Merge branch 'v4-next' into backport-to-v4-next-staging

Author: benesjan

CHANGELOG.md

@@ -68,7 +68,7 @@ function release {
 }
 
 function cross_copy {
-  ./scripts/copy_cross.sh
+  ./scripts/copy_cross.sh "$@"
 }
 
 case "$cmd" in

barretenberg/ts/bootstrap.sh

@@ -5,7 +5,12 @@ NO_CD=1 source $(git rev-parse --show-toplevel)/ci3/source
 
 cd $(dirname $0)/..
 
-if semver check "${REF_NAME:-}" && [[ "$(arch)" == "amd64" ]]; then
+if [ -n "${1:-}" ]; then
+  arch="$1"
+  mkdir -p ./build/$arch
+  cp ../cpp/build-zig-$arch/bin/bb ./build/$arch
+  cp ../cpp/build-zig-$arch/lib/nodejs_module.node ./build/$arch
+elif semver check "${REF_NAME:-}" && [[ "$(arch)" == "amd64" ]]; then
   # We're building a release.
   # We take host build for amd64-linux.
   mkdir -p ./build/amd64-linux

barretenberg/ts/scripts/copy_cross.sh

@@ -203,6 +203,7 @@ RUN apt update && \
         neovim \
         psmisc \
         python3-blessed \
+        qemu-utils \
         redis-tools \
         rsync \
         software-properties-common \
@@ -264,7 +265,7 @@ RUN echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
 # It can be used independently:
 # - The user should use the ./run.sh script to launch.
 # - A persistent volume will be mounted to /home/aztec-dev.
-# - It provides docker via the hosts docker instance, mounted at /var/lib/docker.sock.
+# - It provides docker-in-docker.
 # - It uses an entrypoint script at runtime to perform uid/gid alignment with the host and drop into user account.
 FROM basebox AS devbox
 

build-images/src/Dockerfile

@@ -9,6 +9,8 @@ Aztec is in active development. Each version may introduce breaking changes that
 
 ## TBD
 
+## 4.3.0-rc.1
+
 ### [Aztec.nr] `attempt_note_discovery` is no longer exposed; use `process_private_note_msg`
 
 `attempt_note_discovery` is now crate-private. Custom message handlers (implementations of `CustomMessageHandler`) that previously called it directly should call `process_private_note_msg` instead, which runs the standard private note message decoding and discovery pipeline.

docs/docs-developers/docs/resources/migration_notes.md

@@ -18,5 +18,8 @@ WORKDIR "/usr/src/yarn-project"
 # Ensure the correct version shows in aztec --version
 ARG VERSION
 RUN echo '{".": "'$VERSION'"}' > /usr/src/.release-please-manifest.json
+# Stamp the version into stdlib/package.json, which getPackageVersion() reads at runtime.
+RUN jq --arg v "$VERSION" '.version = $v' /usr/src/yarn-project/stdlib/package.json > /tmp/p.json \
+    && mv /tmp/p.json /usr/src/yarn-project/stdlib/package.json
 
 ENTRYPOINT ["node", "--no-warnings", "/usr/src/yarn-project/aztec/dest/bin/index.js"]

release-image/Dockerfile

@@ -0,0 +1,87 @@
+# Release Notes: v4.2.1 → v4.3.0-rc.1
+
+**Date:** 2026-05-15
+**Range:** `v4.2.1..v4.3.0-rc.1` (2026-05-07 → 2026-05-15)
+**Commits:** 225 non-merge commits
+
+Full migration instructions for every breaking change below live in [`docs/docs-developers/docs/resources/migration_notes.md`](docs/docs-developers/docs/resources/migration_notes.md).
+
+> **Note**: This is a draft release-notes file generated from commit history. Curate the headline sections (Summary, Breaking Changes, Highlights) before publishing. The detailed change log lives in [`CHANGELOG.md`](CHANGELOG.md).
+
+---
+
+## Summary
+
+`v4.3.0-rc.1` is the first release candidate of the v4.3 line, cut after the `v4.2.x` series stabilized on the Alpha network. The release rolls up roughly 225 commits backported to `v4-next` since `v4.2.1` and is primarily focused on **PXE / wallet-side improvements**, **kv-store on SQLite-wasm**, and **Aztec.nr / TXE ergonomics**. Beyond the three breaking changes listed below, the release is dominated by bug fixes, refactors that improve sync performance, and tooling improvements.
+
+---
+
+## Breaking Changes
+
+- **`aztec init` / `aztec new` counter template** ([#22751](https://github.com/AztecProtocol/aztec-packages/pull/22751)): `aztec init` / `aztec new` now scaffold a *counter* template instead of the previous default. Any tooling or docs that relied on the prior scaffold contents must be updated.
+
+- **Shared protocol-circuit utilities in the history module** (`refactor!` cherry-pick `8f805bb8d3`): The `aztec-nr` history module now consumes shared protocol-circuit utilities. Direct consumers of internal history-module helpers must adapt — see migration notes.
+
+---
+
+## Highlights
+
+### PXE / Wallet
+
+- **New opt-in SQLite kv-store backend** ([#22658](https://github.com/AztecProtocol/aztec-packages/pull/22658), [#22759](https://github.com/AztecProtocol/aztec-packages/pull/22759), [#23089](https://github.com/AztecProtocol/aztec-packages/pull/23089), [#23231](https://github.com/AztecProtocol/aztec-packages/pull/23231)): A new SQLite-on-WASM-over-OPFS implementation of the PXE / wallet kv-store ships alongside the existing LMDB and IndexedDB backends, with a page-level-encrypted variant for stricter browser environments. The new backend is **opt-in** at wallet construction time; existing PXE stores continue to work unchanged on LMDB / IndexedDB. SQLite is expected to become the recommended default in v5, with IndexedDB deprecated thereafter.
+- **Cross-contract utility call hooks and auth** ([#23007](https://github.com/AztecProtocol/aztec-packages/pull/23007), [#23064](https://github.com/AztecProtocol/aztec-packages/pull/23064), [#22822](https://github.com/AztecProtocol/aztec-packages/pull/22822)): PXE gains execution hooks for authorizing cross-contract utility calls, and TXE supports authorizing them in Noir tests. Nested utility-function calls are now supported end-to-end.
+- **Sync performance** ([#23129](https://github.com/AztecProtocol/aztec-packages/pull/23129), [#23131](https://github.com/AztecProtocol/aztec-packages/pull/23131), [#23123](https://github.com/AztecProtocol/aztec-packages/pull/23123), [#23130](https://github.com/AztecProtocol/aztec-packages/pull/23130), [#23100](https://github.com/AztecProtocol/aztec-packages/pull/23100), [#23088](https://github.com/AztecProtocol/aztec-packages/pull/23088), [#23048](https://github.com/AztecProtocol/aztec-packages/pull/23048), [#22988](https://github.com/AztecProtocol/aztec-packages/pull/22988), [#22525](https://github.com/AztecProtocol/aztec-packages/pull/22525)): A series of refactors batches nullifier sync across scopes, batches log RPC calls, prefetches updated class-id hints per contract, short-circuits block-header lookups at the anchor block, and parallelizes per-scope contract syncs.
+- **Tag-as-sender optimization** ([#23239](https://github.com/AztecProtocol/aztec-packages/pull/23239)): Faster `get_next_app_tag_as_sender` lookups.
+- **wallet-sdk heartbeat** ([#22948](https://github.com/AztecProtocol/aztec-packages/pull/22948)): Wallet SDK now emits a heartbeat for liveness signalling.
+
+### Aztec.nr / TXE
+
+- **TXE oracle versioning** ([#23285](https://github.com/AztecProtocol/aztec-packages/pull/23285), [#23289](https://github.com/AztecProtocol/aztec-packages/pull/23289)): TXE gains oracle versioning for the test environment and basic gas settings, mirroring production behavior more closely.
+- **Initial handshake registry contract** ([#22854](https://github.com/AztecProtocol/aztec-packages/pull/22854)): New handshake registry contract with non-interactive handshake function for offchain message delivery.
+- **`call_self` utility stubs** ([#22885](https://github.com/AztecProtocol/aztec-packages/pull/22885)): Aztec.nr utility functions gain `call_self` stubs for cleaner self-invocation patterns.
+- **Serializability assertions** ([#22877](https://github.com/AztecProtocol/aztec-packages/pull/22877)): Aztec.nr now asserts that contract function return types and parameters are serializable, catching a common compile-time class of bugs.
+- **Offchain delivered private transfer** ([#22574](https://github.com/AztecProtocol/aztec-packages/pull/22574)): Example/infra for offchain-delivered private transfers.
+- **Oxide upstream merge** ([#22979](https://github.com/AztecProtocol/aztec-packages/pull/22979)): Oxide aztec-nr changes upstreamed.
+
+### CLI / `aztec-up`
+
+- **`aztec dep` version check** ([#21245](https://github.com/AztecProtocol/aztec-packages/pull/21245)): Asserts the aztec-nr dependency version matches the CLI version.
+- **Multi-crate scaffolding** ([#21007](https://github.com/AztecProtocol/aztec-packages/pull/21007), [#20681](https://github.com/AztecProtocol/aztec-packages/pull/20681), [#20723](https://github.com/AztecProtocol/aztec-packages/pull/20723), [#20729](https://github.com/AztecProtocol/aztec-packages/pull/20729)): `aztec new` and `aztec init` now create a 2-crate workspace, warn if the contract crate has tests, and auto-recompile when `aztec test` is run.
+- **Contract version stamping** ([#22550](https://github.com/AztecProtocol/aztec-packages/pull/22550)): Contract artifacts now stamp the `aztec` version they were compiled against.
+- **`aztec profile gates --json`** ([#22860](https://github.com/AztecProtocol/aztec-packages/pull/22860)): JSON output for `aztec profile gates`.
+
+### Docs
+
+- **Node JSON-RPC API reference auto-generated** (commit `de6e69f8fa`): The node JSON-RPC API reference is now generated from the TypeScript source.
+- **Aztec.nr API reference discoverability** ([#22861](https://github.com/AztecProtocol/aztec-packages/pull/22861)): Aztec.nr API reference docs are more discoverable in the sidebar.
+- **Nethermind / FPC docs** ([#22541](https://github.com/AztecProtocol/aztec-packages/pull/22541) and `2511d876d7`): FPC docs applied to developer versioned docs; Nethermind FPC docs added.
+- **Alpha Network privacy/limitations page** ([#22515](https://github.com/AztecProtocol/aztec-packages/pull/22515)).
+
+---
+
+## Notable Bug Fixes
+
+- **Dropped tagging indices no longer crash PXE on sync** ([#23044](https://github.com/AztecProtocol/aztec-packages/pull/23044)).
+- **`sendMessagesAs` cross-contract utility-call sync** ([#23225](https://github.com/AztecProtocol/aztec-packages/pull/23225)): PXE now syncs the target contract before a cross-contract utility call.
+- **Anchor-header threading** (cherry-pick of [#22679](https://github.com/AztecProtocol/aztec-packages/pull/22679)): Backport of anchor-header threading in PXE simulation paths.
+- **Origin/contract address mismatch detected** ([#22637](https://github.com/AztecProtocol/aztec-packages/pull/22637)): PXE throws on origin/contract address mismatch during simulation rather than silently producing wrong results.
+- **Race conditions in block-stream event handling** ([#22635](https://github.com/AztecProtocol/aztec-packages/pull/22635)): PXE now serializes block-stream event handling.
+- **Private event store rollback** ([#22615](https://github.com/AztecProtocol/aztec-packages/pull/22615)): Guarded against in-flight jobs during rollback.
+- **`setSenderForTags` scope correctness** ([#22672](https://github.com/AztecProtocol/aztec-packages/pull/22672)): Restricted to the current call (F-564).
+- **`registerSender` wipe race** ([#22623](https://github.com/AztecProtocol/aztec-packages/pull/22623)): Wipes are now queued to avoid racing in-flight jobs.
+- **`aztec-up` PATH leak** ([#22709](https://github.com/AztecProtocol/aztec-packages/pull/22709)): Bundled binaries no longer leak `node_modules/.bin` onto `PATH`.
+- **ABI argument-encoder validation** ([#22529](https://github.com/AztecProtocol/aztec-packages/pull/22529)): Missing ABI validation in argument encoder added.
+
+Full list in [`CHANGELOG.md`](CHANGELOG.md).
+
+---
+
+## Upgrade notes
+
+- The breaking changes above are documented under the `## 4.3.0-rc.1` section of `docs/docs-developers/docs/resources/migration_notes.md`.
+
+---
+
+## All Changes
+
+See [`CHANGELOG.md`](CHANGELOG.md) for the complete list of 162 categorized commits (BREAKING / Features / Bug Fixes / Documentation / Miscellaneous).

release-notes-4.3.0-rc.1.md

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 set -euo pipefail
-shopt -s inherit_errexit
 
 # Re-execute using correct version if we have an .aztecrc file.
 if [ "${AZTEC_VERSIONED:-0}" -eq 0 ] && [ -f .aztecrc ] && command -v aztec-up &>/dev/null; then

yarn-project/aztec/scripts/aztec.sh

@@ -199,6 +199,82 @@ describe('prover-node-publisher', () => {
     },
   );
 
+  it('waits until the proven checkpoint reaches the checkpoint before the proof start', async () => {
+    const checkpoints = Array.from({ length: 100 }, () => RootRollupPublicInputs.random());
+    const fromCheckpoint = CheckpointNumber(33);
+    const toCheckpoint = CheckpointNumber(64);
+
+    rollup.getTips
+      .mockResolvedValueOnce({
+        pending: CheckpointNumber(65),
+        proven: CheckpointNumber(31),
+      })
+      .mockResolvedValueOnce({
+        pending: CheckpointNumber(65),
+        proven: CheckpointNumber(32),
+      })
+      .mockResolvedValue({
+        pending: CheckpointNumber(65),
+        proven: CheckpointNumber(32),
+      });
+    rollup.getRollupConstants.mockResolvedValue({
+      l1StartBlock: 0n,
+      l1GenesisTime: BigInt(Math.floor(Date.now() / 1000)),
+      slotDuration: 1,
+      epochDuration: 1,
+      proofSubmissionEpochs: 100,
+      targetCommitteeSize: 48,
+      rollupManaLimit: Number.MAX_SAFE_INTEGER,
+    });
+
+    rollup.getCheckpoint.mockImplementation((checkpointNumber: CheckpointNumber) =>
+      Promise.resolve({
+        archive: checkpoints[checkpointNumber - 1].endArchiveRoot,
+        attestationsHash: Buffer32.ZERO,
+        payloadDigest: Buffer32.ZERO,
+        headerHash: Buffer32.ZERO,
+        blobCommitmentsHash: Buffer32.ZERO,
+        outHash: '0x',
+        slotNumber: SlotNumber(0),
+        feeHeader: {
+          excessMana: 0n,
+          manaUsed: 0n,
+          ethPerFeeAsset: 0n,
+          congestionCost: 0n,
+          proverCost: 0n,
+        },
+      }),
+    );
+
+    const ourPublicInputs = RootRollupPublicInputs.random();
+    ourPublicInputs.previousArchiveRoot = checkpoints[fromCheckpoint - 2].endArchiveRoot;
+    ourPublicInputs.endArchiveRoot = checkpoints[toCheckpoint - 1].endArchiveRoot;
+
+    const ourBatchedBlob = new BatchedBlob(
+      ourPublicInputs.blobPublicInputs.blobCommitmentsHash,
+      ourPublicInputs.blobPublicInputs.z,
+      ourPublicInputs.blobPublicInputs.y,
+      ourPublicInputs.blobPublicInputs.c,
+      ourPublicInputs.blobPublicInputs.c.negate(),
+    );
+
+    rollup.getEpochProofPublicInputs.mockResolvedValue(ourPublicInputs.toFields());
+
+    await publisher.submitEpochProof({
+      epochNumber: EpochNumber(2),
+      fromCheckpoint,
+      toCheckpoint,
+      publicInputs: ourPublicInputs,
+      proof: Proof.empty(),
+      batchedBlobInputs: ourBatchedBlob,
+      attestations: [],
+    });
+
+    expect(rollup.getRollupConstants).toHaveBeenCalled();
+    expect(rollup.getTips).toHaveBeenCalledTimes(3);
+    expect(l1Utils.sendAndMonitorTransaction).toHaveBeenCalled();
+  });
+
   it('handles reverted txs correctly', async () => {
     const checkpoints = [RootRollupPublicInputs.random(), RootRollupPublicInputs.random()];
 

yarn-project/prover-node/src/prover-node-publisher.test.ts

@@ -8,11 +8,13 @@ import { areArraysEqual } from '@aztec/foundation/collection';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { type Logger, type LoggerBindings, createLogger } from '@aztec/foundation/log';
+import { retryUntil } from '@aztec/foundation/retry';
 import type { Tuple } from '@aztec/foundation/serialize';
 import { Timer } from '@aztec/foundation/timer';
 import { RollupAbi } from '@aztec/l1-artifacts';
 import type { PublisherConfig, TxSenderConfig } from '@aztec/sequencer-client';
 import { CommitteeAttestation, CommitteeAttestationsAndSigners } from '@aztec/stdlib/block';
+import { getProofSubmissionDeadlineTimestamp } from '@aztec/stdlib/epoch-helpers';
 import type { Proof } from '@aztec/stdlib/proofs';
 import type { FeeRecipient, RootRollupPublicInputs } from '@aztec/stdlib/rollup';
 import type { L1PublishProofStats } from '@aztec/stdlib/stats';
@@ -101,6 +103,11 @@ export class ProverNodePublisher {
     const ctx = { epochNumber, fromCheckpoint, toCheckpoint };
 
     if (!this.interrupted) {
+      if (!(await this.waitUntilStartBuildsOnProven(args))) {
+        this.log.verbose('Checkpoint data syncing interrupted', ctx);
+        return false;
+      }
+
       const timer = new Timer();
       // Validate epoch proof range and hashes are correct before submitting
       await this.validateEpochProofSubmission(args);
@@ -147,6 +154,53 @@ export class ProverNodePublisher {
     return false;
   }
 
+  private async waitUntilStartBuildsOnProven(args: { epochNumber: EpochNumber; fromCheckpoint: CheckpointNumber }) {
+    const { epochNumber, fromCheckpoint } = args;
+    const provenCheckpoint = await this.getProvenCheckpoint();
+    if (this.isStartBuildingOnProven(fromCheckpoint, provenCheckpoint)) {
+      return true;
+    }
+
+    const timeout = await this.getSecondsUntilProofSubmissionWindowEnd(epochNumber);
+    this.log.info(`Waiting for proven checkpoint to reach proof start`, {
+      epochNumber,
+      fromCheckpoint,
+      provenCheckpoint,
+      timeout,
+    });
+
+    await retryUntil(
+      async () => {
+        if (this.interrupted) {
+          return true;
+        }
+
+        const proven = await this.getProvenCheckpoint();
+        this.log.verbose(`Proven checkpoint is at ${proven} (waiting for ${fromCheckpoint - 1})`, { epochNumber });
+        return this.isStartBuildingOnProven(fromCheckpoint, proven) ? true : undefined;
+      },
+      `proven checkpoint to reach ${fromCheckpoint - 1}`,
+      timeout,
+      4,
+    );
+
+    return !this.interrupted;
+  }
+
+  private async getProvenCheckpoint() {
+    return (await this.rollupContract.getTips()).proven;
+  }
+
+  private isStartBuildingOnProven(fromCheckpoint: CheckpointNumber, provenCheckpoint: CheckpointNumber) {
+    return fromCheckpoint - 1 <= provenCheckpoint;
+  }
+
+  private async getSecondsUntilProofSubmissionWindowEnd(epochNumber: EpochNumber) {
+    const deadline = getProofSubmissionDeadlineTimestamp(epochNumber, await this.rollupContract.getRollupConstants());
+    const now = BigInt(Math.floor(Date.now() / 1000));
+    return Math.max(Number(deadline - now), 0.001);
+  }
+
   private async validateEpochProofSubmission(args: {
     fromCheckpoint: CheckpointNumber;
     toCheckpoint: CheckpointNumber;