Welcome to this week’s Weekly Development Report, highlighting continued progress across the ecosystem, with a focus on reliability, compatibility, and keeping our applications and tools aligned with the latest Mainsail changes. This week, Mainsail saw significant improvements to P2P communication, transaction validation, and data handling, alongside further work on snapshot imports and network stability. Dependency updates also continued across ARK Scan and ARK Vault, while the SDKs and documentation received updates to validator proof-of-possession functionality and compatibility with newer framework versions. Work on ARK Pricing also progressed, bringing market and exchange data integration closer to a consistent approach across the ecosystem.
Development Activity Summary (October 09 – October 16, 2026)
Below is a breakdown of the total number of merged commits and contributing authors by project, highlighting development activity from October 09, 2026, to October 16, 2026.
| Project | Commits | Authors |
|---|---|---|
| ARK Connect | 0 | 0 |
| ARK Scan | 22 | 2 |
| ARK SDKs & Docs | 38 | 3 |
| ARK Vault | 78 | 3 |
| Mainsail | 35 | 2 |
In total, 173 commits were merged across all projects this week. As always, commit counts fluctuate with sprint focus and task complexity.
ARK Scan Weekly Report
This week’s ARK Scan work focused on improving forging statistics reliability, aligning the application with the latest foundation updates, and consolidating market data integration through ARK Pricing.
Work continued on integrating ARK Pricing as the central source for market data across the ecosystem. A new ArkPricing market data provider was implemented in ARK Scan to route pricing and historical data requests through the ARK Pricing service instead of accessing third-party APIs directly. This provides a consistent integration point and allows the market data provider to be configured through environment variables. In parallel, the market data architecture was simplified to rely on ARK Pricing rather than maintaining separate providers in ARK Scan. Exchange data handling was also moved toward ARK Pricing, with exchange information fetched and maintained through commands and jobs and exposed through a dedicated endpoint. This allows exchange data to be formatted consistently and shared across products without each application needing to fetch and process data individually.
Dependency updates were also applied to the regular develop branch, bringing it in line with the Mainsail branch. This included upgrading to PHP 8.5, Node.js 24, pnpm 12, and the latest compatible dependencies.
Next week, we’ll continue updating dependencies across ARK Scan, address any compatibility issues arising from the upgrades, and continue refining the ARK Pricing integration to improve consistency in how market and exchange data is handled across the ecosystem.
ARK SDKs & Documentation Weekly Report
This week’s Documentation and SDKs work focused on aligning validator proof-of-possession (PoP) functionality across the ecosystem, updating the documentation to reflect the latest API changes, and improving compatibility with newer Laravel versions.
The documentation site was updated to describe the new validatorProof method and its use of the registrant address when generating validator transaction proofs. The PHP Client SDK was also updated to support Laravel 12 and 13, removing a dependency constraint that prevented applications such as the ARK Faucet from upgrading to Laravel 13 and Foundation 22. Version 3.0.2 was prepared with these compatibility changes.
In the Go Crypto SDK, validator PoP generation was updated to bind proofs to both the configured chain ID and the registrant address, preventing them from being reused by another account or on a different network. The relevant transaction builders, encoding methods, and mnemonic-related functions were updated to accept the registrant address. Address validation, including EIP-55 checksum verification, was added, alongside tests covering Mainsail’s reference vectors, chain and address binding, and invalid addresses. The transaction fixtures and shared multi-language BLS test fixture were also regenerated.
The Java Crypto SDK received similar updates to align with Mainsail’s new PoP format. The validatorPassphrase() method was replaced with validatorProof(), and the validator registration and update builders now require the registrant address. The chain ID is derived from the SDK’s configured network, and invalid or incorrectly checksummed addresses now produce an error rather than generating a proof for the wrong account.
Next week, we’ll continue updating dependencies across the SDKs and documentation projects, address any compatibility issues that arise, and keep the client libraries aligned with the latest Mainsail changes. We’ll also continue reviewing the updated validator transaction APIs and their documentation to maintain consistency across supported languages.
ARK Vault Weekly Report
This week’s ARK Vault work focused on aligning validator transactions with the latest Mainsail changes, improving address display behavior, and completing a broad set of dependency upgrades across the application.
Validator registration and update transactions were adjusted to pass only the registrant address when generating proof of possession, with the chain ID now derived from the currently selected network. An issue with address truncation in the transaction table was also fixed to ensure that the recipient address remains visible when an imported address is removed from the side panel.
A significant part of this week’s work involved updating the application’s core dependencies and development toolchain. React Router was upgraded to v8 alongside React and its related type packages, while React Hook Form was upgraded from v6 to v7, requiring changes across the application’s forms, validation handling, and field state management. Vitest was upgraded to v5, and Mock Service Worker to v3, with corresponding updates to test configuration, mocks, snapshots, and asynchronous test handling. The Vite toolchain was also updated, alongside Tailwind CSS, Prettier, ESLint, i18next, viem, and several smaller dependencies. The Tailwind CSS update also allowed the removal of the unused Autoprefixer dependency.
Additional updates included upgrading jsdom to v30 and Cucumber to v13, raising the minimum supported Node.js version to 24.15.0, and updating Ledger integration packages. The react-hook-form migration also addressed several behavioral differences, including authentication form values persisting after navigation, server form validation states, and asynchronous field validation. Related E2E and unit tests were updated to accommodate the new versions, improve reliability, and prevent unmocked API requests from reaching external hosts during testing. Finally, the deprecated crypto-js library was replaced.
Next week, we’ll continue updating dependencies across ARK Vault, address any remaining compatibility issues, and carry out further testing to ensure the upgraded application remains stable. We’ll also continue checking the main transaction flows and integrations as the dependency updates are consolidated.
Mainsail Weekly Report
This week’s Mainsail work focused on hardening transaction decoding, improving API sync and genesis handling, and a broad round of reliability and security improvements across the P2P layer.
Genesis block handling was improved so that genesis data is only seeded if the genesis block has not yet been committed. To support this, initializeGenesis was split into two methods: initializeGenesis now only sets the genesis info without touching the database, while the new seedGenesisAccount stores genesis block data to the LMDB store. The snapshot importer was also updated to reject duplicate wallets.
Transaction decoding was tightened to reject non-canonical RLP encoding. An off-by-one error in the field-count guard, which allowed an 11th RLP field, was fixed. Empty legacy second signature fields are now rejected instead of being treated as “no signature,” and RLP lengths are now decoded without 32-bit overflow, preventing overlong length prefixes from wrapping around into valid lengths.
On the API sync side, several wallet storage issues were resolved. Validators without an account update no longer end up with -1 stored as their balance and nonce, since a 0/0 row is now inserted first so the upsert always updates an existing row. Legacy attributes such as multiSignature and legacyMerge are now kept as jsonb rather than being converted into JSON strings on subsequent updates. Cold wallet merges now run after the wallet upsert, so they also apply to wallets that already exist, and merged wallets receive the correct legacy flags and attributes. Untrusted EVM data that cannot be stored is now skipped.
The P2P layer received the most attention this week. GetMessages and GetProposal requests now carry an explicit query pinned to a specific block number and round, and the responder serves exactly that round or nothing. This removes timing races in which honest replies were judged against a target that had already moved, causing peers to be wrongly banned. Incomplete replies are now logged instead of resulting in a ban, precommit minorities now trigger full downloads in line with the consensus rule, and the payload limit scales with validator count. Header bitmaps were also made more compact, using a single count byte plus a packed bigint instead of one byte per validator.
Peer acceptance was fixed so that already-accepted peers are no longer disconnected when their subnet reaches its limit. Previously, this caused repeated rejections and re-verification. The --disableDiscovery flag no longer isolates the node: inbound requests and configured seed peers are still handled, and the node only stops learning about new peers. Pending IPs are now always released, even when an acceptance step fails.
Connection handling was improved with a 10-second timeout on outbound connects, so unreachable addresses no longer stall peer discovery for minutes. Only one in-flight connection per peer is now allowed, which prevents duplicate clients, and IPv6 addresses are correctly bracketed in all HTTP URLs. Stale API nodes are also revalidated again after two inverted time checks were fixed, and API node verification now handles missing or differently-cased headers correctly.
The socket server was hardened by capping postMessage payloads at 1 KB, down from 3 MB, since a serialized vote is only around 140 bytes. Request headers are now validated as strictly as replies, and validation errors are more concise. In the block downloader, a successor job that is already ready is now processed immediately instead of waiting for the next header event. Unused code was also removed from Peer and related contracts, including an unused transactions queue, with no change in behavior.
Next week, we’ll continue improving snapshot imports and the P2P layer, with a focus on import reliability, peer communication, and handling edge cases under different network conditions.
Feedback & Feature Requests
If you are using our open-source products and would like to provide feedback or request a feature, please feel free to contact us via the contact pages for the specific product you are using or open an issue on GitHub.
Quick access links to GitHub issues pages:
Follow Us on X
Follow us on X and keep an eye on the blog to stay up to date with everything we ship. We publish a development report every week so you can follow along as the ecosystem grows.
