Release Notes for [release-2025-11-28_03-22-base](https://github.com/dfinity/ic/tree/release-2025-11-28_03-22-base) (`724ae4101bfdd8d4443126a6a8b1ec5ca9b68a12`)
This release is based on changes since [release-2025-11-20_03-21-base](https://dashboard.internetcomputer.org/release/948d5b9260494ec3e6c9bc9db499f34d52ba6c7f) (`948d5b9260494ec3e6c9bc9db499f34d52ba6c7f`).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2025-11-20_03-21-base...release-2025-11-28_03-22-base).
## Features:
* [`12342de72`](https://github.com/dfinity/ic/commit/12342de72) Consensus: Add endpoint for requesting `SignedIDkgDealing` in block ([#7698](https://github.com/dfinity/ic/pull/7698))
* [`99e994055`](https://github.com/dfinity/ic/commit/99e994055) Consensus(crypto): check NiDkgConfig invariants upon serde deserialization ([#7769](https://github.com/dfinity/ic/pull/7769))
* [`2765aee26`](https://github.com/dfinity/ic/commit/2765aee26) Consensus(outcalls): make app subnets use API boundary nodes ([#7586](https://github.com/dfinity/ic/pull/7586))
* [`55c2dab26`](https://github.com/dfinity/ic/commit/55c2dab26) Node: NNS recovery UX improvements ([#7655](https://github.com/dfinity/ic/pull/7655))
## Bugfixes:
* [`e23802192`](https://github.com/dfinity/ic/commit/e23802192) Consensus,Node: opening up observability and upgrade ports for own prefix for API BNs ([#7843](https://github.com/dfinity/ic/pull/7843))
* [`7f7af7f98`](https://github.com/dfinity/ic/commit/7f7af7f98) DSM: mark ftruncate call as unsafe on Darwin ([#7746](https://github.com/dfinity/ic/pull/7746))
## Performance improvements:
* [`0f07c7d5d`](https://github.com/dfinity/ic/commit/0f07c7d5d) Consensus: avoid some clones in block assembler ([#7573](https://github.com/dfinity/ic/pull/7573))
* [`a014b9281`](https://github.com/dfinity/ic/commit/a014b9281) Consensus(crypto): Add G2Affine::deserialize_cached, enabling public key validation caching ([#7663](https://github.com/dfinity/ic/pull/7663))
* [`dc7789e92`](https://github.com/dfinity/ic/commit/dc7789e92) Consensus(crypto): Add variable time mul2 to BLS12-381 crate ([#7666](https://github.com/dfinity/ic/pull/7666))
* [`5dbb246cd`](https://github.com/dfinity/ic/commit/5dbb246cd) DSM: Bump state sync version for file group chunks ([#7640](https://github.com/dfinity/ic/pull/7640))
## Chores:
* [`766861264`](https://github.com/dfinity/ic/commit/766861264) Consensus: Fix flaky VetKD unknown contexts test ([#7822](https://github.com/dfinity/ic/pull/7822))
* [`b0ea5e970`](https://github.com/dfinity/ic/commit/b0ea5e970) Consensus(orchestrator): log more info about local CUP before persisting it ([#7487](https://github.com/dfinity/ic/pull/7487))
* [`221ea71ae`](https://github.com/dfinity/ic/commit/221ea71ae) Consensus(btc-adapter): log error returned from pruning headers ([#7798](https://github.com/dfinity/ic/pull/7798))
* [`955f234c1`](https://github.com/dfinity/ic/commit/955f234c1) Consensus(crypto): Check the NiDkgConfig invariants upon deserialization ([#7750](https://github.com/dfinity/ic/pull/7750))
* [`7400d10c7`](https://github.com/dfinity/ic/commit/7400d10c7) Consensus(crypto): remove ignored crypto config test ([#7777](https://github.com/dfinity/ic/pull/7777))
* [`08cb7128c`](https://github.com/dfinity/ic/commit/08cb7128c) Consensus(crypto): Remove ic_crypto_internal_sha2::Context trait ([#7725](https://github.com/dfinity/ic/pull/7725))
* [`961e775ea`](https://github.com/dfinity/ic/commit/961e775ea) Consensus(crypto): Remove duplicate methods on CspPublicKey ([#7728](https://github.com/dfinity/ic/pull/7728))
* [`6b660d7cc`](https://github.com/dfinity/ic/commit/6b660d7cc) Consensus,Interface,DSM: default to latest syn ([#7735](https://github.com/dfinity/ic/pull/7735))
* [`f5b2ce58a`](https://github.com/dfinity/ic/commit/f5b2ce58a) Consensus,DSM(consensus): Introduce an enum to the `Batch` struct containing, among others, an instruction to split the state ([#7476](https://github.com/dfinity/ic/pull/7476))
* [`f483a6cff`](https://github.com/dfinity/ic/commit/f483a6cff) Node: Update Base Image Refs [2025-11-27-0804] ([#7828](https://github.com/dfinity/ic/pull/7828))
* [`4f986cf42`](https://github.com/dfinity/ic/commit/4f986cf42) Node: Update Base Image Refs [2025-11-20-0830] ([#7726](https://github.com/dfinity/ic/pull/7726))
* [`9594a23f5`](https://github.com/dfinity/ic/commit/9594a23f5) Node: switch NTP to NTS ([#7686](https://github.com/dfinity/ic/pull/7686))
* [`b6af14666`](https://github.com/dfinity/ic/commit/b6af14666) Node,DSM: ic-cdk v0.19 & ic-cdk-timers v1.0.0 ([#7494](https://github.com/dfinity/ic/pull/7494))
* [`328519370`](https://github.com/dfinity/ic/commit/328519370) Node,DSM: Update `ic-bn-lib` / `ic-gateway` crates ([#7772](https://github.com/dfinity/ic/pull/7772))
* [`8788a9dbf`](https://github.com/dfinity/ic/commit/8788a9dbf) DSM: Add failed blockmakers metric with node ID label ([#7729](https://github.com/dfinity/ic/pull/7729))
* [`7e2982c62`](https://github.com/dfinity/ic/commit/7e2982c62) DSM: use syn alias for ic-heap-bytes-derive ([#7742](https://github.com/dfinity/ic/pull/7742))
## Refactoring:
* [`ced8847c7`](https://github.com/dfinity/ic/commit/ced8847c7) Consensus: move registry client polling logic inside the replicator ([#5909](https://github.com/dfinity/ic/pull/5909))
* [`ff2990494`](https://github.com/dfinity/ic/commit/ff2990494) Interface: cleanup CanisterLog code ([#7796](https://github.com/dfinity/ic/pull/7796))
## Tests:
* [`10946c4c6`](https://github.com/dfinity/ic/commit/10946c4c6) Consensus(crypto): add canister signature system tests ([#7745](https://github.com/dfinity/ic/pull/7745))
Full list of changes (including the ones that are not relevant to GuestOS) can be found on [GitHub](https://github.com/dfinity/dre/blob/b9c0fb8ccdaba51b65019a4f4e8cc7754e8abfa8/replica-releases/724ae4101bfdd8d4443126a6a8b1ec5ca9b68a12.md).

# IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (`sudo apt install curl`), run:

```
# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/724ae4101bfdd8d4443126a6a8b1ec5ca9b68a12/ci/scripts/repro-check | python3 - -c 724ae4101bfdd8d4443126a6a8b1ec5ca9b68a12 --guestos
```

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing `--hostos` to the script above instead of `--guestos`, or the SetupOS by passing `--setupos`.
