Elect new IC/GuestOS revision (commit d26cd03)

Release Notes for release-2026-09-25_03-28-base (d26cd031176beec51b39fbb9e39e80a3a46a748e) This release is based on changes since release-2026-09-18_03-28-base (2c2c7c99bd526d8c3da51df32aeeb977e852292d).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image. Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on GitHub.

Features:

• d26cd0311 Core Protocol: Fast upgrades: upgrade permit protocol types (#11548)
• c17e988b9 Core Protocol(delegations): introduce more ways of checking whether a delegation is valid w.r.t. the replicated state (#11631)
• 8896451e7 Core Protocol(subnet-splitting): make destination orchestrators restart the replica (#11238)
• a9f7914d8 Core Protocol: XNetAdvertHandler for XNetPayloadBuilderImpl (#11602)
• 48b6f629d Core Protocol(crypto): add secp256r1 variant to EcdsaCurve (#11573)
• 82d947e19 Core Protocol: Backfill the canister-level monotonic consumed cycles by use case (#11585)
• 45abaf452 Core Protocol: disable unused features (#11544)

Bugfixes:

• 79fce9ab7 Core Protocol: adjust each part of the response execution prepayment on its own (#11431)
• a7c173b98 Core Protocol: Advert classification: check for gap-free pooled slices (#11621)
• 2967c1cc9 Core Protocol(delegations): always fetch an initial delegation (#11605)
• d91d72d77 Core Protocol(execution): handle the log_memory_limit resize before the other update_settings settings (#11614)
• 1d7231173 Node(ic-os): make diroid look fakeroot's ownership map up by st_ino, not d_ino (#11661)

Chores:

• 6d699c3d2 Core Protocol(core): Limit custom sections (#11645)
• c7dda50be Core Protocol(dkg): remove summary's transcripts for remote subnets (3/4) (#11223)
• 847607626 Node: Fix a few small things across ICOS (#11623)
• 8c5304c48 Node: Update Base Image Refs [2026-09-23-0133] (#11657)

Refactoring:

• 03fb58230 Core Protocol(batch delivery): highlight and group together differences between data and summary blocks delivery (#11225)
• 7dbe6a707 Core Protocol: charge for create_snapshot_from_metadata upfront (#11641)
• 0e3007110 Core Protocol: read HTTP/ECDSA outcall cycles from the per-use-case map (#11202)
• ccb062733 Core Protocol: account for instructions in the round limits along with their cycles (#11640)
• 4092ffcde Core Protocol(execution): charge instructions w.r.t. the old memory usage (#11625)
• a6e8bf44c Core Protocol: make QueryContext owned and Send (#11620)

Tests:

Full list of changes (including the ones that are not relevant to GuestOS) can be found on GitHub.

IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (sudo apt install curl), run:

# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/d26cd031176beec51b39fbb9e39e80a3a46a748e/ci/scripts/repro-check | python3 - -c d26cd031176beec51b39fbb9e39e80a3a46a748e --guestos

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing --hostos to the script above instead of --guestos, or the SetupOS by passing --setupos.