Elect new IC/GuestOS revision (commit 620b81c)

Release Notes for release-2026-11-06_03-19-base (620b81c4bf6c59aa1065fe7412afcaf49e51503e) This release is based on changes since release-2026-10-30_12-16-base (83f29e0803496ba6aaea3d6b43f6c6bebea12dd9).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image. Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on GitHub.

Features:

• 37f32d8fe Core Protocol(p2p): Retry download of messages if assembly fails (#12019)
• 64a532e86 Core Protocol: Metrics for heap access refusals (#11868)
• b189b4c3e Core Protocol(http-handler): return 503 on state-delegation mismatch in sync/read_state endpoints (#11684)
• 31251d81b Core Protocol: Instrument stable APIs that touch the heap (#11865)
• c135ad7fe Core Protocol: Check bulk instructions (#11843)
• 05489f2cd Core Protocol: bound sender_info payload size by 1 KiB (#12016)
• 2d735ffc2 Core Protocol: Page limit global (#11801)
• 71ceb5f52 Core Protocol: Connect heap page limit with system API and DMT (#11793)
• 13c9e3401 Core Protocol(execution): count delivered HTTP outcalls by call class (#12001)
• c4c16f44e Core Protocol: Tracker limits (#11770)
• b4a38ba74 Node(guestos): add editors to the prod GuestOS image (#11954)

Bugfixes:

• 739bec942 Core Protocol: only accept Bitcoin adapter responses for matching pending requests (#12024)
• ed335e463 Core Protocol: allow cloud engine admins to read private metadata via read_state (#11911)
• 470c3fb4d Core Protocol(execution): bound query scheduler state for nonexistent canister IDs (#11943)
• 84b76ac38 Core Protocol(execution): redact backtraces after paused execution (#11942)
• 5d91d1761 Core Protocol(execution): replay the canister log of a failed response callback when resuming its cleanup callback (#11850)
• 72ac00403 Core Protocol(execution): cap DTS slice usage at remaining message budget (#11956)
• 7d196ed67 Core Protocol(messaging): do not record cycles of dropped engine-boundary messages as lost (#11919)
• b32aafe09 Core Protocol,Node(ic-os): drop inbound IPv4 packets with IP options to mitigate-98432 (#11988)

Performance improvements:

• f1ed91f25 Core Protocol: Optimize method name validation (#12005)
• 5e6c84c84 Core Protocol(pools): stop linear scan on artifact insertion in pool (#11933)

Chores:

• a4a65a1e6 Core Protocol: log composite queries' callers and receivers (#12012)
• 98c0bca87 Core Protocol: Count key names in NiDkgId::count_bytes and remove unused Certification::count_bytes (#12003)
• a66d3c8cd Core Protocol: Reject CertifiedStreamSlice signers other than high-threshold NI-DKG IDs (#12002)
• 620b81c4b Node: Update Base Image Refs [2026-11-05-0804] (#12023)
• 8c16a2159 Node: Switch from fetching registry to update call during SEV upgrade (#11989)
• 2f0525dca Node: Update Base Image Refs [2026-11-05-0118] (#12022)

Refactoring:

• 1184e177f Core Protocol(p2p): make the artifact downloader builders FnOnce (#11991)
• 0cd0fa238 Core Protocol(p2p): remove confusing ValidatedPoolReaderRef<T> type alias (#11981)

Tests:

• a515376f0 Core Protocol: More page limit tests (#11982)

Full list of changes (including the ones that are not relevant to GuestOS) can be found on GitHub.

IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (sudo apt install curl), run:

# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/620b81c4bf6c59aa1065fe7412afcaf49e51503e/ci/scripts/repro-check | python3 - -c 620b81c4bf6c59aa1065fe7412afcaf49e51503e --guestos

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing --hostos to the script above instead of --guestos, or the SetupOS by passing --setupos.