26.7.1

🚨 Besu 26.7.1 fixes security vulnerabilities — upgrade ASAP. Thanks to EF Security & CertiK for responsible disclosure.

Breaking Changes

• If you are a heavy user of eth_newFilter/eth_newBlockFilter/eth_newPendingTransactionFilter RPC methods, you may need to review the default values of the new configuration options --rpc-max-active-filters (default 1000; 0 = no limit) which rejects filter creation past the cap, and --rpc-filter-timeout-seconds (seconds; default 120) which makes the previously hardcoded 10-minute filter expiry configurable.
• If you are a heavy user of eth_subscribe websocket RPC, you may need to review the default values of the new configuration options --rpc-ws-max-active-subscriptions (default 100,000; 0 = no limit) which rejects subscription creation past the cap.

Upcoming Breaking Changes

• --min-block-occupancy-ratio is deprecated and will be removed in a future release
• Plugin API
  • PluginTransactionSelectorFactory.create(final SelectorsStateManager selectorsStateManager) is deprecated for removal
• --Xmax-tracked-seen-txs-per-peer renamed to --Xmax-tracked-seen-txs (old name kept as deprecated alias will be removed in a future release)
• BFT option xemptyblockperiodseconds has been taken out of experimental and been renamed emptyblockperiodseconds. The old config option is deprecated and will be removed in a future release.
• --Xbft-legacy-protocol-encoding will be removed once Besu 25.x is no longer supported. #10499
• --Xsnapsync-synchronizer-pivot-block-distance-before-caching is deprecated and will be removed in a future release; the flag is now a silent no-op.
• --rpc-tx-feecap will treat a value of 0 as limiting fees to 0. Today it treats 0 as "do not cap fees". To achieve similar behaviour set it to a suitably large value to effectively prevent any fee capping.

Bug fixes

• Fix engine_newPayload responding with a -32600 Invalid Request JSON-RPC error instead of an INVALID payload status when the payload contains a legacy transaction with an invalid v value. eth_sendRawTransaction and debug_batchSendRawTransaction now report the standard Invalid RLP in raw transaction hex invalid-params error for such transactions instead of an unhandled internal error. #10784
• Fix potential ArithmeticException: integer overflow when prioritizing peer connections whose initiation timestamps are more than ~24.8 days apart. EthPeers.compareConnectionInitiationTimes now uses Long.compare instead of narrowing the timestamp difference to an int. #10787
• Layered txpool: fix the sender balance check rejecting zero upfront cost transactions from zero balance senders, which caused free gas networks to produce only empty blocks #10751
• Fix eth_sendRawTransaction returning -32603 Internal Error instead of -32602 Invalid params for malformed RLP inputs such as 0x80. #10735
• Skip DNS discovery records that fail enode conversion (e.g. out-of-range port) instead of dropping the rest of the batch #10752

Additions and Improvements

• Update besu-native to 2.0.0
• Upgrade jackson dependencies to 2.21.5 and opentelemetry to 1.62.0 #10775
• Upgrade commons-io dependency to 2.22.0 #10809
• Upgrade netty dependency to 4.2.16-Final
• Migrate the DiscV4 peer discovery UDP transport from Vert.x to Netty. The vertx_eventloop_pending_tasks metric is dropped with no replacement (it was Vert.x-specific); all other discovery metrics (besu_network_discovery_*) are unaffected. #10716

d9d5f77dd2db70c56f20492b30e79e85ed7831b5ac9ed853da48b3f1e6777225 besu-26.7.1.zip
7311ba20a585a016543a12417d2c822e850c6a6fc58e5128cdf770653951f6c7 besu-26.7.1.tar.gz