Testnet v1.25.0-rc is live, bringing protocol version 28 with updates across validators, indexer, JSON-RPC, GraphQL, CLI, and the Rust SDK. This release focuses on Move-based authentication, improved DoS protection, and several deprecations. Here’s what’s new:

Protocol Updates

• Protocol version 28 ships with enhanced Move authenticator functionality. Two new AuthContext accessors—sender_authenticator_function_info_v1() and sponsor_authenticator_function_info_v1()—let contracts inspect which authenticator functions were used during transaction execution (#11626).
• Move-based account authentication is now enabled on mainnet, while sponsor account authentication is available on testnet. The max_auth_gas parameter is set to 0.00002 IOTA for both (#11708).

Validator and Full Node Changes

• DoS protection defaults to enabled in dryRun mode for validators. A new admin API endpoint allows hot-reconfiguring traffic control policies without clearing blocklists. Metrics for blocked requests and blocklist length are now accurate (#11598).
• The unused PassthroughCache execution cache is removed. WritebackCache is now the sole supported implementation. Config fields like execution-cache and the DISABLE_WRITEBACK_CACHE env var are deprecated and should be removed from configs (#11680).
• Two new RocksDB column families—scoring_metrics and received_reports_state—are auto-created on epoch store open. These persist Starfish misbehavior counts and per-validator report tallies across restarts. No migration required (#11569).

Indexer Updates

• The --epochs-to-keep flag is scheduled for removal in v1.28. Migrate to --pruning-config-path (#11692).
• The objects_snapshot ingestion pipeline is removed. Related CLI flags and the OBJECTS_SNAPSHOT_MIN_CHECKPOINT_LAG env var are deprecated and will log warnings if set. Full removal is planned for v1.31 (#11709).

JSON-RPC Fixes

• Several IotaValidatorSummary fields now serialize correctly as Base64 instead of byte arrays: next_epoch_authority_pubkey_bytes, next_epoch_proof_of_possession, next_epoch_network_pubkey_bytes, and next_epoch_protocol_pubkey_bytes (#11702).

GraphQL Enhancements

• Subscriptions for Event and TransactionBlock now support resuming from a specific transaction digest via the startAfter parameter (#11635).
• Validator APY calculations now include the current epoch for consistency with JSON-RPC (#11655).
• TransactionBlockFilter.signAddress and AddressTransactionBlockRelationship.SIGN are replaced by TransactionBlockFilter.sentAddress and AddressTransactionBlockRelationship.SENT, respectively (#11595).

CLI Updates

• Accounts with authenticator functions requiring no additional arguments can now create MoveAuthenticators (#11684).

Rust SDK Changes

• iota_types::effects::TransactionEvents is now a tuple struct re-exported from iota_sdk_types. Call sites must switch from events.data to events.0 (#11633).
• iota_types::transfer::Receiving::{struct_tag, type_tag} now require a TypeTag argument. The unused MoveTypeTagTrait for Config is removed (#11556).
• iota_types::multisig::MultiSig and MultiSigPublicKey are re-exported from iota_sdk_types. Constructors and accessors are updated—use MultiSigPublicKey::new(members, threshold) and committee().members() instead of pk_map (#11505).

This testnet release includes breaking changes and deprecations. Ensure your configs, scripts, and integrations are updated before these changes hit mainnet. Full details and migration paths are in the release notes.

Sources: v1.25.0-rc