Skip to content

kona-node v1.9.0

Choose a tag to compare

View all tags
@teddyknox teddyknox released this 27 Oct 20:17
· 63 commits to develop since this release
Immutable release. Only release title and notes can be modified.
kona-node/v1.9.0
d662020
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Overview

Note

kona-node is not production-ready. Production deployments should use op-node.

This release includes the changes from kona-node v1.8.0, which was tagged but never published. A sequencer now needs a valid block signer at startup (see Breaking changes). If you run kona-node with op-reth, upgrade kona-node before or together with op-reth v2.8.0.

Breaking changes

  • A sequencer now requires a block signer (#23202). kona-node --mode sequencer now fails at startup unless a block signer is configured with --p2p.sequencer.key, --p2p.sequencer.key.path, or --p2p.signer.endpoint together with --p2p.signer.address. Configure one before upgrading a sequencer.
  • --p2p.sequencer.key.path must point to an existing key file (#23515). On any node that sets this flag, kona-node now fails at startup when the file is missing, unreadable, or does not hold a hex-encoded 32-byte key. Previously a missing file made kona-node generate and save a random key, so a sequencer signed blocks that its peers reject. Before upgrading, check that the path points to the intended key, or remove the flag on nodes that do not sequence. Existing valid key files are read as before.

Chain Configuration

  • GIWA Sepolia added (#23511). The embedded superchain registry now includes GIWA Sepolia (sepolia/giwa, chain ID 91342) and sepolia-devnet-3 (chain ID 420130018), so --chain accepts them without an explicit rollup config. No existing chain's hardfork activation times change in this release.

Other changes

Derivation

  • When the execution client rejects derived attributes at engine_forkchoiceUpdated with -38003 (invalid payload attributes), kona-node now replaces the block with a deposits-only block from Holocene onward, as op-node does. Previously it retried the same attributes indefinitely and the safe head stalled. op-reth v2.8.0 returns this error when the transactions in a batch would make the derived block invalid, so earlier kona-node releases paired with op-reth v2.8.0 stall on such a batch. An internal error (-32603) or a transport failure is still retried (#23454)
  • Attribute consolidation now checks the Jovian minimum base fee in a block's extraData against the derived attributes, and requires extraData to be empty before Holocene, as op-node does. Previously kona-node could keep as safe an unsafe block that differed from the derived attributes only in these fields, where op-node replaces it with the block derived from L1 (#23143)

Sequencer

  • Transient remote-signer failures, such as transport errors and timeouts, are now retried with backoff until signing succeeds, and blocks are signed and gossiped in order. Previously any signing failure shut the node down. If the signer is down for more than 32 blocks, block production pauses until it recovers. The admin RPC keeps responding throughout, so op-conductor can still stop the sequencer, and the queued blocks are gossiped in order once signing resumes (#23125, #23202)
  • The block signer, including a remote signer's startup health check, now starts only in sequencer mode. A node in any other mode that has a signer configured logs that it is ignored (#23202)

RPC

  • optimism_version and the healthz endpoint now report the kona-node release version, matching --version output and metrics. Previously they reported the version of an internal library (#23543)
  • admin_postUnsafePayload now rejects a payload whose block hash does not match its contents straight away, with an InvalidParams error, as op-node does. Valid payloads are still queued and processed asynchronously (#23484)
  • The P2P method for blocking an IP address is now served as opp2p_blockAddr, the name op-node and its clients use. It was previously registered under the misspelled opp2p_blocAddr, which is no longer served (#23516)

Bug fixes

  • A transient L1 RPC failure in the L1 watcher no longer shuts the node down. The unsafe block signer is read from the SystemConfig contract at the L1 head and retried on failure, so a signer rotation missed during an outage or a reorg is still picked up. Failed engine operations are retried with backoff in their original order (#23125)
  • Every request kona-node sends to the execution client's Engine API, and to L1 for engine work, now has a 10-second deadline. A stalled endpoint fails the request, which is retried, instead of hanging the node. This includes the startup capability exchange, so a stalled Engine API endpoint now fails the startup JWT check instead of hanging it (#23125, #23202)
  • The remote signer's mTLS client certificate is now reloaded on every rotation of a Kubernetes Secret volume. Previously only the first rotation was picked up. A reload that fails, for example on a partially written file, keeps the current certificate and is retried every two seconds. kona-node now also reloads on a change to the CA file (--p2p.signer.tls.ca), trusts the platform roots when no CA is configured, and rejects certificate files that contain no certificates (#23140)
  • The beacon slot duration is now read from SLOT_DURATION_MS in the beacon node's /eth/v1/config/spec, with a fallback to SECONDS_PER_SLOT, so kona-node can fetch blobs from a consensus client that no longer serves SECONDS_PER_SLOT. If neither key is served, startup fails with an error naming both. A slot duration of zero is now reported as an error instead of crashing the node. --l1.slot-duration-override still takes precedence (#23138)

Networking

  • kona-node's libp2p stack moves to the rust-libp2p 0.57 release, which fixes the gossipsub GRAFT handling advisory GHSA-g3g5-x568-qvqx (high severity). Peers whose noise or identify signatures use high-S secp256k1 values are now rejected. go-libp2p, op-node and op-geth sign with low-S values, so no interoperability effect is expected (#23163)

Security

  • rustls is updated from 0.23.45 to 0.23.46 (RUSTSEC-2026-0349). Previously an attacker on the network path could make later TLS connections from kona-node to the same RPC host fall back from hybrid post-quantum to classical key exchange (#23433)
  • hickory-resolver is updated from 0.26.1 to 0.26.3, fixing an unbounded retry loop on truncated DNS responses (GHSA-6w6g-hm98-mhgm) in the resolver kona-node uses for peer addresses given as DNS names (#23261)
  • The CVE-2026-111943 certificate fixes already shipped in kona-node v1.7.3 are carried forward (#23567, #23566)

Full Changelog: kona-node/v1.7.3...kona-node/v1.9.0

🚢 Docker Image:

Assets 3
Loading