Release Notes for [release-2026-10-02_03-31-base](https://github.com/dfinity/ic/tree/release-2026-10-02_03-31-base) (`2cdff28573522b2c9c5e96a4407b50281eb82b5c`)
This release is based on changes since [release-2026-09-25_03-28-base](https://dashboard.internetcomputer.org/release/d26cd031176beec51b39fbb9e39e80a3a46a748e) (`d26cd031176beec51b39fbb9e39e80a3a46a748e`).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2026-09-25_03-28-base...release-2026-10-02_03-31-base).
## Features:
* [`647a36502`](https://github.com/dfinity/ic/commit/647a36502) Core Protocol: More timeouts for the XNet endpoint ([#11707](https://github.com/dfinity/ic/pull/11707))
* [`3588f1203`](https://github.com/dfinity/ic/commit/3588f1203) Core Protocol: Advert trigger, conditions and targets ([#11698](https://github.com/dfinity/ic/pull/11698))
* [`514854dd1`](https://github.com/dfinity/ic/commit/514854dd1) Core Protocol: `AdvertTask::advertise_to()` ([#11663](https://github.com/dfinity/ic/pull/11663))
* [`4f3d0d8d5`](https://github.com/dfinity/ic/commit/4f3d0d8d5) Core Protocol: `XNetClient::post_advert()` ([#11613](https://github.com/dfinity/ic/pull/11613))
* [`f5b887d83`](https://github.com/dfinity/ic/commit/f5b887d83) Core Protocol: XNet advert endpoint ([#11603](https://github.com/dfinity/ic/pull/11603))
* [`6a6957489`](https://github.com/dfinity/ic/commit/6a6957489) Core Protocol: Fast upgrades: upgrade payload section in blocks ([#11655](https://github.com/dfinity/ic/pull/11655))
* [`9ccebc7db`](https://github.com/dfinity/ic/commit/9ccebc7db) Core Protocol(p2p): retry after some delay when connection is short-lived ([#11671](https://github.com/dfinity/ic/pull/11671))
## Bugfixes:
* [`2a310be3e`](https://github.com/dfinity/ic/commit/2a310be3e) Core Protocol(replay): keep querying registry for new changes until reaching latest version ([#11699](https://github.com/dfinity/ic/pull/11699))
* [`79114b9c0`](https://github.com/dfinity/ic/commit/79114b9c0) Core Protocol: Read advert bodies before taking an XNet endpoint permit ([#11702](https://github.com/dfinity/ic/pull/11702))
* [`14ca7cc0b`](https://github.com/dfinity/ic/commit/14ca7cc0b) Core Protocol(ci): compile the universal canister module without host CPU features ([#11673](https://github.com/dfinity/ic/pull/11673))
## Performance improvements:
* [`19d16c0bb`](https://github.com/dfinity/ic/commit/19d16c0bb) Core Protocol: Do not count asynchronous HTTP outcall receipts towards the per-block response limit ([#11713](https://github.com/dfinity/ic/pull/11713))
* [`fb9a8cc13`](https://github.com/dfinity/ic/commit/fb9a8cc13) Core Protocol: Drop delivered HTTP outcall contexts once all replicas are accounted for ([#11709](https://github.com/dfinity/ic/pull/11709))
* [`6f8c82bdb`](https://github.com/dfinity/ic/commit/6f8c82bdb) Core Protocol: Wrap some `CanisterHttpRequestContext` fields in `Arc<_>` ([#11568](https://github.com/dfinity/ic/pull/11568))
* [`443585ebc`](https://github.com/dfinity/ic/commit/443585ebc) Core Protocol(https_outcalls): Avoid cloning responses when building payloads ([#11676](https://github.com/dfinity/ic/pull/11676))
## Chores:
* [`687e6a42e`](https://github.com/dfinity/ic/commit/687e6a42e) Core Protocol(protobuf): add the canister HTTP hashes-in-blocks messages ([#11716](https://github.com/dfinity/ic/pull/11716))
* [`7b8819b0a`](https://github.com/dfinity/ic/commit/7b8819b0a) Core Protocol: simplify dependency graph ([#11669](https://github.com/dfinity/ic/pull/11669))
* [`ecfed2b76`](https://github.com/dfinity/ic/commit/ecfed2b76) Core Protocol: Reject some more principals with better errors ([#11705](https://github.com/dfinity/ic/pull/11705))
* [`be35a3ecf`](https://github.com/dfinity/ic/commit/be35a3ecf) Core Protocol(recovery): log downloaded checkpoint name and height ([#11680](https://github.com/dfinity/ic/pull/11680))
* [`f570aa657`](https://github.com/dfinity/ic/commit/f570aa657) Node: Improve manageboot.sh clean-up ([#11664](https://github.com/dfinity/ic/pull/11664))
* [`bf30d3348`](https://github.com/dfinity/ic/commit/bf30d3348) Node: Update Base Image Refs [2026-09-24-0808] ([#11666](https://github.com/dfinity/ic/pull/11666))
## Refactoring:
* [`e60630ddb`](https://github.com/dfinity/ic/commit/e60630ddb) Core Protocol(delegations): introduce trait to verify delegations against the replicated state ([#11706](https://github.com/dfinity/ic/pull/11706))
* [`d63108a99`](https://github.com/dfinity/ic/commit/d63108a99) Core Protocol: Track node health in `ProximityMap` ([#11697](https://github.com/dfinity/ic/pull/11697))
* [`4446fe452`](https://github.com/dfinity/ic/commit/4446fe452) Core Protocol: Extract `XNetAdvertHandlerImpl` from `XNetPayloadBuilderImpl` ([#11696](https://github.com/dfinity/ic/pull/11696))
* [`b56357952`](https://github.com/dfinity/ic/commit/b56357952) Core Protocol: extract SOCKS proxy resolution into a cache ([#11619](https://github.com/dfinity/ic/pull/11619))
* [`209c10ffa`](https://github.com/dfinity/ic/commit/209c10ffa) Core Protocol: share subnet memory accounting between install_code and management operations ([#11682](https://github.com/dfinity/ic/pull/11682))
* [`e8616d7a0`](https://github.com/dfinity/ic/commit/e8616d7a0) Core Protocol: share the up-front management instruction charge ([#11679](https://github.com/dfinity/ic/pull/11679))
* [`a6239f7ac`](https://github.com/dfinity/ic/commit/a6239f7ac) Core Protocol: account for cycles and memory usage after management operations ([#11571](https://github.com/dfinity/ic/pull/11571))
## Tests:
## Documentation:
* [`95eeb5b88`](https://github.com/dfinity/ic/commit/95eeb5b88) Core Protocol(subnet-splitting): mention splitting in registry CUPs ([#11239](https://github.com/dfinity/ic/pull/11239))
Full list of changes (including the ones that are not relevant to GuestOS) can be found on [GitHub](https://github.com/dfinity/dre/blob/6cc794d0733051252f4681533f58c081bdbfbd5e/replica-releases/2cdff28573522b2c9c5e96a4407b50281eb82b5c.md).

# IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (`sudo apt install curl`), run:

```
# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/2cdff28573522b2c9c5e96a4407b50281eb82b5c/ci/scripts/repro-check | python3 - -c 2cdff28573522b2c9c5e96a4407b50281eb82b5c --guestos
```

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing `--hostos` to the script above instead of `--guestos`, or the SetupOS by passing `--setupos`.
