Skip to content

chore(deps): update ethereum el/cl client updates - #796

Open
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/ethereum-clients
Open

chore(deps): update ethereum el/cl client updates#796
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/ethereum-clients

Conversation

@github-actions

@github-actions github-actions Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
ChainSafe/lodestar minor v1.44.0 → v1.45.0
NethermindEth/nethermind patch 1.39.0 → 1.39.2
OffchainLabs/prysm patch v7.1.6 → v7.1.8
erigontech/erigon patch v3.5.1 → v3.5.4
ethereum/go-ethereum patch v1.17.4 → v1.17.5
hyperledger/besu patch 26.7.0 → 26.7.1
paradigmxyz/reth minor v2.3.0 → v2.4.1
sigp/lighthouse patch v8.2.0 → v8.2.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

ChainSafe/lodestar (ChainSafe/lodestar)

v1.45.0

Compare Source

Good day Lodestar operators! We've just released v1.45.0, a highly recommended upgrade for all users. There are a couple of important security fixes that are important to mitigate.

This release continues our Glamsterdam/ePBS (Gloas) preparation. We have also shipped a set of API, networking, and sync-stability fixes. There is also a host of new peer manager metrics and dashboards.

We are excited to announce that graffiti now carries client info by default. When a validator leaves room in its graffiti, the beacon node appends a client-diversity suffix (full watermark, BULS-style codes, or just LS). We never overwrite user graffiti if it fills the field. This feature is turned on by default and help the community and the core development team better understand client diversity. We love our users and appreciate you letting everyone know you run Lodestar proudly!! Thank you for your continued Lodestar support!! If you want, you can disable with --graffitiAppend false; --private also suppresses it.

Note that if you have had issues with your node hanging at shutdown/restart, this release will also fix that bug. In some cases this hanging caused nodes to need to sync from old checkpoints, instead of the most recent state before shutdown. So if you had long re-sync times on restart, that issue should clear up.

Full Changelog

Features
Bug Fixes
Performance
Refactoring
Maintenance

v1.45.0-rc.0

Compare Source

Changelog

Full Changelog

Features
Bug Fixes
Performance
Refactoring
Maintenance
NethermindEth/nethermind (NethermindEth/nethermind)

v1.39.2

Compare Source

[!IMPORTANT]
Given the number of CVEs from Microsoft this release fixes it is mandatory for all node operators.

Release notes

This is a patch release on top of 1.39.1 that updates the .NET dependencies to Microsoft's July 2026 servicing release (10.0.10), which 17 CVE security fixes, and makes the eth_getLogs block-range limit explicit and configurable.

Overview

4 changes since 1.39.1:

  • .NET packages updated to 10.0.10 — Microsoft's July 2026 servicing update, which addresses several security vulnerabilities in .NET (#​12449)
  • Explicit, configurable eth_getLogs block-range limit — the Receipt.MaxBlockDepth option (default 10,000 blocks) is now documented and applied consistently, including when "useIndex": false is requested; requests exceeding the range are rejected with an "invalid params" (32602) error. Set to 0 to disable; ignored when the log index is enabled (#​12509)
  • Routine dependency bumps: Microsoft.IdentityModel.JsonWebTokens, System.CommandLine, Nethermind.Crypto.SecP256r1, and a RocksDB package rebuild (10.10.1.649 → 10.10.1.1747; same native RocksDB version) (#​12449, #​12491)

What's Changed

Full Changelog: NethermindEth/nethermind@1.39.1...1.39.2

Build signatures

The packages are signed with the following OpenPGP key: AD12 7976 5093 C675 9CD8 A400 24A7 7461 6F1E 617E

v1.39.1

Compare Source

Release notes

This is a patch release on top of 1.39.0 with a round of bug fixes and reliability improvements across snap sync, networking, JSON-RPC, and the experimental Flat DB.

Overview

Full diff: NethermindEth/nethermind@1.39.0...1.39.1

8 changes since 1.39.0. Highlights:

  • Flat DB (experimental, opt-in) — fixed a disposal race between shutdown and in-flight trie-warmer jobs (#​12237)
  • eth_simulateV1 now bounds the total block expansion, not just each inter-block gap (#​12210)
  • Bad-block store is bounded by entry count as intended, instead of comparing against the DB byte size (#​12225)
  • Quieter logs — RLP limit diagnostics toned down (#​12130)

Highlights

Sync

  • Reject malformed snap range proofs instead of throwing (#​12187)
  • Verify the hash of trie nodes recovered via snap heal (#​12200)

Networking

  • Reject zero-size RLPx frames in ZeroFrameDecoder (#​12202)
  • Tone down RLP limit logging (#​12130)

JSON-RPC & Engine API

  • Bound eth_simulateV1 total block expansion, not just each gap (#​12210)
  • Side-effect-free invalid-chain query and atomic node get-or-create in the invalid-chain tracker (#​12208)

Storage & state

  • Bound BadBlockStore by entry count, not DB byte size (#​12225)
  • Flat DB (experimental, opt-in): lease the read-only bundle for in-flight trie-warmer jobs (#​12237, fixes #​12079)

What's Changed

Full Changelog: NethermindEth/nethermind@1.39.0...1.39.1

Build signatures

The packages are signed with the following OpenPGP key: AD12 7976 5093 C675 9CD8 A400 24A7 7461 6F1E 617E

OffchainLabs/prysm (OffchainLabs/prysm)

v7.1.8

Compare Source

This is a highly recommended patch release containing multiple bug fixes improving the handling of early attestations for better inclusion. Several other bugfixes and ux improvements are also included. Some highlights:

  • libp2p bug fixed, improving network-wide propagation of early attestations. [PR]
  • Bug fix enabling validator clients using grpc to make timely attestations (resolving notification stream connection issues).
  • Builder client now automatically falls back to JSON when a remote builder rejects SSZ requests (415/406), so builders without SSZ support (e.g. Commit Boost) work without needing --disable-builder-ssz.
  • Numerous UX / quality of life improvements (see Added and Changed sections below).
  • Miscellanious small bugfixes (see the Fixed section below)
  • And of course, changes related to the upcoming gloas fork, including support for partial data columns (more efficient blob networking) and progressive merkleization.
Added
  • Gate the --distributed validator client flag when used without the REST API being enabled. [PR]
  • Added shorter flag aliases: --beacon-rest, --beacon-grpc, and --enable-rest. [PR]
  • Add GET /prysm/v1/node/custody endpoint exposing the node's data column custody state: custody group count, custody groups and columns, earliest available slot, supernode/semi-supernode status, and backfill progress. [PR]
  • Builder client now automatically falls back to JSON when a remote builder rejects SSZ requests (415/406), so builders without SSZ support (e.g. Commit Boost) work without needing --disable-builder-ssz. Covers GetHeader, RegisterValidator, SubmitBlindedBlock, SubmitBlindedBlockPostFulu, and the Gloas GetExecutionPayloadBid and SubmitBuilderPreferences endpoints. Once a builder rejects SSZ, the client uses JSON for the remainder of its lifetime. [PR]
  • Reorg late payloads in Gloas behind the --reorg-late-payloads flag when the PTC did not reach timeliness consensus. [PR]
  • progressive merklization functions in the ssz package. [PR]
  • progressive SSZ merkleization for Gloas beacon state. [PR]
  • hidden, experimental beacon node flag --enable-progressive-ssz to. [PR]
Changed
  • GET /eth/v1/validator/payload_attestation_data/{slot} now returns 204 instead of 503 when no block has been seen for the requested slot, per ethereum/beacon-APIs#612. [PR]
  • Setting --beacon-rest-api-provider now implicitly enables the beacon REST API, so --enable-beacon-rest-api is optional. [PR]
  • Changed the producePayloadAttestationData endpoint to take slot as a query parameter instead of a path parameter, per the latest beacon-APIs spec. [PR]
  • Verify the proposer signature of by-root blocks before adding them to the pending queue. [PR]
  • Removed the blinded execution payload envelope publish flow in favor of publishing the full signed envelope or envelope contents, per beacon-APIs #​624. [PR]
  • Envelope publish endpoint now returns after broadcast, moving local import off the RPC path. [PR]
  • Updated geth to v1.17.4. [PR]
  • Updated go-libp2p-pubsub to v0.17.0, which allows republishing a previously seen but never delivered message (e.g. an attestation ignored because its block had not arrived yet). [PR]
  • Reduce the Gloas Engine API get-payload timeout to 300 milliseconds. [PR]
  • --max-builder-consecutive-missed-slots and --max-builder-epoch-missed-slots help text: Reports the mainnet config value as the default instead of a hardcoded, false and unused values. [PR]
  • Validator client now retries only the failed next-epoch duties independently instead of re-pulling every duty, making duty updates resilient to transient beacon node errors. [PR]
  • Upgrading to go 1.26.5 with security and bugfixes: see golang changelog. [PR]
Deprecated
  • --interop-num-validators, --interop-start-index, --interop-eth1data-votes and --interop-write-ssz-state-transitions are now hidden no-ops. Use ethereum-package for interop/devnet testing. [PR]
Removed
  • Removed the interop keymanager, mocked eth1 data votes, the SSZ state-transition dump helpers (tools/extractor), and the interop chain-config preset. [PR]
  • Unused data_column_obtained_via_el_count metric that was never recorded. [PR]
Fixed
  • Fixed flaky pending attestation bucket tests by asserting on specific log messages instead of exact global log counts. [PR]
  • Reset the self-build envelope signature failure budget every slot instead of tying it to a prune path that rarely runs. [PR]
  • Set the bid gas limit on full forkchoice nodes restored via MarkFullNode, so bid validation no longer sees a zero parent gas limit after a restart. [PR]
  • Fail the block data column availability check during initial sync instead of waiting indefinitely, so checkpoint sync no longer stalls when a block's custody columns are missing. [PR]
  • Ignore Gloas data column sidecars from a future slot before queueing, preventing pending entries that are never pruned. [PR]
  • Wait for the clock before starting the pending Gloas columns pruning routine to avoid a nil clock panic on startup. [PR]
  • Apply the Gloas cross-fork state-diff pending_deposits against the anchor's pre-upgrade list, fixing a panic and state corruption when builder deposits are onboarded at the Fulu to Gloas fork with --enable-state-diff. [PR]
  • Re-verify builder deposit signatures when an in-batch index reuse evicts a pubkey. [PR]
  • Stop downscoring peers when pending Gloas data columns are pruned for a block root this node has not imported. [PR]
  • Validator client now restarts its beacon event stream after a fallback host switch or after the stream dies. Previously the stream stayed bound to the old beacon node until a full restart, silently stopping head and payload-availability events — and with them reorg-triggered proposer-preference resubmission — even though the rest of the client kept working against the new node. [PR]
  • A replaced event stream is now stopped and drained before its successor starts, so two streams can never feed the validator client's event loop concurrently, and a stream shutdown can no longer close the shared events channel out from under its replacement. [PR]
  • Fail payload reconstruction in Gloas if correctness cannot be guaranteed. [PR]
  • Validator client with the beacon REST API now fetches proposer duties from the v2 endpoint post-Gloas, so its dependent root is fork-aware and consistent with attester duties. [PR]
  • Guard against a nil block dereference in Gloas execution payload envelope and data column gossip validation. [PR]
  • Do not queue blocks that arrive earlier than the max clock disparity. Also move HTR computation after the timestamp check. [PR]
  • Reject future-slot execution payload envelopes fetched by root and enforce pending caps, preventing an unbounded pending-envelope memory exhaustion. [PR]
  • Remote web3signer keymanager: NewKeymanager now waits for the key-file watcher to initialize before returning and fails startup immediately if the watcher cannot be initialized, key-update notifications are sent without holding the keymanager lock, and keys are reloaded from the key file when the watcher recovers from a failure. This prevents a startup race, a potential lock-ordering deadlock, and a stale flag-only key set after watcher recovery. [PR]
  • Clarified validator accounts exit prompts and final log message when --exit-json-output-dir is set: signed exits are only written to files and are not broadcast, so the messaging no longer implies validators were exited. [PR]
  • Fix a panic in GET /eth/v1/beacon/blobs/{block_id} when a versioned_hashes filter matches a commitment that appears more than once in the block. [PR]
  • Clear the attestation data cache when the head is updated. [PR]
  • Validator now skips payload attestation with an info log instead of an error when no block exists for the slot. [PR]
  • Use saturating arithmetic when computing the effective bid value during Gloas bid selection. [PR]
  • A next-epoch duty fetch failure no longer disrupts the validator's current-epoch duties. [PR]
  • Mark pending payload envelopes as seen only after successful import so transient failures can be retried. [PR]
  • Skip unusable static peer ENRs without discarding other valid peer addresses. [PR]
  • Count each PTC vote once in forkchoice_ptc_vote_count instead of on every re-application. [PR]
  • Increment new_payload_*_node_count metrics on the Gloas payload envelope path. [PR]
  • Accept execution payload bids building on the parent's empty branch, fixing valid bid rejections after a missed payload reveal. [PR]
  • PTC payload attestation now reports blob data availability from the data column store instead of forkchoice payload insertion. [PR]
  • beacon_execution_payload_envelope_invalid_total no longer counts internal processing failures, only invalid envelopes. [PR]

v7.1.7

Compare Source

This patch release focuses on Beacon API interoperability, validator-client resilience, and a broad round of Gloas (ePBS) correctness and stability improvements.

Release highlights:

  • Gloas and builder APIs: Added external builder bid selection and per-builder maximum execution payments, improved payload bid and attestation validation, and strengthened missing-payload and data-column recovery paths.
  • Partial data columns: Drop messages for unsubscribed topics before SSZ decoding, preventing large partial messages for non-custodied subnets from blocking the shared gossip loop. [PR]
  • Beacon API and validator client: Added SSZ support for proposer preferences, payload attestations, and validator balances; switched REST validator clients to head_v2 with automatic legacy fallback; and added replacement hints for removed routes.
  • Resilience and failover: Re-push proposer preferences after beacon-node failover, retry failed submissions, accelerate unknown-parent recovery, and prevent startup, REST-handler, builder-registry, and peer-address edge-case failures.
  • Database startup recovery: Prevent a startup panic when the database returns a nil head block without an error; Prysm now logs the invalid head and starts fork choice from the finalized checkpoint instead. [PR]
  • Operator experience: Reduced noisy beacon-node and validator-client logs, added clearer Gloas bid-selection and envelope-publication diagnostics, documented ordered REST endpoint failover, and improved error reporting for invalid P2P IP configuration.
Added
  • Accept SSZ (application/octet-stream) request bodies on POST /eth/v1/validator/proposer_preferences, matching beacon-APIs #​608. [PR]
  • Add max_execution_payment to the proposer builder config, the maximum execution-layer payment a proposer will accept from a Gloas builder. [PR]
  • Submit per-builder proposer preferences and signed request auths from the validator client ahead of Gloas proposals, and forward the matching request auth in the block request. [PR]
  • Queue payload attestations received before their beacon block and process them once the block arrives. [PR]
  • Pull execution payload bids from external builders during Gloas block production, select the best of self-build, P2P, and Builder-API bids, and submit the signed block back to the winning builder. [PR]
  • Added SSZ (application/octet-stream) response support to GET and POST /eth/v1/beacon/states/{state_id}/validator_balances (beacon-APIs #​622). [PR]
  • Add a proactive request for the payload if we haven't seen it by the payload time. [PR]
  • make build [<bin>...] [flags=...]: Build Prysm binaries without Bazel. [PR]
  • make run <bin> [flags=...] [-- <args>]: Build and run a Prysm binary without Bazel. [PR]
  • Add ConnectionCounter to the REST connection provider and ConnectionGeneration to the validator client interface, exposing a monotonic counter that advances on each beacon-node fallback switch (the gRPC provider already had ConnectionCounter). [PR]
  • Respond with 410 Gone and a message naming the replacement route when a Beacon API route that was removed from the spec (e.g. GET /eth/v1/beacon/blocks/{block_id}, POST /eth/v1/beacon/pool/attestations, GET /eth/v2/validator/blocks/{slot}) is requested, instead of a bare 404 Not Found. [PR]
Changed
  • Validator client submits proposer preferences as SSZ by default, falling back to JSON if the beacon node returns 415. [PR]
  • Validator client submits payload attestations as SSZ by default, falling back to JSON if the beacon node returns 415. [PR]
  • Validator client requests payload_attestation_data as SSZ, decoding either an SSZ or JSON response. [PR]
  • Retain BuilderConfig (relays, enabled, max execution payment) when upgrading proposer settings from v1 to v2 instead of dropping it. [PR]
  • Request a block's unknown parent by root immediately on gossip arrival instead of waiting for the pending-blocks queue tick. [PR]
  • REST Validator client now subscribes to the head_v2 beacon API event by default instead of the deprecated head event. If the beacon node does not support head_v2 (it rejects the subscription with HTTP 400), the validator client automatically falls back to the legacy head event, so it keeps working against older beacon nodes with no behavior change. [PR]
  • The payload_attributes event no longer includes parent_block_number from the gloas fork onwards. [PR]
  • Document that --beacon-rest-api-provider accepts comma-separated endpoints for ordered failover. [PR]
  • Cleaned up Gloas proposer flow logs: consistent verbs, self-build builder index rendering, single bid selection line with source and gwei value, and publish duration on envelope reveal. [PR]
  • Consolidated validator client submission logs: sync committee messages, sync contributions, and payload attestations are now summarized as one info line per distinct submission content per slot (with range-compressed validator indices), and the previous per-validator success logs were downgraded to debug level. [PR]
  • Run isAggregator check concurrently in validator.subscribeToSubnets method body. [PR]
  • make gen: Cache generation inputs to skip re-generating files that are already up to date. [PR]
  • Ignore instead of reject execution payload bids whose fee recipient does not match proposer preferences. [PR]
  • Update C-KZG to v2.1.8. [PR]
Removed
  • Remove the unused top-level max_execution_payment proposer-option field in favor of the per-builder BuilderConfig.max_execution_payment. [PR]
  • Removed proposer index cache. [PR]
Fixed
  • Accept SSZ (application/octet-stream) request bodies on POST /eth/v1/beacon/pool/payload_attestations. The handler already decoded SSZ, but the route only registered JSON so SSZ submissions were rejected with 415. [PR]
  • Allow SSZ responses on GET /eth/v1/beacon/pool/payload_attestations. The handler already supported SSZ, but the route's Accept negotiation only allowed JSON, making the SSZ response unreachable. [PR]
  • Request the data column sidecars needed to validate a payload envelope when we do not already have them. [PR]
  • Ignore execution payload bids that cannot be verified against the current head state instead of rejecting them. [PR]
  • Return execution_optimistic correctly for reward APIs (block, attestation, sync committee). [PR]
  • Emit the correct parent_block_hash in the Gloas payload_attributes SSE event by carrying the exact hash sent to the engine, so it matches for a full head instead of reporting the parent's hash. [PR]
  • avoid panic when event stream request creation fails #​16234. [PR]
  • Stop logging skipped payload_attributes events for past proposal slots as an ERROR ("received an event it was unable to handle") in the beacon node event stream. The errPayloadAttributeExpired skip is now excused like errNotRequested, removing high-volume noise under ePBS. The event_type log field now prints the event type (%T) instead of dumping the full event struct. [PR]
  • Fixed the attestation rewards API ideal_rewards response for Electra compounding validators with effective balances above 32 ETH. [PR]
  • Submit the signed block to the winning builder even when local block processing fails after broadcast. [PR]
  • Drop partial data column messages for unsubscribed topics before the SSZ decode so the shared gossip loop is not head-of-line-blocked. [PR]
  • Recover from nil headblock in db at startup. [PR]
  • Accept builder preference submissions without the --http-mev-relay flag, gloas builders are dialed per URL from the request auth. [PR]
  • Drain pending Gloas data column sidecars on block processing so columns gossiped back for our own proposed block are imported and the payload is marked available. [PR]
  • Fix race condition for reading host in REST handler. [PR]
  • Correctly populate attestation data (FromAttData) when logging in VC. [PR]
  • Notify the execution engine of the head per imported batch during Gloas initial sync. [PR]
  • Treat nil builder registry entries as reusable slots in builderInsertionIndex instead of panicking. [PR]
  • Compute the validator client's mid-slot submission delay from SLOT_DURATION_MS instead of SECONDS_PER_SLOT. [PR]
  • Ignore instead of reject queued payload envelopes and payload attestations whose signatures fail against a possibly divergent head state. [PR]
  • Surface undefined execution engine errors from gloas forkchoice updates instead of returning a nil payload ID that callers read as not proposing. [PR]
  • Return deep copies from the payload attestation pool so later aggregation cannot mutate attestations already handed to block building. [PR]
  • Apply fork choice PTC votes and enforce the current-slot check for payload attestations submitted via the REST pool endpoint. [PR]
  • Order the Gloas branch before Fulu in the gossip block topic mapping so the epoch cascade returns the right block type. [PR]
  • Hold the state lock in QueueBuilderPaymentForSlot and route builder pending withdrawal appends through one copy-on-write path. [PR]
  • Guard the startup head block with blocks.BeaconBlockIsNil before use: BeaconDB.Block returns a nil block with no error when the root is not found, so the previous inner-block nil check still segfaulted the node at startup. [PR]
  • Count PTC votes from duplicated validators (consensus-specs#5222): a validator sampled into the payload timeliness committee multiple times now has its vote recorded at every position it occupies, not only at ptc.index(validator_index). Un-skips the corresponding on_payload_attestation_message fork choice spec tests. [PR]
  • Verify submitted execution payload bids with the gossip rules and record them in the local highest-bid cache before broadcasting. [PR]
  • Fix execution_optimistic decision for attestation rewards API: use ancestor so that block root is guaranteed inside DB. [PR]
  • Treat an ENR port value of 0 as absent when building dial addresses, so peers advertising a zero port are no longer dialed at /tcp/0. [PR]
  • Re-push proposer preferences when the validator client connects to a different beacon node. The submitted-slot dedup cache survives runner restarts and beacon-node fallback switches, so a freshly connected node previously received no preferences for slots already marked submitted. A new runner (initial connect / health recovery) now propagates forceFullPush to the proposer-preference build, and a beacon-node connection change forces a full re-push. The change is detected via a monotonic connection counter (ValidatorClient.ConnectionGeneration, implemented by each transport client from its own connection provider) rather than the host string, so a round-robin bounce (host0 → host1 → host0) that replaces the connection is still caught. The switch signal is only consumed once a push is confirmed, and proposer preferences and builder registrations are tracked independently, so a failed re-push to the new node is retried on later slots. [PR]
  • Retry failed proposer-preference submissions: a batch whose subm

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@bussyjd bussyjd mentioned this pull request Jul 20, 2026
Open
@github-actions
github-actions Bot force-pushed the renovate/ethereum-clients branch 6 times, most recently from 9fb5519 to d0aa770 Compare July 27, 2026 20:30
@github-actions
github-actions Bot force-pushed the renovate/ethereum-clients branch from d0aa770 to be8dc97 Compare July 29, 2026 06:00
@github-actions
github-actions Bot force-pushed the renovate/ethereum-clients branch from be8dc97 to 2b50694 Compare July 29, 2026 15:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate/ethereum-clients

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants