This release adds support for celestia-app v9 and reduces network block time to 3s. Once the v9 activation height takes place, upgrading to this version is required.
⚠️ Action Required: run config-update
This release adds new config fields. **After upgrading the binary and before starting your node, run:
celestia bridge config-update --p2p.network arabica
celestia light config-update --p2p.network arabicaThis merges newly-added fields (e.g. the RPC RateLimit section) into your existing config.toml while preserving your custom values. Skipping this step means new options silently fall back to defaults and may log config warnings. Review your config.toml afterwards to confirm custom values were kept.
Key Highlights:
- celestia-app v9 / 3s block time (#4872, #4950, #4970) — Bumps to app v9 (via v8 → v8.0.3-mocha → v9) and go-square v4. Block time drops from 6s to 3s; syncer, DASer and pruner timing constants are scaled accordingly.
- RPC server hardening (#4909) — Request size capped at 16 MiB (down from 100 MiB), HTTP Read/Write/Idle timeouts, a 500 concurrent-connection limit, and optional per-IP rate limiting (disabled by default).
- Shrex server resource & rate limiting (#4898, #4900) — Adds resource limiting and per-peer-IP rate limiting to the shrex server.
- go-fraud removed (#4934) — Fraud proofs have been non-functional since the shwap migration; the dependency, the fraud RPC namespace and BEFP code are removed.
- More useful node info (#4341) — node.Info.type is now a string (e.g. "Bridge") and reports network_id; adds a new NetworkID endpoint.
- Nightly bootstrapper health check (#4922) — CI now monitors bootstrapper reachability.
⚠️ Breaking Changes
- fraud RPC namespace removed (#4934) — Calls to fraud.Subscribe/fraud.Get now error; the Fraud field is removed from the Go RPC client.
- node.Info shape change (#4341) — type is now a string instead of an int; clients parsing it as a number must update.
- RPC limits enforced (#4909) — Requests over 16 MiB and connections over the limit are now rejected.
- header.GetRangeByHeight enforces MaxRangeRequestSize (#4945) — Oversized range requests now return an error over RPC (matching the P2P server).
- Commitment.String() is now hex-encoded (#4413) — Anything relying on the previous raw byte output must update.
What's Changed
- bump: bump celestia-node to app@v8 and go-square@v4 by @vgonkivs in #4872
- chore(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #4876
- chore(deps): bump actions/cache from 4 to 5 by @dependabot[bot] in #4881
- chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #4878
- chore(deps): bump actions/github-script from 7 to 8 by @dependabot[bot] in #4879
- chore(deps): bump goreleaser/goreleaser-action from 6 to 7 by @dependabot[bot] in #4880
- chore(deps): bump go.opentelemetry.io/proto/otlp from 1.9.0 to 1.10.0 by @dependabot[bot] in #4883
- chore(deps): bump github.com/celestiaorg/tastora from 0.8.0 to 0.16.0 in /nodebuilder/tests/tastora by @dependabot[bot] in #4890
- chore(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 in the patch-updates group by @dependabot[bot] in #4875
- docs: fix project name in supported architectures section by @Ocheretovich in #4848
- ci: selective unit testing based on changed packages by @walldiss in #4815
- fix(state): prevent panic on overflow in amount validation by @rootulp in #4873
- refactor(state): extract txClient by @vgonkivs in #4866
- fix(metrics): fix critical metric naming bugs and global state by @walldiss in #4870
- fix(cel-shed): prevent panic on missing root hash by @Ocheretovich in #4809
- chore(deps): bump github.com/gammazero/workerpool from 1.1.3 to 1.2.1 by @dependabot[bot] in #4885
- chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.39.0 to 1.42.0 by @dependabot[bot] in #4886
- fix(metrics): add missing units and standardize error context handling by @walldiss in #4871
- chore(deps): bump github.com/libp2p/go-libp2p-kad-dht from 0.38.0 to 0.39.0 by @dependabot[bot] in #4884
- chore(deps): bump crazy-max/ghaction-import-gpg from 6 to 7 by @dependabot[bot] in #4877
- fix(blob): add subtree roots completeness check in CommitmentProof.Verify() by @rootulp in #4874
- chore: remove go-libp2p-pubsub fork, use upstream by @walldiss in #4893
- fix: align go.mod parity between root and tastora by @walldiss in #4891
- chore(deps): bump go.opentelemetry.io/otel/metric from 1.42.0 to 1.43.0 by @dependabot[bot] in #4903
- chore(deps): bump codecov/codecov-action from 5.5.3 to 6.0.0 by @dependabot[bot] in #4894
- chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #4899
- chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 by @dependabot[bot] in #4904
- chore(deps): bump go.opentelemetry.io/otel/sdk/metric from 1.42.0 to 1.43.0 by @dependabot[bot] in #4905
- chore(deps): bump github.com/celestiaorg/go-header from 0.8.5-rc to 0.8.5 by @dependabot[bot] in #4906
- chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.42.0 to 1.43.0 by @dependabot[bot] in #4907
- chore(deps): bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.7.7 to 1.7.8 by @dependabot[bot] in #4917
- chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #4924
- fix(p2p): remove broken mocha bootstrappers by @rootulp in #4913
- chore(shrex/client): change log level in shrex-client by @vgonkivs in #4927
- chore(make): add
modtarget to tidy all Go modules by @rach-id in #4925 - chore: add CLAUDE.md with Hacken bug bounty PR guidelines by @rootulp in #4911
- feat: add nightly bootstrapper health check by @rootulp in #4922
- chore(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #4938
- feat(shrex): add resource limitting to shrex server by @Wondertan in #4898
- chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #4908
- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.97.1 to 1.97.3 by @dependabot[bot] in #4916
- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.97.1 to 1.97.3 in /nodebuilder/tests/tastora by @dependabot[bot] in #4918
- chore(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in #4937
- refactor!: remove go-fraud dependency and related dead code by @rootulp in #4934
- docs(adr-013): clarify Upload behavior and rationale for Upload/Submit split by @walldiss in #4947
- fix!(header): enforce MaxRangeRequestSize in GetRangeByHeight by @vgonkivs in #4945
- feat(shrex): add per-peer-IP rate limiting to shrex server by @Wondertan in #4900
- fix(share/shwap/getters): set span err only if all getters truly failed, otherwise just record err in span for single getter failure by @renaynay in #4130
- refactor(blob)!: use hex encoding for Commitment String() output by @Galoretka in #4413
- chore(deps): bump github.com/hashicorp/go-getter from 1.7.9 to 1.8.6 by @dependabot[bot] in #4940
- fix: resubscribe to consensus node in case of dead connection by @vgonkivs in #4948
- chore(deps): bump node to app v8.0.3-mocha by @vgonkivs in #4950
- fix(daser): remove duplicated EDS Notification by @vgonkivs in #4959
- ci: set least-privilege GITHUB_TOKEN permissions by @rootulp in #4956
- ci: pin third-party actions to commit SHAs by @rootulp in #4957
- fix(core): use block height value in Exchange.Get error strings by @cuiweixie in #4935
- fix: correct cleanup usage in pidstore tests by @enlightened88 in #4942
- chore(deps): bump tastora to v0.19.0 to resolve docker/moby CVEs by @rootulp in #4955
- fix(share/cmd): bounds-check index parsing in share CLI by @rootulp in #4954
- fix(header/sync): bump recencyThreshold to 3x blockTime by @vgonkivs in #4966
- chore: bump node to app v9 commit by @ninabarbakadze in #4970
- chore(deps): bump go.opentelemetry.io/contrib/bridges/prometheus from 0.67.0 to 0.68.0 by @dependabot[bot] in #4975
- chore(deps): bump slackapi/slack-github-action from 3.0.1 to 3.0.2 in the patch-updates group by @dependabot[bot] in #4968
- chore(deps): bump github.com/libp2p/go-libp2p-pubsub from 0.15.1-0.20260318184623-12372d99a0bc to 0.16.0 by @dependabot[bot] in #4973
- chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @dependabot[bot] in #4969
- chore(deps): bump the patch-updates group across 1 directory with 2 updates by @dependabot[bot] in #4977
- chore(deps): bump alpine from 3.23.3 to 3.23.4 in the patch-updates group across 1 directory by @dependabot[bot] in #4952
- chore(deps): bump slackapi/slack-github-action from 3.0.2 to 3.0.3 in the patch-updates group by @dependabot[bot] in #4979
- fix(state): include ABCI result code in balance query error by @cuiweixie in #4936
- chore(headertest): use ErrorIs on original error and NoError for success by @VolodymyrBg in #4535
- fix: interface compliance check for
APIstruct by @brawncode in #4488 - chore(deps): bump github.com/ipld/go-ipld-prime from 0.22.0 to 0.23.0 in /nodebuilder/tests/tastora by @dependabot[bot] in #4989
- docgen: include Authorization header requirement in OpenRPC method de… by @Sushil-19 in #4818
- chore(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 in /nodebuilder/tests/tastora by @dependabot[bot] in #4985
- chore(deps): bump github.com/ipld/go-ipld-prime from 0.22.0 to 0.23.0 by @dependabot[bot] in #4988
- fix(p2p): re-add DevOps-managed Mocha bootstrappers by @rootulp in #4995
- chore(deps): bump go.uber.org/zap to v1.28.0 for parity with tastora by @rootulp in #4996
- fix: close stats file on write error by @Radovenchyk in #4967
- fix: add teardown logic to clean up Docker networks in tastora tests by @hawkadrian in #4645
- feat(nodebuilder/node)!: More useful node info (type is string and report network ID) by @renaynay in #4341
- misc(share/shwap/p2p/shrex): add traces to shrex client/server hotpaths by @renaynay in #4537
- chore(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 by @dependabot[bot] in #5001
- fix(test): fix data race during app and node startups by @vgonkivs in #5007
- feat!(rpc): harden RPC server by @Wondertan in #4909
- fix(shwap): reject nil inputs in proto decoders by @vgonkivs in #5008
- chore(deps): bump celestia-app to v9 arabica release by @rach-id in #4999
- chore(deps): bump the patch-updates group across 2 directories with 2 updates by @dependabot[bot] in #5012
New Contributors
- @Ocheretovich made their first contribution in #4848
- @cuiweixie made their first contribution in #4935
- @enlightened88 made their first contribution in #4942
- @brawncode made their first contribution in #4488
- @Sushil-19 made their first contribution in #4818
- @Radovenchyk made their first contribution in #4967
- @hawkadrian made their first contribution in #4645
Full Changelog: v0.30.2-arabica...v0.31.0-arabica