celestiaorg/celestia-core v0.40.9

on GitHub

This release of celestia-core backports RPC, consensus, sync, and stability fixes to the v0.40.x line. It includes a breaking change to RPC request concurrency and requires Go 1.26.6.

Breaking Changes

• Hardened RPC endpoints (#3307). Heavy RPC responses (block, block_results, transaction and block searches, unconfirmed_txs, share/data-root proofs, and the gRPC block, validator-set, and proof endpoints) are now gated by a process-wide concurrency limit, configurable via max_concurrent_heavy_requests (default 20) and shared across HTTP JSON-RPC, URI, WebSocket, and gRPC. Excess heavy requests are rejected fast: HTTP GET returns 503, JSON-RPC and WebSocket return a JSON-RPC error, and gRPC returns ResourceExhausted. Clients should retry with backoff. A value of 0 uses the built-in default; a negative value disables the limit.

Consensus & sync hardening

• Validate the full block and part-set identity when updating valid or locked blocks; require the complete committed part set before finalizing (#3260)
• Bound signatures and validators reached through evidence in blocksync before full protobuf unmarshalling (#3247)
• Prevent blocksync maxPeerHeight poisoning; ensure IsCaughtUp handles peers that have pruned ahead of the pool height (#3264)
• Fix double-sign check off-by-one and statsMsgQueue stall (#3263)
• Light client and state sync: bind ConsensusParams responses to the requested height (#3257); stop witness comparison after divergence checks (#3267)
• Reject abusive mempool Txs messages before full unmarshalling to prevent memory amplification (#3258)
• Guard propagation GetProposal against nil compact blocks (#3266)
• Prevent panic on unlock in ABCI socket server panic recovery (#3268)

Bug Fixes

• gRPC BlockAPI: fix the Stop deadlock, make height broadcasts non-blocking, and fix the subscription race; add connection keepalive (#3265). Slow subscribers can now miss height events when their buffers fill; clients requiring every block should backfill gaps with BlockByHeight.
• Render peer identity in JSON log fields (#3270)

Improvements

• data_root_inclusion_proof and data_commitment now load block metadata instead of full blocks, reducing memory use for wide ranges (#3307)
• Bump the Go toolchain and e2e Docker image from 1.26.5 to 1.26.6 to address standard-library vulnerability findings (#3259)

What's Changed

• fix(blocksync): bound signatures reached through evidence (backport #3243) by @mergify[bot] in #3247
• fix(light): bind ConsensusParams response to requested height (backport #3256) by @mergify[bot] in #3257
• fix(mempool): reject abusive Txs messages before unmarshalling (backport #3227) by @mergify[bot] in #3258
• chore: bump Go to 1.26.6 to clear govulncheck stdlib findings (backport #3239) by @rootulp in #3259
• fix(consensus): backport double-sign check off-by-one and statsMsgQueue stall (backport #3207) by @rootulp in #3263
• fix(abci): prevent panic on unlock in socket server panic recovery (backport #3040) by @rootulp in #3268
• fix(light): stop witness comparison after divergence checks (backport #3043) by @rootulp in #3267
• fix(p2p): render peer identity in JSON log fields (backport #3262) by @mergify[bot] in #3270
• fix(propagation): guard GetProposal against nil compact block (backport #3060) by @rootulp in #3266
• fix(blocksync): prevent maxPeerHeight poisoning and IsCaughtUp with pruned-ahead peers (backport #3038, #3058) by @rootulp in #3264
• fix(rpc/grpc): non-blocking height broadcast, Stop deadlock, and subscription race (backport #3002, #3004, #3007) by @rootulp in #3265
• fix(consensus): backport committed part-set validation by @rootulp in #3260
• feat!(rpc): harden rpc endpoints (#3240) by @vgonkivs in #3307

Full Changelog: v0.40.8...v0.40.9