berachain/beacon-kit v1.3.5

BeaconKit v1.3.5

on GitHub

This release includes bug fixes for memory management and storage cleanup, along with an enhancement to the beacon API.

Bug Fixes:

• Fix unbounded memory growth during consensus failures (#2991): The cachedStates cache is now bounded (LRU with 10 entries max) to prevent memory growth when consensus rounds repeatedly fail before reaching +2/3 prevotes.
• Clean up orphaned blob sidecars on startup (#2988): If FinalizeBlock fails after blob sidecars are persisted, these orphaned blobs are now automatically removed on node restart, preventing disk space waste and invalid state.

New Features:

• Block signatures in beacon header RPC endpoints (#2997, #3010): The /eth/v1/beacon/headers and /eth/v1/beacon/headers/{block_id} endpoints now return actual BLS signatures instead of empty strings. Signatures are fetched from the CometBFT blockstore and are available for all blocks (unless CometBFT block pruning is enabled via min-retain-blocks).

Update Priority

This table provides priorities for which classes of users should update particular components.

All Changes

• chore(deps): update to latest berachain/cometbft (#3014)
• Bound the cachedStates cache (#2991)
• node-api: fetch block signatures from CometBFT blockstore (#3010)
• chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0 (#3003)
• Add block signatures in beacon header RPC endpoints (#2997)
• refactor: omit unnecessary reassignment (#2994)
• Remove orphaned blobs on started after incomplete block finalization (#2988)
• chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 (#2996)
• chore(deps): bump github.com/attestantio/go-eth2-client from 0.27.1 to 0.27.2 (#2993)

Binaries

System	Architecture	Binary	PGP Signature
	amd64	beacond-v1.3.5-linux-amd64	Signature
	arm64	beacond-v1.3.5-linux-arm64	Signature
	arm64	beacond-v1.3.5-darwin-arm64	Signature
System	Option	-	Resource
	Docker		berachain/beacon-kit

Verifying signatures

Use gpg to verify the signature on these binary archives. This is important to make sure that the content you've downloaded is legitimate. gpg can be installed with most package managers. For example:

• brew install gpg on mac
• apt install gpg on Ubuntu/Debian

Once gpg is installed, import our public key into its database and verify:

• Download signing public key from here.
• Run gpg --import berachain_release.asc
• Verify with gpg --verify {signature}.sig {binary}.tar.gz
• This message is expected: WARNING: This key is not certified with a trusted signature!
• To resolve the warning, trust the key by signing with your own keypair. gpg --lsign-key <keyid>