Strongly recommended upgrade
Important
op-node v1.19.9 → v1.19.11, op-reth v2.6.0 → v2.6.1. Upstream marks both strongly recommended for all operators: security fixes for the compromised eMudhra certificate authority (CVE-2026-111943), plus Go standard-library security fixes in op-node. No mainnet env, peer, entrypoint or flag change.
What changes on a Lisk node
- eMudhra distrust: op-node (Go 1.26.10
crypto/x509) and op-reth (rustls-webpki0.103.16) reject the compromised eMudhra intermediate certificates on outbound TLS, e.g. to the L1 RPC, beacon and sequencer endpoints. The image now pins Go1.26.10instead of the floating1.26tag, so a stale cached Go base can't build op-node without the fix. - Runtime base Ubuntu 25.04 → 26.04 LTS: 25.04 reached end of life on 2026-01-15 and no longer receives security updates. 26.04's
ca-certificatesstill ships the eMudhra emSign C1 and C3 roots, which upstream removed from its own images. The binaries reject the compromised intermediates regardless. - L1 compatibility (op-node): op-node can now fetch blobs from beacon nodes that serve only
SLOT_DURATION_MS. It also starts against L1 clients that have pruned the rollup's L1 genesis block (e.g.reth --minimal), which previously failed. - Lisk Sepolia support removed: the network was decommissioned on 2026-09-01.
.env.sepoliaand both Sepolia patches are gone. Its final snapshots are archived at https://archive.lisk.com/L2/sepolia/.
Upstream changes inert here
op-node's sequencer L1-origin fix applies only to chains whose L2 block time exceeds half the L1 block time. Lisk's block time is 2 s, and these nodes don't sequence.
Upgrade
git pull
docker compose up --build --detachOP Stack Changeset
op-node — v1.19.11 · changelog
op-reth — v2.6.1 · changelog
Full Changelog: v0.4.31...v0.4.32