chore(deps): update ethereum el/cl client updates by github-actions[bot] · Pull Request #825 · ObolNetwork/obol-stack

github-actions · 2026-08-17T01:30:47Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
ChainSafe/lodestar	minor	`v1.45.0` → `v1.46.0`
Consensys/teku	minor	`26.7.1` → `26.8.0`
NethermindEth/nethermind	patch	`1.39.2` → `1.39.3`
erigontech/erigon	patch	`v3.5.4` → `v3.5.5`
hyperledger/besu	minor	`26.7.1` → `26.8.0`
paradigmxyz/reth	minor	`v2.4.1` → `v2.5.1`
sigp/lighthouse	patch	`v8.2.1` → `v8.2.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

ChainSafe/lodestar (ChainSafe/lodestar)

`v1.46.0`

Compare Source

Good day Lodestar operators! We've just released v1.46.0, a recommended upgrade for all mainnet and testnet users. This release focuses on shutdown/restart stability, safer validator behavior while optimistic, and continued Gloas/Heze development for the upcoming forks and devnets.

If you build or run Lodestar from source with Bun, switch back to Node.js: Bun runtime support was removed. Node remains ^24.13.0. No migration is required for Docker or binary operators.

You may have noticed your nodes hanging on shutdown or restarts recently. We found, fixed a couple of bugs related to libp2p so you will now have smoother shutdowns and restarts. This will also fix a secondary effect that caused longer than normal re-sync times. Now the network-worker termination is bounded and no longer prevents finalized-state archiving before that process-manager kills the hanging shutdown. During our investigation we have found a latent bug in Node.js that we are tracking down and will get fixed. It is a pretty rare race condition that may affect shutdown in 1-ish percent of terminations. This will no longer affect state archival though as mentioned and your nodes will start up and sync quickly again.

We also fixed a weird edge case and in all circumstances, Lodestar will now refuses block production on optimistic heads, and the validator client skips sync-committee signing while the connected beacon node is optimistic.

The hanging process, that was mentioned above, highlighted an issue with far-behind-node head-state sync failure. It was only present if you were syncing from genesis though which is not a recommended process. This release fixed that bug and also provides better Gloas batch-failure classification, orphaned first-payload handling, and avoiding peer penalties for local EL failures.

Full Changelog

Features

produce proposer slashings from observed equivocations (#9787) (@nflaig)
report parent_block_hash for safe/finalized post-Gloas (#9393) (@wemeetagain)
cache builder deposit signatures for gloas fork transition (#9727) (@twoeths)
implement consensus_and_equivocation for blocks and payload envelopes (#9757) (@nflaig)
gloas polar bear banner (#9742) (@markolazic01)
add heze fork definition and boilerplate (#9505) (@ensi321)
implement compute_weak_subjectivity_period for Gloas (EIP-8061) (#9625) (@markolazic01)
builder initial setup (#9758) (@markolazic01)
allow multiple bids compatible with the head view (#9739) (@nflaig)
classify batch processing failures (#9693) (@twoeths)
require minimum increment to forward bids over gossip (#9706) (@nflaig)
implement head_v2 event (#9486) (@markolazic01)
builder selection, broadcast validation, stateless flow for gloas block production (#9595) (@nflaig)
implement forkchoice is_head_weak() and is_parent_strong() (#9654) (@twoeths)
disable fast confirmation rule while syncing (#9681) (@nazarhussain)
implement non-eip-7688 changes in alpha.12 (#9606) (@ensi321)
add fork choice compliance test for pre-gloas forks (#9670) (@ensi321)
implement EIP 7688 (#9390) (@wemeetagain)

Bug Fixes

bound network worker termination so shutdown can complete (#9790) (@nflaig)
handle 1st orphaned payload of blocks[0] in range sync (#9785) (@twoeths)
do not produce blocks on top of an optimistic head (#9779) (@nflaig)
treat ping/status dial timeouts as HighToleranceError (#9707) (@Lodekeeper)
skip sync committee participation while node is optimistic (#9752) (@Lodekeeper)
get proposer from head state in prepareNextSlot (#9762) (@twoeths)
avoid peer scoring on local payload errors (#9755) (@Lodekeeper)
getPoolAttestationsV2 should return an empty array when no attestations are available (#9675) (@markolazic01)
use payload request limit for envelope byPeer range quota (#9710) (@ensi321)
ignore parent bids at epoch boundary (#9756) (@nflaig)
use attested slot for light client response context (#9760) (@spiral-ladder)
use UintBn64 for gloas targetGasLimit (#9751) (@Lodekeeper)
validate cached validator indices against state (#9748) (@nflaig)
use UintBn64 for gloas ExecutionPayloadBid.executionPayment (#9749) (@Lodekeeper)
use parent block slot for attestation payload availability (#9731) (@nflaig)
use UintBn64 for gloas ExecutionPayloadBid.gasLimit (#9750) (@Lodekeeper)
correct clock disparity handling for proposer preferences (#9729) (@nflaig)
use proposer lookahead for next epoch proposer cache (#9730) (@nflaig)
distinguish 404 from real errors when waiting for genesis (#9726) (@Lodekeeper)
validate proposer preferences dependent root (#9695) (@nflaig)
skip already-seen data columns in zero-peer publish warning (#9580) (@Lodekeeper)
tighten light-client zeroed-header checks to match spec (#9419) (@ensi321)
emit head event whenever fork choice head changes (#9697) (@nflaig)
return 400 for gossip validation errors (#9699) (@nflaig)
split execution engine errors (#9685) (@twoeths)
harden assertLinearChainSegment (#9684) (@twoeths)
scan all proto array nodes when counting payload reveals (#9676) (@nflaig)
beacon-node: avoid deep-sync head-state wedge (#9717) (@Lodekeeper)
reqresp: map malformed request payloads to invalid request (#9645) (@Osraka)

Performance

improve process_attestation() for gloas (#9664) (@twoeths)

Refactoring

use UintBn64 for Eth1Data.depositCount (#9747) (@Lodekeeper)
validate light_client_updates_by_range handler (#9745) (@nflaig)
move validator clock util to state-transition (#9733) (@Lodekeeper)
remove bun runtime support (#9719) (@nazarhussain)
move assertEqualParams from validator to config (#9725) (@Lodekeeper)
optimize head event emission logic (#9720) (@markolazic01)

Dependencies

bump @chainsafe/libp2p-quic to 2.1.3 (#9792) (@nflaig)

Build System

migrate to TypeScript 7.0 (#9575) (@nazarhussain)

Continuous Integration

expand native portability checks (#9642) (@nflaig)

Tests

enable gloas fast_confirmation spec tests (#9704) (@nazarhussain)
beacon-node: add e2e beacon-api query array length compliance tests (#9713) (@Lodekeeper)

Maintenance

release v1.46.0 (#9788) (@Matthewkeil)
add debug log when proposer slashing production is skipped (#9789) (@nflaig)
bump libp2p-quic (#9784) (@matthewkeil)
trim verbose gossip-disparity doc comments (#9631) (@Lodekeeper)
handle Rekor 409 conflict during npm provenance publish (#9703) (@Lodekeeper)
avoid epoch transition when validating gossip columns (#9772) (@twoeths)
hide builder-cli doc (#9770) (@markolazic01)
use tsc for builder package scripts (#9766) (@Lodekeeper)
follow up on #9390 on EIP-7688 changes (#9689) (@ensi321)
properly order BLS job wait histogram buckets (#9765) (@spiral-ladder)
add gloas ethspecify references (#9753) (@nflaig)
reject blob sidecar with slot not higher than parent (#9740) (@Alleysira)
fix typo in validator config verification log (#9737) (@Lodekeeper)
merge v1.45.0 back to unstable (#9714) (@matthewkeil)
replace ts-node with tsx for running TypeScript (#9635) (@nazarhussain)
deps: bump js-yaml from 4.3.0 to 4.3.1 (#9786) (@dependabot[bot])
deps: bump js-yaml from 4.2.0 to 4.3.0 (#9702) (@dependabot[bot])
deps: bump the actions group across 1 directory with 8 updates (#9759) (@dependabot[bot])

Documentation

prefer targeted pre-push tests (#9643) (@nflaig)

`v1.46.0-rc.1`

Compare Source

Changelog

Full Changelog

Features

produce proposer slashings from observed equivocations (#9787) (@nflaig)
report parent_block_hash for safe/finalized post-Gloas (#9393) (@wemeetagain)
cache builder deposit signatures for gloas fork transition (#9727) (@twoeths)
implement consensus_and_equivocation for blocks and payload envelopes (#9757) (@nflaig)
gloas polar bear banner (#9742) (@markolazic01)
add heze fork definition and boilerplate (#9505) (@ensi321)
implement compute_weak_subjectivity_period for Gloas (EIP-8061) (#9625) (@markolazic01)
builder initial setup (#9758) (@markolazic01)
allow multiple bids compatible with the head view (#9739) (@nflaig)
classify batch processing failures (#9693) (@twoeths)
require minimum increment to forward bids over gossip (#9706) (@nflaig)
implement head_v2 event (#9486) (@markolazic01)
builder selection, broadcast validation, stateless flow for gloas block production (#9595) (@nflaig)
implement forkchoice is_head_weak() and is_parent_strong() (#9654) (@twoeths)
disable fast confirmation rule while syncing (#9681) (@nazarhussain)
implement non-eip-7688 changes in alpha.12 (#9606) (@ensi321)
add fork choice compliance test for pre-gloas forks (#9670) (@ensi321)
implement EIP 7688 (#9390) (@wemeetagain)

Bug Fixes

bound network worker termination so shutdown can complete (#9790) (@nflaig)
handle 1st orphaned payload of blocks[0] in range sync (#9785) (@twoeths)
do not produce blocks on top of an optimistic head (#9779) (@nflaig)
treat ping/status dial timeouts as HighToleranceError (#9707) (@lodekeeper)
skip sync committee participation while node is optimistic (#9752) (@lodekeeper)
get proposer from head state in prepareNextSlot (#9762) (@twoeths)
avoid peer scoring on local payload errors (#9755) (@lodekeeper)
getPoolAttestationsV2 should return an empty array when no attestations are available (#9675) (@markolazic01)
use payload request limit for envelope byPeer range quota (#9710) (@ensi321)
ignore parent bids at epoch boundary (#9756) (@nflaig)
use attested slot for light client response context (#9760) (@spiral-ladder)
use UintBn64 for gloas targetGasLimit (#9751) (@lodekeeper)
validate cached validator indices against state (#9748) (@nflaig)
use UintBn64 for gloas ExecutionPayloadBid.executionPayment (#9749) (@lodekeeper)
use parent block slot for attestation payload availability (#9731) (@nflaig)
use UintBn64 for gloas ExecutionPayloadBid.gasLimit (#9750) (@lodekeeper)
correct clock disparity handling for proposer preferences (#9729) (@nflaig)
use proposer lookahead for next epoch proposer cache (#9730) (@nflaig)
distinguish 404 from real errors when waiting for genesis (#9726) (@lodekeeper)
validate proposer preferences dependent root (#9695) (@nflaig)
skip already-seen data columns in zero-peer publish warning (#9580) (@lodekeeper)
tighten light-client zeroed-header checks to match spec (#9419) (@ensi321)
emit head event whenever fork choice head changes (#9697) (@nflaig)
return 400 for gossip validation errors (#9699) (@nflaig)
split execution engine errors (#9685) (@twoeths)
harden assertLinearChainSegment (#9684) (@twoeths)
scan all proto array nodes when counting payload reveals (#9676) (@nflaig)
beacon-node: avoid deep-sync head-state wedge (#9717) (@lodekeeper)
reqresp: map malformed request payloads to invalid request (#9645) (@Osraka)

Performance

improve process_attestation() for gloas (#9664) (@twoeths)

Refactoring

use UintBn64 for Eth1Data.depositCount (#9747) (@lodekeeper)
validate light_client_updates_by_range handler (#9745) (@nflaig)
move validator clock util to state-transition (#9733) (@lodekeeper)
remove bun runtime support (#9719) (@nazarhussain)
move assertEqualParams from validator to config (#9725) (@lodekeeper)
optimize head event emission logic (#9720) (@markolazic01)

Dependencies

bump @chainsafe/libp2p-quic to 2.1.3 (#9792) (@nflaig)

Build System

migrate to TypeScript 7.0 (#9575) (@nazarhussain)

Continuous Integration

expand native portability checks (#9642) (@nflaig)

Tests

enable gloas fast_confirmation spec tests (#9704) (@nazarhussain)
beacon-node: add e2e beacon-api query array length compliance tests (#9713) (@lodekeeper)

Maintenance

add debug log when proposer slashing production is skipped (#9789) (@nflaig)
bump libp2p-quic (#9784) (@matthewkeil)
trim verbose gossip-disparity doc comments (#9631) (@lodekeeper)
handle Rekor 409 conflict during npm provenance publish (#9703) (@lodekeeper)
avoid epoch transition when validating gossip columns (#9772) (@twoeths)
hide builder-cli doc (#9770) (@markolazic01)
use tsc for builder package scripts (#9766) (@lodekeeper)
follow up on #9390 on EIP-7688 changes (#9689) (@ensi321)
properly order BLS job wait histogram buckets (#9765) (@spiral-ladder)
add gloas ethspecify references (#9753) (@nflaig)
reject blob sidecar with slot not higher than parent (#9740) (@Alleysira)
fix typo in validator config verification log (#9737) (@lodekeeper)
merge v1.45.0 back to unstable (#9714) (@matthewkeil)
replace ts-node with tsx for running TypeScript (#9635) (@nazarhussain)
deps: bump js-yaml from 4.3.0 to 4.3.1 (#9786) (@dependabot[bot])
deps: bump js-yaml from 4.2.0 to 4.3.0 (#9702) (@dependabot[bot])
deps: bump the actions group across 1 directory with 8 updates (#9759) (@dependabot[bot])

Documentation

prefer targeted pre-push tests (#9643) (@nflaig)

`v1.46.0-rc.0`

Compare Source

Changelog

Full Changelog

Features

produce proposer slashings from observed equivocations (#9787) (@nflaig)
report parent_block_hash for safe/finalized post-Gloas (#9393) (@wemeetagain)
cache builder deposit signatures for gloas fork transition (#9727) (@twoeths)
implement consensus_and_equivocation for blocks and payload envelopes (#9757) (@nflaig)
gloas polar bear banner (#9742) (@markolazic01)
add heze fork definition and boilerplate (#9505) (@ensi321)
implement compute_weak_subjectivity_period for Gloas (EIP-8061) (#9625) (@markolazic01)
builder initial setup (#9758) (@markolazic01)
allow multiple bids compatible with the head view (#9739) (@nflaig)
classify batch processing failures (#9693) (@twoeths)
require minimum increment to forward bids over gossip (#9706) (@nflaig)
implement head_v2 event (#9486) (@markolazic01)
builder selection, broadcast validation, stateless flow for gloas block production (#9595) (@nflaig)
implement forkchoice is_head_weak() and is_parent_strong() (#9654) (@twoeths)
disable fast confirmation rule while syncing (#9681) (@nazarhussain)
implement non-eip-7688 changes in alpha.12 (#9606) (@ensi321)
add fork choice compliance test for pre-gloas forks (#9670) (@ensi321)
implement EIP 7688 (#9390) (@wemeetagain)

Bug Fixes

handle 1st orphaned payload of blocks[0] in range sync (#9785) (@twoeths)
do not produce blocks on top of an optimistic head (#9779) (@nflaig)
treat ping/status dial timeouts as HighToleranceError (#9707) (@lodekeeper)
skip sync committee participation while node is optimistic (#9752) (@lodekeeper)
get proposer from head state in prepareNextSlot (#9762) (@twoeths)
avoid peer scoring on local payload errors (#9755) (@lodekeeper)
getPoolAttestationsV2 should return an empty array when no attestations are available (#9675) (@markolazic01)
use payload request limit for envelope byPeer range quota (#9710) (@ensi321)
ignore parent bids at epoch boundary (#9756) (@nflaig)
use attested slot for light client response context (#9760) (@spiral-ladder)
use UintBn64 for gloas targetGasLimit (#9751) (@lodekeeper)
validate cached validator indices against state (#9748) (@nflaig)
use UintBn64 for gloas ExecutionPayloadBid.executionPayment (#9749) (@lodekeeper)
use parent block slot for attestation payload availability (#9731) (@nflaig)
use UintBn64 for gloas ExecutionPayloadBid.gasLimit (#9750) (@lodekeeper)
correct clock disparity handling for proposer preferences (#9729) (@nflaig)
use proposer lookahead for next epoch proposer cache (#9730) (@nflaig)
distinguish 404 from real errors when waiting for genesis (#9726) (@lodekeeper)
validate proposer preferences dependent root (#9695) (@nflaig)
skip already-seen data columns in zero-peer publish warning (#9580) (@lodekeeper)
tighten light-client zeroed-header checks to match spec (#9419) (@ensi321)
emit head event whenever fork choice head changes (#9697) (@nflaig)
return 400 for gossip validation errors (#9699) (@nflaig)
split execution engine errors (#9685) (@twoeths)
harden assertLinearChainSegment (#9684) (@twoeths)
scan all proto array nodes when counting payload reveals (#9676) (@nflaig)
beacon-node: avoid deep-sync head-state wedge (#9717) (@lodekeeper)
reqresp: map malformed request payloads to invalid request (#9645) (@Osraka)

Performance

improve process_attestation() for gloas (#9664) (@twoeths)

Refactoring

use UintBn64 for Eth1Data.depositCount (#9747) (@lodekeeper)
validate light_client_updates_by_range handler (#9745) (@nflaig)
move validator clock util to state-transition (#9733) (@lodekeeper)
remove bun runtime support (#9719) (@nazarhussain)
move assertEqualParams from validator to config (#9725) (@lodekeeper)
optimize head event emission logic (#9720) (@markolazic01)

Build System

migrate to TypeScript 7.0 (#9575) (@nazarhussain)

Continuous Integration

expand native portability checks (#9642) (@nflaig)

Tests

enable gloas fast_confirmation spec tests (#9704) (@nazarhussain)
beacon-node: add e2e beacon-api query array length compliance tests (#9713) (@lodekeeper)

Maintenance

bump libp2p-quic (#9784) (@matthewkeil)
trim verbose gossip-disparity doc comments (#9631) (@lodekeeper)
handle Rekor 409 conflict during npm provenance publish (#9703) (@lodekeeper)
avoid epoch transition when validating gossip columns (#9772) (@twoeths)
hide builder-cli doc (#9770) (@markolazic01)
use tsc for builder package scripts (#9766) (@lodekeeper)
follow up on #9390 on EIP-7688 changes (#9689) (@ensi321)
properly order BLS job wait histogram buckets (#9765) (@spiral-ladder)
add gloas ethspecify references (#9753) (@nflaig)
reject blob sidecar with slot not higher than parent (#9740) (@Alleysira)
fix typo in validator config verification log (#9737) (@lodekeeper)
merge v1.45.0 back to unstable (#9714) (@matthewkeil)
replace ts-node with tsx for running TypeScript (#9635) (@nazarhussain)
deps: bump js-yaml from 4.3.0 to 4.3.1 (#9786) (@dependabot[bot])
deps: bump js-yaml from 4.2.0 to 4.3.0 (#9702) (@dependabot[bot])
deps: bump the actions group across 1 directory with 8 updates (#9759) (@dependabot[bot])

Documentation

prefer targeted pre-push tests (#9643) (@nflaig)

Consensys/teku (Consensys/teku)

`v26.8.0`

Compare Source

This is a recommended update containing bug fixes and breaking changes.

Downloads

Available as 26.8.0 on Dockerhub
Download the binary distribution:
- tar.gz (sha256: 19d6b3a5e65e8608d0809877973e8ce2bcdca912c13d43e2d41a472d70d98ea4)
- zip (sha256: e29759d182442ea26096188796f69bbb8d46d987534128edf27ffb5e955bfeb4)

Known Issues

If you are using an archive node with a leveldb-tree database, an issue has been introduced where startup takes a very long time. You may be better off avoiding this release if your beacon/db/db.version is leveldb-tree.

Breaking Changes

Removed the legacy web3j-based Eth1/PoW deposit-log fetching. A node no longer requires an Eth1 JSON-RPC endpoint to run; deposits are sourced from the finalized deposit-tree snapshot and in-protocol (EIP-6110) execution requests. The following CLI options have been removed: --eth1-endpoints / --eth1-endpoint, --eth1-deposit-contract-max-request-size.
Removed the non-production validator-tools send-deposits and validator-tools generate-and-send-deposits internal subcommands (web3j-based deposit submission). validator-tools generate-keys is unaffected.
Removed the GetDepositSnapshot RPC endpoint, which has been deprecated and removed since v3.0.0 of the Beacon API spec.

Bug Fixes

Fixed Beacon REST API socket retention when clients cancel pending asynchronous requests. Requests now time out after 30 seconds.
Fix an edge case on BeaconBlocksByRange where a request for a single block would return an empty response instead of the block.

NethermindEth/nethermind (NethermindEth/nethermind)

`v1.39.3`

Compare Source

[!IMPORTANT]
This is a mandatory update for all node operators. Please upgrade at your earliest convenience.

Release notes

A patch release on top of 1.39.2 with reliability and hardening fixes across block processing, networking, and request decoding. No consensus or database-format changes, so it's a drop-in upgrade from any 1.39.x version.

Overview

3 changes since 1.39.2:

Hardened ABI decoding against malformed input (#12588)
Fixed pooled-memory cleanup in block processing and networking (#12034)
Reduced allocations in EIP-6110 deposit-request decoding (#12185)

What's Changed

Validate ABI decode allocation bounds by @flcl42 in #12588
Fix undisposed array-pool list leaks by @batrr in #12034
perf(requests): reuse a stack buffer for deposit request decoding by @AnkushinDaniil in #12185
chore: update Directory.Build.props for 1.39.3 by @stdevMac in 28cbe2a

Full Changelog: NethermindEth/nethermind@1.39.2...1.39.3

Build signatures

The packages are signed with the following OpenPGP key: AD12 7976 5093 C675 9CD8 A400 24A7 7461 6F1E 617E

erigontech/erigon (erigontech/erigon)

`v3.5.5`

Compare Source

v3.5.5 is a bugfix and security release recommended for all users, and especially for block proposers and archive-node operators. It fixes a panic on every Fulu blinded-block submission (#23150), a payload frozen before its slot began under an external consensus layer (#23102), and wrong logIndex values on archive nodes (#22951). It is a drop-in upgrade from 3.5.4 — no re-sync required.

Bugfixes

cl/beacon: handle an empty Fulu builder response (#23150) by @domiwei — Builder API v2 answers a successful Fulu blinded-block submission with 202 Accepted and no body, so the builder client returned all-nil and publishBlindedBlocks dereferenced the nil payload. The beacon router installs no middleware.Recoverer, so the validator client saw only a dropped connection and nothing reached the Erigon log. Fixes #22598.
execution: build payloads until the slot they are for (#23102) by @lystopad — the builder's time budget ran from when payload attributes arrived rather than from the payload timestamp, so a consensus layer sending attributes well ahead of the slot got a payload frozen before that slot began. The budget now derives from the timestamp, floored at the old value and capped at two slots. Non-proposing nodes and Caplin are unaffected.
db/state: route receipt-domain reads through the overlay DomainReader (#22951) by @Sahil-4555 and @mh0lt — a block admitted through the block overlay read its receipt metadata from the committed tx, where a history miss fell back to GetLatest and returned the previous writing block's final log count. The wrong logIndex was then cached in the RPC layer. Affected v3.5.1–v3.5.4. Fixes #22106.
db/state: roll back receipt domains on an in-RAM reorg unwind (#23064) by @MoonBoi9001 — the in-memory unwind path restored a hand-written list of the four state kinds that existed when it was written and never gained the receipt counters added later, so it left the abandoned blocks' values in place. It now walks every state kind, as the disk path does.
db/downloader: allow seeding caplin state snapshots with a nil global type (#22980) by @lystopad — a node upgraded in place from a recent release/3.4 build logged nil ptr after parsing file: caplin/…-NextSyncCommittee.seg and silently stopped seeding its caplin state snapshots.

Security

build: bump golang.org/x/text to v0.39.0 (#23178) by @lystopad — CVE-2026-56852: infinite loop in unicode/norm on invalid UTF-8. Reachable from the downloader's HTTP/3 webseed path, and the only advisory here that govulncheck reports as called.
build: bump golang.org/x/net to v0.56.0 (#23178) by @lystopad — CVE-2026-46600: panic parsing a malformed SVCB or HTTPS DNS resource record.
build: bump github.com/quic-go/webtransport-go to v0.11.1 (#23178) by @lystopad — CVE-2026-57497: memory exhaustion from unbounded buffering of unknown capsules. Not reachable in Erigon: no WebTransport libp2p transport is registered.
build: bump github.com/go-chi/chi/v5 to v5.3.1 (#23178) by @lystopad — CVE-2025-69725 (open redirect in RedirectSlashes) plus three middleware.RealIP IP-spoofing advisories. Not reachable in Erigon: none of chi's middleware is used.

Improvements

build: revert the go-eth-kzg verifier optimization (#23177) by @yperbasis — release/3.5 pinned crate-crypto/go-eth-kzg to an Erigon fork carrying an upstream change that is still an unmerged draft. This restores the released upstream v1.5.0 while the correctness concerns are investigated.

Full Changelog: <https://gi

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

github-actions Bot added the renovate/ethereum-clients label Aug 17, 2026

github-actions Bot force-pushed the renovate/ethereum-clients branch 2 times, most recently from 85634df to 3075fdd Compare August 19, 2026 23:05

chore(deps): update ethereum el/cl client updates

a816f4c

github-actions Bot force-pushed the renovate/ethereum-clients branch from 3075fdd to a816f4c Compare August 20, 2026 13:19

Navigation Menu

Uh oh!

chore(deps): update ethereum el/cl client updates - #825

chore(deps): update ethereum el/cl client updates#825
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/ethereum-clients

github-actions Bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

github-actions Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.46.0

Features

Bug Fixes

Performance

Refactoring

Dependencies

Build System

Continuous Integration

Tests

Maintenance

Documentation

v1.46.0-rc.1

Changelog

Features

Bug Fixes

Performance

Refactoring

Dependencies

Build System

Continuous Integration

Tests

Maintenance

Documentation

v1.46.0-rc.0

Changelog

Features

Bug Fixes

Performance

Refactoring

Build System

Continuous Integration

Tests

Maintenance

Documentation

v26.8.0

Downloads

Known Issues

Breaking Changes

Bug Fixes

v1.39.3

Release notes

Overview

What's Changed

Build signatures

v3.5.5

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

github-actions Bot commented Aug 17, 2026 •

edited

Loading

`v1.46.0`

`v1.46.0-rc.1`

`v1.46.0-rc.0`

`v26.8.0`

`v1.39.3`

`v3.5.5`