Skip to content

chore(deps): update ethereum el/cl client updates#796

Open
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/ethereum-clients
Open

chore(deps): update ethereum el/cl client updates#796
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/ethereum-clients

Conversation

@github-actions

@github-actions github-actions Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
NethermindEth/nethermind patch 1.39.0 → 1.39.2
OffchainLabs/prysm patch v7.1.6 → v7.1.7
erigontech/erigon patch v3.5.1 → v3.5.3
paradigmxyz/reth minor v2.3.0 → v2.4.1
sigp/lighthouse patch v8.2.0 → v8.2.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

NethermindEth/nethermind (NethermindEth/nethermind)

v1.39.2

Compare Source

[!IMPORTANT]
Given the number of CVEs from Microsoft this release fixes it is mandatory for all node operators.

Release notes

This is a patch release on top of 1.39.1 that updates the .NET dependencies to Microsoft's July 2026 servicing release (10.0.10), which 17 CVE security fixes, and makes the eth_getLogs block-range limit explicit and configurable.

Overview

4 changes since 1.39.1:

  • .NET packages updated to 10.0.10 — Microsoft's July 2026 servicing update, which addresses several security vulnerabilities in .NET (#​12449)
  • Explicit, configurable eth_getLogs block-range limit — the Receipt.MaxBlockDepth option (default 10,000 blocks) is now documented and applied consistently, including when "useIndex": false is requested; requests exceeding the range are rejected with an "invalid params" (32602) error. Set to 0 to disable; ignored when the log index is enabled (#​12509)
  • Routine dependency bumps: Microsoft.IdentityModel.JsonWebTokens, System.CommandLine, Nethermind.Crypto.SecP256r1, and a RocksDB package rebuild (10.10.1.649 → 10.10.1.1747; same native RocksDB version) (#​12449, #​12491)

What's Changed

Full Changelog: NethermindEth/nethermind@1.39.1...1.39.2

Build signatures

The packages are signed with the following OpenPGP key: AD12 7976 5093 C675 9CD8 A400 24A7 7461 6F1E 617E

v1.39.1

Compare Source

Release notes

This is a patch release on top of 1.39.0 with a round of bug fixes and reliability improvements across snap sync, networking, JSON-RPC, and the experimental Flat DB.

Overview

Full diff: NethermindEth/nethermind@1.39.0...1.39.1

8 changes since 1.39.0. Highlights:

  • Flat DB (experimental, opt-in) — fixed a disposal race between shutdown and in-flight trie-warmer jobs (#​12237)
  • eth_simulateV1 now bounds the total block expansion, not just each inter-block gap (#​12210)
  • Bad-block store is bounded by entry count as intended, instead of comparing against the DB byte size (#​12225)
  • Quieter logs — RLP limit diagnostics toned down (#​12130)

Highlights

Sync

  • Reject malformed snap range proofs instead of throwing (#​12187)
  • Verify the hash of trie nodes recovered via snap heal (#​12200)

Networking

  • Reject zero-size RLPx frames in ZeroFrameDecoder (#​12202)
  • Tone down RLP limit logging (#​12130)

JSON-RPC & Engine API

  • Bound eth_simulateV1 total block expansion, not just each gap (#​12210)
  • Side-effect-free invalid-chain query and atomic node get-or-create in the invalid-chain tracker (#​12208)

Storage & state

  • Bound BadBlockStore by entry count, not DB byte size (#​12225)
  • Flat DB (experimental, opt-in): lease the read-only bundle for in-flight trie-warmer jobs (#​12237, fixes #​12079)

What's Changed

Full Changelog: NethermindEth/nethermind@1.39.0...1.39.1

Build signatures

The packages are signed with the following OpenPGP key: AD12 7976 5093 C675 9CD8 A400 24A7 7461 6F1E 617E

OffchainLabs/prysm (OffchainLabs/prysm)

v7.1.7

Compare Source

This patch release focuses on Beacon API interoperability, validator-client resilience, and a broad round of Gloas (ePBS) correctness and stability improvements.

Release highlights:

  • Gloas and builder APIs: Added external builder bid selection and per-builder maximum execution payments, improved payload bid and attestation validation, and strengthened missing-payload and data-column recovery paths.
  • Partial data columns: Drop messages for unsubscribed topics before SSZ decoding, preventing large partial messages for non-custodied subnets from blocking the shared gossip loop. [PR]
  • Beacon API and validator client: Added SSZ support for proposer preferences, payload attestations, and validator balances; switched REST validator clients to head_v2 with automatic legacy fallback; and added replacement hints for removed routes.
  • Resilience and failover: Re-push proposer preferences after beacon-node failover, retry failed submissions, accelerate unknown-parent recovery, and prevent startup, REST-handler, builder-registry, and peer-address edge-case failures.
  • Database startup recovery: Prevent a startup panic when the database returns a nil head block without an error; Prysm now logs the invalid head and starts fork choice from the finalized checkpoint instead. [PR]
  • Operator experience: Reduced noisy beacon-node and validator-client logs, added clearer Gloas bid-selection and envelope-publication diagnostics, documented ordered REST endpoint failover, and improved error reporting for invalid P2P IP configuration.
Added
  • Accept SSZ (application/octet-stream) request bodies on POST /eth/v1/validator/proposer_preferences, matching beacon-APIs #​608. [PR]
  • Add max_execution_payment to the proposer builder config, the maximum execution-layer payment a proposer will accept from a Gloas builder. [PR]
  • Submit per-builder proposer preferences and signed request auths from the validator client ahead of Gloas proposals, and forward the matching request auth in the block request. [PR]
  • Queue payload attestations received before their beacon block and process them once the block arrives. [PR]
  • Pull execution payload bids from external builders during Gloas block production, select the best of self-build, P2P, and Builder-API bids, and submit the signed block back to the winning builder. [PR]
  • Added SSZ (application/octet-stream) response support to GET and POST /eth/v1/beacon/states/{state_id}/validator_balances (beacon-APIs #​622). [PR]
  • Add a proactive request for the payload if we haven't seen it by the payload time. [PR]
  • make build [<bin>...] [flags=...]: Build Prysm binaries without Bazel. [PR]
  • make run <bin> [flags=...] [-- <args>]: Build and run a Prysm binary without Bazel. [PR]
  • Add ConnectionCounter to the REST connection provider and ConnectionGeneration to the validator client interface, exposing a monotonic counter that advances on each beacon-node fallback switch (the gRPC provider already had ConnectionCounter). [PR]
  • Respond with 410 Gone and a message naming the replacement route when a Beacon API route that was removed from the spec (e.g. GET /eth/v1/beacon/blocks/{block_id}, POST /eth/v1/beacon/pool/attestations, GET /eth/v2/validator/blocks/{slot}) is requested, instead of a bare 404 Not Found. [PR]
Changed
  • Validator client submits proposer preferences as SSZ by default, falling back to JSON if the beacon node returns 415. [PR]
  • Validator client submits payload attestations as SSZ by default, falling back to JSON if the beacon node returns 415. [PR]
  • Validator client requests payload_attestation_data as SSZ, decoding either an SSZ or JSON response. [PR]
  • Retain BuilderConfig (relays, enabled, max execution payment) when upgrading proposer settings from v1 to v2 instead of dropping it. [PR]
  • Request a block's unknown parent by root immediately on gossip arrival instead of waiting for the pending-blocks queue tick. [PR]
  • REST Validator client now subscribes to the head_v2 beacon API event by default instead of the deprecated head event. If the beacon node does not support head_v2 (it rejects the subscription with HTTP 400), the validator client automatically falls back to the legacy head event, so it keeps working against older beacon nodes with no behavior change. [PR]
  • The payload_attributes event no longer includes parent_block_number from the gloas fork onwards. [PR]
  • Document that --beacon-rest-api-provider accepts comma-separated endpoints for ordered failover. [PR]
  • Cleaned up Gloas proposer flow logs: consistent verbs, self-build builder index rendering, single bid selection line with source and gwei value, and publish duration on envelope reveal. [PR]
  • Consolidated validator client submission logs: sync committee messages, sync contributions, and payload attestations are now summarized as one info line per distinct submission content per slot (with range-compressed validator indices), and the previous per-validator success logs were downgraded to debug level. [PR]
  • Run isAggregator check concurrently in validator.subscribeToSubnets method body. [PR]
  • make gen: Cache generation inputs to skip re-generating files that are already up to date. [PR]
  • Ignore instead of reject execution payload bids whose fee recipient does not match proposer preferences. [PR]
  • Update C-KZG to v2.1.8. [PR]
Removed
  • Remove the unused top-level max_execution_payment proposer-option field in favor of the per-builder BuilderConfig.max_execution_payment. [PR]
  • Removed proposer index cache. [PR]
Fixed
  • Accept SSZ (application/octet-stream) request bodies on POST /eth/v1/beacon/pool/payload_attestations. The handler already decoded SSZ, but the route only registered JSON so SSZ submissions were rejected with 415. [PR]
  • Allow SSZ responses on GET /eth/v1/beacon/pool/payload_attestations. The handler already supported SSZ, but the route's Accept negotiation only allowed JSON, making the SSZ response unreachable. [PR]
  • Request the data column sidecars needed to validate a payload envelope when we do not already have them. [PR]
  • Ignore execution payload bids that cannot be verified against the current head state instead of rejecting them. [PR]
  • Return execution_optimistic correctly for reward APIs (block, attestation, sync committee). [PR]
  • Emit the correct parent_block_hash in the Gloas payload_attributes SSE event by carrying the exact hash sent to the engine, so it matches for a full head instead of reporting the parent's hash. [PR]
  • avoid panic when event stream request creation fails #​16234. [PR]
  • Stop logging skipped payload_attributes events for past proposal slots as an ERROR ("received an event it was unable to handle") in the beacon node event stream. The errPayloadAttributeExpired skip is now excused like errNotRequested, removing high-volume noise under ePBS. The event_type log field now prints the event type (%T) instead of dumping the full event struct. [PR]
  • Fixed the attestation rewards API ideal_rewards response for Electra compounding validators with effective balances above 32 ETH. [PR]
  • Submit the signed block to the winning builder even when local block processing fails after broadcast. [PR]
  • Drop partial data column messages for unsubscribed topics before the SSZ decode so the shared gossip loop is not head-of-line-blocked. [PR]
  • Recover from nil headblock in db at startup. [PR]
  • Accept builder preference submissions without the --http-mev-relay flag, gloas builders are dialed per URL from the request auth. [PR]
  • Drain pending Gloas data column sidecars on block processing so columns gossiped back for our own proposed block are imported and the payload is marked available. [PR]
  • Fix race condition for reading host in REST handler. [PR]
  • Correctly populate attestation data (FromAttData) when logging in VC. [PR]
  • Notify the execution engine of the head per imported batch during Gloas initial sync. [PR]
  • Treat nil builder registry entries as reusable slots in builderInsertionIndex instead of panicking. [PR]
  • Compute the validator client's mid-slot submission delay from SLOT_DURATION_MS instead of SECONDS_PER_SLOT. [PR]
  • Ignore instead of reject queued payload envelopes and payload attestations whose signatures fail against a possibly divergent head state. [PR]
  • Surface undefined execution engine errors from gloas forkchoice updates instead of returning a nil payload ID that callers read as not proposing. [PR]
  • Return deep copies from the payload attestation pool so later aggregation cannot mutate attestations already handed to block building. [PR]
  • Apply fork choice PTC votes and enforce the current-slot check for payload attestations submitted via the REST pool endpoint. [PR]
  • Order the Gloas branch before Fulu in the gossip block topic mapping so the epoch cascade returns the right block type. [PR]
  • Hold the state lock in QueueBuilderPaymentForSlot and route builder pending withdrawal appends through one copy-on-write path. [PR]
  • Guard the startup head block with blocks.BeaconBlockIsNil before use: BeaconDB.Block returns a nil block with no error when the root is not found, so the previous inner-block nil check still segfaulted the node at startup. [PR]
  • Count PTC votes from duplicated validators (consensus-specs#5222): a validator sampled into the payload timeliness committee multiple times now has its vote recorded at every position it occupies, not only at ptc.index(validator_index). Un-skips the corresponding on_payload_attestation_message fork choice spec tests. [PR]
  • Verify submitted execution payload bids with the gossip rules and record them in the local highest-bid cache before broadcasting. [PR]
  • Fix execution_optimistic decision for attestation rewards API: use ancestor so that block root is guaranteed inside DB. [PR]
  • Treat an ENR port value of 0 as absent when building dial addresses, so peers advertising a zero port are no longer dialed at /tcp/0. [PR]
  • Re-push proposer preferences when the validator client connects to a different beacon node. The submitted-slot dedup cache survives runner restarts and beacon-node fallback switches, so a freshly connected node previously received no preferences for slots already marked submitted. A new runner (initial connect / health recovery) now propagates forceFullPush to the proposer-preference build, and a beacon-node connection change forces a full re-push. The change is detected via a monotonic connection counter (ValidatorClient.ConnectionGeneration, implemented by each transport client from its own connection provider) rather than the host string, so a round-robin bounce (host0 → host1 → host0) that replaces the connection is still caught. The switch signal is only consumed once a push is confirmed, and proposer preferences and builder registrations are tracked independently, so a failed re-push to the new node is retried on later slots. [PR]
  • Retry failed proposer-preference submissions: a batch whose submission fails releases its dedup-cache reservations so the per-slot rebuild resubmits it, covering both the regular push and the reorg resubmission path. [PR]
  • Detach the proposer-preference submission from the slot context so it can no longer be cancelled before the mid-slot submit delay elapses (matching the builder-preference submission). [PR]
  • Return an error for an invalid --p2p-local-ip or --p2p-host-ip instead of silently ignoring it. [PR]
  • Wrapped the payload_attestation_message SSE event in the version/data envelope to match the beacon-APIs spec. [PR]
  • Stopped serving data column sidecars of empty slots in the by range RPC handler, matching the canonical payload chain semantics of the execution payload envelopes by range handler. [PR]
erigontech/erigon (erigontech/erigon)

v3.5.3

Compare Source

Erigon v3.5.3 — Tidal Tails

v3.5.3 is a bugfix release recommended for all users. It is a drop-in upgrade from 3.5.2 — no re-sync required.

Bugfixes

  • execution/stagedsync: restore log/receipt notifications for mid-block resumed blocks (#​22648) by @​lupin012 — backports the notification-completeness half of #​22235. After the earlier ReceiptDomain fix, both executors still gated RecentReceipts.Add on a stale isPartial/startTxIndex==0 flag, so a block resumed mid-block never emitted a correct receipt/log notification over
    eth_subscribe("logs"/"newReceipts"). Both executors now reconstruct the resumed block's prefix receipts and gate on a receiptsComplete field.
  • rpc: return a JSON-RPC error instead of panicking on a null transaction in the trace path (#​22668) by @​AskAlexSharov - trace_transaction / trace_filter could dereference a nil txn when TxnByIdxInBlock resolves a txIndex whose body hasn't materialized yet at the chain tip. Fixes #​22643.
  • rpc: fix the handleBatch deadlock (#​22459) by @​yperbasis — a filtered JSON-RPC batch could wedge on wg.Wait() and time the request out. Fixes #​22424.
  • types: reject legacy transactions wrapped in a typed (EIP-2718) envelope (#​22525) by @​taratorio.
  • types: reject an empty-string element in RLP transaction-list decoding (#​22524) by @​taratorio.
  • cl/phase1/stages: fix uint64 underflow in the "Downloading Execution History" progress log (#​22462) by @​lystopad — once the live EL head advanced past the frozen initial progress, the toprocess subtraction wrapped to ~2⁶⁴ and produced a garbage ETA. Fixes #​22455.
  • cl/phase1/stages: guard the "[Caplin] Forward Sync" progress log against slot under/overflow (#​22465) by @​lystopad — the same
    unguarded-subtraction / time.Duration-overflow pattern on the forward-sync line.

Improvements

  • rpc: make the eth_getLogs per-position address/topic limit configurable via --rpc.logs.querylimit (#​22477) by @​lupin012 - replaces the hardcoded 1000-entry limit; default 1000 preserves current behaviour, 0 = unlimited.
  • cl/phase1/stages: route the history-download and forward-sync progress ETAs through the shared, overflow-safe utils.ETA helper (#​22493, #​22512) by @​lystopad.

Full Changelog: v3.5.2...v3.5.3

v3.5.2

Compare Source

v3.5.2 is a bugfix release recommended for all users, and especially for anyone running 3.5.1 — it fixes a sync-halting trie-root regression introduced there (#​22399). It is a drop-in upgrade from 3.5.1 — no re-sync required.

Bugfixes

  • db/state: clear the StateCache on SharedDomains unwind below the reorg window (#​22402) by @​Sahil-4555 — after the v3.5.1 changeset-isolation backport, a block that failed execution within the reorg window did a disk-noop overlay unwind that left dirty, uncommitted writes in the state cache; on the next run execution read those stale values instead of the database, producing a deterministic trie-root mismatch that halted sync. Closes #​22399.
  • rpc, node: fix the nil-pointer panic in the gzip batch flush race (#​22383) by @​lupin012 — a gzipped JSON-RPC batch with two or more streamable methods invoked the shared gzip-streaming flush hook concurrently from per-call goroutines; gzipResponseWriter.Flush is not concurrency-safe, so the calls raced on the underlying gzip writer and could dereference a nil flate compressor, crashing the node. Closes #​22334.

Full Changelog: erigontech/erigon@v3.5.1...v3.5.2

paradigmxyz/reth (paradigmxyz/reth)

v2.4.1: Reth v2.4.1

Compare Source

image

Latest Release

This patch release is for alloy dependency updates.

Update Priority

This table provides priorities for which classes of users should update particular components.

User Class Priority
Payload Builders High
Non-Payload Builders High

See Update Priorities for more information about this table.

All Changes

  • chore: remove release formatting noise
  • chore(deps): bump alloy core 1.6.1 (#​26419)
  • chore: release 2.4.1

Binaries

See pre-built binaries documentation.

The binaries are signed with the PGP key: 50FB 7CC5 5B2E 8AFA 59FE 03B7 AA5E D56A 7FBF 253E

Reth
System Architecture Binary PGP Signature
x86_64 reth-v2.4.1-x86_64-unknown-linux-gnu.tar.gz PGP Signature
aarch64 reth-v2.4.1-aarch64-unknown-linux-gnu.tar.gz PGP Signature
aarch64 reth-v2.4.1-aarch64-apple-darwin.tar.gz PGP Signature
Docker paradigmxyz/reth -

v2.4.0: Reth v2.4.0

Compare Source

image

Performance

Reth v2.4.0 reduces mean newPayload latency by 6.2% compared with v2.3.0.

Experimental revmc JIT EVM support is added and can be activated with --jit.enabled flag.

Networking and transaction propagation get a large set of throughput-oriented improvements: faster pooled transaction recovery (#​26304), cached full transaction propagation encoding (#​26012), and multiple ECIES / P2PStream allocation reductions.

Features

We continue with Amsterdam and EIP-7928 Block Access List development.

reth p2p bootnode --v5 now co-locates discv4 and discv5 on a single UDP port (--addr), matching go-ethereum and reth's own networking stack, with IPv4/IPv6 support (#​26089)

RPC compatibility was improved with eth_sendRawTransactionSync timeout support, geth-aligned raw transaction handling, empty-proof normalization for eth_getProof, and several eth_simulate, eth_estimateGas, fee-history, and txpool fixes.

ParallelStateRoot deprecation

SDK/library users that depend on trie internals should update usages of ParallelStateRoot, ParallelSparseTrie, and ParallelStateRootError that were removed in this version.

Deployments still passing --engine.legacy-state-root should remove it or use --engine.state-root-fallback if they intentionally need synchronous state-root computation.

Update Priority

This table provides priorities for which classes of users should update particular components.

User Class Priority
Payload Builders High
Non-Payload Builders High

Breaking Changes

Runtime / Configuration
  • Dropped the legacy parallel state-root runtime path; --engine.legacy-state-root is hidden and now only warns if passed, with the sparse trie task as the normal path and serial fallback retained (#​26069).
SDK / State Root APIs
  • Refactored state-root strategy APIs to support custom out-of-tree state-root implementations (#​26085).
  • Removed ParallelStateRoot; downstream users should migrate to the sparse trie task or the serial fallback path (#​26121).
  • Renamed ParallelStateRootError to StateRootTaskError (#​26132).
  • Removed ParallelSparseTrie; ArenaParallelSparseTrie is now the default sparse trie implementation used by engine sparse-trie paths (#​25453).
  • Changed PayloadValidator::validate_block_post_execution_with_hashed_state to receive a lazy overlay-aware parent-state provider and return PostExecutionValidationError; custom implementations overriding this method must update their signatures (#​26330).

Features

Performance
  • Added experimental revmc JIT support for Ethereum EVM execution, including --jit node flags and reth_jit debug controls (#​23230).
  • Made JIT opt-in for library crates and fixed JIT CLI/helper handling (#​25178, #​25183, #​25413).
  • Reduced transaction conversion latency by emitting recovered transactions in ordered windows instead of waiting on a large Rayon ordered iterator (#​25783).
  • Avoided full block clones in FCU, RPC cache, and ExEx paths by storing and exposing Arc<RecoveredBlock> handles in Chain (#​25645, #​25647).
  • Optimized state-root and storage-history work with better update_leaves parallelism, parallel write_storage_history, and more aggressive sparse trie caching. (#​24774, #​25282, #​25428).
  • Reduced BAL execution overhead by using unordered transaction iteration for BALs, buffering BAL execution cache metrics, and avoiding unnecessary hashed-account reads (#​25411, #​25366, #​25369).
  • Offloaded metric rendering and added worker queue / provider metric improvements (#​26180, #​25649, #​25481).
  • Routed raw transaction submission through PoolTransaction::recover_raw_transaction, allowing custom pool transaction types to recover directly from encoded bytes (#​25238).
Networking & P2P
  • Added snap/2 support across negotiation, dedicated eth + snap/2 streams, SnapClient BAL APIs, snap message helpers, the snap client, and inbound snap/2 request routing (#​25774, #​25752, #​25607, #​25608, #​26049, #​26324).
  • Improved bootnode reachability by supporting NAT advertisement and dual-stack discv5 addresses, then running discv4 and discv5 on the same UDP port (#​25757, #​26089).
  • Optimized transaction propagation and devp2p decoding with cached full transaction encodings, lower allocation transaction list decodes, preallocated pooled hash metadata, and same-poll pending transaction propagation (#​26012, #​26164, #​26145, #​25087).
  • Reduced ECIES and P2PStream overhead by caching AES key schedules, reusing snappy buffers, batching flushes, raising the write flush boundary, and avoiding redundant zero-fill/copy work (#​26346, #​26347, #​26349, #​26348, #​26120, #​26119).
RPC
  • Added eth_sendRawTransactionSync timeout support matching EIP-7966-style timeout behavior (#​25682).
  • Added engine_hasBlobs so consensus clients can check ordered blob availability without fetching blob/proof payloads (#​25589).
  • Added debug_clearTxpool for geth-compatible testing and debugging workflows (#​25588).
  • Added admin_banPeer and admin_unbanPeer methods (#​25140).
  • Added the EthSubscriptions trait for logs and header streams (#​22155).
  • Added testing RPC helpers for committing and building blocks (#​25070, #​25750).
Engine, Payload & Amsterdam
  • Added SSZ Engine API payload and forkchoice status containers, plus SSZ proxy wiring (#​26133, #​26271, #​25422).
  • Validated Block Access Lists during flashbots_validateBuilderSubmissionV6 and stored validated payload BALs (#​24297, #​25268).
  • Added BAL-capable download client requirements (#​25266).
CLI, ERA & Snapshots
  • Added ERE export and extended ERE import through stage sync (#​25304, #​25262).
  • Improved .era import handling by supporting ERA file imports, decoding execution blocks from consensus .era blocks, avoiding misreading consensus .era as era1, and accepting local filename variants (#​25404, #​25582, #​25603, #​26006).
  • Added import-era support for ERE .erae files and explicitly rejected unsupported .era export paths (#​25122, #​25576).
  • Supported file archives in modular snapshots and exposed SlotPreimages for snapshot importers (#​26078, #​25035).
  • Allowed overriding TraceArgs defaults and added node command helpers (#​25736, #​25273).
Pruning & Storage
  • Added row-budgeted dupsort pruning and used static-file transaction-hash ranges for pruning (#​26287, #​26312).
  • Added sealed or recovered block lookup and DatabaseStateProvider for revm integration (#​25338, #​25121).
Observability

Bug Fixes

Engine, Trie & Payload
  • Restored the state-root task parallelism gate (#​26080).
  • Included Amsterdam fields in payload IDs and used the execution version header for SSZ routes (#​25973, #​25925).
  • Fixed execution-cache saved-cache tracking and waited for workers before writing cache state (#​25460, #​25462).
  • Fixed BAL handling so empty newly created accounts are excluded from hashed post-state (#​26367).
RPC
  • Treated eth_sendRawTransaction submissions as local transactions, matching documented local transaction handling (#​25412).
  • Used revm's effective transaction gas cap for eth_estimateGas bounds (#​25612).
  • Weighted fee-history rewards by receipt gas for Amsterdam semantics (#​26067).
  • Normalized eth_getProof empty account and storage trie proofs to empty arrays for geth-compatible EIP-1186 responses (#​24719).
  • Fixed nonce-related eth_simulate failures and aligned missing-block error behavior (#​25079, #​25074).
  • Aligned eth_fillTransaction default maxFeePerGas with geth's 2 * base_fee + tip behavior (#​25258).
  • Buffered trace_filter block replays and serialized capability retention as a quantity (#​25133, #​25324).
P2P & Txpool
  • Wired the configured --max-pending-imports value into the transaction manager instead of always using the default (#​25921).
  • Respected the configured full-transaction broadcast peer count (#​25086).
  • Accounted for blob transaction access-list size in txpool accounting (#​26113).
  • Reset peer reputation when admin-unbanning a peer and advertised the bound RLPx port in the discv5 ENR (#​26334, #​26265).
Pruning, Storage, ERA & Snapshots
  • Derived receipts static-file size from prune distance (#​26108).
  • Returned None for incomplete block receipts in provider lookups (#​25410).
  • Omitted total difficulty and accumulator fields for post-merge ERE exports (#​25379).
  • Included repository licenses in Docker build context and added m4 to Nix/native build inputs (#​25855, #​26321).
  • Rejected incomplete chain-file and gzip block data at EOF, preventing malformed imports from looping indefinitely (#​26363).
Compatible versions
  • revm: 41.0.0
  • alloy-*: 2.1.1 (core alloy crates), 1.6.0 (alloy-primitives / sol-types / dyn-abi)
  • alloy-evm: 0.37.0
  • revm-inspectors: 0.41.0
  • alloy-eip7928: 0.4.5

Full Changelog: paradigmxyz/reth@v2.3.0...v2.4.0

Binaries

See pre-built binaries documentation.

The binaries are signed with the PGP key: 50FB 7CC5 5B2E 8AFA 59FE 03B7 AA5E D56A 7FBF 253E

Reth
System Architecture Binary PGP Signature
x86_64 reth-v2.4.0-x86_64-unknown-linux-gnu.tar.gz PGP Signature
aarch64 reth-v2.4.0-aarch64-unknown-linux-gnu.tar.gz PGP Signature
aarch64 reth-v2.4.0-aarch64-apple-darwin.tar.gz PGP Signature
Docker paradigmxyz/reth -
sigp/lighthouse (sigp/lighthouse)

v8.2.1: Mrs. Pancakes

Compare Source

Summary

⚠️ Lighthouse v8.2.1 is a high-priority release containing fixes for several security vulnerabilities, as well as fixes and optimisations.

All mainnet beacon node users should upgrade as soon as practical to receive the security fixes in this release.

This release also fixes several bugs relating to partial data columns, which are enabled by default on the Hoodi and Sepolia testnets.

Upgrade Notes

No special action is required beyond upgrading. This release does not contain a database schema migration or any breaking CLI changes.

🧩 Partial Data Columns

Lighthouse v8.2.1 includes several fixes for partial data columns (EIP-8136), which are enabled by default on Hoodi and Sepolia.

These fixes improve the handling of cached partial data, prevent headers for already-imported blocks from being cached and re-gossiped, and reject received cells that conflict with cells already in the cache.

Users running Lighthouse on Hoodi or Sepolia are encouraged to upgrade to benefit from these fixes. To opt out of partial data columns, use --enable-partial-columns false.

Notable Changes

  • Fixed several issues in the partial data column cache and gossip implementation.
  • Optimised proposer preparation by removing redundant work that triggered get_expected_withdrawals, particularly around epoch boundaries.
  • Updated dependencies and compiler compatibility.

Update Priority

This table provides priorities for which classes of users should update particular components.

User Class Beacon Node Validator Client
Staking Users High Low
Non-Staking Users High ---

See Update Priorities for more information about this table.

Security Content

This section will be updated with security advisories as they are made public. We are not disclosing the security content of this release in order to give users time to upgrade.

Known Issues

Data column backfill can OOM, particularly on Gnosis chain. This is fixed on unstable and will be included in v8.3.0: #​9665. We do not recommend re-syncing unnecessarily, as this issue affects every prior release of Lighthouse as well.

All Changes

  • Release v8.2.1
  • Update libp2p
  • Update snap
  • Simplify block streamer to use roots
  • Check if cached cells are identical to received cells (#​9633)
  • Downgrade log on data column <-> finalization race condition (#​9635)
  • Add a bunch of semicolons to satisfy Nightly rustc (#​9648)
  • Silence future-incompat warnings (#​9639)
  • Update spin (#​9626)
  • Do not cache partial header of imported blocks (#​9604)
  • Pin genesis generator to devnet-6 (#​9608)
  • Fix rust 1.97 lints (#​9607)
  • Optimisations relating to get_expected_withdrawals (#​9314)
  • Update crossbeam-epoch to fix cargo audit (#​9581)
  • Update mergify config ([#​9564](ht

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@bussyjd bussyjd mentioned this pull request Jul 20, 2026
Open
@github-actions
github-actions Bot force-pushed the renovate/ethereum-clients branch 2 times, most recently from 498783d to d163376 Compare July 21, 2026 17:30
@github-actions
github-actions Bot force-pushed the renovate/ethereum-clients branch from d163376 to 84a3843 Compare July 23, 2026 18:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate/ethereum-clients

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants