Good day Lodestar operators! We've just released v1.50.1. This is a critical update and all users must upgrade. It is mandatory for Hoodi operators before epoch 132352 (October 26, ~17:42 UTC). Mainnet users should upgrade as soon as possible.
Hoodi operators: do NOT stay on v1.50.0. The Glamsterdam fork on Hoodi has been unscheduled (ACDE #248), but v1.50.0 still activates Gloas at epoch 132352. Any node still on v1.50.0 at that epoch will fork off Hoodi onto its own chain, and its validators will miss every duty until it is upgraded and resynced. Your execution client must also run a release with the fork unscheduled, so check with your EL team. Keep your existing pre-Gloas builder/relay settings on the beacon node. They stay in use until Gloas is rescheduled. (#10461)
All users: eMudhra certificate authority compromise. The compromised eMudhra CA keys allow an attacker who can intercept your traffic to impersonate any HTTPS endpoint Lodestar connects to. That includes checkpoint sync, Web3Signer and validator client to beacon node connections. A spoofed checkpoint sync response could start your node on a chain the attacker controls. Node.js 24.22.1 removes trust in the compromised keys. (#10459)
- Docker and binaries: v1.50.1 ships Node.js 24.22.1
or newer. Pull the new image or binary and restart. - Built from source: upgrade Node.js to 24.22.1 or a newer 24.x release and restart. Upgrading Lodestar alone does not fix this, the runtime does. The minimum supported Node.js version is now 24.22.1.
Maintenance
- v1.50.1 release (#10462) (@matthewkeil)
- unschedule Gloas fork and 200M gas limit on Hoodi (#10461) (@lodekeeper)
- refresh Node.js runtimes for builds (#10459) (@wemeetagain)