.yml

@@ -89,7 +89,6 @@
   loop:
     - "/etc/nginx/sites-enabled/{{ hostname }}-ssl"
     - "/etc/nginx/sites-enabled/nym-wss-config"
-  when: not le_cert.stat.exists
   notify: Restart nginx
 
 - name: Ensure nginx is enabled and running (needed for ACME http-01)
@@ -111,18 +110,13 @@
 - name: Obtain/renew certificate
   command:
     cmd: >-
-      {% if le_cert.stat.exists %}
+      certbot certonly --nginx
-      certbot certonly --webroot
-      -w /var/www/{{ hostname }}
       --non-interactive --agree-tos --keep-until-expiring
       -m {{ email }} -d {{ hostname }}
-      {% else %}
-      certbot --nginx
-      --non-interactive --agree-tos --redirect
-      -m {{ email }} -d {{ hostname }}
-      {% endif %}
   register: certbot_result
-  failed_when: false
+  failed_when: false  
+  
+  
 
 # re-check cert after certbot attempt
 - name: Re-check whether certificate exists after certbot
@@ -170,4 +164,4 @@
   changed_when: false
 
 - name: Flush handlers (apply restart after successful tests)
-  meta: flush_handlers
+  meta: flush_handlers

ansible/nym-node/roles/nym/defaults/main.yml

@@ -10,7 +10,7 @@ mixnet_bind_address: "0.0.0.0:1789"      # maps to --mixnet-bind-address
 landing_page_assets_base_dir: "/var/www"
 
 # Flag toggles
-# accept_operator_terms: true              # controls --accept-operator-terms-and-conditions
+accept_operator_terms: false             # override in group_vars or inventory
 nym_write_flag: true                     # controls -w
 nym_init_only_flag: true                 # controls --init-only
 wss_port: 9001                           # controlls --announce-wss-port
@@ -18,7 +18,7 @@ wss_port: 9001                           # controlls --announce-wss-port
 # Optional: extra flags if you want to append more later
 nym_extra_flags: ""
 
-# CLI URL (nym_version can be set elsewhere / via GitHub API)
+# CLI URL
 nym_cli_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-cli"
 
 # UFW

ansible/nym-node/roles/nymnode_logging/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+nymnode_log_level_max: "warning"
+nymnode_rate_limit_interval: "30s"
+nymnode_rate_limit_burst: "200"
+nymnode_unit_name: "nym-node"   # set to "nym-node.service" if your distro expects it
+nymnode_dropin_dir: "/etc/systemd/system/nym-node.service.d"
+nymnode_dropin_file: "10-logging.conf"

ansible/nym-node/roles/nymnode_logging/tasks/main.yml

@@ -0,0 +1,26 @@
+---
+- name: Ensure systemd drop-in dir for nym-node exists
+  file:
+    path: "{{ nymnode_dropin_dir }}"
+    state: directory
+    mode: "0755"
+
+- name: Cap nym-node logs + apply per-unit rate limiting
+  copy:
+    dest: "{{ nymnode_dropin_dir }}/{{ nymnode_dropin_file }}"
+    mode: "0644"
+    content: |
+      [Service]
+      LogLevelMax={{ nymnode_log_level_max }}
+      LogRateLimitIntervalSec={{ nymnode_rate_limit_interval }}
+      LogRateLimitBurst={{ nymnode_rate_limit_burst }}
+
+- name: Reload systemd after nym-node drop-in
+  systemd:
+    daemon_reload: true
+
+- name: Restart nym-node to apply new logging limits (best-effort)
+  systemd:
+    name: "{{ nymnode_unit_name }}"
+    state: restarted
+  ignore_errors: true

ansible/nym-node/roles/postinstall-auto/tasks/main.yml

@@ -0,0 +1,38 @@
+- name: Show which node is being bonded
+  tags: bonding
+  debug:
+    msg: "Bonding Nym node: {{ hostname }}"
+
+- name: Get bonding details
+  tags: bonding
+  command: "/root/nym-binaries/nym-node bonding-information"
+  register: bondinfo
+  changed_when: false
+
+- name: Display bonding info
+  tags: bonding
+  debug:
+    msg: "{{ item }}"
+  loop: "{{ bondinfo.stdout_lines }}"
+
+- name: Sign bonding contract message on the node
+  tags: bonding
+  command:
+    argv:
+      - /root/nym-binaries/nym-node
+      - sign
+      - --contract-msg
+      - "{{ contract_msg }}"
+      - --output
+      - json
+  register: sign_output
+
+- name: Display full signed message exactly as returned
+  tags: bonding
+  debug:
+    msg: "{{ sign_output.stdout }}"
+
+- name: Display encoded signature
+  tags: bonding
+  debug:
+    msg: "ENCODED_SIGNATURE={{ (sign_output.stdout | from_json).encoded_signature }}"

ansible/nym-node/roles/quic/tasks/main.yml

@@ -1,16 +1,20 @@
 - name: Download quic_bridge_deployment.sh
-  tags: quic bridge deployment
+  command:
-  get_url:
+    cmd: "curl -fsSL {{ quic_bridge_deployment_url }} -o /root/nym-binaries/quic_bridge_deployment.sh"
-    url: "{{ quic_bridge_deployment_url }}"
+  tags: quic
-    dest: "/root/nym-binaries/quic_bridge_deployment.sh"
+
+- name: Set quic_bridge_deployment permissions
+  file:
+    path: /root/nym-binaries/quic_bridge_deployment.sh
     mode: "0755"
+  tags: quic
 
 - name: Configure tunnel manager
-  tags: quic bridge deployment
   become: true
   command:
     cmd: "/root/nym-binaries/quic_bridge_deployment.sh {{ item }}"
   environment:
     NONINTERACTIVE: "1"
   loop:
-    - full_bridge_setup
+    - full_bridge_setup
+  tags: quic

ansible/nym-node/roles/report/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Show journal disk usage
+  command: journalctl --disk-usage
+  register: journal_usage
+  changed_when: false
+
+- debug:
+    var: journal_usage.stdout

ansible/nym-node/roles/rsyslog_disable/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+- name: Stop/disable rsyslog if installed (best-effort)
+  systemd:
+    name: rsyslog
+    state: stopped
+    enabled: false
+  ignore_errors: true
+
+- name: Remove rsyslog logrotate stanza if present (prevents logrotate failures)
+  file:
+    path: /etc/logrotate.d/rsyslog
+    state: absent
+  ignore_errors: true

ansible/nym-node/roles/snap_cleanup/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Remove disabled snap revisions (best-effort)
+  shell: |
+    set -euo pipefail
+    snap list --all | awk '/disabled/{print $1, $3}' | while read -r name rev; do
+      snap remove "$name" --revision="$rev" || true
+    done
+  args:
+    executable: /bin/bash
+  ignore_errors: true

ansible/nym-node/roles/tunnel/tasks/main.yml

@@ -1,11 +1,36 @@
 ---
-- name: Configure tunnel manager
+- name: Ensure nym binaries directory exists
+  file:
+    path: /root/nym-binaries
+    state: directory
+    mode: "0755"
   tags:
+    - tunnel
     - network_tunnel_manager
-  become: true
+    - ntm
+
+- name: Download network tunnel manager
   command:
-    cmd: "/root/nym-binaries/network-tunnel-manager.sh {{ item }}"
+    cmd: "curl -fsSL {{ tunnel_manager_url }} -o /root/nym-binaries/network-tunnel-manager.sh"
+  tags:
+    - tunnel
+    - network_tunnel_manager
+    - ntm
+
+- name: Set network tunnel manager permissions
+  file:
+    path: /root/nym-binaries/network-tunnel-manager.sh
+    mode: "0755"
+  tags:
+    - tunnel
+    - network_tunnel_manager
+    - ntm
+    
+- name: Run network tunnel manager
+  command: "/root/nym-binaries/network-tunnel-manager.sh {{ item }}"
   loop:
     - complete_networking_configuration
-  register: tunnel_mgr
+  tags:
-  failed_when: false
+    - tunnel
+    - network_tunnel_manager
+    - ntm

clients/native/Cargo.toml

@@ -1,11 +1,11 @@
 [package]
 name = "nym-client"
-version = "1.1.72"
-authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
+version = "1.1.78"
+authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
-rust-version = "1.85"
 license.workspace = true
+rust-version = "1.85"
 publish = false
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

clients/native/src/websocket/handler.rs

@@ -472,6 +472,7 @@ impl Handler {
 fn prepare_reconstructed_binary(
     reconstructed_messages: Vec<ReconstructedMessage>,
 ) -> Vec<Result<WsMessage, WsError>> {
+    #[allow(clippy::result_large_err)] // TODO : remove this once tungstenite is updated
     reconstructed_messages
         .into_iter()
         .map(ServerResponse::Received)
@@ -484,6 +485,7 @@ fn prepare_reconstructed_binary(
 fn prepare_reconstructed_text(
     reconstructed_messages: Vec<ReconstructedMessage>,
 ) -> Vec<Result<WsMessage, WsError>> {
+    #[allow(clippy::result_large_err)] // TODO : remove this once tungstenite is updated
     reconstructed_messages
         .into_iter()
         .map(ServerResponse::Received)

clients/native/websocket-requests/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-client-websocket-requests"
+description = "Request and response definitions for Nym client websocket connections"
 version.workspace = true
 authors = ["Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
-description = "Request and response definitions for Nym client websocket connections"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

clients/socks5/Cargo.toml

@@ -1,11 +1,11 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.72"
-authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
+version = "1.1.78"
+authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.85"
 license.workspace = true
+rust-version = "1.85"
 publish = false
 
 [dependencies]

common/async-file-watcher/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-async-file-watcher"
+description = "Simple file watcher that sends a notification whenever there was any change in the watched file"
 version.workspace = true
+authors.workspace = true
 edition.workspace = true
 license.workspace = true
-description = "Simple file watcher that sends a notification whenever there was any change in the watched file"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/authenticator-requests/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-authenticator-requests"
+description = "Crate defining requests and responses for the Nym authenticator client"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
+rust-version.workspace = true
-license.workspace = true
+readme.workspace = true
-description = "Crate defining requests and responses for the Nym authenticator client"
+publish = true
 
 [dependencies]
 base64 = { workspace = true }

common/bandwidth-controller/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-bandwidth-controller"
+description = "Crate for controlling the use of zknym credentials to ensure constant bandwidth availability for NymVPN app"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Crate for controlling the use of zknym credentials to ensure constant bandwidth availability for NymVPN app"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/bandwidth-controller/src/acquire/mod.rs

@@ -34,7 +34,7 @@ where
     let signing_key = ed25519::PrivateKey::new(&mut rng);
     let expiration = expiration.unwrap_or_else(ecash_default_expiration_date);
 
-    let deposit_amount = client.get_required_deposit_amount().await?;
+    let deposit_amount = client.get_default_deposit_amount().await?;
     info!("we'll need to deposit {deposit_amount} to obtain the ticketbook");
     let result = client
         .make_ticketbook_deposit(

common/bandwidth-controller/src/traits.rs

@@ -25,6 +25,8 @@ pub trait BandwidthTicketProvider: Send + Sync {
     ) -> Result<PreparedCredential, BandwidthControllerError>;
 
     async fn get_upgrade_mode_token(&self) -> Result<Option<String>, BandwidthControllerError>;
+
+    async fn close(&self) {}
 }
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -56,6 +58,10 @@ where
             .map_err(|_| BandwidthControllerError::MalformedUpgradeModeToken)?;
         Ok(Some(token))
     }
+
+    async fn close(&self) {
+        self.storage.close().await;
+    }
 }
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -75,4 +81,8 @@ impl<T: BandwidthTicketProvider + ?Sized + Send> BandwidthTicketProvider for Box
     async fn get_upgrade_mode_token(&self) -> Result<Option<String>, BandwidthControllerError> {
         (**self).get_upgrade_mode_token().await
     }
+
+    async fn close(&self) {
+        (**self).close().await;
+    }
 }

common/bin-common/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-bin-common"
-version.workspace = true
 description = "Common code for nym binaries"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 clap = { workspace = true, features = ["derive"], optional = true }
@@ -38,6 +43,7 @@ default = []
 openapi = ["utoipa"]
 output_format = ["serde_json", "dep:clap"]
 bin_info_schema = ["schemars"]
+ip_check = []
 basic_tracing = ["dep:tracing", "dep:tracing-subscriber"]
 otel-otlp = [
     "basic_tracing",

common/bin-common/src/ip_check/mod.rs

@@ -1,29 +1,12 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
-
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
-// use `ip` feature without nightly
+pub const fn is_global_ip(ip: &IpAddr) -> bool {
-// issue: https://github.com/rust-lang/rust/issues/27709
-pub(crate) const fn is_global_ip(ip: &IpAddr) -> bool {
     match ip {
         IpAddr::V4(addr) => is_global_ipv4(addr),
         IpAddr::V6(addr) => is_global_ipv6(addr),
     }
 }
 
-const fn is_shared_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] == 100 && (ip.octets()[1] & 0b1100_0000 == 0b0100_0000)
-}
-
-const fn is_benchmarking_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] == 198 && (ip.octets()[1] & 0xfe) == 18
-}
-
-const fn is_reserved_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] & 240 == 240 && !ip.is_broadcast()
-}
-
 const fn is_global_ipv4(ip: &Ipv4Addr) -> bool {
     !(ip.octets()[0] == 0 // "This network"
         || ip.is_private()
@@ -42,6 +25,18 @@ const fn is_global_ipv4(ip: &Ipv4Addr) -> bool {
         || ip.is_broadcast())
 }
 
+const fn is_shared_ipv4(ip: &Ipv4Addr) -> bool {
+    ip.octets()[0] == 100 && (ip.octets()[1] & 0b1100_0000 == 0b0100_0000)
+}
+
+const fn is_benchmarking_ipv4(ip: &Ipv4Addr) -> bool {
+    ip.octets()[0] == 198 && (ip.octets()[1] & 0xfe) == 18
+}
+
+const fn is_reserved_ipv4(ip: &Ipv4Addr) -> bool {
+    ip.octets()[0] & 240 == 240 && !ip.is_broadcast()
+}
+
 const fn is_documentation_ipv6(ip: &Ipv6Addr) -> bool {
     (ip.segments()[0] == 0x2001) && (ip.segments()[1] == 0xdb8)
 }

common/bin-common/src/lib.rs

@@ -9,3 +9,6 @@ pub mod completions;
 
 #[cfg(feature = "output_format")]
 pub mod output_format;
+
+#[cfg(feature = "ip_check")]
+pub mod ip_check;

common/client-core/Cargo.toml

@@ -1,14 +1,16 @@
 [package]
 name = "nym-client-core"
+description = "Crate containing core client functionality and configs, used by all other Nym client implentations"
 version.workspace = true
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
-edition = "2021"
+edition = "2024"
-rust-version = "1.85"
 license.workspace = true
-description = "Crate containing core client functionality and configs, used by all other Nym client implentations"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-core/config-types/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-client-core-config-types"
+description = "Low level configs and constants used by Nym clients and nodes"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Low level configs and constants used by Nym clients and nodes"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-core/config-types/src/lib.rs

@@ -32,6 +32,7 @@ const DEFAULT_MIN_MIXNODE_PERFORMANCE: u8 = 50;
 const DEFAULT_MIN_GATEWAY_PERFORMANCE: u8 = 50;
 
 const DEFAULT_MAX_STARTUP_GATEWAY_WAITING_PERIOD: Duration = Duration::from_secs(70 * 60); // 70min -> full epoch (1h) + a bit of overhead
+const DEFAULT_MAX_STARTUP_TOPOLOGY_WAITING_PERIOD: Duration = Duration::from_secs(70 * 60); // 70min -> full epoch (1h) + a bit of overhead
 
 // Set this to a high value for now, so that we don't risk sporadic timeouts that might cause
 // bought bandwidth tokens to not have time to be spent; Once we remove the gateway from the
@@ -555,6 +556,11 @@ pub struct Topology {
     #[serde(with = "humantime_serde")]
     pub max_startup_gateway_waiting_period: Duration,
 
+    /// Defines how long the client is going to wait on startup for minimal topology to become online,
+    /// before abandoning the procedure.
+    #[serde(with = "humantime_serde")]
+    pub max_startup_network_waiting_period: Duration,
+
     /// Specifies a minimum performance of a mixnode that is used on route construction.
     /// This setting is only applicable when `NymApi` topology is used.
     pub minimum_mixnode_performance: u8,
@@ -583,6 +589,7 @@ impl Default for Topology {
             topology_resolution_timeout: DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
             disable_refreshing: false,
             max_startup_gateway_waiting_period: DEFAULT_MAX_STARTUP_GATEWAY_WAITING_PERIOD,
+            max_startup_network_waiting_period: DEFAULT_MAX_STARTUP_TOPOLOGY_WAITING_PERIOD,
             minimum_mixnode_performance: DEFAULT_MIN_MIXNODE_PERFORMANCE,
             minimum_gateway_performance: DEFAULT_MIN_GATEWAY_PERFORMANCE,
             use_extended_topology: false,

common/client-core/config-types/src/old/v6.rs

@@ -159,6 +159,7 @@ impl From<ConfigV6> for Config {
                     use_extended_topology: value.debug.topology.use_extended_topology,
                     ignore_egress_epoch_role: value.debug.topology.ignore_egress_epoch_role,
                     ignore_ingress_epoch_role: value.debug.topology.ignore_ingress_epoch_role,
+                    ..Default::default()
                 },
                 reply_surbs: ReplySurbs {
                     minimum_reply_surb_storage_threshold: value

common/client-core/gateways-storage/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-client-core-gateways-storage"
+description = "Functionality for Nym clients to store and retrive Gateway connections"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-rust-version.workspace = true
-description = "Functionality for Nym clients to store and retrive Gateway connections"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-core/src/cli_helpers/client_add_gateway.rs

@@ -160,7 +160,10 @@ where
         )
         .await?;
     } else {
-        info!("registered with new gateway {} (under address {address}), but this will not be our default address", gateway_details.gateway_id);
+        info!(
+            "registered with new gateway {} (under address {address}), but this will not be our default address",
+            gateway_details.gateway_id
+        );
     }
 
     Ok(GatewayInfo {

common/client-core/src/client/base_client/mod.rs

@@ -4,13 +4,13 @@
 use super::mix_traffic::ClientRequestSender;
 use super::received_buffer::ReceivedBufferMessage;
 use super::statistics_control::StatisticsControl;
-use crate::client::base_client::storage::helpers::store_client_keys;
 use crate::client::base_client::storage::MixnetClientStorage;
+use crate::client::base_client::storage::helpers::store_client_keys;
 use crate::client::cover_traffic_stream::LoopCoverTrafficStream;
 use crate::client::event_control::EventControl;
 use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputMessageSender};
-use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
+use crate::client::key_manager::persistence::KeyStore;
 use crate::client::mix_traffic::transceiver::{GatewayReceiver, GatewayTransceiver, RemoteGateway};
 use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController, MixTrafficEvent};
 use crate::client::real_messages_control;
@@ -52,12 +52,12 @@ use nym_sphinx::addressing::nodes::NodeIdentity;
 use nym_sphinx::receiver::{ReconstructedMessage, SphinxMessageReceiver};
 use nym_statistics_common::clients::ClientStatsSender;
 use nym_statistics_common::generate_client_stats_id;
-use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender, LaneQueueLengths};
 use nym_task::ShutdownTracker;
-use nym_topology::provider_trait::TopologyProvider;
+use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender, LaneQueueLengths};
 use nym_topology::HardcodedTopologyProvider;
+use nym_topology::provider_trait::TopologyProvider;
 use nym_validator_client::nym_api::NymApiClientExt;
-use nym_validator_client::{nyxd::contract_traits::DkgQueryClient, UserAgent};
+use nym_validator_client::{UserAgent, nyxd::contract_traits::DkgQueryClient};
 use rand::prelude::SliceRandom;
 use rand::rngs::OsRng;
 use rand::thread_rng;
@@ -220,6 +220,7 @@ pub struct BaseClientBuilder<C, S: MixnetClientStorage> {
     nym_api_urls: Option<Vec<nym_network_defaults::ApiUrl>>,
 
     wait_for_gateway: bool,
+    wait_for_initial_topology: bool,
     custom_topology_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
     custom_gateway_transceiver: Option<Box<dyn GatewayTransceiver + Send>>,
     shutdown: Option<ShutdownTracker>,
@@ -250,6 +251,7 @@ where
             dkg_query_client,
             nym_api_urls: None,
             wait_for_gateway: false,
+            wait_for_initial_topology: false,
             custom_topology_provider: None,
             custom_gateway_transceiver: None,
             shutdown: None,
@@ -305,6 +307,12 @@ where
         self
     }
 
+    #[must_use]
+    pub fn with_wait_for_initial_topology(mut self, wait_for_initial_topology: bool) -> Self {
+        self.wait_for_initial_topology = wait_for_initial_topology;
+        self
+    }
+
     #[must_use]
     pub fn with_topology_provider(
         mut self,
@@ -674,6 +682,7 @@ where
         topology_accessor: TopologyAccessor,
         local_gateway: NodeIdentity,
         wait_for_gateway: bool,
+        wait_for_initial_topology: bool,
         shutdown_tracker: &ShutdownTracker,
     ) -> Result<(), ClientCoreError> {
         let topology_refresher_config =
@@ -694,6 +703,46 @@ where
         tracing::info!("Obtaining initial network topology");
         topology_refresher.try_refresh().await;
 
+        // 1. wait for the minimum topology (if applicable)
+        if topology_refresher
+            .ensure_topology_is_routable()
+            .await
+            .is_err()
+            && wait_for_initial_topology
+        {
+            if let Err(err) = topology_refresher
+                .wait_for_initial_network(topology_config.max_startup_network_waiting_period)
+                .await
+            {
+                tracing::error!(
+                    "the network did not come become online within the specified timeout: {err}"
+                );
+                return Err(err.into());
+            }
+        }
+
+        // 2. wait for our gateway (if applicable)
+        if topology_refresher
+            .ensure_contains_routable_egress(local_gateway)
+            .await
+            .is_err()
+            && wait_for_gateway
+        {
+            if let Err(err) = topology_refresher
+                .wait_for_gateway(
+                    local_gateway,
+                    topology_config.max_startup_gateway_waiting_period,
+                )
+                .await
+            {
+                tracing::error!(
+                    "the gateway did not come back online within the specified timeout: {err}"
+                );
+                return Err(err.into());
+            }
+        }
+
+        // 3. check if the topology is routable (in case we were NOT waiting for it)
         if let Err(err) = topology_refresher.ensure_topology_is_routable().await {
             tracing::error!(
                 "The current network topology seem to be insufficient to route any packets through \
@@ -702,30 +751,15 @@ where
             return Err(ClientCoreError::InsufficientNetworkTopology(err));
         }
 
-        let gateway_wait_timeout = if wait_for_gateway {
+        // 4. check if the gateway exists (in case we were NOT waiting for it)
-            Some(topology_config.max_startup_gateway_waiting_period)
-        } else {
-            None
-        };
-
         if let Err(err) = topology_refresher
             .ensure_contains_routable_egress(local_gateway)
             .await
         {
-            if let Some(waiting_timeout) = gateway_wait_timeout {
+            tracing::error!(
-                if let Err(err) = topology_refresher
+                "the gateway we're supposedly connected to does not exist. We'll not be able to send any packets to ourselves: {err}"
-                    .wait_for_gateway(local_gateway, waiting_timeout)
+            );
-                    .await
+            return Err(err.into());
-                {
-                    tracing::error!(
-                        "the gateway did not come back online within the specified timeout: {err}"
-                    );
-                    return Err(err.into());
-                }
-            } else {
-                tracing::error!("the gateway we're supposedly connected to does not exist. We'll not be able to send any packets to ourselves: {err}");
-                return Err(err.into());
-            }
         }
 
         if !topology_config.disable_refreshing {
@@ -989,6 +1023,16 @@ where
         let encryption_keys = init_res.client_keys.encryption_keypair();
         let identity_keys = init_res.client_keys.identity_keypair();
 
+        let credential_store_for_close = credential_store.clone();
+        let close_credential_token = shutdown_tracker.clone_shutdown_token();
+        shutdown_tracker.try_spawn_named(
+            async move {
+                close_credential_token.cancelled().await;
+                credential_store_for_close.close().await;
+            },
+            "CredentialStorage::close_on_shutdown",
+        );
+
         // the components are started in very specific order. Unless you know what you are doing,
         // do not change that.
         let bandwidth_controller = self
@@ -1024,6 +1068,7 @@ where
             shared_topology_accessor.clone(),
             self_address.gateway(),
             self.wait_for_gateway,
+            self.wait_for_initial_topology,
             &shutdown_tracker.clone(),
         )
         .await?;
@@ -1195,9 +1240,11 @@ mod tests {
         ]);
 
         assert_eq!(network_details.nym_api_urls.as_ref().unwrap().len(), 2);
-        assert!(network_details.nym_api_urls.as_ref().unwrap()[1]
+        assert!(
-            .front_hosts
+            network_details.nym_api_urls.as_ref().unwrap()[1]
-            .is_some());
+                .front_hosts
+                .is_some()
+        );
     }
 
     #[test]
@@ -1210,11 +1257,13 @@ mod tests {
 
         assert_eq!(api_url.url, "https://nym-frontdoor.vercel.app/api/");
         assert_eq!(api_url.front_hosts.as_ref().unwrap().len(), 2);
-        assert!(api_url
+        assert!(
-            .front_hosts
+            api_url
-            .as_ref()
+                .front_hosts
-            .unwrap()
+                .as_ref()
-            .contains(&"vercel.app".to_string()));
+                .unwrap()
+                .contains(&"vercel.app".to_string())
+        );
     }
 
     #[test]

common/client-core/src/client/base_client/non_wasm_helpers.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::{
-    client::replies::reply_storage::{fs_backend, CombinedReplyStorage, ReplyStorageBackend},
+    client::replies::reply_storage::{CombinedReplyStorage, ReplyStorageBackend, fs_backend},
     config,
     config::Config,
     error::ClientCoreError,
@@ -10,12 +10,18 @@ use crate::{
 use nym_bandwidth_controller::BandwidthController;
 use nym_client_core_gateways_storage::OnDiskGatewaysDetails;
 use nym_credential_storage::storage::Storage as CredentialStorage;
-use nym_validator_client::{nyxd, QueryHttpRpcNyxdClient};
+use nym_validator_client::{QueryHttpRpcNyxdClient, nyxd};
-use std::{io, path::Path};
+use std::{io, path::Path, time::Duration};
 use time::OffsetDateTime;
 use tracing::{error, info, trace};
 use url::Url;
 
+/// Maximum rename retry attempts when the database file is temporarily locked.
+const ARCHIVE_MAX_RETRY_ATTEMPTS: u8 = 15;
+
+/// Delay between archive rename retry attempts.
+const ARCHIVE_RETRY_DELAY: Duration = Duration::from_millis(200);
+
 async fn setup_fresh_backend<P: AsRef<Path>>(
     db_path: P,
     surb_config: &config::ReplySurbs,
@@ -24,7 +30,9 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
     let mut storage_backend = match fs_backend::Backend::init(db_path).await {
         Ok(backend) => backend,
         Err(err) => {
-            error!("setup_fresh_backend: Failed to setup persistent storage backend for our reply needs: {err}");
+            error!(
+                "setup_fresh_backend: Failed to setup persistent storage backend for our reply needs: {err}"
+            );
             return Err(ClientCoreError::SurbStorageError {
                 source: Box::new(err),
             });
@@ -72,13 +80,58 @@ async fn archive_corrupted_database<P: AsRef<Path>>(db_path: P) -> io::Result<()
         };
     let renamed = db_path.with_extension(new_extension);
 
-    tokio::fs::rename(db_path, &renamed).await.inspect_err(|_| {
+    // On Windows, sqlx may release its OS file handles asynchronously after
-        error!(
+    // pool.close() returns, briefly keeping the file locked
-            "Failed to rename corrupt database file: {} to {}",
+    // (ERROR_SHARING_VIOLATION, os error 32).  Retry with a short delay to
-            db_path.display(),
+    // give the OS time to flush the remaining handles.
-            renamed.display()
+    for attempt in 0..ARCHIVE_MAX_RETRY_ATTEMPTS {
-        );
+        match tokio::fs::rename(db_path, &renamed).await {
-    })
+            Ok(()) => return Ok(()),
+            Err(e) if is_file_locked_error(&e) && (attempt + 1) < ARCHIVE_MAX_RETRY_ATTEMPTS => {
+                trace!(
+                    "Database file is temporarily locked, retrying archive \
+                     (attempt {}/{}): {e}",
+                    attempt + 1,
+                    ARCHIVE_MAX_RETRY_ATTEMPTS
+                );
+                tokio::time::sleep(ARCHIVE_RETRY_DELAY).await;
+            }
+            Err(e) => {
+                error!(
+                    "Failed to rename corrupt database file: {} to {}",
+                    db_path.display(),
+                    renamed.display()
+                );
+                return Err(e);
+            }
+        }
+    }
+
+    // Reached only when every attempt was blocked by a file lock.
+    error!(
+        "Failed to rename corrupt database file after {} attempts: {} to {}",
+        ARCHIVE_MAX_RETRY_ATTEMPTS,
+        db_path.display(),
+        renamed.display()
+    );
+    Err(io::Error::other(
+        "corrupt database archive blocked by persistent file lock",
+    ))
+}
+
+/// Returns `true` when the IO error indicates a temporary file lock held by another handle
+/// within the same process.  Only meaningful on Windows; always `false` elsewhere.
+fn is_file_locked_error(e: &io::Error) -> bool {
+    #[cfg(windows)]
+    {
+        // ERROR_SHARING_VIOLATION = 32, ERROR_LOCK_VIOLATION = 33
+        matches!(e.raw_os_error(), Some(32) | Some(33))
+    }
+    #[cfg(not(windows))]
+    {
+        let _ = e;
+        false
+    }
 }
 
 pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
@@ -93,7 +146,9 @@ pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
         match fs_backend::Backend::try_load(db_path).await {
             Ok(backend) => Ok(backend),
             Err(err) => {
-                error!("setup_fs_reply_surb_backend: Failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
+                error!(
+                    "setup_fs_reply_surb_backend: Failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future"
+                );
                 archive_corrupted_database(db_path).await?;
                 setup_fresh_backend(db_path, surb_config).await
             }

common/client-core/src/client/base_client/storage/helpers.rs

@@ -1,8 +1,8 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
+use crate::client::key_manager::persistence::KeyStore;
 use crate::error::ClientCoreError;
 use nym_client_core_gateways_storage::{
     ActiveGateway, GatewayPublishedData, GatewayRegistration, GatewaysDetailsStore,

common/client-core/src/client/base_client/storage/migration_helpers.rs

@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 pub mod v1_1_33 {
-    use crate::config::disk_persistence::old_v1_1_33::CommonClientPathsV1_1_33;
     use crate::config::disk_persistence::CommonClientPaths;
+    use crate::config::disk_persistence::old_v1_1_33::CommonClientPathsV1_1_33;
     use crate::config::old_config_v1_1_33::OldGatewayEndpointConfigV1_1_33;
     use crate::error::ClientCoreError;