Elect new IC/GuestOS revision (commit 2c2c7c9)

Release Notes for release-2026-09-18_03-28-base (2c2c7c99bd526d8c3da51df32aeeb977e852292d) This release is based on changes since release-2026-09-10_03-28-base (dea4a9afe8bb2a6c324eb661e52204c6054d8e91).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image. Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on GitHub.

Features:

• 9f34f23ba Core Protocol: CertifiedSlicePool::classify_advert() (#11601)
• 2788b2b1b Core Protocol: Export million_round_instructions_total in subnet_metrics (#11587)
• a868b86f9 Core Protocol: Don't gossip HTTPS outcalls responses that were already delivered (#11546)
• 6b6729b97 Core Protocol: CertifiedSlicePool: highest seen peer headers (#11545)
• 4b629b496 Core Protocol: Backfill the canister-level monotonic consumed cycles (#11490)
• e3dc82488 Core Protocol: Strict XNet slice byte limits for suffix pulls (#11536)
• 50155e189 Core Protocol: bump base64 (#11487)
• 554dfeadc Node: Refactor VSOCK (#11322)
• 6b75723f5 Node: Build fast upgrade images (#11506)
• 763d0e53c Node: Support SEV firmware upgrades (#11476)
• b75c0e59d Node: bump lru, axum-extra & mockito (#11530)

Bugfixes:

• 20c396cc0 Core Protocol(replay): don't execute the replay target height as a checkpoint round (#11203)
• e5b09f332 Core Protocol: remove the ordering on CompoundCycles (#11529)
• d8891e834 Node: some minor issues in ic-boundary (#11563)

Performance improvements:

• d60c570ae Core Protocol(dkg): iterate over less entries, stop cloning and simplify DKG pool purging (#11492)

Chores:

• 1155b1c20 Core Protocol: Add a metric counting HTTP outcalls submitted in the replicated state (#11584)
• 2e1f80121 Core Protocol: bump ic-gateway & ic-bn-lib (#11574)
• 49395cfcc Core Protocol: Bump current certification version to V29 (#11184)
• df047c055 Core Protocol: rustc: 1.97.1 -> 1.98.1 (#11534)
• 6a7e0a3ef Core Protocol,Node: cargo clippy fixes to prepare for the rustc upgrade: 1.97.1 -> 1.98.1 (#11533)
• b1d1529d6 Node: Update Base Image Refs [2026-09-17-0806] (#11598)
• b888ef401 Node: Update Base Image Refs [2026-09-16-0133] (#11583)
• 605a5396f Node: Update Base Image Refs [2026-09-11-0131] (#11539)

Refactoring:

• dfecf2225 Core Protocol: unify CUP verification and add some sanity checks (#11556)
• 9980b493f Core Protocol: ExpectedIndices::covered_header_begin (#11580)
• 70b58ec08 Core Protocol(recovery): prepare the recovery library for a subnet merging tool (#11570)
• adc10687c Core Protocol(recovery): move the reusable parts of subnet splitting into a crate of their own (#11553)

Tests:

• f746fe558 Core Protocol: Add pay-as-you-go HTTPS outcalls system tests (#11327)

Documentation:

Full list of changes (including the ones that are not relevant to GuestOS) can be found on GitHub.

IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (sudo apt install curl), run:

# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/2c2c7c99bd526d8c3da51df32aeeb977e852292d/ci/scripts/repro-check | python3 - -c 2c2c7c99bd526d8c3da51df32aeeb977e852292d --guestos

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing --hostos to the script above instead of --guestos, or the SetupOS by passing --setupos.