This release includes 4 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+7 more
Summary
AI summaryNTFY notification system removed and replaced with Push Relay across SDK, daemon, admin UI, and migrations.
Full changelog
2.13.0 (2026-04-02)
Features
- 443-01: add 3 SEO landing pages for AI wallet category keywords (a87c64b)
- 449-01: replace ntfy with push_relay in core schemas (b396882)
- 449-01: update sign-request-builder to push_relay + fix schema-ddl CHECK (cfdf198)
- 449-02: add DB v60 migration for push_relay_url + ntfy cleanup (5d081e6)
- 449-03: add sign_responses DB store + rewrite sign-response-routes (8815ccb)
- 449-03: remove ntfy code from push-relay, add direct push API (ff16b1f)
- 450-01: replace NtfySigningChannel with PushRelaySigningChannel (47a35ad)
- 450-01: update ApprovalChannelRouter and daemon startup for sdk_push (8ddebcc)
- 450-02: rewrite WalletNotificationChannel to use Push Relay HTTP POST (34bef0d)
- 451-01: add push_relay_url to WalletApp API and fix notification channel (095eec9)
- 451-01: deprecate SDK ntfy channel functions (2af5fb4)
- 451-02: update Admin UI human-wallet-apps from ntfy to Push Relay (03e1fec)
- 451-02: update wallets.tsx approval method labels from ntfy to Push (77e9f0b)
- 453-02: remove admin/setup skills and update registry/installer (921a8d4)
- 453-02: remove masterAuth content from all skill files (97d4ec4)
- 454-01: scaffold @waiaas/openclaw-plugin package (18beaf8)
- 454-02: implement 17 sessionAuth tools for OpenClaw plugin (83f0d75)
- 455-01: integrate openclaw-plugin into release and publish pipelines (75860e4)
- 455-02: rewrite openclaw-integration.md + add openclaw-plugin SEO page + rebuild site (b26d493)
- 459-01: create Tauri spike project with @reown/appkit integration (a924e7a)
- 460-01: Tauri 2 project scaffolding + SidecarManager implementation (8fb9b4e)
- 460-02: SEA binary build pipeline + native-loader + dynamic port output (6c4e8ca)
- 460-03: splash -> daemon start -> WebView navigate integration (85b4173)
- 461-01: add 4-layer tree-shaking config and CI bundle verification (2aae71b)
- 461-01: add quit_app IPC command, isDesktop() detection, and TS bridge wrappers (24b43f1)
- 461-02: add system tray module with 3-color icons, context menu, and 30s health polling (43412e7)
- 461-02: integrate system tray in main.rs with tray-icon and image-png features (00b1116)
- 462-01: Setup Wizard orchestrator + App.tsx dynamic import integration (7c19769)
- 462-01: wizard store + 5 step components for Desktop Setup Wizard (b4b89af)
- 462-02: WalletConnect QR connector + modal via daemon REST API (Plan B) (7153984)
- 462-03: wire Owner step to WalletConnect QR modal via dynamic imports (5cb0c99)
- 463-01: integrate Tauri updater plugin with Ed25519 signing config (17ce11b)
- 463-02: add 3-platform desktop release CI workflow (bff990d)
- 463-03: add auto-update UI with UpdateBanner and update-checker (3348fa3)
- 465-01: add download page with OS detection and GitHub API integration (14c6373)
- 466-01: add Desktop App distribution channels to SUBMISSION_KIT (48ef4ad)
- 466-01: add Download link to site navigation and sitemap (d8b8efd)
- add debug logging to Action Provider API clients (#412) (9d71a26)
- add debug logging to all Action Provider API clients and SDK wrappers (#412) (aa31bfd)
- add DeFi position exit and DCent Swap extended UAT scenarios (016b160)
- add Env column and --env filter to Agent UAT scenarios (4c03900)
- daemon,admin: add test sign request for wallet apps (#450) (d46e79e)
- daemon,push-relay: fix #459 session wallet query, fix #460 static_fields wiring (521b7ac)
- integrate Dev.to blog posts into waiaas.ai/blog (f9e74bb)
- push-relay: enhance debug logging for push payloads and sign responses (#458) (745fcee)
Bug Fixes
- 450-01: update remaining ntfy references in SDK tests and preset-auto-setup (efae3ff)
- add eslint-disable for @ts-ignore on optional SDK imports (0fbd32b)
- add GET /policies/:id route and fix unused import lint errors (b28c5b5)
- add missing type field to tauri.conf.json extra-file in release-please config (590d0dc)
- add non-null assertions to dcent-debug-dumper test for strict typecheck (1ded5c6)
- add subscription staggering and ILogger injection for IncomingTxMonitor (#429, #430) (f129a3c)
- admin,push-relay: resolve issues 432-436 (1ba3cb8)
- admin,push-relay: resolve issues 432-436 (0280d2e)
- align SDK test assertions with actual URL query values (4a279b4)
- ci: add workspace build step to desktop release pipeline (#471) (689a974)
- ci: disable Windows desktop build, restore release-please version sync (#472) (a8d5a02)
- ci: exclude desktop-v tags from RC auto-detection in promote workflow (7167eef)
- ci: fix release pipeline startup_failure (a43930b)
- ci: install desktop deps separately and use npx --prefix (#472) (91c6519)
- ci: mark desktop RC releases as prerelease on GitHub (20eab21)
- ci: mark desktop RC releases as prerelease on GitHub (#476) (535c70f)
- ci: merge approval-gate into deploy job to eliminate double approval (#470) (9a8a2f5)
- ci: read version from package.json instead of GitHub Releases API (#457) (b73449e)
- ci: remove tauriScript to let tauri-action install CLI itself (#472) (ce9c2d9)
- ci: replace global npm upgrade with npx npm@11 in release workflow (b07cc20)
- ci: replace global npm upgrade with npx npm@11 in release workflow (616eec9)
- ci: restore environment: production on deploy job for npm OIDC auth (75c4dc1)
- ci: scope desktop build to daemon/CLI packages only (#472) (b94bb37)
- ci: use correct package name @waiaas/desktop in turbo filter (#472) (03bfcd6)
- ci: use npx tauri instead of pnpm tauri for CLI resolution (#472) (5cf1804)
- ci: use pnpm --filter instead of turbo --filter for desktop build (#472) (1f17747)
- ci: use RELEASE_PAT for release-please auto-merge and add synchronize trigger (0a7706f)
- ci: use turbo --filter=@waiaas/cli... for scoped SEA build (#472) (33cf737)
- concise error messages for viem errors + register issue #431 (b9cd4cc)
- correct DCent Swap UAT scenario API endpoints and amounts (2a53b47)
- correct DexSwapTxParams field names in debug dumper tests (e3b165c)
- correct Lido testnet contract addresses from Holesky to Sepolia (73ef0c3)
- daemon,admin,push-relay: resolve issues 451-452 — sign request push body and toast args (e24940c)
- daemon,admin: resolve issues 437-442 (81e7405)
- daemon,wallet-sdk: add owner address to test sign request (#462) and remove ntfy remnants (#463) (81092e7)
- daemon: extract buildSignRequestPushPayload helper to fix #461 base64 format bug (7788c66)
- daemon: fix #461 admin test sign request base64 format bug (1981a78)
- daemon: promote startup step logs from debug to info level (75d5ec8)
- daemon: remove OpenAPI body schema from test-sign-request to allow empty body (d8e63d1)
- daemon: replace periodic position sync with startup-once + action-triggered (#455) (290fed4)
- daemon: replace periodic position sync with startup-once + action-triggered (#455) (d6c462c)
- daemon: resolve issue 449 — use subscription_token for Push Relay routing (42ebfb8)
- daemon: resolve issues 443-444 — approval timeout policy passthrough and hot-reload (441a431)
- daemon: resolve issues 446-448 — DELAY cancel keyboard and TX_QUEUED notification enrichment (c1e97ba)
- daemon: send flat SignRequest fields in Push Relay payload (#456) (8c1d0e5)
- db: rebuild wallets table in v60 migration to update CHECK constraint (7d933f4)
- defer PositionTracker sync and increase stagger delay (#431) (ca8613d)
- desktop build pipeline — issues #472 #473 #474 (f399203)
- desktop: add icon.ico/icon.icns and remove Apple signing env (#472) (3fe9779)
- desktop: add legacy Solana deps to esbuild external list (#472) (7705b2f)
- desktop: add remaining Solana transitive deps to esbuild external (#472) (b46972e)
- desktop: decouple desktop version from release-please (#472) (950e8c6)
- desktop: replace placeholder icons with favicon-based icon set (#474) (d0980c3)
- desktop: set Ed25519 updater public key in tauri.conf.json (#472) (8bfc4bf)
- desktop: update Windows API calls for windows crate v0.58 (#472) (2759796)
- desktop: use fixed port 3100 instead of dynamic port 0 (#473) (46dd1b2)
- extract concise one-line error messages from viem errors (#429) (1aed766)
- include error details in Telegram Bot retry warning logs (99b1002)
- IncomingTxMonitor startup stability and auto-merge CI (596805b)
- mcp: extract PKG_VERSION to version.ts to avoid ESM circular import (8ab3f9f)
- mcp: resolve tools/list empty array and inject dynamic version (#477, #478) (07a41f2)
- mcp: resolve tools/list empty array and inject dynamic version (#477, #478) (cffc072)
- normalize EVM token addresses with EIP-55 checksum validation (d0d7229), closes #379
- pass rpcUrl to Jito provider via registerBuiltInProviders and fix fetch mock reuse (6b904fd)
- pass rpcUrl to Kamino/Drift SDK, accept Pendle array response, and auto-resolve DCent decimals (0120f1b)
- promote v2.11.0-rc.27 to stable 2.11.0 (67a3828)
- promote v2.12.0-rc.16 to stable 2.12.0 (95b33a0)
- promote v2.13.0-rc.8 to stable 2.13.0 (ab194d2)
- remove build script from desktop-spike to unblock CI (bf21754)
- remove duplicate H1 title on SEO pages (ae3ba56)
- remove formatAmount() from DCent Swap API calls (646366f)
- remove ntfy channel status from admin-notifications API (be542b0)
- remove obsolete cancelTopicEdit test for removed feature (6875180)
- remove stale ntfy references from tests and admin UI (19529b7)
- remove unused testBytes variable in dcent-dex-swap test (8d8232c)
- resolve 5 open issues (#413-#417) (dc15212)
- resolve 5 open issues (#413-#417) (10313e0)
- resolve 7 open issues (#405-#411) from Agent UAT (2af859e)
- resolve 7 open issues (#405-#411) from Agent UAT (8a567e5)
- resolve issue #428 — Drift SDK authority + uninitialized user handling (466210a)
- resolve issues #391-394 — DeFi position tracking, token registry, DCent Swap (fe09ade)
- resolve issues #391-394 — DeFi positions, token registry, DCent Swap (96d0003)
- resolve issues #395-401 — DeFi providers, positions, UAT scenarios (c6c2767)
- resolve issues #395-401 — DeFi UAT, Jupiter ALT, Jito accounts, Pendle schema, SDK install, Aave decimals, PositionTracker sync (c202e4e)
- resolve issues #418-421 (e314a74)
- resolve issues #418-421 — daemon log level, DeFi UAT fixes, RPC hint (2d62a13)
- resolve issues #422-#427 — nightly CI, RPC pool seeding, Drift SDK compat, DCent swap fixes (4210b24)
- resolve issues #422-#428 — DeFi UAT fixes, RPC pool seeding, DCent swap corrections (885531d)
- resolve issues #469 #470 #471 (1547af0)
- resolve Kamino/Drift RPC URL, Pendle schema regression, and DCent decimals auto-resolution (e2e9da3)
- resolve lint errors in push-relay-signing-channel and signing-sdk-e2e test (9fbc3bb)
- resolve open issues #456, #457, #458 (ff0d22c)
- resolve open issues #459 session wallet query, #460 push relay static_fields (ae308fb)
- resolve open issues #462-#464 — owner address, ntfy cleanup, docs update (825f4aa)
- resolve open issues 437-452 (c6cb6d7)
- resolve PositionTracker RPC URLs via RpcPool for DeFi dashboard (62539c7), closes #380
- resolve TS18048 in action-api-client test mock type (0a87ea4)
- resolve type errors in SDK client-coverage test (7740848)
- resolve unused variable and empty block lint errors in CLI tests (0b9c23c)
- signing: add missing API key to sendViaRelay and fix base64 response parsing (3848624)
- signing: add missing API key to sendViaRelay and fix base64 response parsing (#465, #466, #467) (038ee36)
- site,solana: resolve Dev.to CDN cache and Solana WS 429 flood (#453, #454) (f2275dd)
- site,solana: resolve Dev.to CDN cache and Solana WS 429 flood (#453, #454) (888c902)
- site: add state=all to Dev.to API query to include all published posts (88930f0)
- site: bypass Dev.to CDN cache with API key authentication (9fc4bab)
- site: pass API key to individual Dev.to article fetches (a6675ee)
- site: replace Korean fallback text with English on download page (4f4a8ee)
- solana: resolve eslint no-this-alias and no-unsafe-function-type errors (187be72)
- solana: resolve require-yield lint errors in test async iterables (54fc046)
- update pnpm-lock.yaml for Tauri desktop dependencies (f3b5c94)
- use @ts-ignore for optional SDK imports to support CI without optional deps (c9a5dd4)
- wallet-sdk: simplify decodeInlineData to restore 100% coverage (7780a24)
Code Refactoring
- 452-01: rename docs/guides/ to docs/agent-guides/ (e235d2b)
Breaking Changes
- Removed all NTFY code, APIs, config keys (e.g., ntfy channel functions), and related behavior; replaced with Push Relay endpoints and `push_relay_url` configuration.
- Database migration v60 rebuilds the wallets table to enforce new CHECK constraints for `push_relay_url` and removes NTFY columns.
- Renamed signing channel implementation: `NtfySigningChannel` → `PushRelaySigningChannel` in core schemas and SDK.
- Admin UI components updated – notification channels now use Push Relay HTTP POST instead of NTFY endpoints.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About minhoyoo-iotrust/WAIaaS
Self-hosted wallet-as-a-service for AI agents. 60 tools for multi-chain crypto: transfers, DeFi (swap, lend, stake, bridge, perp, yield), NFTs, smart contracts, transaction signing, and x402 payments. Solana + EVM with session auth and spending policies.
Related context
Beta — feedback welcome: [email protected]