celestiaorg/celestia-core v0.43.0-rc0 on GitHub

First release candidate of the v0.43.x line, for celestia-app v11. It adds dynamic block pacing driven by the app, gates go-square's BlobTx decoder on app version 11, and hardens consensus, propagation, the CAT mempool, light client, state sync and blocksync. It has breaking Go API changes and requires Go 1.26.11.

Breaking Changes

BlobTx decoding is gated on the app version (#3483). types.UnwrapBlobTx(tx, appVersion) keeps core's legacy rules below app version 11 and uses go-square's decoder from app version 11. go-square is now v4.1.0. Callers of coretypes.UnmarshalBlobTx must move to go-square.
ABCI TimeoutInfo.dynamic_timeout_commit (#3542). New field 9 on ABCI and state TimeoutInfo. It is additive on the wire: apps that never set it send 0, and 0 keeps the previous pacing exactly. An app that sets it needs this core on all validators.
autofile FlushAndSync skips the fsync when nothing new was written (#3436), backported from cometbft#5866.
Go 1.26.11 is required (was 1.26.6).

Dynamic block pacing

The app sets the target block interval through dynamic_timeout_commit. Round 0 starts at a deadline computed from the previous height's start, so block times stay on a fixed grid instead of drifting with commit latency (#3639, #3539). On a 100-validator, 6-region network with an 800 ms target, the idle interval p50 was 801 ms.
Late precommits are kept when a height starts without a commit window (#3640).
After a restart, a backward clock step or at the upgrade height, pacing starts from the legacy start and joins the grid on the next height (#3644).
Disaster-recovery switch: [consensus] legacy_pacing = true ignores the app's value and paces with legacy_pacing_timeout_commit (100 ms) and legacy_pacing_delayed_precommit_timeout (550 ms). It only slows the chain once validators with more than 1/3 of the stake turn it on; see docs/core/configuration.md (#3664).
New metric: consensus_pacing_bypass{reason}.

Consensus, propagation and p2p

Bound the block's tx count before decoding it (#3543).
Bound catch-up wants served from the block store: parts are loaded from the store only as they are sent, under a rate limit shared by all peers, and catch-up requests now expire and are retried (#3620).
Forward validated compact blocks before rebuilding parts from the mempool: last-peer receive time 29 → 6 ms at 32 MB (#3471).
Flush latency-critical messages (votes, compact blocks) as soon as they are written instead of waiting for flush_throttle_timeout (#3472).
Ignore precommits for the height before the initial height (#3583), and reject wrong-size public keys in Validator.ValidateBasic (#3578).

Mempool (CAT)

Enforce the tx count limit and keep request ownership when a peer is removed (#3614).
Keep the reap within its byte and gas budget (#3495), and don't evict the incoming signer's own txs (#3659).
Expose the highest pending sequence per signer (#3562).

Light client and blocksync

Verify the commit of light blocks verified backwards and check the target hash afterwards (#3628, #3570); reject signed headers missing their header or commit (#3581).
Blocksync skips pending accounting for peers with no pending requests (#3571).

Performance

Parallel Reed-Solomon encoding, with the parity part set owning the output buffer (#3440, #3439).
Hash block txs once at assembly (#3496); unwrap v11 BlobTxs without copying and reuse them in fireEvents (#3521, #3514, #3515).
Skip fsync for unsigned block parts and reuse WAL encode/decode buffers (#3430, #3442).

Other

RPC handles missing JSON-RPC params and quoted 64-bit integers (#3604); WeightedMedian requires a strict majority (#3353); debug archives are created owner-only (#3354).
Fuzz targets for every network-facing decoder and reactor, plus many test-flake fixes.

What's Changed

chore(ci): enable Mergify backports to v0.42.x by @rach-id in #3325
ci: run native Go fuzz tests nightly by @rootulp in #3322
test: extend tests to cover heavy request cases by @vgonkivs in #3288
feat(config): expose documented TOML renderer on main by @rach-id in #3328
ci: upload unit test coverage to Codecov by @rootulp in #3330
fix(indexer): cap tx_search/block_search match set via max_search_results by @vgonkivs in #3329
build(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.4 to 1.20.5 by @dependabot[bot] in #3335
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.33.4 to 1.33.5 by @dependabot[bot] in #3336
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.0 to 1.113.1 by @dependabot[bot] in #3333
build(deps): Bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #3331
build(deps): Bump linear/linear-release-action from 0.17.2 to 0.18.0 by @dependabot[bot] in #3332
docs: add v0.42.x to README branches and convert to a table by @rootulp in #3339
build(deps): Bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in #3334
chore(deps): enforce 7-day dependency cooldown by @rootulp in #3346
fix(consensus/propagation): reject WantParts bit arrays larger than the max part count by @ninabarbakadze in #3344
fix(types): bind row proof Merkle indexes to the claimed rows by @ninabarbakadze in #3345
fix(consensus/propagation): bound WantParts.MissingPartsCount by the bit array size by @ninabarbakadze in #3343
fix(rpc/core): cancel event write contexts per delivery instead of per subscription by @ninabarbakadze in #3348
fix(rpc/core): enforce max query length in block_search by @ninabarbakadze in #3349
fix(types): validate commit BlockID in Commit.ValidateBasic by @ninabarbakadze in #3350
fix(types): validate share proof entries before using them by @ninabarbakadze in #3352
docs(evidence): document why the evidence channel has no message precheck by @ninabarbakadze in #3358
docs(evidence): tighten the precheck note by @ninabarbakadze in #3365
fix(cmd/debug): create debug archives with owner-only permissions by @ninabarbakadze in #3354
docs(blocksync): document why block responses are not rate limited by @ninabarbakadze in #3362
fix(types/time): require a strict majority in WeightedMedian by @ninabarbakadze in #3353
fix(types): reject duplicate validator addresses in ValidatorSetFromExistingValidators by @ninabarbakadze in #3351
docs(rpc/core): document broadcast_evidence decode cost tradeoff by @ninabarbakadze in #3363
ci: check Go module tidiness by @rootulp in #3368
test(evidence): allow gossip assertions to wait for rebroadcast by @rootulp in #3366
fix(statesync): clarify snapshot discovery retry log by @rootulp in #3367
docs(p2p): document partial-message retention in recvPacketMsg by @ninabarbakadze in #3361
feat: add TLS to privval gRPC by @ninabarbakadze in #3317
docs(statesync): document why chunk responses are not peer-bound by @ninabarbakadze in #3360
fix(light/rpc): bind hash-selected responses to the requested hash by @ninabarbakadze in #3357
docs(rpc/core): document data root tuple proof allocation tradeoff by @ninabarbakadze in #3364
fix(mempool/cat): guard against zero total gas in txSet aggregation by @ninabarbakadze in #3355
chore: disable Mergify queue control comments by @rootulp in #3373
fix(rpc/jsonrpc): cap JSON-RPC client response body size by @ninabarbakadze in #3356
fix(privval): reject SignRawBytes for other chain IDs by @ninabarbakadze in #3374
fix(config)!: don't treat localhost hostname as loopback for privval gRPC by @ninabarbakadze in #3379
test(consensus): drain prevote before injecting precommits by @HusseinAdeiza in #3383
fix(ci): pin test diff action to commit SHA by @rootulp in #3382
ci: run govulncheck daily on main instead of on every PR by @rootulp in #3392
ci: replace super-linter v4 with yamllint and Spectral by @rootulp in #3395
ci: notify #protocol-ci when Build or Go mod tidy fail on main by @rootulp in #3393
ci: lint GitHub Actions workflows with actionlint by @rootulp in #3397
ci: add job timeouts and read-only permissions by @rootulp in #3390
fix(deps): downgrade google.golang.org/grpc to v1.83.2 by @rootulp in #3385
ci: pin all GitHub Actions to commit SHAs by @rootulp in #3389
ci: move copilot-setup-steps into .github/workflows by @rootulp in #3391
ci: replace Janitor with concurrency groups by @rootulp in #3387
ci: replace deprecated buf actions with bufbuild/buf-action by @rootulp in #3394
build(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #3400
build: pin govulncheck and protoc-gen-gogofaster versions by @rootulp in #3396
fix(ci): run check-generated on all pull requests by @rootulp in #3386
fix(ci): run post-merge checks on main by @rootulp in #3388
fix(privval): cap connections and handshake time on the gRPC server by @ninabarbakadze in #3380
fix(rpc/core): gate genesis routes behind the heavy-request budget by @ninabarbakadze in #3399
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.1 to 1.113.2 by @dependabot[bot] in #3398
fix(privval): reject partial gRPC TLS config at startup by @ninabarbakadze in #3404
build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.2 to 1.113.4 by @dependabot[bot] in #3435
build(deps): Bump github.com/aws/aws-sdk-go-v2 from 1.47.0 to 1.47.1 by @dependabot[bot] in #3431
perf(consensus): [high] skip fsync for unsigned block parts (backport) by @ninabarbakadze in #3430
build(deps): Bump github.com/aws/aws-sdk-go-v2/config from 1.33.5 to 1.33.6 by @dependabot[bot] in #3432
build(deps): Bump github.com/prometheus/common from 0.71.0 to 0.72.0 by @dependabot[bot] in #3433
perf(consensus): reuse encode/decode buffers in WALEncoder and WALDecoder (backport) by @ninabarbakadze in #3442
build(deps): bump golang.org/x/net to v0.60.0 and Go to 1.26.9 to fix govulncheck by @rootulp in #3443
test: [low] benchmark 32 MB proposal construction by @rach-id in #3437
perf: let the parity PartSet own the Reed-Solomon output buffer by @rach-id in #3439
perf: parallelize Reed-Solomon encoding by @rach-id in #3440
ci: disable Mergify merge queue comments by @rootulp in #3449
perf(autofile)!: skip fsync in FlushAndSync when no new data was written (bp #5866) by @ninabarbakadze in #3436
build(deps): Bump github.com/grafana/pyroscope-go from 1.4.2 to 1.4.3 by @dependabot[bot] in #3467
build(deps): Bump github.com/grafana/otel-profiling-go from 0.6.0 to 0.7.0 by @dependabot[bot] in #3463
build(deps): Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.46.0 to 1.47.0 by @dependabot[bot] in #3462
build(deps): Bump golang.org/x/sync from 0.23.0 to 0.24.0 by @dependabot[bot] in #3470
docs: use the Celestia organization security policy by @rach-id in #3475
fix(abci/client): clear in-flight requests in flushQueue by @rootulp in #3473
docs: trim redundant agent guidance by @rootulp in #3476
build(deps): Bump linear/linear-release-action from 0.18.0 to 0.18.1 by @dependabot[bot] in #3460
build(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.6 to 1.20.7 by @dependabot[bot] in #3469
build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #3461
feat(state): roll back to a target height [medium] by @vgonkivs in #3479
feat(cmd): rollback --height with depth guard [medium] by @vgonkivs in #3480
ci: [low] require review level tag in PR titles by @rootulp in #3478
build(deps): [high] Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.4 to 1.114.3 by @dependabot[bot] in #3492
build(deps): [high] bump github.com/aws/aws-sdk-go-v2/config from 1.33.6 to 1.33.9 by @dependabot[bot] in #3485
build(deps): [medium] bump Go to 1.26.10 to fix govulncheck by @rootulp in #3497
test(crypto): [low] pin ZIP-215 semantics of ed25519 verification by @rach-id in #3493
perf: [medium] hash block txs once at assembly and reuse them in SaveTxInfo and mempool.Update by @rach-id in #3496
fix(mempool): [high] keep the CAT reap within its byte and gas budget by @rach-id in #3495
feat(types)!: [high] gate go-square's BlobTx decoder on app version 11 by @rootulp in #3483
ci: [low] pin Node.js 24.22.1 for the OpenAPI lint job by @rootulp in #3498
build(deps): [high] Bump github.com/prometheus/common from 0.72.0 to 0.72.1 by @dependabot[bot] in #3491
build(deps): [high] bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 by @dependabot[bot] in #3486
build(deps): Bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3 by @dependabot[bot] in #3465
fix(txindex): [medium] let a re-executed tx replace its old result by @vgonkivs in #3503
test(consensus): [low] stop leaked WALs in TestWALCrash by @rootulp in #3504
build(deps): [low] Bump github.com/moby/sys/user from 0.4.0 to 0.4.1 by @dependabot[bot] in #3507
docs: [low] clarify that main becomes v0.43.x for celestia-app v11 by @rootulp in #3506
fix(rpc): hold heavy-request slots until JSON-RPC responses are written by @rootulp in #3429
ci: [low] apply dependabot title prefix to security updates by @rootulp in #3508
test: [low] add fuzz targets for propagation messages and block-level proto decoding by @rootulp in #3512
fix(p2p): [high] reject weak Ed25519 peer identity keys by @rootulp in #3501
perf(types): [high] find the inner tx of a BlobTx by scanning its fields by @rootulp in #3515
fix(mempool): [high] honor reactor queueing func and use non-blocking sends in CAT by @rootulp in #3517
perf(state): [high] reuse unwrapped BlobTxs in fireEvents by @rootulp in #3514
perf(types): [high] unwrap v11 BlobTxs with the no-copy decoder by @rootulp in #3521
test(types): [medium] add regression tests for the legacy BlobTx field scanner by @rootulp in #3522
fix(ci): [low] retry coverage uploads after transient failures by @rootulp in #3525
docs: [low] drop redundant review level line from PR description guidance by @rootulp in #3520
test(fuzz): [low] cover core peer decoders in nightly fuzzing by @rootulp in #3527
ci: [medium] sign Mergify backport commits by @rootulp in #3516
test(flowrate): [low] fix TestReader lower bound for clock rounding by @rootulp in #3528
fix(types): [high] bind ShareProof and RowProof to positions in the data square by @rootulp in #3532
fix(indexer): [medium] cap intersected search results by @rootulp in #3536
test(p2p/conn): [low] add fuzz targets for SecretConnection handshake/read and MConnection recv by @rootulp in #3545
test(rpc): [low] add fuzz targets for rpc/core handlers and the JSON-RPC server by @rootulp in #3558
test(consensus): [low] add fuzz targets for reactor Receive and state handleMsg by @rootulp in #3544
test(p2p): [low] add fuzz targets for transport upgrade and peer receive by @rootulp in #3546
test(mempool/cat): [low] add sequence fuzz target for reactor Receive by @rootulp in #3548
test(blocksync): [low] add fuzz target for reactor Receive and pool sync by @rootulp in #3552
test(consensus/propagation): [low] add sequence fuzz target for the propagation reactor by @rootulp in #3549
test(consensus/propagation/types): [low] fuzz part set decoding and make TxsToParts fuzz targets deterministic by @rootulp in #3550
test(evidence): [low] add fuzz targets for reactor Receive and pool verification by @rootulp in #3551
test(types): [low] add fuzz targets for commit verification and light blocks by @rootulp in #3553
test(light): [low] add fuzz targets for light client verification and HTTP provider by @rootulp in #3554
test(statesync): [low] add fuzz target for reactor Receive and syncer restore by @rootulp in #3555
test(p2p/pex): [low] add fuzz target for reactor Receive and address book by @rootulp in #3556
test(state): [low] add fuzz targets for block validation, apply and vote extension verification by @rootulp in #3557
test(rpc/grpc): [low] add fuzz target for the gRPC API by @rootulp in #3559
docs(test/fuzz): [low] record entry-point fuzz target inventory by @rootulp in #3561
test: [low] use structured fuzzing for raw-bytes fuzz targets by @rootulp in #3564
test(types): [low] re-sign commit fuzz inputs with the decoded block ID flag by @rootulp in #3566
test(p2p): [low] wait for the peer in TestSwitchDialPeersAsync by @rootulp in #3569
test(consensus): [low] stop base reactor processor in reactor receive fuzz harness by @rootulp in #3568
build(deps): [high] bump github.com/adlio/schema from 1.5.1 to 1.5.2 by @dependabot[bot] in #3523
ci: [high] auto-approve low and medium risk PRs from trusted authors by @rootulp in #3560
ci(fuzz): [low] fuzz only changed packages on pull requests by @rootulp in #3565
fix(bits): [medium] reject negative bit counts in BitArray.ValidateBasic by @rootulp in #3576
fix(blocksync): [high] skip pending accounting for peers with no pending requests by @rootulp in #3571
test(consensus): [low] fix TestStateLockNoPOL flake under load by @rootulp in #3575
fix(light): [high] check the target hash after backwards verification by @rootulp in #3570
ci(fuzz): [medium] file Linear issues for nightly fuzz failures instead of publishing crash inputs by @rootulp in #3573
docs(test/fuzz): [low] narrow state-sync fuzz coverage to snapshots and chunks by @rootulp in #3574
ci: [low] auto-assign PR author on new PRs by @rootulp in #3577
test(consensus): [low] make TestByzantinePrevoteEquivocation wait for the byzantine prevote by @rootulp in #3579
fix(types): [high] reject wrong-size public keys in Validator.ValidateBasic by @rootulp in #3578
fix(light): [medium] reject signed headers missing their header or commit by @rootulp in #3581
ci(fuzz): [low] don't fail a target on go test's own -fuzztime deadline by @rootulp in #3582
test(evidence): [low] skip fuzz edits that leave evidence unencodable by @rootulp in #3585
ci(fuzz): [medium] keep PR-time fuzz crashes out of public logs and artifacts by @rootulp in #3584
build(deps): [high] bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.6 by @dependabot[bot] in #3593
build(deps): [high] bump github.com/prometheus/common from 0.72.1 to 0.73.0 by @dependabot[bot] in #3591
build(deps): [medium] bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #3588
fix(propagation): [high] forward each compact block to consensus once by @rootulp in #3596
ci: [medium] auto-approve low and medium risk Dependabot PRs by @walldiss in #3580
fix(consensus): [high] ignore precommits for the height before the initial height by @vgonkivs in #3583
ci: [low] persist nightly fuzz corpora between runs by @rootulp in #3601
fix(rpc/grpc): [medium] bound concurrent SubscribeNewHeights streams by @rootulp in #3603
fix(rpc): [medium] handle missing JSON-RPC params and lone-quote 64-bit integers by @rootulp in #3604
fix(rpc): [medium] bound heavy permit lifetime for gRPC streams and WebSocket responses by @rootulp in #3612
fix(rpc): [medium] bound block_search page by response size by @rootulp in #3610
fix(mempool/cat): [high] bound the received-tx buffer by @rootulp in #3594
ci: [low] add mutation testing, fuzz target check, and complexity lint by @rootulp in #3602
feat(consensus): [high] disconnect peers that send votes with invalid signatures by @rootulp in #3600
test: [low] fix flaky consensus and node tests by @rootulp in #3623
chore(deps): [high] bump go-square to v4.3.1 by @rootulp in #3624
ci: [low] leave secret_connection.go out of p2p/conn mutation testing by @rootulp in #3625
fix(p2p): [high] validate peer ListenAddr without DNS resolution by @rootulp in #3613
fix(statesync): [high] verify commit returned by light client state provider by @rootulp in #3615
fix(blocksync): [high] verify vote extension signatures before persisting extended commits by @rootulp in #3616
feat(mempool): [medium] expose the highest pending sequence per signer from CAT by @rach-id in #3562
fix: [high] bound block cardinality before decoding by @rach-id in #3543
fix(mempool/cat): [high] enforce the tx count limit and keep request ownership on peer removal by @rootulp in #3614
fix(light): [high] verify commit of light blocks verified backwards by @rootulp in #3628
test(mempool/cat): [low] stop scheduler tests racing the re-request timeout by @rootulp in #3635
chore(deps): [low] bump Go to 1.26.11 by @rootulp in #3636
fix(propagation): [high] bound catchup wants served from the block store by @rootulp in #3620
build(deps): [medium] bump linear/linear-release-action from 0.18.1 to 0.18.2 by @dependabot[bot] in #3655
build(deps): [medium] bump bufbuild/buf-action from 1.6.0 to 1.7.0 by @dependabot[bot] in #3651
build(deps): [medium] bump actions/cache/save from 4.3.0 to 6.1.0 by @dependabot[bot] in #3652
build(deps): [high] bump github.com/prometheus/common from 0.73.0 to 0.73.1 by @dependabot[bot] in #3658
build(deps): [medium] bump actions/cache/restore from 4.3.0 to 6.1.0 by @dependabot[bot] in #3653
build(deps): [high] bump golang.org/x/sync from 0.24.0 to 0.25.0 by @dependabot[bot] in #3654
build(deps): [high] bump github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.13 by @dependabot[bot] in #3656
fix(mempool/cat): [high] don't evict the incoming signer's own txs by @rootulp in #3659
test(consensus): [low] deflake TestStateFullRound1 and TestStateLockPOLUnlockOnUnknownBlock by @rach-id in #3670
perf(propagation): [high] forward compact blocks before local recovery by @ninabarbakadze in #3471
feat(abci): [high] add TimeoutInfo.dynamic_timeout_commit by @rach-id in #3542
feat(consensus): [high] compute the dynamic timeout commit deadline by @rach-id in #3639
feat(consensus): [high] hold round 0 until the dynamic timeout commit deadline by @rach-id in #3539
fix(consensus): [high] keep late precommits when a height starts without a commit window by @rach-id in #3640
perf(p2p): [high] flush latency-critical messages once the send queues drain by @ninabarbakadze in #3472
feat(consensus): [high] add a legacy pacing switch for disaster recovery by @rach-id in #3664
fix(consensus): [high] bootstrap dynamic pacing from the legacy start by @rach-id in #3644

New Contributors

@HusseinAdeiza made their first contribution in #3383

Full Changelog: v0.42.0...v0.43.0-rc0