Release v1.49.0

Good day Lodestar operators! We’ve just released v1.49.0 and recommend upgrading for mainnet and testnet users.

This release makes Lodestar ready for the Glamsterdam fork on Sepolia. Sepolia is the first public network to run Glamsterdam and is the only testnet scheduled so far and will test both the Gloas features and will bump the gas limit to 200M. Hoodi and mainnet aren't scheduled yet, so stay tuned for those releases in the near future.

New flag: --chain.dedupePayloads activates for Gloas
De-duplicates archived execution payloads and stores a ~1 KB header envelope instead of the full payload (>99% archive savings) and reconstructs from the EL on read. This feature is turned on by default. It's quite CPU-heavy (and EL speed dependent) when others are trying to sync from your running node as a call is made to the EL and then payload serialization runs on the main thread, so you may need to monitor you setup and turn it off on low-CPU nodes. The tradeoff for leaving it off is higher disk usage.

Full Changelog

Features

• de-duplicate execution payload from archived Gloas envelopes (#10089) (@markolazic01)
• schedule 200M gas limit at Glamsterdam on Sepolia (#10172) (@lodekeeper)
• use zig backed lodestar-z shuffle (#9829) (@nazarhussain)
• search payload at deadline (#10134) (@twoeths)
• unknownEnvelopeBlockRootSlot event (#10112) (@twoeths)
• penalize peers for forwarding REJECTED gossip messages (#10059) (@twoeths)
• schedule Gloas fork on Sepolia (#10119) (@lodekeeper)
• add metrics for downloadPayload() of unknown sync (#10101) (@twoeths)
• builder: add Engine payload source (#9958) (@krisoshea-eth)

Bug Fixes

• update earliestAvailableSlot when pruning history (#10177) (@nflaig)
• do not remove pending block on failed download (#10137) (@twoeths)
• harden validator block signing (#10142) (@nflaig)
• do not replace recorded slashing protection data on interchange import (#10168) (@nflaig)
• reject slashing protection import of attestations from the future (#10170) (@nflaig)
• check attestation target epoch and block slot before signing (#10169) (@nflaig)
• validate slot and epoch values on slashing protection import (#10166) (@nflaig)
• use exact integer division for Electra slashing penalty (#10163) (@nflaig)
• derive ephemery config from published iteration, not process start time (#10161) (@lodekeeper)
• update gossipsub to v17.1.2 (#10157) (@wemeetagain)
• expose single attestations and filter committees in pool API (#10149) (@nflaig)
• reject pre-Gloas payload attestations on gossip (#10141) (@nflaig)
• always check progressive balances (#10046) (@GrapeBaBa)
• specify optimistic search for payload in NetworkProcessor (#10123) (@twoeths)
• keep idle event streams alive (#10133) (@nflaig)
• bind IPv6 by default only if the host has a global IPv6 address (#10104) (@MysticRyuujin)
• suggest the ASCII form when rejecting a builder url (#10127) (@nflaig)
• derive default builder auth data from the url hostname (#10107) (@nflaig)
• delete block archive index entries when pruning history (#10110) (@nflaig)
• prune archived states before the finalized epoch with chain.pruneHistory (#10106) (@nflaig)
• prune cache entries of repeat proposals that are not imported (#10083) (@nflaig)
• bound inbound gossipsub RPC frames by max_message_size (#10079) (@ensi321)
• prune execution payload envelopes with chain.pruneHistory (#10105) (@nflaig)
• bound gloas DataColumnSidecar by max blob of BLOB_SCHEDULE (#10076) (@twoeths)
• reject invalid characters in fromHex on nodejs build (#9943) (@pucedoteth)
• reject gloas blocks with legacy deposits on deserialization (#10080) (@nflaig)
• align gloas external signer requests with remote signing api (#10071) (@nflaig)
• network: declare @libp2p/utils as a runtime dependency of beacon-node (#10086) (@lodekeeper)
• network: actually dial QUIC before TCP when a peer advertises both (#10077) (@spiral-ladder)
• api: respect cancellation during event stream setup (#10065) (@krisoshea-eth)

Refactoring

• move stateHashTreeRootTime metric to beacon-node (#10153) (@twoeths)
• remove legacy backfill sync (#10147) (@nflaig)
• change onClockSlot to startPayloadPollAtSlot() (#10144) (@twoeths)
• compute payload attributes once in prepareForNextSlot (#10056) (@nflaig)
• state-transition: re-organize test helpers (#10099) (@spiral-ladder)
• builder: name the payload store explicitly (#10063) (@krisoshea-eth)

Continuous Integration

• attest Docker image provenance and SBOMs (#10171) (@lodekeeper)
• require today's nightly spec test run (#10151) (@nflaig)

Tests

• apply EIP-3076 interchange test steps in order and update to v5.3.0 (#10167) (@nflaig)
• assert progressive balance drift metric (#10143) (@lodekeeper)
• builder nightly smoke test (#10150) (@markolazic01)
• fix Capella epoch benchmark fork (#10145) (@lodekeeper)
• fail gossip spec tests on unexpected errors (#10140) (@nflaig)
• apply FCR attestation steps before the slot tick (#10116) (@nazarhussain)
• raise regression threshold for high-variance noise sendData benchmarks (#10111) (@lodekeeper)
• fix finalized sync e2e cleanup (#10098) (@lodekeeper)
• cover finalized checkpoint store callback (#10097) (@lodekeeper)
• verify imported block in unknown-block sync simulation (#10054) (@krisoshea-eth)
• stop gating CI on high-variance data-availability benchmarks (#10074) (@lodekeeper)
• tighten snappy decoder assertions (#10068) (@nflaig)

Maintenance

• v1.49.0 release (#10178) (@matthewkeil)
• update consensus specs to v1.7.0-beta.2 (#10154) (@nflaig)
• track p2p served bytes and request count per method (#10176) (@twoeths)
• track gloas newPayload metrics (#10113) (@twoeths)
• update ethspecify mappings (#10126) (@nflaig)
• log the value and execution payment of each bid candidate (#10135) (@nflaig)
• add builder url to failed preferences submission errors (#10136) (@nflaig)
• make gossip max size type explicit (#10103) (@lodekeeper)
• log block and bid values in ETH (#10108) (@nflaig)
• exclude all spec-tests directories from docker build context (#10102) (@ensi321)
• sign release tags (#10096) (@lodekeeper)
• merge v1.48.0 back to unstable (#10095) (@nflaig)
• publish discv5 and QUIC UDP ports in docker-compose (#10078) (@spiral-ladder)
• test: fix stale Infura JSDoc and drop orphaned state-transition devDep (#10175) (@lodekeeper)
• deps: bump the actions group with 5 updates (#10139) (@dependabot[bot])
• deps: bump the actions group with 4 updates (#10084) (@dependabot[bot])

Documentation

• import AGENTS.md into CLAUDE.md (#10117) (@nazarhussain)