Release Notes for [release-2026-06-25_04-40-base](https://github.com/dfinity/ic/tree/release-2026-06-25_04-40-base) (`feb8e5f205ad5577b2e11e56a6f94faa2d1c6116`)
This release is based on changes since [release-2026-06-18_04-52-base](https://dashboard.internetcomputer.org/release/63e7f8649be744b7ea75bd5571189a2c04ac49bd) (`63e7f8649be744b7ea75bd5571189a2c04ac49bd`).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image.
Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on [GitHub](https://github.com/dfinity/ic/compare/release-2026-06-18_04-52-base...release-2026-06-25_04-40-base).
## Features:
* [`9c15c2de7`](https://github.com/dfinity/ic/commit/9c15c2de7) Core Protocol: reject update calls for delegations with queries-only permissions ([#10449](https://github.com/dfinity/ic/pull/10449))
* [`d91a23fe1`](https://github.com/dfinity/ic/commit/d91a23fe1) Core Protocol: Drop final active blessed version components ([#10495](https://github.com/dfinity/ic/pull/10495))
* [`3b1b5251d`](https://github.com/dfinity/ic/commit/3b1b5251d) Core Protocol: new canister settings minimum_incoming_canister_call_cycles ([#10398](https://github.com/dfinity/ic/pull/10398))
* [`822f6d443`](https://github.com/dfinity/ic/commit/822f6d443) Core Protocol: enable log memory store feature ([#10514](https://github.com/dfinity/ic/pull/10514))
* [`c628a1999`](https://github.com/dfinity/ic/commit/c628a1999) Core Protocol: open app API BN's SOCKS proxy to cloud engines ([#10543](https://github.com/dfinity/ic/pull/10543))
* [`ee5856a4d`](https://github.com/dfinity/ic/commit/ee5856a4d) Core Protocol: Allow xnet on engines ([#10215](https://github.com/dfinity/ic/pull/10215))
* [`9da2368d4`](https://github.com/dfinity/ic/commit/9da2368d4) Core Protocol: make reference subnet size in CyclesAccountManager configurable at runtime ([#10469](https://github.com/dfinity/ic/pull/10469))
* [`c611d87be`](https://github.com/dfinity/ic/commit/c611d87be) Core Protocol: Set registry version of `CanisterHttpContext`s ([#10505](https://github.com/dfinity/ic/pull/10505))
* [`0d43cff6b`](https://github.com/dfinity/ic/commit/0d43cff6b) Core Protocol(firewall): prepare cloud engines' firewalls for running `ic-gateway` as a side-car to the replica ([#10500](https://github.com/dfinity/ic/pull/10500))
* [`360e2556a`](https://github.com/dfinity/ic/commit/360e2556a) Core Protocol(https-outcalls): Introduce pay-as-you-go base fee ([#10501](https://github.com/dfinity/ic/pull/10501))
* [`e2c8a0c5f`](https://github.com/dfinity/ic/commit/e2c8a0c5f) Node: hoist e2fsdroid (from platform-tools) from Dockerfile to Bazel ([#10490](https://github.com/dfinity/ic/pull/10490))
## Bugfixes:
* [`449f17a34`](https://github.com/dfinity/ic/commit/449f17a34) Core Protocol: do not record canister logs in replica logs ([#10558](https://github.com/dfinity/ic/pull/10558))
## Performance improvements:
* [`2ec1527b8`](https://github.com/dfinity/ic/commit/2ec1527b8) Core Protocol: Misc certification optimizations ([#10510](https://github.com/dfinity/ic/pull/10510))
## Chores:
* [`b4da3fc09`](https://github.com/dfinity/ic/commit/b4da3fc09) Core Protocol: Remove unused `PseudoRandomId` and error types ([#10555](https://github.com/dfinity/ic/pull/10555))
* [`3dc578c04`](https://github.com/dfinity/ic/commit/3dc578c04) Core Protocol: prune streams to deleted subnets ([#10145](https://github.com/dfinity/ic/pull/10145))
* [`e38f41837`](https://github.com/dfinity/ic/commit/e38f41837) Core Protocol: Remove `empty_signature_agreements_flag` ([#10504](https://github.com/dfinity/ic/pull/10504))
* [`07abadd9e`](https://github.com/dfinity/ic/commit/07abadd9e) Core Protocol(Core): Pass through config for DMT ([#10507](https://github.com/dfinity/ic/pull/10507))
* [`07f9659dc`](https://github.com/dfinity/ic/commit/07f9659dc) Node: Update Base Image Refs [2026-06-18-0927] ([#10502](https://github.com/dfinity/ic/pull/10502))
## Refactoring:
* [`dc426fe27`](https://github.com/dfinity/ic/commit/dc426fe27) Core Protocol: Allow references on the RHS of `left_outer_join()` ([#10527](https://github.com/dfinity/ic/pull/10527))
## Tests:
## Documentation:
Full list of changes (including the ones that are not relevant to GuestOS) can be found on [GitHub](https://github.com/dfinity/dre/blob/81ec216c18441ef07d1274518d43ce8232644b86/replica-releases/feb8e5f205ad5577b2e11e56a6f94faa2d1c6116.md).

# IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (`sudo apt install curl`), run:

```
# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/feb8e5f205ad5577b2e11e56a6f94faa2d1c6116/ci/scripts/repro-check | python3 - -c feb8e5f205ad5577b2e11e56a6f94faa2d1c6116 --guestos
```

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing `--hostos` to the script above instead of `--guestos`, or the SetupOS by passing `--setupos`.
