I hate DKG

* bugfix: update stored epoch share when changing announce address

* chore: remove placeholder legacy mixnode bonding test [mixnet contract]

.github/workflows/ci-contracts.yml

@@ -54,7 +54,7 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: test
-          args: --lib --manifest-path contracts/Cargo.toml
+          args: --lib --manifest-path contracts/Cargo.toml --all-features
 
       - name: Check formatting
         uses: actions-rs/cargo@v1

.github/workflows/push-node-status-agent.yaml

@@ -3,6 +3,11 @@ name: Build and upload Node Status agent container to harbor.nymte.ch
 on:
   workflow_dispatch:
     inputs:
+      gateway_probe_git_ref:
+        type: string
+        default: nym-vpn-core-v1.4.0
+        required: true
+        description: Which gateway probe git ref to build the image with
       release_image:
         description: 'Tag image as a release'
         required: true
@@ -38,6 +43,16 @@ jobs:
           VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
           echo "result=$VERSION" >> $GITHUB_OUTPUT
 
+      - name: cleanup-gateway-probe-ref
+        id: cleanup_gateway_probe_ref
+        run: |
+          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
+          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
+          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+
       - name: Initialize RELEASE_TAG
         run: echo "RELEASE_TAG=" >> $GITHUB_ENV
       
@@ -46,12 +61,24 @@ jobs:
         run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
       
       - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
         
       - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+
+      # - name: Remove existing tag if exists
+      #   run: |
+      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
+      #       git push --delete origin $${{ env.GIT_TAG }}
+      #       git tag -d $${{ env.GIT_TAG }}
+      #     fi
+
+      # - name: Create tag
+      #   run: |
+      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+      #     git push origin $${{ env.GIT_TAG }}
 
       - name: BuildAndPushImageOnHarbor
         run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
           docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

CHANGELOG.md

@@ -4,46 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
-## [2025.19-kase] (2025-10-30)
-
-- update ns agent workflow ([#6154])
-- Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2 ([#6153])
-- bugfix: nym-credential-proxy query params parsing regression ([#6121])
-- bugfix: revert some dep updates introduced in #6043 ([#6120])
-- Skip ipv6 metadata endpoint request ([#6118])
-- update to no longer use 1mb files ([#6117])
-- chore: restore pending dkg contract state migration ([#6116])
-- Revert "Propagate cancel token to mixnet client" ([#6115])
-- Update dirs to 6.0 ([#6109])
-- Propagate cancel token to mixnet client ([#6105])
-- bugfix: retrieve and update ticketbook in the same query ([#6101])
-- bugfix: include network name in the default gateway probe config path ([#6100])
-- Bugfix/incompatibility fixes ([#6099])
-- [DOCs/operators] QUIC deployment script & docs ([#6098])
-- bugfix: testnet manager 02sql migration ([#6096])
-- feat: move gateway probe to monorepo (and update to rust edition 2024) ([#6094])
-- bugfix: use custom topology provider for list of init gateways ([#6092])
-- Max/fix wasm client + build commands ([#6043])
-
-[#6154]: https://github.com/nymtech/nym/pull/6154
-[#6153]: https://github.com/nymtech/nym/pull/6153
-[#6121]: https://github.com/nymtech/nym/pull/6121
-[#6120]: https://github.com/nymtech/nym/pull/6120
-[#6118]: https://github.com/nymtech/nym/pull/6118
-[#6117]: https://github.com/nymtech/nym/pull/6117
-[#6116]: https://github.com/nymtech/nym/pull/6116
-[#6115]: https://github.com/nymtech/nym/pull/6115
-[#6109]: https://github.com/nymtech/nym/pull/6109
-[#6105]: https://github.com/nymtech/nym/pull/6105
-[#6101]: https://github.com/nymtech/nym/pull/6101
-[#6100]: https://github.com/nymtech/nym/pull/6100
-[#6099]: https://github.com/nymtech/nym/pull/6099
-[#6098]: https://github.com/nymtech/nym/pull/6098
-[#6096]: https://github.com/nymtech/nym/pull/6096
-[#6094]: https://github.com/nymtech/nym/pull/6094
-[#6092]: https://github.com/nymtech/nym/pull/6092
-[#6043]: https://github.com/nymtech/nym/pull/6043
-
 ## [2025.18-jarlsberg] (2025-10-14)
 
 - ns-api: add descriptions to dVPN gateway responses ([#6102])

Cargo.lock

@@ -4824,7 +4824,7 @@ dependencies = [
 
 [[package]]
 name = "nym-api"
-version = "1.1.68"
+version = "1.1.67"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5050,7 +5050,7 @@ dependencies = [
 
 [[package]]
 name = "nym-cli"
-version = "1.1.65"
+version = "1.1.64"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -5133,7 +5133,7 @@ dependencies = [
 
 [[package]]
 name = "nym-client"
-version = "1.1.65"
+version = "1.1.64"
 dependencies = [
  "bs58",
  "clap",
@@ -6354,7 +6354,7 @@ dependencies = [
 
 [[package]]
 name = "nym-network-requester"
-version = "1.1.66"
+version = "1.1.65"
 dependencies = [
  "addr",
  "anyhow",
@@ -6404,7 +6404,7 @@ dependencies = [
 
 [[package]]
 name = "nym-node"
-version = "1.20.0"
+version = "1.19.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -6930,7 +6930,7 @@ dependencies = [
 
 [[package]]
 name = "nym-socks5-client"
-version = "1.1.65"
+version = "1.1.64"
 dependencies = [
  "bs58",
  "clap",
@@ -7669,7 +7669,7 @@ dependencies = [
 
 [[package]]
 name = "nymvisor"
-version = "0.1.30"
+version = "0.1.29"
 dependencies = [
  "anyhow",
  "bytes",

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.65"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.65"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/client-core/src/cli_helpers/client_add_gateway.rs

@@ -114,13 +114,12 @@ where
         })?;
         hardcoded_topology.entry_capable_nodes().cloned().collect()
     } else {
-        let mut rng = rand::thread_rng();
         crate::init::helpers::gateways_for_init(
-            &mut rng,
             &core.client.nym_api_urls,
             user_agent,
             core.debug.topology.minimum_gateway_performance,
             core.debug.topology.ignore_ingress_epoch_role,
+            None,
         )
         .await?
     };

common/client-core/src/cli_helpers/client_init.rs

@@ -173,13 +173,12 @@ where
         })?;
         hardcoded_topology.entry_capable_nodes().cloned().collect()
     } else {
-        let mut rng = rand::thread_rng();
         crate::init::helpers::gateways_for_init(
-            &mut rng,
             &core.client.nym_api_urls,
             user_agent,
             core.debug.topology.minimum_gateway_performance,
             core.debug.topology.ignore_ingress_epoch_role,
+            None,
         )
         .await?
     };

common/client-core/src/client/base_client/mod.rs

@@ -783,7 +783,7 @@ where
             event_tx,
         );
 
-        let mix_tx = mix_traffic_controller.mix_tx();
+        let mix_tx = mix_traffic_controller.mix_rx();
         let client_tx = mix_traffic_controller.client_tx();
 
         shutdown_tracker.try_spawn_named(
@@ -940,8 +940,8 @@ where
         // Create a shutdown tracker for this client - either as a child of provided tracker
         // or get one from the registry
         let shutdown_tracker = match self.shutdown {
-            Some(parent_tracker) => parent_tracker.clone(),
-            None => nym_task::create_sdk_shutdown_tracker()?,
+            Some(parent_tracker) => parent_tracker.child_tracker(),
+            None => nym_task::get_sdk_shutdown_tracker()?,
         };
 
         Self::start_event_control(self.event_tx, event_receiver, &shutdown_tracker);
@@ -976,7 +976,7 @@ where
             self.user_agent.clone(),
             generate_client_stats_id(*self_address.identity()),
             input_sender.clone(),
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
         );
 
         // needs to be started as the first thing to block if required waiting for the gateway
@@ -986,7 +986,7 @@ where
             shared_topology_accessor.clone(),
             self_address.gateway(),
             self.wait_for_gateway,
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
         )
         .await?;
 
@@ -1006,7 +1006,7 @@ where
             stats_reporter.clone(),
             #[cfg(unix)]
             self.connection_fd_callback,
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
         )
         .await?;
         let gateway_ws_fd = gateway_transceiver.ws_fd();
@@ -1014,7 +1014,7 @@ where
         let reply_storage = Self::setup_persistent_reply_storage(
             reply_storage_backend,
             key_rotation_config,
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
         )
         .await?;
 
@@ -1025,7 +1025,7 @@ where
             reply_storage.key_storage(),
             reply_controller_sender.clone(),
             stats_reporter.clone(),
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
         );
 
         // The message_sender is the transmitter for any component generating sphinx packets
@@ -1035,7 +1035,7 @@ where
 
         let (message_sender, client_request_sender) = Self::start_mix_traffic_controller(
             gateway_transceiver,
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
             EventSender(event_sender),
         );
 
@@ -1066,7 +1066,7 @@ where
             shared_lane_queue_lengths.clone(),
             client_connection_rx,
             stats_reporter.clone(),
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
         );
 
         if !self
@@ -1082,7 +1082,7 @@ where
                 shared_topology_accessor.clone(),
                 message_sender,
                 stats_reporter.clone(),
-                &shutdown_tracker.clone(),
+                &shutdown_tracker.child_tracker(),
             );
         }
 

common/client-core/src/client/cover_traffic_stream.rs

@@ -205,7 +205,7 @@ impl LoopCoverTrafficStream<OsRng> {
                 TrySendError::Full(_) => {
                     // This isn't a problem, if the channel is full means we're already sending the
                     // max amount of messages downstream can handle.
-                    tracing::trace!("Failed to send cover message - channel full");
+                    tracing::debug!("Failed to send cover message - channel full");
                 }
                 TrySendError::Closed(_) => {
                     tracing::warn!("Failed to send cover message - channel closed");

common/client-core/src/client/mix_traffic/mod.rs

@@ -20,10 +20,7 @@ pub mod transceiver;
 
 // We remind ourselves that 32 x 32kb = 1024kb, a reasonable size for a network buffer.
 pub const MIX_MESSAGE_RECEIVER_BUFFER_SIZE: usize = 32;
-
-/// Reduced from 100 to 20 to fail fast (~1-2 seconds instead of ~6 seconds).
-/// If we can't send 20 packets in a row, the gateway is unreachable.
-const MAX_FAILURE_COUNT: usize = 20;
+const MAX_FAILURE_COUNT: usize = 100;
 
 // that's also disgusting.
 pub struct Empty;
@@ -87,7 +84,7 @@ impl MixTrafficController {
         self.client_tx.clone()
     }
 
-    pub fn mix_tx(&self) -> BatchMixMessageSender {
+    pub fn mix_rx(&self) -> BatchMixMessageSender {
         self.mix_tx.clone()
     }
 
@@ -159,11 +156,6 @@ impl MixTrafficController {
                             // Do we need to handle the embedded mixnet client case
                             // separately?
                             self.event_tx.send(MixnetClientEvent::Traffic(MixTrafficEvent::FailedSendingSphinx));
-                            // IMO it shouldn't be signalled from there but it is how it is
-                            // TODO : report the failure upwards and shutdown from upwards
-                            // Gateway is dead, we have to shut down currently
-                            error!("Signalling shutdown from the MixTrafficController");
-                            self.shutdown_token.cancel();
                             break;
                         }
                     }

common/client-core/src/client/real_messages_control/real_traffic_stream.rs

@@ -298,8 +298,6 @@ where
                         "failed to send mixnet packet due to closed channel (outside of shutdown!)"
                     );
                 }
-                // Early return to avoid further processing when channel is closed
-                return;
             }
             Ok(_) => {
                 let event = if fragment_id.is_some() {

common/client-core/src/init/helpers.rs

@@ -45,6 +45,7 @@ type WsConn = JSWebsocket;
 
 const CONCURRENT_GATEWAYS_MEASURED: usize = 20;
 const MEASUREMENTS: usize = 3;
+const DEFAULT_NYM_API_RETRIES: usize = 3;
 
 #[cfg(not(target_arch = "wasm32"))]
 const CONN_TIMEOUT: Duration = Duration::from_millis(1500);
@@ -132,25 +133,27 @@ impl<'a, G: ConnectableGateway> GatewayWithLatency<'a, G> {
     }
 }
 
-pub async fn gateways_for_init<R: Rng>(
-    rng: &mut R,
+pub async fn gateways_for_init(
     nym_apis: &[Url],
     user_agent: Option<UserAgent>,
     minimum_performance: u8,
     ignore_epoch_roles: bool,
+    retry_count: Option<usize>,
 ) -> Result<Vec<RoutingNode>, ClientCoreError> {
-    let nym_api = nym_apis
-        .choose(rng)
-        .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
+    // Build client with ALL URLs for fallback support
+    let nym_api_urls: Vec<nym_http_api_client::Url> = nym_apis
+        .iter()
+        .map(|url| nym_http_api_client::Url::from(url.clone()))
+        .collect();
 
-    // Use the unified HTTP client directly with optional user agent
-    let mut builder = nym_http_api_client::Client::builder(nym_api.clone())
-        .map_err(|e| {
-            ClientCoreError::ValidatorClientError(nym_validator_client::ValidatorClientError::from(
-                e,
-            ))
-        })?
-        .with_bincode(); // Use bincode for better performance
+    if nym_api_urls.is_empty() {
+        return Err(ClientCoreError::ListOfNymApisIsEmpty);
+    }
+
+    let retry_count = retry_count.unwrap_or(DEFAULT_NYM_API_RETRIES);
+    let mut builder = nym_http_api_client::ClientBuilder::new_with_urls(nym_api_urls.clone())?
+        .with_retries(retry_count)
+        .with_bincode();
 
     if let Some(user_agent) = user_agent {
         builder = builder.with_user_agent(user_agent);
@@ -160,7 +163,7 @@ pub async fn gateways_for_init<R: Rng>(
         ClientCoreError::ValidatorClientError(nym_validator_client::ValidatorClientError::from(e))
     })?;
 
-    tracing::debug!("Fetching list of gateways from: {nym_api}");
+    tracing::debug!("Fetching list of gateways from: {:?}", nym_api_urls);
 
     // Use our helper to handle pagination
     let gateways = get_all_basic_entry_nodes_with_metadata(&client, true)
@@ -172,17 +175,15 @@ pub async fn gateways_for_init<R: Rng>(
 
     // filter out gateways below minimum performance and ones that could operate as a mixnode
     // (we don't want instability)
-    let valid_gateways = gateways
+    let valid_gateways: Vec<RoutingNode> = gateways
         .iter()
         .filter(|g| ignore_epoch_roles || !g.supported_roles.mixnode)
         .filter(|g| g.performance.round_to_integer() >= minimum_performance)
         .filter_map(|gateway| gateway.try_into().ok())
-        .collect::<Vec<_>>();
-    tracing::debug!("After checking validity: {}", valid_gateways.len());
-    tracing::trace!("Valid gateways: {valid_gateways:#?}");
+        .collect();
 
     tracing::info!(
-        "and {} after validity and performance filtering",
+        "Found {} valid gateways after filtering",
         valid_gateways.len()
     );
 
@@ -345,13 +346,20 @@ pub(super) fn get_specified_gateway(
     must_use_tls: bool,
 ) -> Result<RoutingNode, ClientCoreError> {
     tracing::debug!("Requesting specified gateway: {gateway_identity}");
+
     let user_gateway = ed25519::PublicKey::from_base58_string(gateway_identity)
         .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;
 
     let gateway = gateways
         .iter()
         .find(|gateway| gateway.identity_key == user_gateway)
-        .ok_or_else(|| ClientCoreError::NoGatewayWithId(gateway_identity.to_string()))?;
+        .ok_or_else(|| {
+            tracing::debug!(
+                "Gateway {gateway_identity} not found in {} available gateways",
+                gateways.len()
+            );
+            ClientCoreError::NoGatewayWithId(gateway_identity.to_string())
+        })?;
 
     let Some(entry_details) = gateway.entry.as_ref() else {
         return Err(ClientCoreError::UnsupportedEntry {
@@ -414,3 +422,52 @@ pub(super) async fn register_with_gateway(
         authenticated_ephemeral_client: gateway_client,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use url::Url;
+
+    #[test]
+    fn test_single_url_builds_without_retries() {
+        let urls = [Url::parse("https://api.nym.com").unwrap()];
+
+        let nym_api_urls: Vec<nym_http_api_client::Url> = urls
+            .iter()
+            .map(|url| nym_http_api_client::Url::from(url.clone()))
+            .collect();
+
+        assert_eq!(nym_api_urls.len(), 1, "Should have exactly one URL");
+    }
+
+    #[test]
+    fn test_multiple_urls_prepared_for_retries() {
+        let urls = vec![
+            Url::parse("https://api1.nym.com").unwrap(),
+            Url::parse("https://api2.nym.com").unwrap(),
+            Url::parse("https://api3.nym.com").unwrap(),
+        ];
+
+        let nym_api_urls: Vec<nym_http_api_client::Url> = urls
+            .iter()
+            .map(|url| nym_http_api_client::Url::from(url.clone()))
+            .collect();
+
+        assert_eq!(nym_api_urls.len(), 3, "Should have all three URLs");
+        assert!(
+            nym_api_urls.len() > 1,
+            "Multiple URLs trigger retry behavior"
+        );
+    }
+
+    #[test]
+    fn test_empty_url_list_is_detected() {
+        let urls: Vec<Url> = vec![];
+
+        let nym_api_urls: Vec<nym_http_api_client::Url> = urls
+            .iter()
+            .map(|url| nym_http_api_client::Url::from(url.clone()))
+            .collect();
+
+        assert!(nym_api_urls.is_empty(), "Empty list should remain empty");
+    }
+}

common/cosmwasm-smart-contracts/coconut-dkg/src/msg.rs

@@ -84,6 +84,10 @@ pub enum ExecuteMsg {
     UpdateAnnounceAddress {
         new_address: String,
     },
+
+    FixOldShare {
+        old_owner: String,
+    },
 }
 
 #[cw_serde]

common/http-api-client/src/lib.rs

@@ -296,6 +296,9 @@ impl std::error::Error for ReqwestErrorWrapper {}
 #[derive(Debug, Error)]
 #[allow(missing_docs)]
 pub enum HttpClientError {
+    #[error("did not provide any valid client URLs")]
+    NoUrlsProvided,
+
     #[error("failed to construct inner reqwest client: {source}")]
     ReqwestBuildError {
         #[source]
@@ -582,24 +585,29 @@ impl ClientBuilder {
             Self::new(alt)
         } else {
             let url = url.to_url()?;
-            Ok(Self::new_with_urls(vec![url]))
+            Self::new_with_urls(vec![url])
         }
     }
 
     /// Create a client builder from network details with sensible defaults
     #[cfg(feature = "network-defaults")]
+    // deprecating function since it's not clear from its signature whether the client
+    // would be constructed using `nym_api_urls` or `nym_vpn_api_urls`
+    #[deprecated(note = "use explicit Self::new_with_fronted_urls instead")]
     pub fn from_network(
         network: &nym_network_defaults::NymNetworkDetails,
     ) -> Result<Self, HttpClientError> {
-        let urls = network
-            .nym_api_urls
-            .as_ref()
-            .ok_or_else(|| {
-                HttpClientError::GenericRequestFailure(
-                    "No API URLs configured in network details".to_string(),
-                )
-            })?
-            .iter()
+        let urls = network.nym_api_urls.as_ref().cloned().unwrap_or_default();
+        Self::new_with_fronted_urls(urls.clone())
+    }
+
+    /// Create a client builder using the provided set of domain-fronted URLs
+    #[cfg(feature = "network-defaults")]
+    pub fn new_with_fronted_urls(
+        urls: Vec<nym_network_defaults::ApiUrl>,
+    ) -> Result<Self, HttpClientError> {
+        let urls = urls
+            .into_iter()
             .map(|api_url| {
                 // Convert ApiUrl to our Url type with fronting support
                 let mut url = Url::parse(&api_url.url)?;
@@ -611,15 +619,19 @@ impl ClientBuilder {
                         .iter()
                         .map(|host| format!("https://{}", host))
                         .collect();
-                    url = Url::new(api_url.url.clone(), Some(fronts))
-                        .map_err(|e| HttpClientError::GenericRequestFailure(e.to_string()))?;
+                    url = Url::new(api_url.url.clone(), Some(fronts)).map_err(|source| {
+                        HttpClientError::MalformedUrl {
+                            raw: api_url.url.clone(),
+                            source,
+                        }
+                    })?;
                 }
 
                 Ok(url)
             })
             .collect::<Result<Vec<_>, HttpClientError>>()?;
 
-        let mut builder = Self::new_with_urls(urls);
+        let mut builder = Self::new_with_urls(urls)?;
 
         // Enable domain fronting by default (on retry)
         #[cfg(feature = "tunneling")]
@@ -631,7 +643,11 @@ impl ClientBuilder {
     }
 
     /// Constructs a new http `ClientBuilder` from a valid url.
-    pub fn new_with_urls(urls: Vec<Url>) -> Self {
+    pub fn new_with_urls(urls: Vec<Url>) -> Result<Self, HttpClientError> {
+        if urls.is_empty() {
+            return Err(HttpClientError::NoUrlsProvided);
+        }
+
         let urls = Self::check_urls(urls);
 
         #[cfg(target_arch = "wasm32")]
@@ -640,7 +656,7 @@ impl ClientBuilder {
         #[cfg(not(target_arch = "wasm32"))]
         let reqwest_client_builder = default_builder();
 
-        ClientBuilder {
+        Ok(ClientBuilder {
             urls,
             timeout: None,
             custom_user_agent: false,
@@ -651,7 +667,7 @@ impl ClientBuilder {
 
             retry_limit: 0,
             serialization: SerializationFormat::Json,
-        }
+        })
     }
 
     /// Add an additional URL to the set usable by this constructed `Client`

common/http-api-client/src/registry.rs

@@ -21,6 +21,10 @@ inventory::collect!(ConfigRecord);
 /// Returns the default builder with all registered configurations applied.
 pub fn default_builder() -> ReqwestClientBuilder {
     let mut b = ReqwestClientBuilder::new();
+
+    #[cfg(feature = "debug-inventory")]
+    let mut test_client = ReqwestClientBuilder::new();
+
     let mut records: Vec<&'static ConfigRecord> =
         inventory::iter::<ConfigRecord>.into_iter().collect();
     records.sort_by_key(|r| r.priority); // lower runs first
@@ -35,6 +39,10 @@ pub fn default_builder() -> ReqwestClientBuilder {
 
     for r in records {
         b = (r.apply)(b);
+        #[cfg(feature = "debug-inventory")]
+        {
+            test_client = (r.apply)(test_client);
+        }
     }
 
     #[cfg(feature = "debug-inventory")]
@@ -47,7 +55,7 @@ pub fn default_builder() -> ReqwestClientBuilder {
         eprintln!("[HTTP-INVENTORY] Building test client to verify configuration...");
 
         // Try to build a client to see if it works
-        match b.try_clone().unwrap().build() {
+        match test_client.build() {
             Ok(client) => {
                 eprintln!("[HTTP-INVENTORY] ✓ Client built successfully");
                 eprintln!("[HTTP-INVENTORY] Client debug info: {:#?}", client);

common/http-api-client/src/tests.rs

@@ -93,7 +93,7 @@ async fn api_client_retry() -> Result<(), Box<dyn std::error::Error>> {
     let client = ClientBuilder::new_with_urls(vec![
         "http://broken.nym.badurl".parse()?,
         "http://example.com/".parse()?,
-    ])
+    ])?
     .with_retries(3)
     .build()?;
 

common/http-api-client/src/url.rs

@@ -183,6 +183,11 @@ impl Url {
         })
     }
 
+    /// Returns the underlying URL
+    pub fn inner_url(&self) -> &url::Url {
+        &self.url
+    }
+
     /// Returns true if the URL has a front domain set
     pub fn has_front(&self) -> bool {
         if let Some(fronts) = &self.fronts {
@@ -201,6 +206,11 @@ impl Url {
             .and_then(|url| url.host_str())
     }
 
+    /// Returns the fronts
+    pub fn fronts(&self) -> Option<&[url::Url]> {
+        self.fronts.as_deref()
+    }
+
     /// Return the string representation of the host (domain or IP address) for this URL, if any.
     pub fn host_str(&self) -> Option<&str> {
         self.url.host_str()

common/task/src/lib.rs

@@ -24,6 +24,6 @@ pub use crate::runtime_registry::RegistryAccessError;
 
 /// Get or create a ShutdownTracker for SDK use.
 /// This provides automatic task management without requiring manual setup.
-pub fn create_sdk_shutdown_tracker() -> Result<ShutdownTracker, RegistryAccessError> {
-    Ok(runtime_registry::RuntimeRegistry::create_sdk()?.shutdown_tracker_owned())
+pub fn get_sdk_shutdown_tracker() -> Result<ShutdownTracker, RegistryAccessError> {
+    Ok(runtime_registry::RuntimeRegistry::get_or_create_sdk()?.shutdown_tracker_owned())
 }

common/task/src/runtime_registry.rs

@@ -19,45 +19,30 @@ pub(crate) struct RuntimeRegistry {
 pub enum RegistryAccessError {
     #[error("the runtime registry is poisoned")]
     Poisoned,
-
-    #[error("The SDK ShutdownManager already exists")]
-    ExistingShutdownManager,
-
-    #[error("No existing SDK ShutdownManager")]
-    MissingShutdownManager,
 }
 
 impl RuntimeRegistry {
-    /// Create a ShutdownManager for SDK use.
+    /// Get or create a ShutdownManager for SDK use.
     /// This manager doesn't listen to OS signals, making it suitable for library use.
-    /// This function overwrite any existing manager!
-    pub(crate) fn create_sdk() -> Result<Arc<ShutdownManager>, RegistryAccessError> {
-        let mut guard = REGISTRY
-            .sdk_manager
-            .write()
-            .map_err(|_| RegistryAccessError::Poisoned)?;
-
-        Ok(guard
-            .insert(Arc::new(
-                ShutdownManager::new_without_signals().with_cancel_on_panic(),
-            ))
-            .clone())
-    }
-
-    /// Get the  ShutdownManager for SDK use.
-    /// This manager doesn't listen to OS signals, making it suitable for library use.
-    /// Not yet used, but maybe in the future
-    #[allow(dead_code)]
-    pub(crate) fn get_sdk() -> Result<Arc<ShutdownManager>, RegistryAccessError> {
+    pub(crate) fn get_or_create_sdk() -> Result<Arc<ShutdownManager>, RegistryAccessError> {
         let guard = REGISTRY
             .sdk_manager
             .read()
             .map_err(|_| RegistryAccessError::Poisoned)?;
         if let Some(manager) = guard.as_ref() {
-            Ok(manager.clone())
-        } else {
-            Err(RegistryAccessError::MissingShutdownManager)
+            return Ok(manager.clone());
         }
+        drop(guard);
+
+        let mut guard = REGISTRY
+            .sdk_manager
+            .write()
+            .map_err(|_| RegistryAccessError::Poisoned)?;
+        Ok(guard
+            .get_or_insert_with(|| {
+                Arc::new(ShutdownManager::new_without_signals().with_cancel_on_panic())
+            })
+            .clone())
     }
 
     /// Check if an SDK manager has been created.
@@ -100,13 +85,10 @@ mod tests {
 
         assert!(!RuntimeRegistry::has_sdk_manager().unwrap());
 
-        // Error if nothing was created
-        assert!(RuntimeRegistry::get_sdk().is_err());
-
-        let manager1 = RuntimeRegistry::create_sdk().unwrap();
+        let manager1 = RuntimeRegistry::get_or_create_sdk().unwrap();
         assert!(RuntimeRegistry::has_sdk_manager().unwrap());
 
-        let manager2 = RuntimeRegistry::get_sdk().unwrap();
+        let manager2 = RuntimeRegistry::get_or_create_sdk().unwrap();
         // Should return the same instance
         assert!(Arc::ptr_eq(&manager1, &manager2));
 

common/wasm/client-core/src/helpers.rs

@@ -160,13 +160,12 @@ pub async fn setup_gateway_from_api(
     minimum_performance: u8,
     ignore_epoch_roles: bool,
 ) -> Result<InitialisationResult, WasmCoreError> {
-    let mut rng = thread_rng();
     let gateways = gateways_for_init(
-        &mut rng,
         nym_apis,
         None,
         minimum_performance,
         ignore_epoch_roles,
+        None,
     )
     .await?;
     setup_gateway_wasm(client_store, force_tls, chosen_gateway, gateways).await
@@ -178,13 +177,12 @@ pub async fn current_gateways_wasm(
     minimum_performance: u8,
     ignore_epoch_roles: bool,
 ) -> Result<Vec<RoutingNode>, ClientCoreError> {
-    let mut rng = thread_rng();
     gateways_for_init(
-        &mut rng,
         nym_apis,
         user_agent,
         minimum_performance,
         ignore_epoch_roles,
+        None,
     )
     .await
 }

contracts/coconut-dkg/src/contract.rs

@@ -6,6 +6,7 @@ use crate::dealers::queries::{
     query_epoch_dealers_addresses_paged, query_epoch_dealers_paged,
     query_registered_dealer_details,
 };
+use crate::dealers::storage::{ensure_dealer, EPOCH_DEALERS_MAP};
 use crate::dealers::transactions::{
     try_add_dealer, try_transfer_ownership, try_update_announce_address,
 };
@@ -18,14 +19,16 @@ use crate::epoch_state::queries::{
     query_can_advance_state, query_current_epoch, query_current_epoch_threshold,
     query_epoch_at_height, query_epoch_threshold,
 };
-use crate::epoch_state::storage::save_epoch;
+use crate::epoch_state::storage::{load_current_epoch, save_epoch};
 use crate::epoch_state::transactions::{
     try_advance_epoch_state, try_initiate_dkg, try_trigger_reset, try_trigger_resharing,
 };
+use crate::epoch_state::utils::check_epoch_state;
 use crate::error::ContractError;
 use crate::state::queries::query_state;
 use crate::state::storage::{DKG_ADMIN, MULTISIG, STATE};
 use crate::verification_key_shares::queries::{query_vk_share, query_vk_shares_paged};
+use crate::verification_key_shares::storage::vk_shares;
 use crate::verification_key_shares::transactions::try_commit_verification_key_share;
 use crate::verification_key_shares::transactions::try_verify_verification_key_share;
 use cosmwasm_std::{
@@ -134,6 +137,36 @@ pub fn execute(
         ExecuteMsg::UpdateAnnounceAddress { new_address } => {
             try_update_announce_address(deps, info, new_address)
         }
+        ExecuteMsg::FixOldShare { old_owner } => {
+            let old_owner = deps.api.addr_validate(&old_owner)?;
+
+            let epoch = load_current_epoch(deps.storage)?;
+
+            // make sure we're not mid-exchange
+            check_epoch_state(deps.storage, EpochState::InProgress)?;
+
+            // make sure the requester is actually a dealer for this epoch
+            ensure_dealer(deps.storage, &info.sender, epoch.epoch_id)?;
+
+            for epoch_id in 0..=epoch.epoch_id {
+                if let Some(mut vk_share) =
+                    vk_shares().may_load(deps.storage, (&old_owner, epoch_id))?
+                {
+                    vk_share.owner = info.sender.clone();
+                    vk_shares().remove(deps.storage, (&old_owner, epoch_id))?;
+                    vk_shares().save(deps.storage, (&info.sender, epoch_id), &vk_share)?;
+                }
+
+                if let Some(mut vk_share) =
+                    vk_shares().may_load(deps.storage, (&info.sender, epoch_id))?
+                {
+                    vk_share.owner = info.sender.clone();
+                    vk_shares().save(deps.storage, (&info.sender, epoch_id), &vk_share)?;
+                }
+            }
+
+            Ok(Response::new())
+        }
     }
 }
 
@@ -259,7 +292,7 @@ pub fn migrate(deps: DepsMut<'_>, env: Env, _msg: MigrateMsg) -> Result<Response
     set_build_information!(deps.storage)?;
     cw2::ensure_from_older_version(deps.storage, CONTRACT_NAME, CONTRACT_VERSION)?;
 
-    crate::queued_migrations::introduce_historical_epochs(deps, env)?;
+    // crate::queued_migrations::introduce_historical_epochs(deps, env)?;
 
     Ok(Response::new())
 }

contracts/coconut-dkg/src/dealers/transactions.rs

@@ -9,6 +9,7 @@ use crate::epoch_state::storage::{load_current_epoch, save_epoch};
 use crate::epoch_state::utils::check_epoch_state;
 use crate::error::ContractError;
 use crate::state::storage::STATE;
+use crate::verification_key_shares::storage::vk_shares;
 use crate::Dealer;
 use cosmwasm_std::{Deps, DepsMut, Env, Event, MessageInfo, Response};
 use nym_coconut_dkg_common::dealer::{DealerRegistrationDetails, OwnershipTransfer};
@@ -109,7 +110,7 @@ pub fn try_transfer_ownership(
     DEALERS_INDICES.save(deps.storage, &transfer_to, &current_index)?;
     DEALERS_INDICES.remove(deps.storage, &info.sender);
 
-    // update registration detail for every epoch the current dealer has participated in the protocol
+    // update registration detail and share information for every epoch the current dealer has participated in the protocol
     // ideally, we'd have only updated the current epoch, but the way the contract is constructed
     // forbids that otherwise we'd have introduced inconsistency
     for epoch_id in 0..=epoch.epoch_id {
@@ -117,6 +118,11 @@ pub fn try_transfer_ownership(
             EPOCH_DEALERS_MAP.remove(deps.storage, (epoch_id, &info.sender));
             EPOCH_DEALERS_MAP.save(deps.storage, (epoch_id, &transfer_to), &details)?;
         }
+        if let Some(mut vk_share) = vk_shares().may_load(deps.storage, (&info.sender, epoch_id))? {
+            vk_shares().remove(deps.storage, (&info.sender, epoch_id))?;
+            vk_share.owner = transfer_to.clone();
+            vk_shares().save(deps.storage, (&transfer_to, epoch_id), &vk_share)?;
+        }
     }
 
     let Some(transaction_info) = env.transaction else {
@@ -161,6 +167,14 @@ pub fn try_update_announce_address(
     details.announce_address = new_address.clone();
     EPOCH_DEALERS_MAP.save(deps.storage, (epoch.epoch_id, &info.sender), &details)?;
 
+    let mut contract_share = vk_shares().load(deps.storage, (&info.sender, epoch.epoch_id))?;
+    contract_share.announce_address = new_address.clone();
+    vk_shares().save(
+        deps.storage,
+        (&info.sender, epoch.epoch_id),
+        &contract_share,
+    )?;
+
     Ok(Response::new().add_event(
         Event::new("dkg-announce-address-update")
             .add_attribute("dealer", info.sender)
@@ -228,9 +242,14 @@ pub(crate) mod tests {
 #[cfg(feature = "testable-dkg-contract")]
 mod tests_with_mock {
     use super::*;
-    use crate::testable_dkg_contract::{init_contract_tester, DkgContractTesterExt};
+    use crate::testable_dkg_contract::{
+        init_contract_tester, init_contract_tester_with_group_members, DkgContractTesterExt,
+    };
+    use anyhow::Context;
     use cosmwasm_std::testing::message_info;
-    use nym_contracts_common_testing::ContractOpts;
+    use nym_coconut_dkg_common::msg::QueryMsg;
+    use nym_coconut_dkg_common::verification_key::PagedVKSharesResponse;
+    use nym_contracts_common_testing::{ChainOpts, ContractOpts};
 
     #[test]
     fn transferring_ownership() -> anyhow::Result<()> {
@@ -248,6 +267,7 @@ mod tests_with_mock {
         contract.run_initial_dummy_dkg();
         let old_index = DEALERS_INDICES.load(&contract, &group_member)?;
         let old_details = EPOCH_DEALERS_MAP.load(&contract, (0, &group_member))?;
+        let old_share = vk_shares().load(&contract, (&group_member, 0))?;
 
         let not_group_member = contract.addr_make("not_group_member");
         let (deps, env) = contract.deps_mut_env();
@@ -277,13 +297,20 @@ mod tests_with_mock {
         assert!(EPOCH_DEALERS_MAP
             .may_load(&contract, (0, &group_member))?
             .is_none());
+        assert!(vk_shares()
+            .may_load(&contract, (&group_member, 0))?
+            .is_none());
 
         let new_index = DEALERS_INDICES.load(&contract, &new_group_member)?;
         let new_details = EPOCH_DEALERS_MAP.load(&contract, (0, &new_group_member))?;
+        let new_share = vk_shares().load(&contract, (&new_group_member, 0))?;
 
         // the underlying info hasn't changed
         assert_eq!(old_index, new_index);
         assert_eq!(old_details, new_details);
+        assert_ne!(old_share, new_share);
+        assert_eq!(old_share.owner, group_member);
+        assert_eq!(new_share.owner, new_group_member);
 
         assert_eq!(
             OWNERSHIP_TRANSFER_LOG.load(
@@ -436,9 +463,91 @@ mod tests_with_mock {
         assert_eq!(old_details1, new_details1);
         assert_eq!(old_details2, new_details2);
 
-        // most  recent entry is updated
+        // most recent entry is updated
         assert_eq!(new_details3.announce_address, new_address);
 
         Ok(())
     }
+
+    #[test]
+    fn updating_announce_address_updates_vk_shares() -> anyhow::Result<()> {
+        let mut contract = init_contract_tester_with_group_members(3);
+        let group_member = contract.random_group_member();
+
+        contract.run_initial_dummy_dkg(); // => epoch 0
+        contract.run_reset_dkg(); // => epoch 1
+
+        // LEAVE DKG MEMBERSHIP
+        contract.remove_group_member(group_member.clone());
+        contract.run_reset_dkg(); // => epoch 2
+
+        // COME BACK
+        contract.add_group_member(group_member.clone());
+        contract.run_reset_dkg(); // => epoch 3
+
+        let old_address = EPOCH_DEALERS_MAP
+            .load(&contract, (3, &group_member))?
+            .announce_address;
+
+        let old_share0 = vk_shares().load(&contract, (&group_member, 0))?;
+        let old_share1 = vk_shares().load(&contract, (&group_member, 1))?;
+        let old_share2 = vk_shares().may_load(&contract, (&group_member, 2))?;
+        assert!(old_share2.is_none());
+        let old_share3 = vk_shares().may_load(&contract, (&group_member, 3))?;
+        assert!(old_share3.is_some());
+
+        let new_address = "https://new-address.com".to_string();
+        try_update_announce_address(
+            contract.deps_mut(),
+            message_info(&group_member, &[]),
+            new_address.clone(),
+        )?;
+
+        let new_share0 = vk_shares().load(&contract, (&group_member, 0))?;
+        let new_share1 = vk_shares().load(&contract, (&group_member, 1))?;
+        let new_share2 = vk_shares().may_load(&contract, (&group_member, 2))?;
+        assert!(new_share2.is_none());
+        let new_share3 = vk_shares().load(&contract, (&group_member, 3))?;
+
+        // old epoch data is unchanged
+        assert_eq!(old_share0, new_share0);
+        assert_eq!(old_share1, new_share1);
+        assert_eq!(old_share2, new_share2);
+
+        // most recent entry is updated
+        assert_eq!(new_share3.announce_address, new_address);
+
+        // finally an integration check against query endpoint
+        let epoch0_shares: PagedVKSharesResponse =
+            contract.query(&QueryMsg::GetVerificationKeys {
+                epoch_id: 0,
+                limit: None,
+                start_after: None,
+            })?;
+        assert_eq!(epoch0_shares.shares.len(), 3);
+
+        let member_share = epoch0_shares
+            .shares
+            .iter()
+            .find(|s| s.owner == group_member)
+            .context("failed to find member's share")?;
+        assert_eq!(member_share.announce_address, old_address);
+
+        let epoch0_shares: PagedVKSharesResponse =
+            contract.query(&QueryMsg::GetVerificationKeys {
+                epoch_id: 3,
+                limit: None,
+                start_after: None,
+            })?;
+        assert_eq!(epoch0_shares.shares.len(), 3);
+
+        let member_share = epoch0_shares
+            .shares
+            .iter()
+            .find(|s| s.owner == group_member)
+            .context("failed to find member's share")?;
+        assert_eq!(member_share.announce_address, new_address);
+
+        Ok(())
+    }
 }

contracts/coconut-dkg/src/testable_dkg_contract/mod.rs

@@ -62,12 +62,18 @@ impl TestableNymContract for DkgContract {
     where
         Self: Sized,
     {
-        init_contract_tester_with_group_members(DEFAULT_GROUP_MEMBERS)
+        init_contract_tester()
     }
 }
 
 pub fn init_contract_tester() -> ContractTester<DkgContract> {
-    DkgContract::init().with_common_storage_key(CommonStorageKeys::Admin, "dkg-admin")
+    init_contract_tester_with_group_members(DEFAULT_GROUP_MEMBERS)
+}
+
+pub fn init_contract_tester_with_group_members(members: usize) -> ContractTester<DkgContract> {
+    prepare_contract_tester_builder_with_group_members(members)
+        .build()
+        .with_common_storage_key(CommonStorageKeys::Admin, "dkg-admin")
 }
 
 pub fn prepare_contract_tester_builder_with_group_members<C>(
@@ -137,12 +143,6 @@ where
     builder
 }
 
-pub fn init_contract_tester_with_group_members(members: usize) -> ContractTester<DkgContract> {
-    prepare_contract_tester_builder_with_group_members(members)
-        .build()
-        .with_common_storage_key(CommonStorageKeys::Admin, "dkg-admin")
-}
-
 pub trait DkgContractTesterExt:
     ContractOpts<ExecuteMsg = ExecuteMsg, QueryMsg = QueryMsg, ContractError = ContractError>
     + ChainOpts

contracts/mixnet/src/testing/legacy.rs

@@ -1,12 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn legacy_mixnode_bonding() {
-        todo!()
-    }
-}

contracts/mixnet/src/testing/mod.rs

@@ -2,7 +2,3 @@
 // SPDX-License-Identifier: Apache-2.0
 
 pub(crate) mod transactions;
-
-// the purpose of that module is to keep track of tests of legacy features that will eventually be phased out
-// such as standalone mixnode/gateway bonding
-pub(crate) mod legacy;

nym-api/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.68"
+version = "1.1.67"
 authors.workspace = true
 edition = "2021"
 rust-version.workspace = true

nym-node-status-api/nym-node-status-agent/Dockerfile

@@ -1,17 +1,21 @@
 # this will only work with VPN, otherwise remove the harbor part
 FROM harbor.nymte.ch/dockerhub/rust:latest AS builder
 
+ARG GIT_REF=main
+
 RUN apt update && apt install -yy libdbus-1-dev pkg-config libclang-dev
 
 # Install go
 RUN wget https://go.dev/dl/go1.22.5.linux-amd64.tar.gz -O go.tar.gz
 RUN tar -xzvf go.tar.gz -C /usr/local
-ENV PATH=/go/bin:/usr/local/go/bin:$PATH
 
-COPY ./ /usr/src/nym
-WORKDIR /usr/src/nym
+RUN git clone https://github.com/nymtech/nym-vpn-client /usr/src/nym-vpn-client
+RUN cd /usr/src/nym-vpn-client && git checkout $GIT_REF
+ENV PATH=/go/bin:/usr/local/go/bin:$PATH
+WORKDIR /usr/src/nym-vpn-client/nym-vpn-core
 RUN cargo build --release --package nym-gateway-probe
 
+COPY ./ /usr/src/nym
 WORKDIR /usr/src/nym/nym-node-status-api/nym-node-status-agent
 RUN cargo build --release
 
@@ -31,7 +35,7 @@ RUN apt-get update && apt-get install -y ca-certificates
 WORKDIR /nym
 
 COPY --from=builder /usr/src/nym/target/release/nym-node-status-agent ./
-COPY --from=builder /usr/src/nym/target/release/nym-gateway-probe ./
+COPY --from=builder /usr/src/nym-vpn-client/nym-vpn-core/target/release/nym-gateway-probe ./
 COPY --from=builder /usr/src/nym/nym-node-status-api/nym-node-status-agent/entrypoint.sh ./
 RUN chmod +x /nym/entrypoint.sh
 

nym-node-status-api/nym-node-status-api/src/metrics_scraper/mod.rs

@@ -57,7 +57,7 @@ async fn run(
         .clone()
         .expect("rust sdk mainnet default missing api_url");
 
-    let nym_api = nym_http_api_client::ClientBuilder::new_with_urls(vec![default_api_url.into()])
+    let nym_api = nym_http_api_client::ClientBuilder::new_with_urls(vec![default_api_url.into()])?
         .no_hickory_dns()
         .with_timeout(nym_api_client_timeout)
         .build()?;

nym-node-status-api/nym-node-status-api/src/monitor/mod.rs

@@ -98,7 +98,7 @@ impl Monitor {
             .expect("rust sdk mainnet default missing api_url");
 
         let nym_api =
-            nym_http_api_client::ClientBuilder::new_with_urls(vec![default_api_url.into()])
+            nym_http_api_client::ClientBuilder::new_with_urls(vec![default_api_url.into()])?
                 .no_hickory_dns()
                 .with_timeout(self.nym_api_client_timeout)
                 .build()?;

nym-node/Cargo.toml

@@ -3,7 +3,7 @@
 
 [package]
 name = "nym-node"
-version = "1.20.0"
+version = "1.19.0"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true

nym-node/src/node/replay_protection/manager.rs

@@ -1,9 +1,6 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use crate::config::persistence::{
-    DEFAULT_RD_BLOOMFILTER_FILE_EXT, DEFAULT_RD_BLOOMFILTER_FLUSH_FILE_EXT,
-};
 use crate::config::Config;
 use crate::config::persistence::{
     DEFAULT_RD_BLOOMFILTER_FILE_EXT, DEFAULT_RD_BLOOMFILTER_FLUSH_FILE_EXT,

nym-registration-client/src/builder/config.rs

@@ -56,6 +56,53 @@ pub struct MixnetClientConfig {
 }
 
 impl BuilderConfig {
+    /// Creates a new BuilderConfig with all required parameters.
+    ///
+    /// However, consider using `BuilderConfig::builder()` instead.
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        entry_node: NymNodeWithKeys,
+        exit_node: NymNodeWithKeys,
+        data_path: Option<PathBuf>,
+        mixnet_client_config: MixnetClientConfig,
+        two_hops: bool,
+        user_agent: UserAgent,
+        custom_topology_provider: Box<dyn TopologyProvider + Send + Sync>,
+        network_env: NymNetworkDetails,
+        cancel_token: CancellationToken,
+        #[cfg(unix)] connection_fd_callback: Arc<dyn Fn(RawFd) + Send + Sync>,
+    ) -> Self {
+        Self {
+            entry_node,
+            exit_node,
+            data_path,
+            mixnet_client_config,
+            two_hops,
+            user_agent,
+            custom_topology_provider,
+            network_env,
+            cancel_token,
+            #[cfg(unix)]
+            connection_fd_callback,
+        }
+    }
+
+    /// Creates a builder for BuilderConfig
+    ///
+    /// This is the preferred way to construct a BuilderConfig.
+    ///
+    /// # Example
+    /// ```ignore
+    /// let config = BuilderConfig::builder()
+    ///     .entry_node(entry)
+    ///     .exit_node(exit)
+    ///     .user_agent(agent)
+    ///     .build()?;
+    /// ```
+    pub fn builder() -> BuilderConfigBuilder {
+        BuilderConfigBuilder::default()
+    }
+
     pub fn mixnet_client_debug_config(&self) -> DebugConfig {
         if self.two_hops {
             two_hop_debug_config(&self.mixnet_client_config)
@@ -116,6 +163,7 @@ impl BuilderConfig {
             .credentials_mode(true)
             .with_remember_me(remember_me)
             .custom_topology_provider(self.custom_topology_provider);
+
         #[cfg(unix)]
         let builder = builder.with_connection_fd_callback(self.connection_fd_callback);
 
@@ -205,3 +253,205 @@ fn log_mixnet_client_config(debug_config: &DebugConfig) {
 fn true_to_disabled(val: bool) -> &'static str {
     if val { "disabled" } else { "enabled" }
 }
+
+/// Error type for BuilderConfig validation
+#[derive(Debug, Clone, thiserror::Error)]
+#[allow(clippy::enum_variant_names)]
+pub enum BuilderConfigError {
+    #[error("entry_node is required")]
+    MissingEntryNode,
+    #[error("exit_node is required")]
+    MissingExitNode,
+    #[error("mixnet_client_config is required")]
+    MissingMixnetClientConfig,
+    #[error("user_agent is required")]
+    MissingUserAgent,
+    #[error("custom_topology_provider is required")]
+    MissingTopologyProvider,
+    #[error("network_env is required")]
+    MissingNetworkEnv,
+    #[error("cancel_token is required")]
+    MissingCancelToken,
+    #[cfg(unix)]
+    #[error("connection_fd_callback is required")]
+    MissingConnectionFdCallback,
+}
+
+/// Builder for `BuilderConfig`
+///
+/// This provides a more convenient way to construct a `BuilderConfig` compared to the
+/// `new()` constructor with many arguments.
+#[derive(Default)]
+pub struct BuilderConfigBuilder {
+    entry_node: Option<NymNodeWithKeys>,
+    exit_node: Option<NymNodeWithKeys>,
+    data_path: Option<PathBuf>,
+    mixnet_client_config: Option<MixnetClientConfig>,
+    two_hops: bool,
+    user_agent: Option<UserAgent>,
+    custom_topology_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
+    network_env: Option<NymNetworkDetails>,
+    cancel_token: Option<CancellationToken>,
+    #[cfg(unix)]
+    connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+}
+
+impl BuilderConfigBuilder {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn entry_node(mut self, entry_node: NymNodeWithKeys) -> Self {
+        self.entry_node = Some(entry_node);
+        self
+    }
+
+    pub fn exit_node(mut self, exit_node: NymNodeWithKeys) -> Self {
+        self.exit_node = Some(exit_node);
+        self
+    }
+
+    pub fn data_path(mut self, data_path: Option<PathBuf>) -> Self {
+        self.data_path = data_path;
+        self
+    }
+
+    pub fn mixnet_client_config(mut self, mixnet_client_config: MixnetClientConfig) -> Self {
+        self.mixnet_client_config = Some(mixnet_client_config);
+        self
+    }
+
+    pub fn two_hops(mut self, two_hops: bool) -> Self {
+        self.two_hops = two_hops;
+        self
+    }
+
+    pub fn user_agent(mut self, user_agent: UserAgent) -> Self {
+        self.user_agent = Some(user_agent);
+        self
+    }
+
+    pub fn custom_topology_provider(
+        mut self,
+        custom_topology_provider: Box<dyn TopologyProvider + Send + Sync>,
+    ) -> Self {
+        self.custom_topology_provider = Some(custom_topology_provider);
+        self
+    }
+
+    pub fn network_env(mut self, network_env: NymNetworkDetails) -> Self {
+        self.network_env = Some(network_env);
+        self
+    }
+
+    pub fn cancel_token(mut self, cancel_token: CancellationToken) -> Self {
+        self.cancel_token = Some(cancel_token);
+        self
+    }
+
+    #[cfg(unix)]
+    pub fn connection_fd_callback(
+        mut self,
+        connection_fd_callback: Arc<dyn Fn(RawFd) + Send + Sync>,
+    ) -> Self {
+        self.connection_fd_callback = Some(connection_fd_callback);
+        self
+    }
+
+    /// Builds the `BuilderConfig`.
+    ///
+    /// Returns an error if any required field is missing.
+    pub fn build(self) -> Result<BuilderConfig, BuilderConfigError> {
+        Ok(BuilderConfig {
+            entry_node: self
+                .entry_node
+                .ok_or(BuilderConfigError::MissingEntryNode)?,
+            exit_node: self.exit_node.ok_or(BuilderConfigError::MissingExitNode)?,
+            data_path: self.data_path,
+            mixnet_client_config: self
+                .mixnet_client_config
+                .ok_or(BuilderConfigError::MissingMixnetClientConfig)?,
+            two_hops: self.two_hops,
+            user_agent: self
+                .user_agent
+                .ok_or(BuilderConfigError::MissingUserAgent)?,
+            custom_topology_provider: self
+                .custom_topology_provider
+                .ok_or(BuilderConfigError::MissingTopologyProvider)?,
+            network_env: self
+                .network_env
+                .ok_or(BuilderConfigError::MissingNetworkEnv)?,
+            cancel_token: self
+                .cancel_token
+                .ok_or(BuilderConfigError::MissingCancelToken)?,
+            #[cfg(unix)]
+            connection_fd_callback: self
+                .connection_fd_callback
+                .ok_or(BuilderConfigError::MissingConnectionFdCallback)?,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_mixnet_client_config_default_values() {
+        let config = MixnetClientConfig::default();
+        assert!(!config.disable_poisson_rate);
+        assert!(!config.disable_background_cover_traffic);
+        assert_eq!(config.min_mixnode_performance, None);
+        assert_eq!(config.min_gateway_performance, None);
+    }
+
+    #[test]
+    fn test_builder_config_builder_fails_without_required_fields() {
+        // Building without any fields should fail with specific error
+        let result = BuilderConfig::builder().build();
+        assert!(result.is_err());
+        match result {
+            Err(BuilderConfigError::MissingEntryNode) => (), // Expected
+            Err(e) => panic!("Expected MissingEntryNode, got: {}", e),
+            Ok(_) => panic!("Expected error, got Ok"),
+        }
+    }
+
+    #[test]
+    fn test_builder_config_builder_validates_all_required_fields() {
+        // Test that each required field is validated
+        let result = BuilderConfig::builder().build();
+        assert!(result.is_err());
+
+        // Short-circuits at first missing field, so we just verify it's one of the expected errors
+        #[allow(unreachable_patterns)] // All variants are covered, but keeping catch-all for safety
+        match result {
+            Err(BuilderConfigError::MissingEntryNode)
+            | Err(BuilderConfigError::MissingExitNode)
+            | Err(BuilderConfigError::MissingMixnetClientConfig)
+            | Err(BuilderConfigError::MissingUserAgent)
+            | Err(BuilderConfigError::MissingTopologyProvider)
+            | Err(BuilderConfigError::MissingNetworkEnv)
+            | Err(BuilderConfigError::MissingCancelToken) => (),
+            #[cfg(unix)]
+            Err(BuilderConfigError::MissingConnectionFdCallback) => (),
+            Err(e) => panic!("Unexpected error: {}", e),
+            Ok(_) => panic!("Expected validation error, got Ok"),
+        }
+    }
+
+    #[test]
+    fn test_builder_config_builder_method_chaining() {
+        // Test that builder methods chain properly and return Self
+        let builder = BuilderConfig::builder();
+
+        // Verify the builder returns itself for chaining
+        let builder = builder.two_hops(true);
+        let builder = builder.two_hops(false);
+        let builder = builder.data_path(None);
+
+        // Builder should still fail because required fields are missing
+        let result = builder.build();
+        assert!(result.is_err());
+    }
+}

nym-wallet/Cargo.lock

@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "NymWallet"
@@ -773,7 +773,7 @@ dependencies = [
 [[package]]
 name = "bls12_381"
 version = "0.8.0"
-source = "git+https://github.com/jstuczyn/bls12_381?branch=temp/experimental-serdect-updated#9bf520059cb28323fc51469cae86868ef4fa6fbd"
+source = "git+https://github.com/jstuczyn/bls12_381?branch=temp%2Fexperimental-serdect-updated#9bf520059cb28323fc51469cae86868ef4fa6fbd"
 dependencies = [
  "digest 0.10.7",
  "ff",
@@ -1723,15 +1723,6 @@ dependencies = [
  "dirs-sys 0.3.7",
 ]
 
-[[package]]
-name = "dirs"
-version = "5.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
-dependencies = [
- "dirs-sys 0.4.1",
-]
-
 [[package]]
 name = "dirs"
 version = "6.0.0"
@@ -1752,18 +1743,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "dirs-sys"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
-dependencies = [
- "libc",
- "option-ext",
- "redox_users 0.4.6",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "dirs-sys"
 version = "0.5.0"
@@ -4100,7 +4079,7 @@ dependencies = [
 name = "nym-config"
 version = "0.1.0"
 dependencies = [
- "dirs 5.0.1",
+ "dirs 6.0.0",
  "handlebars",
  "log",
  "nym-network-defaults",

sdk/rust/nym-sdk/src/mixnet/client.rs

@@ -555,21 +555,22 @@ where
     async fn available_gateways(&mut self) -> Result<Vec<RoutingNode>, ClientCoreError> {
         if let Some(ref mut custom_provider) = self.custom_topology_provider {
             if let Some(topology) = custom_provider.get_new_topology().await {
-                return Ok(topology.entry_gateways().cloned().collect());
+                // Use entry_capable_nodes() instead of entry_gateways() to include
+                // all entry-capable nodes, not just actively assigned ones
+                return Ok(topology.entry_capable_nodes().cloned().collect());
             }
         }
 
         let nym_api_endpoints = self.get_api_endpoints();
         let topology_cfg = &self.config.debug_config.topology;
         let user_agent = self.user_agent.clone();
-        let mut rng = OsRng;
 
         gateways_for_init(
-            &mut rng,
             &nym_api_endpoints,
             user_agent,
             topology_cfg.minimum_gateway_performance,
             topology_cfg.ignore_ingress_epoch_role,
+            None,
         )
         .await
     }
@@ -720,11 +721,15 @@ where
             base_builder = base_builder.with_topology_provider(topology_provider);
         }
 
-        // Use custom shutdown if provided, otherwise the sdk one will be used later down the line
-        if let Some(shutdown_tracker) = self.custom_shutdown {
-            base_builder = base_builder.with_shutdown(shutdown_tracker);
-        }
-
+        // Use custom shutdown if provided, otherwise get from registry
+        let shutdown_tracker = match self.custom_shutdown {
+            Some(custom) => custom,
+            None => {
+                // Auto-create from registry for SDK use
+                nym_task::get_sdk_shutdown_tracker()?
+            }
+        };
+        base_builder = base_builder.with_shutdown(shutdown_tracker);
         if let Some(event_tx) = self.event_tx {
             base_builder = base_builder.with_event_tx(event_tx);
         }
@@ -789,7 +794,7 @@ where
             client_output,
             client_state.clone(),
             nym_address,
-            started_client.shutdown_handle.clone(),
+            started_client.shutdown_handle.child_tracker(),
             packet_type,
         );
 
@@ -876,3 +881,17 @@ impl IncludedSurbs {
         Self::ExposeSelfAddress
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_mixnet_builder_default_no_custom_client() {
+        let builder = MixnetClientBuilder::new_ephemeral();
+        assert!(
+            builder.build().is_ok(),
+            "Builder should succeed without custom client"
+        );
+    }
+}

service-providers/network-requester/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-network-requester"
 license = "GPL-3.0"
-version = "1.1.66"
+version = "1.1.65"
 authors.workspace = true
 edition.workspace = true
 rust-version = "1.85"

tools/nym-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-cli"
-version = "1.1.65"
+version = "1.1.64"
 authors.workspace = true
 edition = "2021"
 license.workspace = true

tools/nymvisor/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nymvisor"
-version = "0.1.30"
+version = "0.1.29"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true