Resources · Changelog

Release notes.

What shipped in each minor + major. Authoritative source: npm + GitHub releases, this page is the navigable summary.

v1.1.12026-06-23
- ·Testnet faucet SDK surface for Sepolia TTT + CTTT, including headless clients, ABIs, types, errors, and React hooks.
- ·Faucet quickstart, hooks catalog, ABI/type/error reference pages, and API reference coverage.
- ·Canonical Sepolia faucet registry resolution for React read hooks, plus clearer mint hook TSDoc.
- ·First faucet release on npm: v1.1.0 was tagged but never published (release-pipeline fix), so v1.1.1 is the registry version.
v1.0.02026-05-29
- ·Public release. Three FHE products (vesting, airdrop, disperse) under their own subpaths.
- ·Branded primitives: VestingId, AirdropId, DisperseId, EncryptedHandle, plus 4 more.
- ·Eager + lazy encryptor injection (React lazy-factory pattern, Node eager).
- ·DEPLOYED_ADDRESSES baked in for Sepolia (all 3) + Ethereum mainnet (fhe-disperse).
- ·Per-product React subpaths under @tokenops/sdk/<product>/react; vesting and airdrop also expose @tokenops/sdk/<product>/advanced/react for advanced factory helpers.
- ·Two optional Zama peer deps: @zama-fhe/react-sdk and @zama-fhe/sdk (both ^3.0.0); root package ships zero FHE runtime deps (only abitype in dependencies).
- ·Security: OpenZeppelin audits published — fhe-disperse + fhe-vesting (May 2026) and fhe-airdrop (Jan 2026), 0 critical / 0 high; reports linked from /resources.

Upstream

Upstream dependencies

Known breaking changes in the @zama-fhe/sdk peer dependency, verified against the published npm typings + release notes.

Verified entries only

Every entry below was confirmed against the published npm type declarations and the Zama SDK release notes (the zama-ai/sdk repository on GitHub) before it was added. A version missing from this list means we have not verified a breaking change in it — not that none exists. Fallback when the release pages move: npm view @zama-fhe/sdk time lists every published version with its date.

@zama-fhe/sdk v3.1.02026-06-22Breaking: encrypt() return shape

encrypt() now returns contract-ready hex instead of raw bytes, and the handles field was renamed encryptedValues (release note: “return encrypt handles and proof as contract-ready hex”, SDK-200). Code that destructures handles gets undefined at runtime.

EncryptResult — published typings, 3.0.1 vs 3.1.0

// @zama-fhe/sdk <= 3.0.1
interface EncryptResult {
  handles: Uint8Array[];
  inputProof: Uint8Array;
}

// @zama-fhe/sdk >= 3.1.0 — field renamed, raw bytes -> contract-ready hex
type EncryptResult = {
  encryptedValues: `0x${string}`[]; // bytes32 hex
  inputProof: `0x${string}`;
};

Pin 3.0.x with @tokenops/sdk 1.1.1

@tokenops/sdk 1.1.1 destructures handles from the encryptor result internally, so it breaks at runtime with @zama-fhe/sdk 3.1.0 or later — even though the ^3.0.0 peer range lets the newer version install. Pin the peer until a @tokenops/sdk release notes compatibility:

package.json

json

{
  "dependencies": {
    "@tokenops/sdk": "^1.1.1",
    "@zama-fhe/sdk": "~3.0.1"
  }
}

@zama-fhe/sdk v3.2.02026-06-24No encrypt() change

Often blamed for the encrypt-shape change — it shipped two days after 3.1.0, so upgrades from 3.0.x that landed on 3.2.0 saw the breakage here first. The published 3.1.0 and 3.2.0 typings declare an identical EncryptResult; the actual boundary is 3.0.x → 3.1.0. What 3.2.0 did ship: upgrade codemods for the 3.1.0 migration and configurable, silent-by-default logging.

Pre-1.0

0.x history

Earlier work happened in the pre-launch sprint and isn't versioned here. See the SDK repo's git log for the rounds-pattern commit history.

npm publishes

Every release pushes a tarball to npm view @tokenops/sdk versions , the cleanest source-of-truth.

Back to Resources