Release Notes for [release-2026-09-03_04-41-base](https://github.com/dfinity/ic/tree/release-2026-09-03_04-41-base) (`7360f8f35bda2e4754bb7f2258d6852feec268e8`)
This release is based on changes since [release-2026-08-27_05-01-base](https://dashboard.internetcomputer.org/release/e9fd136f3fed6cb44625379e056ad63789d52d2c) (`e9fd136f3fed6cb44625379e056ad63789d52d2c`).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2026-08-27_05-01-base...release-2026-09-03_04-41-base).
## Features:
* [`c14df8a5b`](https://github.com/dfinity/ic/commit/c14df8a5b) Core Protocol: Enable flexible HTTP outcalls and (optionally) pay-as-you-go pricing ([#11399](https://github.com/dfinity/ic/pull/11399))
* [`2469fc76d`](https://github.com/dfinity/ic/commit/2469fc76d) Core Protocol: Add subnet_metrics management canister endpoint ([#11032](https://github.com/dfinity/ic/pull/11032))
* [`f70741a6c`](https://github.com/dfinity/ic/commit/f70741a6c) Core Protocol: Support flexible outcalls and pay-as-you-go pricing in `pocket-ic` ([#11245](https://github.com/dfinity/ic/pull/11245))
* [`f692a77f9`](https://github.com/dfinity/ic/commit/f692a77f9) Core Protocol(subnet-spiltting): deliver `Splitting` batch to DSM ([#11213](https://github.com/dfinity/ic/pull/11213))
* [`bc62af0ff`](https://github.com/dfinity/ic/commit/bc62af0ff) Core Protocol(subnet-splitting): preemptively load the post-split DKG transcripts in the key manager ([#11205](https://github.com/dfinity/ic/pull/11205))
* [`5e2b68aa6`](https://github.com/dfinity/ic/commit/5e2b68aa6) Node: New SEV checks ([#11421](https://github.com/dfinity/ic/pull/11421))
* [`82b4893ea`](https://github.com/dfinity/ic/commit/82b4893ea) Node: add sender match condition ([#11364](https://github.com/dfinity/ic/pull/11364))
## Bugfixes:
* [`880b1f521`](https://github.com/dfinity/ic/commit/880b1f521) Core Protocol(execution): Recompute the subnet available memory before draining subnet queues ([#11402](https://github.com/dfinity/ic/pull/11402))
* [`e120aa14e`](https://github.com/dfinity/ic/commit/e120aa14e) Core Protocol: Adjust the response execution prepayment to the Wasm execution mode ([#11414](https://github.com/dfinity/ic/pull/11414))
* [`e86b5d1ec`](https://github.com/dfinity/ic/commit/e86b5d1ec) Core Protocol: charge the ingress induction debit before install_code applies its Wasm state changes ([#11398](https://github.com/dfinity/ic/pull/11398))
* [`11f08eb7c`](https://github.com/dfinity/ic/commit/11f08eb7c) Core Protocol: Return `CanisterReject` on (non-)replicated HTTPS outcall out-of-cycles error ([#11393](https://github.com/dfinity/ic/pull/11393))
* [`a32d604f9`](https://github.com/dfinity/ic/commit/a32d604f9) Core Protocol: Insert HTTP outcalls pay-as-you-go refunds into the refund pool ([#11045](https://github.com/dfinity/ic/pull/11045))
* [`56ac2978a`](https://github.com/dfinity/ic/commit/56ac2978a) Core Protocol: Use the same registry version in `CatchUpPackageParam` and verification  ([#11358](https://github.com/dfinity/ic/pull/11358))
* [`98ed17c50`](https://github.com/dfinity/ic/commit/98ed17c50) Core Protocol(validator): ensure CUPs' registry versions are increasing ([#11340](https://github.com/dfinity/ic/pull/11340))
* [`7360f8f35`](https://github.com/dfinity/ic/commit/7360f8f35) Node(guestos): allow systemd-resolved to connect to networkd's resolve-hook socket ([#11413](https://github.com/dfinity/ic/pull/11413))
## Chores:
* [`2f984b407`](https://github.com/dfinity/ic/commit/2f984b407) Core Protocol(replay): remove unused `RestoreFromBackup2Cmd` struct ([#11377](https://github.com/dfinity/ic/pull/11377))
* [`1e3614fb5`](https://github.com/dfinity/ic/commit/1e3614fb5) Core Protocol: Remove prefetching memory tracker ([#11295](https://github.com/dfinity/ic/pull/11295))
* [`2d67f335c`](https://github.com/dfinity/ic/commit/2d67f335c) Core Protocol: Remove temporary metric ([#11293](https://github.com/dfinity/ic/pull/11293))
* [`d9fd141cb`](https://github.com/dfinity/ic/commit/d9fd141cb) Core Protocol: Add the `RequestId` to `VetKdArgs` ([#11333](https://github.com/dfinity/ic/pull/11333))
* [`5a0c6ee38`](https://github.com/dfinity/ic/commit/5a0c6ee38) Core Protocol: Rename config ([#11289](https://github.com/dfinity/ic/pull/11289))
* [`e01214738`](https://github.com/dfinity/ic/commit/e01214738) Node: Great simplification of SEV key exchange ([#11354](https://github.com/dfinity/ic/pull/11354))
* [`507868454`](https://github.com/dfinity/ic/commit/507868454) Node: Update Base Image Refs [2026-09-01-0142] ([#11385](https://github.com/dfinity/ic/pull/11385))
* [`2e9c52e3f`](https://github.com/dfinity/ic/commit/2e9c52e3f) Node: Update Base Image Refs [2026-08-27-1119] ([#11350](https://github.com/dfinity/ic/pull/11350))
## Refactoring:
* [`c2cebaff7`](https://github.com/dfinity/ic/commit/c2cebaff7) Core Protocol: Hold the whole consumed-cycles total in SubnetMetrics ([#11335](https://github.com/dfinity/ic/pull/11335))
## Tests:
## Documentation:
Full list of changes (including the ones that are not relevant to GuestOS) can be found on [GitHub](https://github.com/dfinity/dre/blob/409d4e93df458d7d8c9dbc5aedfb15f633c20201/replica-releases/7360f8f35bda2e4754bb7f2258d6852feec268e8.md).

# IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (`sudo apt install curl`), run:

```
# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/7360f8f35bda2e4754bb7f2258d6852feec268e8/ci/scripts/repro-check | python3 - -c 7360f8f35bda2e4754bb7f2258d6852feec268e8 --guestos
```

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing `--hostos` to the script above instead of `--guestos`, or the SetupOS by passing `--setupos`.
