ObolNetwork/lido-charon-distributed-validator-node v0.4.0-rc3 on GitHub

Warning

This is a release candidate and a required update for Hoodi operators before October 26, 2026, 17:42:48 UTC. The Glamsterdam (Gloas) fork on Hoodi has been postponed with no new date, but the clients in v0.4.0-rc2 still activate it at epoch 132352. A Hoodi node left on v0.4.0-rc2 splits from the network at that time. Mainnet operators should not update and should remain on v0.3.11.

This is LCDVN's v0.4.0-rc3 release. It updates every client to the release that unschedules the Glamsterdam fork on Hoodi, and makes the bundled monitoring private by default. Charon is unchanged at v2.0.0-rc2 and needs no change, as it follows the fork schedule of your beacon node. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

Update

# Stop the node
docker compose down
# Save your local .env / custom overrides
git stash
# Update your local copy of this repo
git pull
# Checkout this release
git checkout v0.4.0-rc3
# Re-apply your stashed changes
git stash apply
# Restart the node
docker compose up -d

If you pin client versions in your .env (for example LIGHTHOUSE_VERSION or EL_NETHERMIND_VERSION), remove those lines or update them to the versions below, or your node keeps running the pinned versions.

If your node was still on v0.4.0-rc2 at 17:42:48 UTC on October 26, update straight away and check that your beacon node follows the Hoodi chain again. Ask in discord if it doesn't.

Updated versions

Component	Version
Charon	`v2.0.0-rc2` (unchanged)
Lighthouse	`v8.3.1` → `v8.3.2`
Teku	`26.10.1` → `26.10.2`
Lodestar	`v1.50.0` → `v1.50.1`
Nimbus	`v26.10.1` → `v26.10.2`
Prysm	`v7.3.0` → `v7.3.1`
Grandine	`3.0.0-rc.1` → `3.0.0-rc.2`
Nethermind	`2.2.0` → `2.2.1`
Reth	`v2.8.0` → `v2.8.1`

mev-boost and Commit-Boost are unchanged.

Monitoring is now private by default

This release tightens the default monitoring setup. Charon, the clients and remote-write to Obol's monitoring are unaffected.

Grafana listens on 127.0.0.1 only. To view it from another machine, use an SSH tunnel and open http://localhost:3000:
```
ssh -L 3000:127.0.0.1:3000 <user>@<node>
```
If you need Grafana on another address, set MONITORING_IP_GRAFANA, and only behind a provider or network firewall: ports published by Docker are not filtered by host firewalls such as ufw.
Grafana is read-only. Visitors can view every dashboard, but can't make changes, and there is no login form. Dashboards and datasources are provisioned from this repository.
Grafana starts with a fresh database in a Docker volume (grafana-data) and runs as a non-root user. Your old data/grafana folder is no longer used.
The log collector (the monitoring-log-collector profile) now reads container logs through a read-only Docker API proxy (a new docker-socket-proxy container) instead of mounting the Docker socket.

Important

Anything you created in the Grafana UI, such as custom dashboards, alert rules or contact points, does not carry over to the fresh Grafana. Export custom dashboards before updating (Share > Export). The README's Security section explains how to set them up again, either as files under grafana/dashboards/ or by re-enabling logins with your own admin password.

After updating

Check your previous Grafana data. The script lists any accounts, tokens, datasources or plugins in the old data/grafana that this stack doesn't create. It may need sudo:
```
./grafana/security-check.sh
```
If it reports anything, please let us know at security@obol.tech.
Delete the old Grafana data, which is no longer used:
```
sudo rm -rf data/grafana
```

What's Changed

Full Changelog: v0.4.0-rc2...v0.4.0-rc3