Radicle 1.7: updates to P2P Git platform

# Radicle 1.7: Key Improvements in the P2P Platform for Decentralized Development

On March 18, 2026, version 1.7 of the P2P platform Radicle was released—a decentralized alternative to GitHub and GitLab. The platform operates without central servers, leverages network node resources, and is censorship-resistant. Radicle 1.0 debuted in September 2024. Components are implemented in Rust under Apache 2.0 and MIT licenses, with builds available for Linux and macOS. A desktop client, web interface, and CLI are in development.

Neighbor discovery uses the Gossip protocol, while data replication relies on Heartwood built on Git. Node identification and repository verification are based on public-key cryptography without user accounts. Authentication and authorization are decentralized.

Repositories are self-certifying: each has a unique ID, and commits and issue comments are signed by the owner. Access is possible if at least one replica exists in the network. Nodes subscribe to repositories for updates, and private repositories are supported.

Data Management and Storage Mechanisms

Management is handled through delegates—users, bots, or groups tied to IDs. Delegates accept patches, close issues, and configure access. Multiple delegates can be assigned to a repository.

Data is stored in standard git repositories with additional namespaces for peers and forks. Discussions, patches, and reviews are Collaborative Objects (COB), replicated between nodes.

Integration with Git tools is streamlined: the platform uses Git objects and supports references to external branches, tags, labels, and notes.

Key Updates in Version 1.7

Version 1.7 focuses on security, performance, and usability. Here are the key changes:

• Sigrefs (Signed References): Implementation reworked for protection against replay attacks. Added a pointer to the previous entry in the chain, which is signed in full. This prevents substitution of old code via re-signing, ensuring a verifiable history from the root.

• Node blocking: Extended to the connection level. Blocking triggers upon connection establishment or receipt from a blocked node, not just during data transfer.

• References to external Git objects: Any are now allowed except temporary branches (previously limited to branches, tags, and Radicle metadata).

• Error messages: Improved informativeness for operations lacking access permissions.

• I/O optimization: Default synchronous = NORMAL in SQLite (previously FULL), reducing load on long-running nodes. Added journal_mode and synchronous settings to the config.

• Vulnerability fix: Issue resolved; details to be disclosed on March 23. Scanning of public repositories found no evidence of exploitation.

What's Important

• Sigrefs now form a chain of signatures, blocking replay attacks and history tampering.
• Node blocking at the connection level strengthens protection against unwanted peers.
• SQLite optimization reduces I/O load without sacrificing integrity.
• Support for any external Git references simplifies migration and integration.
• The platform remains fully decentralized with Git-compatible storage.

Implementation Recommendations

For mid-level and senior developers: Test Radicle 1.7 in an isolated P2P network. Set up delegates for CI/CD bots. Monitor I/O via SQLite parameters on long-running nodes. Use sigrefs for critical repositories requiring high censorship resistance.

— Editorial Team