Release Notes for [release-2026-09-25_03-28-base](https://github.com/dfinity/ic/tree/release-2026-09-25_03-28-base) (`d26cd031176beec51b39fbb9e39e80a3a46a748e`)
This release is based on changes since [release-2026-09-18_03-28-base](https://dashboard.internetcomputer.org/release/2c2c7c99bd526d8c3da51df32aeeb977e852292d) (`2c2c7c99bd526d8c3da51df32aeeb977e852292d`).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2026-09-18_03-28-base...release-2026-09-25_03-28-base).
## Features:
* [`d26cd0311`](https://github.com/dfinity/ic/commit/d26cd0311) Core Protocol: Fast upgrades: upgrade permit protocol types ([#11548](https://github.com/dfinity/ic/pull/11548))
* [`c17e988b9`](https://github.com/dfinity/ic/commit/c17e988b9) Core Protocol(delegations): introduce more ways of checking whether a delegation is valid w.r.t. the replicated state ([#11631](https://github.com/dfinity/ic/pull/11631))
* [`8896451e7`](https://github.com/dfinity/ic/commit/8896451e7) Core Protocol(subnet-splitting): make destination orchestrators restart the replica ([#11238](https://github.com/dfinity/ic/pull/11238))
* [`a9f7914d8`](https://github.com/dfinity/ic/commit/a9f7914d8) Core Protocol: `XNetAdvertHandler` for `XNetPayloadBuilderImpl` ([#11602](https://github.com/dfinity/ic/pull/11602))
* [`48b6f629d`](https://github.com/dfinity/ic/commit/48b6f629d) Core Protocol(crypto): add secp256r1 variant to EcdsaCurve ([#11573](https://github.com/dfinity/ic/pull/11573))
* [`82d947e19`](https://github.com/dfinity/ic/commit/82d947e19) Core Protocol: Backfill the canister-level monotonic consumed cycles by use case ([#11585](https://github.com/dfinity/ic/pull/11585))
* [`45abaf452`](https://github.com/dfinity/ic/commit/45abaf452) Core Protocol: disable unused features ([#11544](https://github.com/dfinity/ic/pull/11544))
## Bugfixes:
* [`79fce9ab7`](https://github.com/dfinity/ic/commit/79fce9ab7) Core Protocol: adjust each part of the response execution prepayment on its own ([#11431](https://github.com/dfinity/ic/pull/11431))
* [`a7c173b98`](https://github.com/dfinity/ic/commit/a7c173b98) Core Protocol: Advert classification: check for gap-free pooled slices ([#11621](https://github.com/dfinity/ic/pull/11621))
* [`2967c1cc9`](https://github.com/dfinity/ic/commit/2967c1cc9) Core Protocol(delegations): always fetch an initial delegation ([#11605](https://github.com/dfinity/ic/pull/11605))
* [`d91d72d77`](https://github.com/dfinity/ic/commit/d91d72d77) Core Protocol(execution): handle the log_memory_limit resize before the other update_settings settings ([#11614](https://github.com/dfinity/ic/pull/11614))
* [`1d7231173`](https://github.com/dfinity/ic/commit/1d7231173) Node(ic-os): make diroid look fakeroot's ownership map up by st_ino, not d_ino ([#11661](https://github.com/dfinity/ic/pull/11661))
## Chores:
* [`6d699c3d2`](https://github.com/dfinity/ic/commit/6d699c3d2) Core Protocol(core): Limit custom sections ([#11645](https://github.com/dfinity/ic/pull/11645))
* [`c7dda50be`](https://github.com/dfinity/ic/commit/c7dda50be) Core Protocol(dkg): remove summary's transcripts for remote subnets (3/4) ([#11223](https://github.com/dfinity/ic/pull/11223))
* [`847607626`](https://github.com/dfinity/ic/commit/847607626) Node: Fix a few small things across ICOS ([#11623](https://github.com/dfinity/ic/pull/11623))
* [`8c5304c48`](https://github.com/dfinity/ic/commit/8c5304c48) Node: Update Base Image Refs [2026-09-23-0133] ([#11657](https://github.com/dfinity/ic/pull/11657))
## Refactoring:
* [`03fb58230`](https://github.com/dfinity/ic/commit/03fb58230) Core Protocol(batch delivery): highlight and group together differences between data and summary blocks delivery ([#11225](https://github.com/dfinity/ic/pull/11225))
* [`7dbe6a707`](https://github.com/dfinity/ic/commit/7dbe6a707) Core Protocol: charge for `create_snapshot_from_metadata` upfront ([#11641](https://github.com/dfinity/ic/pull/11641))
* [`0e3007110`](https://github.com/dfinity/ic/commit/0e3007110) Core Protocol: read HTTP/ECDSA outcall cycles from the per-use-case map ([#11202](https://github.com/dfinity/ic/pull/11202))
* [`ccb062733`](https://github.com/dfinity/ic/commit/ccb062733) Core Protocol: account for instructions in the round limits along with their cycles ([#11640](https://github.com/dfinity/ic/pull/11640))
* [`4092ffcde`](https://github.com/dfinity/ic/commit/4092ffcde) Core Protocol(execution): charge instructions w.r.t. the old memory usage ([#11625](https://github.com/dfinity/ic/pull/11625))
* [`a6e8bf44c`](https://github.com/dfinity/ic/commit/a6e8bf44c) Core Protocol: make QueryContext owned and Send ([#11620](https://github.com/dfinity/ic/pull/11620))
## Tests:
Full list of changes (including the ones that are not relevant to GuestOS) can be found on [GitHub](https://github.com/dfinity/dre/blob/fdb97fb4478edf7c265224c4dc5150de7b1107da/replica-releases/d26cd031176beec51b39fbb9e39e80a3a46a748e.md).

# IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (`sudo apt install curl`), run:

```
# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/d26cd031176beec51b39fbb9e39e80a3a46a748e/ci/scripts/repro-check | python3 - -c d26cd031176beec51b39fbb9e39e80a3a46a748e --guestos
```

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing `--hostos` to the script above instead of `--guestos`, or the SetupOS by passing `--setupos`.
