PastaPastaPasta · Nov 2, 2026 · Oct 31, 2026 · Nov 1, 2026 · Nov 1, 2026 · Nov 2, 2026
@@ -71,6 +71,7 @@ jobs:
           git log --oneline ${COMMIT_RANGE} || echo "Could not show commit range"
 
           ./ci/dash/lint.sh
+          test/lint/cppcheck-dash.py
           du -sh "${CACHE_DIR}/cppcheck"
         shell: bash
 

@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-CLI "1" "October 2026" "dash-cli v24.0.0" "User Commands"
+.TH DASH-CLI "1" "November 2026" "dash-cli v24.0.0" "User Commands"
 .SH NAME
 dash-cli \- manual page for dash-cli v24.0.0
 .SH SYNOPSIS

@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-QT "1" "October 2026" "dash-qt v24.0.0" "User Commands"
+.TH DASH-QT "1" "November 2026" "dash-qt v24.0.0" "User Commands"
 .SH NAME
 dash-qt \- manual page for dash-qt v24.0.0
 .SH SYNOPSIS
@@ -30,9 +30,9 @@ datadir as a warning, not an error.
 If this block is in the chain assume that it and its ancestors are valid
 and potentially skip their script verification (0 to verify all,
 default:
-00000000000000119fe42827219e0686d3f7b494ae65f823194c740c5dbab492,
+000000000000000346a1804da4832b0b69dd9a7f96b14c7cb54585a9ac6ae98f,
 testnet:
-000000541a23f9db7411cddbe50f9f1ebd4aa7108ebdcad62214753f648c0239,
+000000116cd3c11d44c88cbc0a26804bd277a5d790f684ec3a8aaa820690318c,
 devnet:
 0000000000000000000000000000000000000000000000000000000000000000)
 .HP
@@ -60,10 +60,10 @@ Specify directory to hold blocks subdirectory for *.dat files (default:
 .HP
 \fB\-blocksonly\fR
 .IP
-Whether to reject transactions from network peers. Automatic broadcast
-and rebroadcast of any transactions from inbound peers is
-disabled, unless the peer has the 'forcerelay' permission. RPC
-transactions are not affected. (default: 0)
+Whether to reject transactions from network peers. Disables automatic
+broadcast and rebroadcast of transactions, unless the source peer
+has the 'forcerelay' permission. RPC transactions are not
+affected. (default: 0)
 .HP
 \fB\-chainlocknotify=\fR<cmd>
 .IP
@@ -222,10 +222,11 @@ Bind to given address and always listen on it (default: 0.0.0.0). Use
 connections to that address and port as incoming Tor connections
 (default: 127.0.0.1:9996=onion, testnet: 127.0.0.1:19996=onion,
 devnet: 127.0.0.1:19796=onion, regtest: 127.0.0.1:19896=onion).
-The default onion bind is added only when no \fB\-bind\fR is specified.
-When \fB\-listenonion\fR is enabled and \fB\-bind\fR is specified, a
-non\-wildcard =onion bind is required, and wildcard =onion binds
-are rejected.
+Without an =onion bind, the default onion bind is added unless
+\fB\-bind\fR is given and \fB\-listenonion\fR is disabled; failing to bind it
+stops startup only with an explicit \fB\-listenonion\fR=\fI\,1\/\fR, and otherwise
+no onion service is created. While \fB\-listenonion\fR is enabled, a
+wildcard =onion bind is an error.
 .HP
 \fB\-cjdnsreachable\fR
 .IP
@@ -285,7 +286,9 @@ Accept connections from outside (default: 1 if no \fB\-proxy\fR, \fB\-connect\fR
 .HP
 \fB\-listenonion\fR
 .IP
-Automatically create Tor onion service (default: 1)
+Automatically create Tor onion service if Tor is available and the onion
+bind could be bound (see \fB\-bind\fR). If set to 1 explicitly, fail to
+start if the onion bind cannot be bound (default: 1)
 .HP
 \fB\-maxconnections=\fR<n>
 .IP
@@ -426,10 +429,11 @@ download,noban,mempool,relay). Can be specified multiple times.
 .HP
 \fB\-whitelist=\fR<[permissions@]IP address or network>
 .IP
-Add permission flags to the peers connecting from the given IP address
-(e.g. 1.2.3.4) or CIDR\-notated network (e.g. 1.2.3.0/24). Uses
-the same permissions as \fB\-whitebind\fR. Can be specified multiple
-times.
+Add permission flags to the peers using the given IP address (e.g.
+1.2.3.4) or CIDR\-notated network (e.g. 1.2.3.0/24). Uses the same
+permissions as \fB\-whitebind\fR. Additional flags "in" and "out"
+control whether permissions apply to incoming connections and/or
+manual (default: incoming only). Can be specified multiple times.
 .PP
 Indexing options:
 .HP
@@ -1059,15 +1063,15 @@ Relay non\-P2SH multisig (default: 1)
 .HP
 \fB\-whitelistforcerelay\fR
 .IP
-Add 'forcerelay' permission to whitelisted inbound peers with default
+Add 'forcerelay' permission to whitelisted peers with default
 permissions. This will relay transactions even if the
 transactions were already in the mempool. (default: 0)
 .HP
 \fB\-whitelistrelay\fR
 .IP
-Add 'relay' permission to whitelisted inbound peers with default
-permissions. This will accept relayed transactions even when not
-relaying transactions (default: 1)
+Add 'relay' permission to whitelisted peers with default permissions.
+This will accept relayed transactions even when not relaying
+transactions (default: 1)
 .PP
 Block creation options:
 .HP

@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-TX "1" "October 2026" "dash-tx v24.0.0" "User Commands"
+.TH DASH-TX "1" "November 2026" "dash-tx v24.0.0" "User Commands"
 .SH NAME
 dash-tx \- manual page for dash-tx v24.0.0
 .SH SYNOPSIS

@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-UTIL "1" "October 2026" "dash-util v24.0.0" "User Commands"
+.TH DASH-UTIL "1" "November 2026" "dash-util v24.0.0" "User Commands"
 .SH NAME
 dash-util \- manual page for dash-util v24.0.0
 .SH SYNOPSIS

@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-WALLET "1" "October 2026" "dash-wallet v24.0.0" "User Commands"
+.TH DASH-WALLET "1" "November 2026" "dash-wallet v24.0.0" "User Commands"
 .SH NAME
 dash-wallet \- manual page for dash-wallet v24.0.0
 .SH DESCRIPTION

@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASHD "1" "October 2026" "dashd v24.0.0" "User Commands"
+.TH DASHD "1" "November 2026" "dashd v24.0.0" "User Commands"
 .SH NAME
 dashd \- manual page for dashd v24.0.0
 .SH SYNOPSIS
@@ -28,9 +28,9 @@ datadir as a warning, not an error.
 If this block is in the chain assume that it and its ancestors are valid
 and potentially skip their script verification (0 to verify all,
 default:
-00000000000000119fe42827219e0686d3f7b494ae65f823194c740c5dbab492,
+000000000000000346a1804da4832b0b69dd9a7f96b14c7cb54585a9ac6ae98f,
 testnet:
-000000541a23f9db7411cddbe50f9f1ebd4aa7108ebdcad62214753f648c0239,
+000000116cd3c11d44c88cbc0a26804bd277a5d790f684ec3a8aaa820690318c,
 devnet:
 0000000000000000000000000000000000000000000000000000000000000000)
 .HP
@@ -58,10 +58,10 @@ Specify directory to hold blocks subdirectory for *.dat files (default:
 .HP
 \fB\-blocksonly\fR
 .IP
-Whether to reject transactions from network peers. Automatic broadcast
-and rebroadcast of any transactions from inbound peers is
-disabled, unless the peer has the 'forcerelay' permission. RPC
-transactions are not affected. (default: 0)
+Whether to reject transactions from network peers. Disables automatic
+broadcast and rebroadcast of transactions, unless the source peer
+has the 'forcerelay' permission. RPC transactions are not
+affected. (default: 0)
 .HP
 \fB\-chainlocknotify=\fR<cmd>
 .IP
@@ -220,10 +220,11 @@ Bind to given address and always listen on it (default: 0.0.0.0). Use
 connections to that address and port as incoming Tor connections
 (default: 127.0.0.1:9996=onion, testnet: 127.0.0.1:19996=onion,
 devnet: 127.0.0.1:19796=onion, regtest: 127.0.0.1:19896=onion).
-The default onion bind is added only when no \fB\-bind\fR is specified.
-When \fB\-listenonion\fR is enabled and \fB\-bind\fR is specified, a
-non\-wildcard =onion bind is required, and wildcard =onion binds
-are rejected.
+Without an =onion bind, the default onion bind is added unless
+\fB\-bind\fR is given and \fB\-listenonion\fR is disabled; failing to bind it
+stops startup only with an explicit \fB\-listenonion\fR=\fI\,1\/\fR, and otherwise
+no onion service is created. While \fB\-listenonion\fR is enabled, a
+wildcard =onion bind is an error.
 .HP
 \fB\-cjdnsreachable\fR
 .IP
@@ -283,7 +284,9 @@ Accept connections from outside (default: 1 if no \fB\-proxy\fR, \fB\-connect\fR
 .HP
 \fB\-listenonion\fR
 .IP
-Automatically create Tor onion service (default: 1)
+Automatically create Tor onion service if Tor is available and the onion
+bind could be bound (see \fB\-bind\fR). If set to 1 explicitly, fail to
+start if the onion bind cannot be bound (default: 1)
 .HP
 \fB\-maxconnections=\fR<n>
 .IP
@@ -424,10 +427,11 @@ download,noban,mempool,relay). Can be specified multiple times.
 .HP
 \fB\-whitelist=\fR<[permissions@]IP address or network>
 .IP
-Add permission flags to the peers connecting from the given IP address
-(e.g. 1.2.3.4) or CIDR\-notated network (e.g. 1.2.3.0/24). Uses
-the same permissions as \fB\-whitebind\fR. Can be specified multiple
-times.
+Add permission flags to the peers using the given IP address (e.g.
+1.2.3.4) or CIDR\-notated network (e.g. 1.2.3.0/24). Uses the same
+permissions as \fB\-whitebind\fR. Additional flags "in" and "out"
+control whether permissions apply to incoming connections and/or
+manual (default: incoming only). Can be specified multiple times.
 .PP
 Indexing options:
 .HP
@@ -1057,15 +1061,15 @@ Relay non\-P2SH multisig (default: 1)
 .HP
 \fB\-whitelistforcerelay\fR
 .IP
-Add 'forcerelay' permission to whitelisted inbound peers with default
+Add 'forcerelay' permission to whitelisted peers with default
 permissions. This will relay transactions even if the
 transactions were already in the mempool. (default: 0)
 .HP
 \fB\-whitelistrelay\fR
 .IP
-Add 'relay' permission to whitelisted inbound peers with default
-permissions. This will accept relayed transactions even when not
-relaying transactions (default: 1)
+Add 'relay' permission to whitelisted peers with default permissions.
+This will accept relayed transactions even when not relaying
+transactions (default: 1)
 .PP
 Block creation options:
 .HP

@@ -462,6 +462,14 @@ does not accept that option. (#7294, #7285, #7577)
   participant's coins. Because admission relies on the declared directions, a
   participant whose entry deviates from what it declared has its collateral
   consumed. (#7052)
+- A wallet that still has coins to mix keeps standard mixing. It joins
+  promotion and demotion queues that other wallets opened, but only opens its
+  own when it has no standard mixing session to join or start, so a conversion
+  waiting for a counterpart never holds up mixing. (#7995)
+- A promotion prefers fully-mixed coins from different mixing transactions. If
+  there are not enough of those, it also spends coins that came out of the same
+  mixing transaction, which links them as one owner's coins, as an ordinary send
+  of the same coins would. (#7996)
 
 See [P2P and network changes](#p2p-and-network-changes) for the related
 protocol changes.
@@ -657,18 +665,30 @@ and RPC parameters.
   the mixing metadata they cannot parse. (#7052)
 - Version 2 Asset Unlock transactions are relayed by instance hash using the new
   inventory type `MSG_ASSET_UNLOCK` (protocol version 70242). (#7639)
-- Startup now fails if any configured `-bind`, `-whitebind` or the implicit Tor
-  onion-service bind (`127.0.0.1:9996` by default) cannot be set up. Dash Core
-  v23 and earlier started as long as at least one bind succeeded.
-- Nodes configured with `-bind` but no specific `-bind=<addr:port>=onion` now
-  refuse to start when `-listenonion` is enabled. This includes nodes without
-  Tor configured, since `-listenonion` is enabled by default when listening.
-  Shared binds cannot distinguish Tor-forwarded connections from direct
-  connections, which can grant Tor peers unintended IP-based whitelist
-  permissions. Nodes without `-bind`, including those using only `-whitebind`,
-  continue to get the default onion target. Users should add a specific
-  `-bind=<addr:port>=onion` to accept incoming Tor connections, or set
-  `-listenonion=0` to disable automatic onion service creation. (#7300, #7786)
+- Startup now fails if any configured `-bind` (including `-bind=...=onion`) or
+  `-whitebind` cannot be set up. Dash Core v23 and earlier started as long as
+  at least one bind succeeded. The implicit Tor onion-service bind
+  (`127.0.0.1:9996` by default) is still best effort, as in v23, unless
+  `-listenonion=1` is set explicitly. (#7300, #8003)
+- The automatic Tor onion service (`-listenonion`) only forwards to a
+  dedicated, non-wildcard onion listener that the node actually bound, so peers
+  arriving through Tor are always recognized as onion peers. Without a
+  `-bind=<addr:port>=onion`, Dash Core adds the default onion bind as v23 did,
+  also when `-bind` is given; with `-bind` and `-listenonion=0` it no longer
+  does. If the default onion bind fails, for example because another instance
+  on the same host holds it, the node logs a warning and creates no onion
+  service rather than pointing Tor at whatever holds that port. It still
+  starts and still uses Tor for outbound onion connections if its control port
+  is reachable; the debug log notes that no onion service was created. With an
+  explicit `-listenonion=1`, a failed default onion bind makes startup fail. To
+  run onion services for several instances on one host, give each its own
+  `-bind=127.0.0.1:<port>=onion`. (#7300, #7786, #8003)
+- A wildcard onion bind such as `-bind=0.0.0.0:<port>=onion` is a startup error
+  unless `-listenonion=0` is set, also with the default `-listenonion`. The node
+  can't tell which connections to a wildcard listener came through Tor, so Tor
+  peers would be treated as clearnet peers. Dash Core v23 accepted it. Use a
+  specific address such as `-bind=127.0.0.1:<port>=onion` instead. (#7786,
+  #8003)
 - `getqrinfo` requests now carry at most 4096 `baseBlockHashes`. A request with
   more is rejected and the sending peer is penalized as misbehaving. No known
   client sends more than a handful. The `quorum rotationinfo` RPC applies the
@@ -688,6 +708,11 @@ and RPC parameters.
   starts without sporks (for example after the `sporks.dat` reset) receives
   them. Repeated `getsporks` requests are ignored while the active spork set is
   unchanged. (#7893, #7343)
+- Address-based `-whitelist` permissions no longer apply to peers that connect
+  through the node's onion service. Tor forwards those peers from its own
+  address, usually `127.0.0.1`, so an entry such as `-whitelist=noban@127.0.0.1`
+  used to grant its permissions to every Tor peer. `-whitebind` is not
+  affected. (#8005)
 
 ## Mining and mempool policy
 
@@ -921,6 +946,9 @@ and RPC parameters.
 
 - `-sporkaddr` now configures a single spork address. Previously it could be
   specified multiple times to configure a set of valid spork signers. (#7505)
+- Additional flags "in" and "out" have been added to `-whitelist` to control
+  whether permissions apply to incoming connections and/or manual (default:
+  incoming only). (#8005)
 
 ### Removed options
 

@@ -83,8 +83,17 @@ it requires a Tor connection to work. It can be explicitly disabled with
 `-listenonion=0`. If it is not disabled, it can be configured using the
 `-torcontrol` and `-torpassword` settings.
 
-When enabled with an explicit `-bind`, the automatic service requires a non-wildcard onion bind such as `-bind=127.0.0.1:<port>=onion`.
-Without `-bind`, Dash Core adds the default onion bind.
+The automatic service forwards incoming connections to a dedicated,
+non-wildcard onion bind. Unless one is given with `-bind=<addr>:<port>=onion`,
+Dash Core adds the default onion bind (`127.0.0.1:9996` on mainnet). If that
+port is taken, for example by another instance on the same host, no onion
+service is created; give each instance its own `-bind=127.0.0.1:<port>=onion`.
+With `-bind` and `-listenonion=0`, the default onion bind is not added. If the
+default onion bind fails, Dash Core still uses Tor for outbound onion
+connections; only an explicit `-listenonion=1` then stops startup. A wildcard
+onion bind such as `-bind=0.0.0.0:<port>=onion` is a startup error unless
+`-listenonion=0` is set, because Dash Core can't recognize the Tor peers
+connecting to it.
 
 To see verbose Tor information in the dashd debug log, pass `-debug=tor`.