v1.39.2

Important

Given the number of CVEs from Microsoft this release fixes it is mandatory for all node operators.

Release notes

This is a patch release on top of 1.39.1 that updates the .NET dependencies to Microsoft's July 2026 servicing release (10.0.10), which 17 CVE security fixes, and makes the eth_getLogs block-range limit explicit and configurable.

Overview

4 changes since 1.39.1:

• .NET packages updated to 10.0.10 — Microsoft's July 2026 servicing update, which addresses several security vulnerabilities in .NET (#12449)
• Explicit, configurable eth_getLogs block-range limit — the Receipt.MaxBlockDepth option (default 10,000 blocks) is now documented and applied consistently, including when "useIndex": false is requested; requests exceeding the range are rejected with an "invalid params" (32602) error. Set to 0 to disable; ignored when the log index is enabled (#12509)
• Routine dependency bumps: Microsoft.IdentityModel.JsonWebTokens, System.CommandLine, Nethermind.Crypto.SecP256r1, and a RocksDB package rebuild (10.10.1.649 → 10.10.1.1747; same native RocksDB version) (#12449, #12491)

What's Changed

• chore: Update packages by @rubo in #12449
• hotfix: Configurable and explicit eth_getLogs scan limit by @alexb5dh in #12509
• Update 1.39.2 by @stdevMac in #12491
• chore: update Directory.Build.props for 1.39.2 by @stdevMac in 6a0e3c427c

Full Changelog: 1.39.1...1.39.2

Build signatures

The packages are signed with the following OpenPGP key: AD12 7976 5093 C675 9CD8 A400 24A7 7461 6F1E 617E