A short release that hardens the GraphQL server and fixes a Linux startup problem.

Released 6 October 2026.

Startup errors are shown

On Linux without xdg-user-dir installed, Zkool used to open a blank window and stay there. The app now falls back to the standard data directory, ~/.local/share, and any error during startup is shown on screen with its cause instead of a blank window.

FROST hardening

A signing session aborts when a participant sends more commitments than expected, and malformed messages from other participants are rejected rather than parsed.

GraphQL

The zkool_graphql server is safer to run by default and covers more of the wallet:

• The API binds to the loopback interface unless told otherwise, and running without authentication has to be asked for explicitly.
• The FROST mutations require authorization, and their integer inputs are validated.
• Creating a database requires an explicit choice between an encrypted and a plain database.
• New queries export an account's unified full viewing key for a selection of pools, import Official Ledger accounts, list voting rounds with their proposals, submit votes and poll the delivery of the helper shares.

See the GraphQL API section.

Also

• The Nix package runs the GUI straight from the binary cache, and its dependency hashes are refreshed automatically on stable releases.