celestiaorg/celestia-core v0.41.0 on GitHub

This is a major release of celestia-core with breaking changes to the RPC layer, the CAT mempool, and storage configuration. It requires Go 1.26.6.

Breaking Changes

Hardened RPC endpoints (#3240). Heavy RPC responses (block, block_results, tx_search, unconfirmed_txs, share/data-root proofs, and the gRPC block, validator-set, and proof endpoints) are now gated by a process-wide concurrency limit, configurable via max_concurrent_heavy_requests (default 20) and shared across HTTP JSON-RPC, URI, WebSocket, and gRPC. Excess heavy requests are rejected fast with HTTP 503 / gRPC ResourceExhausted. data_root_inclusion_proof and data_commitment now load block meta instead of full blocks, so wide ranges no longer pull thousands of full blocks into memory.
SeenTxTracker integrated into the CAT mempool (#3144, #3147). Replaces the old pendingSeen/SeenTxSet tracking, removes the compatibility path for apps that don't implement sequence querying, and fixes a bug that discarded sequence-0 SeenTxs. Per-peer and per-signer seen limits are set to 1000 (#3152).
Batched-transaction logic removed from CAT and config (#3151). Removes the unused max_batch_bytes mempool config field.
Store compaction after pruning (#3052, #3056). New [storage] config options compact (default false) and compaction_interval (default 10000). When enabled, the blockstore is compacted asynchronously over the pruned range only, keeping the store at a bounded size. Go API: PruneStates() signature changed.

Consensus & sync hardening

Validate the part set before updating the valid block (#3261); require the committed part set before finalizing (#3222)
Reject parts with index/proof mismatch in PartSet.AddPart (#3046)
Bound signatures reached through evidence in blocksync (#3243)
Prevent blocksync maxPeerHeight poisoning (#3038); IsCaughtUp handles peers pruned ahead of pool height (#3058)
Fix double-sign check off-by-one and statsMsgQueue stall (#3207)
Light client: bind ConsensusParams response to the requested height (#3256); stop witness comparison after divergence checks (#3043)
Reject abusive mempool Txs messages before unmarshalling (#3227)
Guard propagation GetProposal against nil compact block (#3060)
Prevent panic on unlock in ABCI socket server panic recovery (#3040)

CAT mempool fixes

Retry WantTx after a failed send (#3204); retry tx requests rejected by the per-peer request limit (#3205)
Prevent rerequesting a tx from a peer whose request just timed out (#3206); fix a failed WantTx send rollback deleting another peer's rerequest (#3203)
Fix a race between request timeout and pending-seen gap-fill causing duplicate WantTx (#3164)
Guarantee SeenTx broadcasts to persistent peers (#3009)

Bug Fixes

gRPC BlockAPI: Stop deadlock (#3004); non-blocking broadcast to height subscribers (#3002); subscription race (#3007)
Store: properly prune extended commits (#3080)
Trace haves/wants correctly (#2693)
Render peer identity in JSON log fields (#3262)

Improvements

Undeprecated the timeout_commit consensus config parameter (#2915)
Deprecated the kv indexer (#2922)
Tx search: unmarshal only a single page from the tx index (#3008)
Remote KMS signing latency metrics and warnings (#3176)
gRPC height events now include block time and catching-up status (#3175)
Reduced ERR log noise from routine peer churn (#3110)

What's Changed

chore: add Hacken bug bounty PR guidelines to CLAUDE.md by @rootulp in #2911
build(deps): Bump github.com/go-git/go-git/v5 from 5.17.1 to 5.17.2 by @dependabot[bot] in #2910
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.97.3 to 1.98.0 by @dependabot[bot] in #2906
build(deps): Bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in #2905
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.13 to 1.32.14 by @dependabot[bot] in #2902
build(deps): Bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #2901
feat: undeprecate timeout_commit consensus config parameter by @rach-id in #2915
build(deps): Bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #2918
fix: bump Go version from 1.26.1 to 1.26.2 by @rootulp in #2917
build(deps): Bump golang.org/x/crypto from 0.49.0 to 0.50.0 by @dependabot[bot] in #2921
build(deps): Bump golang.org/x/net from 0.52.0 to 0.53.0 by @dependabot[bot] in #2920
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.98.0 to 1.99.0 by @dependabot[bot] in #2919
chore: deprecate kv indexer by @ninabarbakadze in #2922
fix(types): validate nil SignedHeader in LightClientAttackEvidence by @rootulp in #2923
build(deps): bump github.com/celestiaorg/nmt from 0.24.2 to 0.24.3 by @rootulp in #2944
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.99.0 to 1.99.1 by @dependabot[bot] in #2959
feat(ci): add upstream CometBFT watcher workflow by @rootulp in #2961
fix: trace haves and wants correctly by @evan-forbes in #2693
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.99.1 to 1.100.0 by @dependabot[bot] in #2964
build(deps): Bump slackapi/slack-github-action from 3.0.1 to 3.0.2 by @dependabot[bot] in #2963
build(deps): Bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 by @dependabot[bot] in #2958
build(deps): Bump github.com/adlio/schema from 1.4.0 to 1.5.0 by @dependabot[bot] in #2957
fix(rpc/grpc): non-blocking broadcast to height-subscribers by @rootulp in #3002
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.14 to 1.32.17 by @dependabot[bot] in #3012
build(deps): Bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 by @dependabot[bot] in #3015
build(deps): Bump slackapi/slack-github-action from 3.0.2 to 3.0.3 by @dependabot[bot] in #3010
build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #3017
fix(rpc/grpc): BlockAPI.Stop deadlock by @rootulp in #3004
fix(rpc/grpc): lock-protect initial newBlockSubscription write by @rootulp in #3007
chore: drop changelog system and instruct agents not to create entries by @rootulp in #3019
chore: consolidate go.mod require blocks by @rootulp in #3021
build(deps): Bump github.com/klauspost/reedsolomon from 1.13.3 to 1.14.0 by @dependabot[bot] in #3016
fix(consensus): flake in TestSetValidBlockOnDelayedProposal by @rootulp in #3025
feat(mempool): guarantee SeenTx broadcasts to persistent peers by @evan-forbes in #3009
test(mempool/cat): fix TestReactorBroadcastTxsMessage flake from tied priorities by @rootulp in #3022
fix(consensus): reduce flake in TestSetValidBlockOnDelayedProposal by @rootulp in #3027
fix(consensus): stabilize TestByzantinePrevoteEquivocation flake by @rootulp in #2950
fix: bump Go to 1.26.3 to resolve govulncheck failures by @rootulp in #3034
fix(blocksync): prevent maxPeerHeight poisoning by @rootulp in #3038
test(consensus): wait for peers to reach prevote height to de-flake TestByzantinePrevoteEquivocation by @rootulp in #3044
fix(types): reject part with index/proof mismatch in PartSet.AddPart by @rootulp in #3046
fix(consensus): stabilize TestByzantinePrevoteEquivocation in CI by @rootulp in #3037
fix(light): stop witness comparison after divergence checks by @rach-id in #3043
fix(p2p/pex): de-flake TestPEXReactorRunning by ignoring duplicate-peer dial rejections by @rootulp in #3033
fix(abci): prevent panic on unlock in socket server panic recovery by @rach-id in #3040
build(deps): Bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 by @dependabot[bot] in #3028
build(deps): Bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in #3030
fix(consensus): bump ensureVoteTimeout in TestStateOversizedBlock to 5s by @rootulp in #3047
refactor: only unmarshal a single page from the tx index by @evan-forbes in #3008
feat!: support store compaction after pruning blocks by @rach-id in #3052
build(deps): Bump github.com/btcsuite/btcd/btcutil from 1.1.6 to 1.2.0 by @dependabot[bot] in #3055
build(deps): Bump golang.org/x/net from 0.53.0 to 0.54.0 by @dependabot[bot] in #3031
build(deps): Bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #3054
fix: ensure IsCaughtUp handles peers pruned ahead of pool height by @rach-id in #3058
chore: update compaction setting description in config file by @rach-id in #3059
feat!: only compact the pruner range in blockstore db by @rach-id in #3056
build(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.16 to 1.19.17 by @dependabot[bot] in #3066
build(deps): Bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in #3069
build(deps): Bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #3064
build(deps): Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 by @dependabot[bot] in #3065
build(deps): Bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #3063
build(deps): Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #3062
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.17 to 1.32.18 by @dependabot[bot] in #3068
build(deps): Bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #3067
fix(propagation): guard GetProposal against nil compact block by @SAY-5 in #3060
chore(ci): mergify to v0.40.x by @rach-id in #3072
feat(store): log progress while pruning a large block backlog by @rach-id in #3073
chore: backport comet refactor by @evan-forbes in #3077
fix(store): properly prune extended commits by @rootulp in #3080
feat(consensus): precommit metrics by @rootulp in #3081
build(deps): Bump github.com/grafana/pyroscope-go from 1.2.8 to 1.3.1 by @dependabot[bot] in #3087
build(deps): Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.43.0 to 1.44.0 by @dependabot[bot] in #3092
fix: check block part size by @evan-forbes in #3071
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.100.0 to 1.102.2 by @dependabot[bot] in #3091
build(deps): Bump github.com/prometheus/common from 0.67.5 to 0.68.0 by @dependabot[bot] in #3089
build(deps): Bump github.com/aws/aws-sdk-go-v2 from 1.41.9 to 1.41.11 by @dependabot[bot] in #3088
build(deps): Bump github.com/grafana/otel-profiling-go from 0.5.1 to 0.5.3 by @dependabot[bot] in #3090
build(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.17 to 1.19.22 by @dependabot[bot] in #3086
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.18 to 1.32.23 by @dependabot[bot] in #3084
refactor(blocksync): verify last commit before persisting the block by @ninabarbakadze in #3098
ci: notify #protocol-ci Slack channel on CI failures by @rootulp in #3101
feat(state): log app-hash mismatch runbook before failure by @rach-id in #3108
build: align Go toolchain to 1.26.4 (fix govulncheck + Docker release builds) by @rootulp in #3114
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.102.2 to 1.103.2 by @dependabot[bot] in #3106
build(deps): Bump github.com/prometheus/common from 0.68.0 to 0.68.1 by @dependabot[bot] in #3107
feat: add on wire proto check for signature count by @ninabarbakadze in #3113
test(consensus): stabilize oversized block vote wait by @rootulp in #3116
build(deps): Bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in #3120
build(deps): Bump github.com/aws/aws-sdk-go-v2 from 1.41.12 to 1.42.0 by @dependabot[bot] in #3123
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.103.2 to 1.103.3 by @dependabot[bot] in #3125
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.23 to 1.32.25 by @dependabot[bot] in #3122
refactor(p2p): reduce ERR log noise from routine peer churn by @rootulp in #3110
refactor(consensus): remove "failed to process message" catch-all and log errors in place by @rootulp in #3111
test(mempool/cat): deflake TestTxPool_ExpiredTxs_Timestamp by @rootulp in #3128
docs: mention propagation reactor in README by @reflecttypefor in #3130
fix: removeTimedoutPeers deadlock in blocksync by @ninabarbakadze in #3129
test(consensus): deflake TestReactorValidatorSetChanges timeout by @rootulp in #3131
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.103.3 to 1.104.0 by @dependabot[bot] in #3133
fix(blocksync): concurrency bug in AddBlock caused by sendErr holding pool mtx by @ninabarbakadze in #3137
build(deps): Bump github.com/klauspost/reedsolomon from 1.14.0 to 1.14.1 by @dependabot[bot] in #3136
build(deps): Bump github.com/grafana/otel-profiling-go from 0.5.3 to 0.6.0 by @dependabot[bot] in #3134
build(deps): Bump actions/checkout from 6 to 7 by @dependabot[bot] in #3132
fix(propagation): run ValidateBasic on want parts by @ninabarbakadze in #3138
build(deps): Bump github.com/prometheus/common from 0.68.1 to 0.69.0 by @dependabot[bot] in #3135
test(consensus): remove unnecessary log-level test by @rootulp in #3146
feat(memppol/cat): introduce the new SeenTracker data structure by @ninabarbakadze in #3144
feat!: integrate SeenTxTracker in CAT by @ninabarbakadze in #3147
chore: set seenPerPeerLimit and seenPerSignerLimit to 1000 by @ninabarbakadze in #3152
build(deps): Bump github.com/grafana/pyroscope-go from 1.3.1 to 1.4.0 by @dependabot[bot] in #3163
build(deps): Bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #3161
build(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.24 to 1.19.26 by @dependabot[bot] in #3157
build(deps): Bump github.com/adlio/schema from 1.5.0 to 1.5.1 by @dependabot[bot] in #3159
build(deps): Bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #3155
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.25 to 1.32.27 by @dependabot[bot] in #3160
build(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #3156
test(node): fix flaky TestNodePrivValidatorGRPCServer port collision by @rootulp in #3165
build(deps): Bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #3154
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.104.0 to 1.105.0 by @dependabot[bot] in #3158
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.27 to 1.32.29 by @dependabot[bot] in #3172
build(deps): Bump github.com/grafana/pyroscope-go from 1.4.0 to 1.4.1 by @dependabot[bot] in #3169
build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0 by @dependabot[bot] in #3171
build(deps): Bump github.com/prometheus/common from 0.69.0 to 0.70.0 by @dependabot[bot] in #3167
fix: resolve govulncheck failures (remove unused crypto/armor, bump Go to 1.26.5) by @rach-id in #3174
build(deps): Bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #3173
build(deps): Bump golang.org/x/net from 0.56.0 to 0.57.0 by @dependabot[bot] in #3170
feat(rpc/grpc): add time and catching-up to height events by @NikhilSharmaWe in #3175
build(deps): Bump slackapi/slack-github-action from 3.0.3 to 4.0.0 by @dependabot[bot] in #3178
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.29 to 1.32.30 by @dependabot[bot] in #3181
build(deps): Bump actions/setup-go from 6 to 7 by @dependabot[bot] in #3177
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.105.0 to 1.105.2 by @dependabot[bot] in #3180
build(deps): Bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in #3179
refactor!: remove the logic for batched txs in cat and config by @ninabarbakadze in #3151
fix(mempool/cat): race between request timeout and pending-seen gap-fill causing duplicate WantTx by @ninabarbakadze in #3164
test: re-enable TestReactorInvalidMessages by @NikhilSharmaWe in #3185
feat(privval): add remote KMS signing latency metrics and warnings by @NikhilSharmaWe in #3176
test(rpc/grpc): deduplicate streaming tests by @vigneshakaviki in #3186
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.105.2 to 1.106.0 by @dependabot[bot] in #3191
build(deps): Bump github.com/prometheus/common from 0.70.0 to 0.70.1 by @dependabot[bot] in #3190
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.30 to 1.32.31 by @dependabot[bot] in #3192
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.106.0 to 1.106.2 by @dependabot[bot] in #3196
build(deps): Bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 by @dependabot[bot] in #3200
build(deps): Bump docker/login-action from 4.4.0 to 4.6.0 by @dependabot[bot] in #3202
build(deps): Bump actions/stale from 10 to 11 by @dependabot[bot] in #3201
build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in #3198
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.31 to 1.32.33 by @dependabot[bot] in #3199
build(deps): Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @dependabot[bot] in #3188
fix(mempool/cat): failed WantTx send rollback deleting another peer rerequest by @ninabarbakadze in #3203
fix(mempool/cat): prevent rerequesting tx from a peer whose request just timed out by @ninabarbakadze in #3206
docs: document v0.40.x and correct the celestia-app version mapping by @rootulp in #3209
fix(consensus): backport double-sign check off-by-one and statsMsgQueue stall by @rootulp in #3207
build(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.32 to 1.19.33 by @dependabot[bot] in #3197
build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @dependabot[bot] in #3214
build(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.33 to 1.19.34 by @dependabot[bot] in #3217
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.106.2 to 1.107.0 by @dependabot[bot] in #3218
build(deps): Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.44.0 to 1.45.0 by @dependabot[bot] in #3216
chore: remove leftover .changelog entries by @rootulp in #3224
chore: finish removing the changelog system by @rootulp in #3226
fix(mempool/cat): retry tx requests rejected by the per peer request limit by @ninabarbakadze in #3205
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.33 to 1.32.35 by @dependabot[bot] in #3213
fix(consensus): require the committed part set before finalizing by @rootulp in #3222
fix(mempool/cat): retry WantTx after a failed send by @ninabarbakadze in #3204
docs: prefer short PR descriptions by @rootulp in #3228
fix(mempool): reject abusive Txs messages before unmarshalling by @rootulp in #3227
build(deps): Bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in #3235
build(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.34 to 1.19.35 by @dependabot[bot] in #3230
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.35 to 1.32.36 by @dependabot[bot] in #3236
chore: bump Go patch version to clear govulncheck stdlib findings by @rach-id with @Copilot in #3239
build(deps): Bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in #3231
build(deps): Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in #3238
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.0 to 1.107.2 by @dependabot[bot] in #3237
build(deps): Bump github.com/grafana/pyroscope-go from 1.4.1 to 1.4.2 by @dependabot[bot] in #3233
build(deps): Bump golang.org/x/net from 0.57.0 to 0.58.0 by @dependabot[bot] in #3232
fix(blocksync): bound signatures reached through evidence by @rootulp in #3243
docs: instruct Claude to write short godoc comments by @rootulp in #3246
chore: fixing some flaky tests by @chatton in #3242
build(deps): Bump github.com/klauspost/reedsolomon from 1.14.1 to 1.14.2 by @dependabot[bot] in #3252
build(deps): Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @dependabot[bot] in #3254
build(deps): Bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot[bot] in #3253
build(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #3248
feat!(rpc): harden rpc endpoints by @vgonkivs in #3240
build(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.35 to 1.19.37 by @dependabot[bot] in #3251
fix(light): bind ConsensusParams response to requested height by @rootulp in #3256
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.32.36 to 1.32.38 by @dependabot[bot] in #3249
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.2 to 1.107.3 by @dependabot[bot] in #3255
fix(p2p): render peer identity in JSON log fields by @rootulp in #3262
fix(consensus): validate part set before updating valid block by @rootulp in #3261
build(deps): Bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #3279
build(deps): Bump go.opentelemetry.io/otel from 1.45.0 to 1.46.0 by @dependabot[bot] in #3285
build(deps): Bump github.com/aws/aws-sdk-go-v2 from 1.43.7 to 1.45.1 by @dependabot[bot] in #3280
build(deps): Bump go.opentelemetry.io/otel/sdk from 1.45.0 to 1.46.0 by @dependabot[bot] in #3282
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.3 to 1.109.1 by @dependabot[bot] in #3281

New Contributors

@SAY-5 made their first contribution in #3060
@reflecttypefor made their first contribution in #3130
@NikhilSharmaWe made their first contribution in #3175
@vigneshakaviki made their first contribution in #3186
@chatton made their first contribution in #3242

Full Changelog: v0.40.8...v0.41.0