2.13 release tracker — DevEx library PRs

[r-near]

Umbrella tracker for the nearcore 2.13 (protocol 86) rollout across the DevEx Rust stack. Gas-key design lives in #43.

Status — 2026-07-15: cascade complete, 1 crate left ✅

The full DevEx stable pass for nearcore 2.13.0 (protocol 86) is published to crates.io. Everything below is live except near-validator, which is code-complete and green but blocked on a co-maintainer approval (r-near lacks admin on that one repo).

Recap: nearcore 2.13.0 stable shipped 2026-07-09 (near/nearcore#15957) — the 0.37.0 nearcore crates went live. We then ran the stable pass across the stack in dependency order: flip every =0.37.0-rc.2 pin → 0.37.0, drop the -rc.N from each DevEx crate, default the sandbox binary to the stable 2.13.0, and republish bottom-up (jsonrpc → sandbox/socialdb → workspaces → cli → sdk/cargo-near → validator).

nearcore 2.13.0 final is protocol 86 (not 85 — a feature stabilized between rc.2 and final).

Prior phase (2026-07-02): the whole stack shipped as release candidates pinned to =0.37.0-rc.2 while nearcore held the final crates for mainnet. This stable pass supersedes those RCs.

Published — stable, live on crates.io (none yanked)

Crate	Stable	Was (RC)	PR
near-jsonrpc-client	0.22.0	0.22.0-rc.1	near/near-jsonrpc-client-rs#192
near-socialdb-client	0.16.0	0.16.0-rc.1	near/near-socialdb-client-rs#51
near-sandbox	0.3.12	0.3.12-rc.1	near/near-sandbox-rs#80 — default sandbox() binary → 2.13.0
near-workspaces	0.23.0	0.23.0-rc.1	near/near-workspaces-rs#453 — near-sandbox pin → 0.3.12
near-cli-rs	0.28.0	0.28.0-rc.1	near/near-cli-rs#616
near-sdk (+ near-contract-standards, near-sdk-macros)	5.29.0	5.29.0-rc.2	near/near-sdk-rs#1586 (+ release-plz #1583)
near-sdk-core / near-global-contracts / near-sys	4.2.2 / 0.2.5 / 0.2.13	deps-only bumps	↑ same release
cargo-near	0.22.0	0.22.0-rc.1	near/cargo-near#445
cargo-near-build	0.11.5	0.11.4	↑ same PR (picked up #442/#441 since rc.1)

Remaining

• near-validator 0.2.0 — feat: support nearcore 2.13 / post-quantum ML-DSA-65 (draft) near-validator-cli-rs#41. Green, review-clean, deps all live, current with main. Blocked on a human approval only: r-near has push+triage (not admin) on this repo, so it can't self-approve or bypass the required review. A co-maintainer with write access needs to approve Coordinate Rust 2024 edition upgrades across DevEx repos #41 → then a squash-merge publishes 0.2.0. This is the last crate in the cascade.

Follow-up

• Release tracker: 2.13.3 nearcore#15957 — nearcore 2.13.0 stable on crates.io ✅
• Flip =0.37.0-rc.2 → 0.37.0 and DevEx -rc.N → stable across the stack ✅ (except near-validator above)
• Retire the explicit sandbox_with_version(...) pins to bare sandbox() now that the default is the stable 2.13.0 binary: near-sdk examples reverted in #1586; near-workspaces tests/account.rs → chore: retire RC sandbox pin, use default sandbox() near-workspaces-rs#454 (open); near-cli / cargo-near already clean.
• Toolchain drift: repos on unpinned stable now hit Rust 1.97's useless_borrows_in_formatting clippy lint (fixed inline in near-cli#616 via clippy --fix + re-fmt); consider pinning CI toolchains or a repo sweep.
• near-socialdb-client-rs: a pre-existing malformed duplicate # Changelog H1 breaks release-plz's release-notes extractor (the v0.16.0 GH release body was populated manually) — de-dupe in a cleanup PR.
• near-api-rs — skipped for 2.13 (near-kit supersedes it). near-kit stays at 0.12.0-rc.1 (hand-rolls types, no nearcore dep; outside this pin cascade).

Release gotchas worth remembering

• near-sys version-bump discipline: near-sdk 5.29.0's first release-plz run failed publish-verify (cannot find value chain_id in crate sys) because a host-fn binding was added to near-sys without bumping its version — so cargo publish --verify built near-sdk against the stale published near-sys. Plain CI passed (path-dep). Fixed by publishing near-sys 0.2.13 first (release-plz PR #1583). Any near-sys API addition must bump + publish near-sys before/with the near-sdk release that uses it.
• near-sdk 5.29.0 raised the effective contract proto floor to 85: it unconditionally imports the 3 gas-key host fns into any Promise-using contract, and those gate on protocol 85. 5.29 contracts load fine on proto ≥85 (testnet + 2.13 mainnet + a 2.13 sandbox) but link-error (unknown or invalid import) on a proto-84 / nearcore-2.12 node. The cargo near new template and the sdk examples both resolve their sandbox to the 0.3.12 (proto-86) binary, so this is transparent there.

Post-quantum (ML-DSA-65) notes

2.13 ships initial ML-DSA-65 support. Verified end-to-end on-chain (2026-07-02, on a 2.13.0-rc.2 sandbox = proto 85; 2.13.0 stable is proto 86, behaviour unchanged): AddKey(ml-dsa-65 full-access) → on-trie handle ml-dsa-65-hash:<bs58(SHA3-256)>; view_access_key accepts the full key (nearcore hashes it to the handle server-side — the client sends the full key since the ml-dsa-65-hash: handle can't parse as a PublicKey); a transfer signed by the ML-DSA key succeeds. So near-cli online ML-DSA signing works against a 2.13 node.

Distribution-channel gotcha for on-chain tests: the S3 neard binary (what the near-sandbox Rust crate downloads) has ML-DSA + view_state pagination; the Docker image nearprotocol/sandbox of the same tag may lag — use the pre-release/master tag there.

Known 2.13 PQ limitations (not blockers): on-trie keys stored as 32-byte hashes so the full pubkey isn't recoverable (can't enumerate PQ access keys); fork-network / mirror tools skip ML-DSA-65 keys; no in-contract ML-DSA verify host fn.

Design references: #43 (NEP-611 gas keys), #47 (Ledger catch-up epic, PQ as P2).

[r-near]

near-kit client libraries (Rust + TS) — 2.13

Adding the two hand-rolled near-kit clients to this tracker. They live in r-near/*,
depend on no nearcore crates (hand-roll all types/borsh/crypto), so they are not
gated on the stable-crates trigger above — they ship on their own cadence.

Scope: full 2.13 surface, including full ML-DSA-65 signing (generate/add/sign/verify
end-to-end). Built by 4 parallel agent tracks (2 per repo, file-disjoint), one PR per WP.
near-kit-rs was already ~70% there (gas-key actions/perms, global contracts, deterministic
state init); near-kit (TS) trails it.

r-near/near-kit-rs (Rust, v0.11.2)

• RS-6 — sandbox default → latest 2.13.x
• RS-1 — ML-DSA-65 full signing (fips204)
• RS-2 — gas-key transacting (TransactionV1 + TransactionNonce + nonce_mode)
• RS-3 — DelegateV2 (action 14)
• RS-4 — view_state + pagination
• RS-5 — ExecutionMetadata V4 typed

r-near/near-kit (TypeScript, v0.14.0)

• TS-7 — sandbox default → latest 2.13.x
• TS-1 — ML-DSA-65 full signing (@noble/post-quantum)
• TS-2 — gas-key actions + permissions (catch up to rs)
• TS-3 — gas-key transacting (TransactionV1)
• TS-4 — DelegateV2 (action 14)
• TS-5 — ExecutionMetadata V4 typed
• TS-6 — view_state pagination + stabilized RPC methods (block_effects/genesis_config/maintenance_windows)

Notes: 2.13's versioned Transaction (V0/V1) is borsh-backward-compatible — existing
bare-nonce txs are valid V0, so V1 is additive (only needed for gas-key signing / strict
nonce). ML-DSA on-trie keys are stored as 32-byte hashes (ml-dsa-65-hash:), so views
can't recover the full 1952-byte pubkey — clients parse the handle without panicking.

[r-near]

near-kit 2.13 — ✅ COMPLETE (2026-06-29)

Both hand-rolled near-kit client libraries are fully on NEAR 2.13 (protocol v85). All 15 PRs merged to main, each gated on green CI and every Copilot/Codex review thread resolved.

r-near/near-kit-rs (Rust): #225 sandbox→2.13.0-rc.2 · #226 gas-key transacting (TransactionV1) · #227 DelegateV2 · #228 ML-DSA-65 full signing · #230 view_state + pagination · #231 ExecutionMetadata V4 / read-path · #232 stabilized RPC wrappers (block_effects/genesis_config/maintenance_windows)

r-near/near-kit (TS): #195 sandbox→2.13.0-rc.2 · #196 gas-key actions+permissions · #197 gas-key transacting · #198 ML-DSA-65 full signing · #199 DelegateV2 · #200 view_state + stabilized wrappers · #201 ExecutionMetadata V4 · #202 gas-key RPC view schemas

ML-DSA-65 signing proven on-chain on both sides (AddKey + ML-DSA-signed transfer accepted by a proto-85 node). Gas keys, DelegateV2, view_state pagination, and the full typed read path (so the default .send() parses 2.13 responses) all landed and tested against a 2.13 sandbox.

Note: integration tests pin the 2.13.0-rc.2 sandbox (no stable 2.13.0 image yet); ML-DSA/view_state on-chain tests use pre-release on the Rust side (the rc.2 Docker image predates the PQ merge). Revisit pins when a stable 2.13.x sandbox ships.