op-node v1.20.1

Overview

Note

This is an optional release for all operators. It contains two removals that are breaking for operators who still use them, the --sequencer.max-safe-lag flag and the built-in Holesky L1 chain config, and a brotli dependency update for CVE-2026-111497.

Breaking changes

• --sequencer.max-safe-lag removed (#23738). The sequencer no longer pauses block production when the safe head falls behind the unsafe head. op-node now refuses to start with --sequencer.max-safe-lag, so remove it from your launch configuration before upgrading. A leftover OP_NODE_SEQUENCER_MAX_SAFE_LAG is ignored, with an Unknown env var warning at startup.
• Built-in Holesky L1 chain config removed (#23554). Holesky has shut down. An op-node whose L1 is Holesky now fails to start unless it is given the L1 chain config with --rollup.l1-chain-config, like any other L1 without a built-in config. The built-in configs for Ethereum Mainnet, Sepolia and Hoodi are unchanged.

Other changes

• github.com/andybalholm/brotli is updated to v1.2.7 for CVE-2026-111497. Go's bounds checks already kept op-node memory-safe, so it was not exposed. Malformed brotli channels are now rejected earlier, and derivation results are unchanged (#23689)

Full Changelog: op-node/v1.20.0...op-node/v1.20.1

🚢 Docker Image:

• https://us-docker.pkg.dev/oplabs-tools-artifacts/images/op-node:v1.20.1