Release Notes for [release-2025-11-20_03-21-base](https://github.com/dfinity/ic/tree/release-2025-11-20_03-21-base) (`948d5b9260494ec3e6c9bc9db499f34d52ba6c7f`)
This release is based on changes since [release-2025-11-13_03-24-base](https://dashboard.internetcomputer.org/release/fa06b0e8aa683981334c6eb64b00d791e6bbbe7c) (`fa06b0e8aa683981334c6eb64b00d791e6bbbe7c`).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2025-11-13_03-24-base...release-2025-11-20_03-21-base).
## Features:
* [`9e9a4b434`](https://github.com/dfinity/ic/commit/9e9a4b434) Consensus,Interface(crypto): include sources in vault rpc error message ([#7622](https://github.com/dfinity/ic/pull/7622))
## Bugfixes:
* [`948d5b926`](https://github.com/dfinity/ic/commit/948d5b926) Interface: Fix running state machine tests with `cargo` ([#7701](https://github.com/dfinity/ic/pull/7701))
## Performance improvements:
* [`ef9303305`](https://github.com/dfinity/ic/commit/ef9303305) Consensus,Interface(crypto): Optimize the NIDKG sharing proof ([#7671](https://github.com/dfinity/ic/pull/7671))
* [`f4f58ffa0`](https://github.com/dfinity/ic/commit/f4f58ffa0) Consensus,Interface(crypto): Use multiscalar multiplication for threshold signature combination ([#7673](https://github.com/dfinity/ic/pull/7673))
## Chores:
* [`d83bc94b7`](https://github.com/dfinity/ic/commit/d83bc94b7) Consensus(crypto): Upgrade pem crate from version 1 to version 3 ([#7669](https://github.com/dfinity/ic/pull/7669))
* [`cfe1960e2`](https://github.com/dfinity/ic/commit/cfe1960e2) Consensus(crypto): Take advantage of new Edwards point conversion function ([#7672](https://github.com/dfinity/ic/pull/7672))
* [`ce42c876f`](https://github.com/dfinity/ic/commit/ce42c876f) Consensus(crypto): Make use of key encoding traits added in k256 0.12 ([#7662](https://github.com/dfinity/ic/pull/7662))
* [`b68bd59e9`](https://github.com/dfinity/ic/commit/b68bd59e9) Consensus,Interface(crypto): Remove redundant Ed25519 DER functions from basic_sig ([#7693](https://github.com/dfinity/ic/pull/7693))
* [`402c23ea5`](https://github.com/dfinity/ic/commit/402c23ea5) Consensus,Interface(crypto): Remove buggy Ed25519 PKCS8 v2 encoding function ([#7689](https://github.com/dfinity/ic/pull/7689))
* [`5a21031d0`](https://github.com/dfinity/ic/commit/5a21031d0) Consensus,Interface: Fix flaky VetKD max payload size test ([#7665](https://github.com/dfinity/ic/pull/7665))
* [`68995e6a4`](https://github.com/dfinity/ic/commit/68995e6a4) Interface: run ingress filter on latest certified state ([#7685](https://github.com/dfinity/ic/pull/7685))
* [`dede7e4fb`](https://github.com/dfinity/ic/commit/dede7e4fb) Interface: bump candid to v0.10.20 ([#7704](https://github.com/dfinity/ic/pull/7704))
* [`c333ccd6f`](https://github.com/dfinity/ic/commit/c333ccd6f) Interface: retire static testnets ([#7648](https://github.com/dfinity/ic/pull/7648))
* [`0f2ecf9aa`](https://github.com/dfinity/ic/commit/0f2ecf9aa) Interface: use versioned name for duplicated crates ([#7687](https://github.com/dfinity/ic/pull/7687))
* [`ee64a50f2`](https://github.com/dfinity/ic/commit/ee64a50f2) Interface: Extend log message for invalid stream slices during block making ([#7658](https://github.com/dfinity/ic/pull/7658))
* [`619b07581`](https://github.com/dfinity/ic/commit/619b07581) Owners: bump bazel modules ([#7684](https://github.com/dfinity/ic/pull/7684))
* [`1a274f377`](https://github.com/dfinity/ic/commit/1a274f377) Owners: bump bazel to 7.7.1 ([#7683](https://github.com/dfinity/ic/pull/7683))
* [`8cc501000`](https://github.com/dfinity/ic/commit/8cc501000) Owners: bump rules_rust to 0.67.0 ([#7659](https://github.com/dfinity/ic/pull/7659))
* [`ebb74d6b6`](https://github.com/dfinity/ic/commit/ebb74d6b6) Owners: use hermetic toolchain for arm64-linux ([#7667](https://github.com/dfinity/ic/pull/7667))
* [`f12654a01`](https://github.com/dfinity/ic/commit/f12654a01) Node: Update Base Image Refs [2025-11-13-0805] ([#7644](https://github.com/dfinity/ic/pull/7644))
## Refactoring:
* [`14535ef84`](https://github.com/dfinity/ic/commit/14535ef84) Consensus,Interface(crypto): make Send + Sync explicit for some Crypto traits ([#7634](https://github.com/dfinity/ic/pull/7634))
* [`35bde7a90`](https://github.com/dfinity/ic/commit/35bde7a90) Consensus,Interface(crypto): cleanup ic-request(-auth-delegation) domain separators ([#7635](https://github.com/dfinity/ic/pull/7635))
## Tests:
## Documentation:
Full list of changes (including the ones that are not relevant to GuestOS) can be found on [GitHub](https://github.com/dfinity/dre/blob/44695179a3f10d6eacacbb7be59a8a0e0a877ce9/replica-releases/948d5b9260494ec3e6c9bc9db499f34d52ba6c7f.md).

# IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (`sudo apt install curl`), run:

```
# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/948d5b9260494ec3e6c9bc9db499f34d52ba6c7f/ci/scripts/repro-check | python3 - -c 948d5b9260494ec3e6c9bc9db499f34d52ba6c7f --guestos
```

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing `--hostos` to the script above instead of `--guestos`, or the SetupOS by passing `--setupos`.
