[sdp-release-bot]

Release 0.87.0

This pull request was generated by the release workflow.

Auto-merge is enabled. After review approval and required checks pass, GitHub will squash-merge this PR and the release workflow will publish the tag and GitHub release.

Required repository settings: Allow auto-merge and Allow squash merging.

0.87.0 (2026-10-21)

⚠ BREAKING CHANGES

• payments: the Fee Payer reads the cluster scope; Kora only, sponsored sends on the pool (#2438) (cf4e5aa)
• db: drop the legacy API-key schema after the code ships (#2398) (af98fcc)
• api: authorize every API-key request from its live row; keys can't manage keys (#2393) (7916af1)

Features

• payments: revoke a wallet's Subscriptions authority once its recurring payments end (#2488) (fab1371)
• web: drop the % change from Overview's network figures (#2490) (86f06e6)
• api: refuse to boot without a managed RPC endpoint per cluster (#2487) (0e3c905)
• payments: save each recurring step's expiry on its attempt row (#2452) (6f358e9)
• payments: the Fee Payer reads the cluster scope; Kora only, sponsored sends on the pool (#2438) (cf4e5aa)
• web: run the API playground on the dashboard session (#2433) (fbfa795)
• custody: dashboard-only devnet faucet replaces the RPC relay (HOO-2168) (#2420) (f356efc)
• api: sweep ramp transfer statuses and expire abandoned checkouts (#2425) (c5a7374)
• api: a key's wallet scope applies wherever SDP signs (#2397) (118d930)
• api: API keys hold explicit module grants instead of roles (#2395) (c419647)
• api: authorize every API-key request from its live row; keys can't manage keys (#2393) (7916af1)
• payments: add fetchTransferStatus to the ramp provider contract (#2424) (ab547bd)
• issuance: [10/11] redesign the Issuance list, draft flow and token page (#2175) (8ab985c)

Bug Fixes

• security: retire the eMudhra TLS preload for Node 24.22.1's native fix (#2489) (6718e51)
• web: make ramp quotes, the review and payment lists read true (#2447) (dcbff6b)
• web: make the off-ramp's last step and open sales actionable (#2446) (73390f0)
• payments: recurring step recovery proves a saved send expired before sending it again (#2472) (5e02205)
• web: read each ramp's status from its whole transfer (#2445) (49a66f7)
• payments: fence unstarted submission expiry (APE-656) (#2484) (c700404)
• payments: fence unsigned transfer timeouts (APE-768) (#2483) (1221450)
• payments: stop addressing payment requests to a counterparty (#2476) (c61d42a)
• payments: reject sponsor-funded pay-link payments (APE-606) (#2482) (11dd99b)
• web: one deposit skeleton for the route and the panel, in the page's own column (#2471) (a2d4f70)
• ramps: keep ramp rows true to the provider and the chain (#2444) (02185b0)
• security: distrust compromised eMudhra CA paths in Node (#2465) (7c468ea)
• api: require an explicit proxy-trust assertion for client IPs (APE-810) (#2442) (7ab83b8)
• wallets: price balances only from Jupiter, and only on mainnet (#2437) (ea94a44)
• payments: refuse an out-of-scope recurring cancel before claiming it (#2435) (2cacaaa)
• api: one refusal shape for API-key denials, and an inventory of early wallet-scope refusals (#2434) (7530c5b)
• web: bind the API-key flash to its auth scope and redact the docs key screenshot (#2432) (639d6ce)
• ramps: refuse an underfunded off-ramp deposit before claiming it (#2427) (bef7b68)
• db: give the ramp poll migrations their own numbers (0145-0147) (#2431) (5817b96)
• ramps: refuse on-ramp delivery proof older than the transfer (#2426) (b73ce95)
• ramp-support: guard the rail refresh and fix its PR step (#2423) (25ea436)
• ramps: verify settlement before completion (HOO-2039) (#2422) (bcb972b)
• web: send an Idempotency-Key on ramp quote POSTs (#2421) (050604d)
• guard MoonPay settlement correlation and ordering (#2415) (dd0eae2)
• compliance: restrict module to experimental deployments (#2418) (6440e08)
• payments: resumed recurring attempts read the chain before sending a step again (HOO-2044) (#2400) (a58ed90)
• wallets: move every managed custody provider but Privy back to beta (#2391) (efa2e7b)
• ramps: guard settlement environment (HOO-2039 PR A) (#2387) (4d9779f)
• payments: keep money keys while processing, canonical batch options, bounded audit Redis (HOO-1918 follow-ups) (#2385) (690ed99)
• payments: enable mainnet fee sponsorship (#2390) (dae1356)

Performance Improvements

• api: cache query plans and answer 503 when the database pool is exhausted (#2388) (044a4cd)

Documentation

• api: record that data.solana.com answers gzip (#2486) (068c793)
• ramps: add a local sandbox testing guide and webhook forwarder (#2428) (3b8fbaa)

Refactors

• payments: finish the ramp provider contract (HOO-2086) (#2492) (62f935e)
• web: run the API playground through a catch-all proxy (#2440) (1a50cdd)
• payments: type RPC clients as SolanaRpc, not ReturnType (#2419) (23deaa4)
• api: run every background cron as a Cron Definition on the worker (#2414) (9744867)
• payments: write every ramp status through the transition table (HOO-2087) (#2417) (7951272)
• repo: replace parent-relative imports with workspace aliases (#2408) (bdb579a)
• repo: enforce import hygiene: no relays, no cycles, declared dependencies, script imports linted in full (#2407) (0d90a60)
• packages: delete package entry barrels; exports lists name each public file (#2406) (690b3ef)
• api: import from defining files, no re-exports in sdp-api (#2404) (43f41eb)
• repo: named exports everywhere a framework does not read the default (#2403) (a6998c4)

Maintenance

• dev: run pnpm dev in many worktrees at once (#2443) (efa00bc)
• payments: drop the retired signAndSend stubs from two recurring scope tests (#2451) (aa99278)
• db: drop the legacy API-key schema after the code ships (#2398) (af98fcc)
• api: run local cron in its own dev worker (#2363) (e375ee4)
• api: drop the unused @solana/transactions dependency (#2412) (4123423)
• issuance: drop the redesign E2E's rate-limit sleeps (#2409) (95dae44)
• repo: trim dead files and duplicate dependencies (#2402) (0c66e14)
• web: stop the cross-tab theme e2e signing both tabs out (#2401) (b21297e)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sdp-docs	Ready	Preview	Oct 21, 2026 8:20pm UTC
sdp-web (dev)	Ready	Preview	Oct 21, 2026 8:20pm UTC
sdp-web	Building	Preview	Oct 21, 2026 8:20pm UTC

[greptile-apps]

Confidence Score: 5/5

[Low impact] This release-only PR appears safe to merge.

Summary

Prepares release 0.87.0.

• The project records version 0.87.0 across its release files.

_{Reviews (35) · Last reviewed commit: "chore(main): release 0.87.0" · Reviewed by Greptile}

[sdp-release-bot]

Eve translation sync

• Status: partial
• Impacted locales: es (1117), fr (1117), pt (1117), vi (1117)
• Newly discovered locales: None
• Existing locales updated: es, fr, pt, vi
• Missing strings: 4468
• Stale strings re-translated: 0
• Generated strings: 4418
• Eve agent: sdp-translation-agent.vercel.app
• Model: deepseek/deepseek-v4-flash
• Context: product and locale background, translation instructions, terminology, key namespace, and up to 6 nearby catalog entries
• Requests: 92
• Failed batches: 1 (50 strings deferred to the next run)
• Generated files: es/dashboard-custody.json, es/dashboard-earn.json, es/dashboard-issuance.json, es/dashboard-payments.json, es/dashboard-private-channels.json, es/shared.json, fr/dashboard-custody.json, fr/dashboard-earn.json, fr/dashboard-issuance.json, fr/dashboard-payments.json, fr/dashboard-private-channels.json, fr/shared.json, pt/dashboard-custody.json, pt/dashboard-earn.json, pt/dashboard-issuance.json, pt/dashboard-payments.json, pt/dashboard-private-channels.json, pt/shared.json, vi/dashboard-custody.json, vi/dashboard-earn.json, vi/dashboard-issuance.json, vi/dashboard-payments.json, vi/dashboard-private-channels.json, vi/shared.json

Failed batches

• es (50 strings): Translation terminology validation failed:
  es:DashboardCustody.walletAllowListOne uses discouraged "allow list"; use allowlist
  es:DashboardCustody.walletAllowListCount uses discouraged "allow list"; use allowlist

Generated values are LLM-assisted and require normal review.

[greptile-apps]

Decimal commas change the amount

The new Portuguese amountPlaceholder shows 0,00, but SupplyOperationForm deletes commas instead of treating them as decimal separators. A user following this format and entering 1,50 gets 150, which becomes the amount sent for minting or burning. Keep the placeholder as 0.00 until the input supports comma decimals.

Suggested change

	"amountPlaceholder": "0,00",
	"amountPlaceholder": "0.00",

[greptile-apps]

Reversibility label says the opposite

The Vietnamese reversible label means “Irreversible,” which reverses the English question. The deploy page pairs it with “No,” while the draft review pairs it with “Yes.” Both answers now contradict their explanations, leaving users unsure whether they can change a draft or reverse a deployment. Use “Có thể đảo ngược” so the label asks whether the action can be reversed.

Suggested change

	"reversible": "Không thể đảo ngược",
	"reversible": "Có thể đảo ngược",

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!