op-supernode v1.0.6

Overview

Important

This is a strongly recommended release for all op-supernode operators. It contains security fixes for the compromised eMudhra certificate authority (CVE-2026-111943) and other Go standard-library security fixes, and support for beacon nodes that publish the slot duration only as SLOT_DURATION_MS.

This release includes the changes tagged as op-supernode/v1.0.5, which was not published separately.

Other changes

L1

• op-supernode now reads the beacon slot duration from SLOT_DURATION_MS in the beacon node's /eth/v1/config/spec, falling back to SECONDS_PER_SLOT. It can therefore fetch blobs for its virtual nodes from beacon nodes that no longer serve SECONDS_PER_SLOT, which the consensus specs have replaced and which Teku already omits on some custom networks. Nothing changes with beacon nodes that serve either key. If neither key is served, op-supernode fails with an error naming both (#23138)

Security

• The image is built with Go 1.26.10, up from 1.26.8. Go 1.26.10 makes crypto/x509 reject the compromised eMudhra intermediate certificates (CVE-2026-111943), and Go 1.26.9 includes security fixes to the crypto/tls, html/template, net/http, net/textproto and os packages (#23290, #23546)
• The image's CA trust store (ca-certificates-bundle 20260909-r3) no longer includes the eMudhra emSign Root CA G3, C1 and C3 roots (#23566)

Full Changelog: op-supernode/v1.0.4...op-supernode/v1.0.6

🚢 Docker Image:

• https://us-docker.pkg.dev/oplabs-tools-artifacts/images/op-supernode:v1.0.6