v1.11.4 - 2026-11-06

⚠️ This release is NOT Gloas-ready. It is a patch release on top of v1.11.3 for the current fork only. Gloas support ships with Charon v2.0.0.

This is a recommended patch release of Charon v1.11.4. It bundles DKG ceremony robustness fixes, secret redaction in stack sniping telemetry, a fix for beacon node client refreshes stopping after the first request, consistent address handling in the CLI and new p2p metrics, and moves the build to Go 1.27 and go-libp2p v0.50.0. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

Read the rest of the release notes for more:

Full Changelog: v1.11.3..v1.11.4

Bugfixes

• Fix the inclusion checker flushing pending submissions as not included on fresh chains (#4662)
• Redact secret flag values from validator client command lines exported by stack sniping (#4688)
• Buffer DKG pedersen channels so early bundles from peers are not dropped (#4683)
• Retry transient p2p send failures during DKG ceremonies (#4684)
• Warn in exit sign --all about validators with pending deposits and no index yet (#4702)
• Keep beacon node static value refreshes and connection pings running after the first request (#4772)
• Log sync committee selection proof inconsistencies at debug level (#4801)
• Send a User-Agent on Obol API requests and return a typed error for 404s on POST (#4808)
• Convert withdrawal addresses to credentials in deposit sign (#4804)
• Validate addresses consistently across create and edit commands (#4805)

Tests

• Fix flaky TestStartChecker and TestSchedulerWait (#4654,#4726)

Misc

• Add p2p message size, read error, concurrency and handler panic metrics, labelled by the validated stream protocol (#4680,#4706,#4722)
• Keep //nolint:revive from the nolintlint false autofix (#4703)
• Declare token permissions for CI jobs that push Docker images (#4803)

Version bumps

• Bump the Go language version to 1.27; the toolchain and Docker images stay on 1.27.3 (#4661)
• Bump golangci-lint to v2.14.0 (#4741)
• Bump go-libp2p to v0.50.0 (quic-go v0.63.0) and buf to v1.74.0 (#4790)
• Bump go-ethereum to v1.17.8, otel to v1.47.0, prometheus client_golang to v1.25.0, drand/kyber to v1.3.3 and golang.org/x/*, including x/net v0.62.0 (#4687,#4690,#4698,#4730,#4737,#4742,#4770,#4778,#4817)

Compatibility Matrix

❗ An issue between Lodestar BN and Lighthouse, Nimbus and Prysm VCs has been discovered. It has surfaced with testing latest versions of the above mentioned clients, however, it is applicable for multiple older Lodestar CL versions. Those duty failures are not related to Charon v1.11.0. If node operators are using any of those 3 combinations and are experiencing issues, we strongly recommend switching to different VC or BN until patches are released. We will keep this section of the release notes up to date with latest updates.

This release of Charon is backwards compatible with Charon >= v1.0, though only v1.7 and newer are Fulu-ready.

The below matrix details a combination of beacon node (consensus layer) + validator clients and their corresponding versions the DV Labs team have tested with this Charon release. More validator and consensus clients will be added to this list as they are supported in our automated testing framework.

Legend

• ✅: All duties succeed in testing
• 🟡: All duties succeed in testing, except non-penalised aggregation duties
• 🟠: Duties may fail for this combination
• 🔴: One or more duties fail consistently

What's Changed

• app: fix flaky TestStartChecker (#4654) by @KaloyanTanev
• build(deps): Bump the docker-dependencies group across 2 directories with 1 update (#4661) by @dependabot
• core/tracker: fix inclusion trim underflow at chain start (#4662) by @KaloyanTanev
• p2p: add message size, read error and concurrency metrics (#4680) by @KaloyanTanev
• dkg/pedersen: buffer channels to not drop early bundles (#4683) by @KaloyanTanev
• dkg: retry transient p2p send failures during ceremonies (#4684) by @KaloyanTanev
• build(deps): Bump the go-dependencies group across 1 directory with 4 updates (#4687) by @dependabot
• app/stacksnipe: redact secret flag values from exported command lines (#4688) by @aly-obol
• build(deps): Bump the go-dependencies group with 2 updates (#4690) by @dependabot
• build(deps): Bump the go-dependencies group across 1 directory with 5 updates (#4698) by @dependabot
• cmd/exit_sign: warn on validators with pending deposits and no index (#4702) by @KaloyanTanev
• *: keep //nolint:revive from nolintlint false autofix (#4703) by @KaloyanTanev
• p2p: label handler metrics from validated stream protocol (#4722) by @KaloyanTanev
• core/scheduler: fix flaky TestSchedulerWait clock rewind (#4726) by @KaloyanTanev
• build(deps): Bump github.com/ethereum/go-ethereum (#4730) by @dependabot
• build(deps): Bump the go-dependencies group with 7 updates (#4737) by @dependabot
• *: bump golangci-lint to v2.14.0 (#4741) by @KaloyanTanev
• build(deps): Bump golang.org/x/tools (#4742) by @dependabot
• build(deps): Bump the go-dependencies group with 3 updates (#4770) by @dependabot
• app/eth2wrap: bind eth2http service lifetime to caller ctx (#4772) by @KaloyanTanev
• build(deps): Bump the go-dependencies group across 1 directory with 7 updates (#4778) by @dependabot
• build(deps): Bump the go-dependencies group across 1 directory with 2 updates (#4790) by @dependabot
• core/tracker: debug log sync selection proof inconsistency (#4801) by @KaloyanTanev
• ci: declare token permissions for jobs that write (#4803) by @aly-obol
• cmd: convert deposit sign withdrawal addresses to creds (#4804) by @OisinKyne
• cmd: validate addresses consistently across create and edit (#4805) by @OisinKyne
• app/obolapi: send a User-Agent and type 404s on POST (#4808) by @OisinKyne
• build(deps): Bump the go-dependencies group across 1 directory with 4 updates (#4817) by @dependabot
• app: bump patch version to v1.11-rc (#4823) by @obol-platform
• app/version: bump v1.11 to stable (#4826) by @obol-platform