celestiaorg/celestia-node v0.35.0-corto

on GitHub

This release removes Bitswap in favour of shrex, adds JWT token revocation, and ships a set of security and stability fixes. It is compatible with celestia-app v10 and with v0.34.x nodes on the network, so no coordinated upgrade is needed. It is recommended to upgrade.

Action Recommended: run config-update

This release removes the unused Share.UseShareExchange, Share.UseBitswap and Share.BlockStoreCacheSize keys from the config. Nodes start without this step and ignore the old keys. To remove them from your config.toml, stop the node, upgrade the binary and, before starting the node, run:

celestia bridge config-update --p2p.network corto

celestia light config-update --p2p.network corto

Your custom values for the other fields are kept. Review your config.toml afterwards to confirm.

Breaking changes & upgrade notes

• Bitswap removed: shrex is now the only share exchange protocol (#5378). v0.35.0 nodes keep working with v0.34.x peers, which already used shrex first and Bitswap only as a fallback.
  • The Share.UseShareExchange, Share.UseBitswap and Share.BlockStoreCacheSize config options are removed. Existing config files still load and the keys are ignored. Nodes that had disabled shrex now use it.
  • On first start, light nodes delete the samples that the Bitswap client left in the datastore. This runs once.
  • The cel-shed shwap command is removed.
• Go API changes:
  • The share/shwap/p2p/bitswap package is removed.
  • rpc.NewServer now takes an *authtoken.Verifier instead of a jwt.Verifier. Custom implementations of nodebuilder/node.Module must also implement AuthRevoke (#5364).
• Go version: source builds now require Go 1.26.10 or later. Docker images are built with Go 1.27.2.

Highlights

• JWT token revocation: the new admin-only node.AuthRevoke method and the celestia node revoke-token command revoke a single token. Revoked tokens stop authenticating, and their open WebSocket sessions and subscriptions are closed. Revocations persist across restarts. The JWT format and the existing RPC methods are unchanged.

  celestia node revoke-token "$TOKEN_TO_REVOKE" --url http://localhost:26658 --token "$ADMIN_TOKEN"

• Security and resource hardening:
  • the EDS proofs cache is bounded;
  • shrex streams namespace and range responses row by row instead of building them whole;
  • discovery no longer starts endless peer searches when the peer set is over its limit;
  • range proof and GetRangeResult verification are stricter and return errors instead of panicking. A new VerifyRange also checks that a proof covers the requested range.
• Stability:
  • header requests serve stored headers while the syncer head lags;
  • DAS resumes interrupted jobs correctly after a restart;
  • the pruner stops a round when a batch fails;
  • state methods and the CLI return errors instead of panicking on a nil TxConfig, a wrong address kind or an invalid GrantFee amount.
• Dependencies: celestia-app v10.6.0, celestia-core v0.42.8, go-header v0.8.10, go-square v4.3.1, and libp2p updates.

What's Changed

• fix(shrex): return canonical rows for empty blocks [low] by @renaynay in #5322
• fix(blob): return errors instead of panicking on malformed proofs by @Bruce039 in #5284
• perf(share/eds): pool buffered NMTs in EDS construction by @vgonkivs in #5241
• fix(share/eds): make closeOnce safe to close while in use by @kriss39 in #5304
• core: Stop partially started test network on retry by @rootulp in #5336
• bump(dependency): bump go-header to the latest version [low] by @vgonkivs in #5334
• fix(e2e/test): fix flakky tastora tests [low] by @vgonkivs in #5333
• fix(header): [medium] serve stored headers when syncer head lags by @vgonkivs in #5326
• fix(shrex): stream namespace responses sequentially [high] by @renaynay in #5301
• fix(blob): [low] reject invalid subscription namespaces by @renaynay in #5338
• fix(state): validate GrantFee amount by @0xShadowX in #5288
• docs: repoint cosmos-sdk references after the unfork by @rach-id in #5339
• fix(fibre/stateclient): reject an empty proof op list in GetHost by @Bruce039 in #5343
• chore(deps): bump github.com/libp2p/go-libp2p-pubsub from 0.17.0 to 0.18.0 in the libp2p group across 1 directory by @dependabot[bot] in #5354
• fix(state): verify the absence proof for an empty balance by @Bruce039 in #5351
• docs: Trim redundant agent context by @rootulp in #5344
• ci: [low] require review level tag in PR titles by @rootulp in #5357
• chore(deps): bump actions/upload-artifact from 4 to 6 by @dependabot[bot] in #5328
• fix(state): [medium] normalize nil TxConfig to defaults instead of panicking by @HusseinAdeiza in #5349
• fix(ci): [low] pin patched Node.js runtime by @rootulp in #5358
• state/cmd: reject the wrong address kind instead of panicking by @Ravan002 in #5348
• chore(deps): bump golang from 1.26.8-alpine3.23 to 1.27.2-alpine3.23 by @dependabot[bot] in #5352
• chore(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 by @dependabot[bot] in #5353
• chore(deps): [medium] bump the go-deps group across 2 directories with 22 updates by @dependabot[bot] in #5355
• pruner: stop the round when a full batch fails by @Ravan002 in #5346
• fix(share/eds): [high] bound proofs cache axis entries by @rootulp in #5360
• chore(deps): [medium] align go-connections and go-ansiterm with tastora by @rootulp in #5362
• docs: [low] stop repeating the review level in PR descriptions by @rootulp in #5367
• fix(api/docgen): [low] add authenticated RPC request guidance by @jcstein in #5363
• ci(deps): [medium] sign Dependabot tidy commits through GitHub by @rootulp in #5365
• chore(deps): [medium] bump the go-deps group across 2 directories with 2 updates by @dependabot[bot] in #5370
• docs(nodebuilder): [low] remove stale DA module reference by @jcstein in #5371
• test(share/shwap): [low] add fuzz targets for Sample, Row and RowNamespaceData decoding by @rootulp in #5369
• fix(shwap/bitswap): [low] stop noisy hasher logs (closes #3864) by @jcstein in #5372
• fix(das): [low] report catch-up done after resuming an empty checkpoint by @Ravan002 in #5375
• test(nodebuilder/tests): [low] port remaining swamp coverage to tastora by @vgonkivs in #5373
• test(nodebuilder/tests): [low] remove swamp by @vgonkivs in #5374
• chore(deps): [medium] bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 by @dependabot[bot] in #5377
• refactor(share)!: [high] remove shwap bitswap by @vgonkivs in #5378
• chore(deps): [medium] bump go-square/v4 to v4.3.0 by @rootulp in #5380
• fix(nodebuilder/share): [high] harden GetRangeResult verification and bump celestia-core to v0.42.7 by @rootulp in #5379
• feat(node)!: [high] support JWT auth token revocation by @jcstein in #5364
• chore(deps): [medium] bump the go-deps group across 2 directories with 3 updates by @dependabot[bot] in #5386
• fix(share/discovery): [high] don't wrap the wanted peer count when the set is over its limit by @Snan0M in #5382
• ci: [high] auto-approve low and medium risk PRs from trusted authors by @walldiss in #5387
• ci: [medium] auto-approve low and medium risk Dependabot PRs by @walldiss in #5389
• chore(deps): [medium] bump actions/checkout from 7.0.0 to 7.0.1 in the patch-updates group by @dependabot[bot] in #5384
• fix(share/shwap): [high] bind range proofs to the requested range by @rootulp in #5390
• chore(deps): [medium] bump the libp2p group across 2 directories with 2 updates by @dependabot[bot] in #5385
• chore(deps): [low] bump go-header to v0.8.10 by @vgonkivs in #5391
• chore(deps): [medium] bump go-square to v4.3.1 by @rootulp in #5396
• test: [low] fix flaky unit and Tastora E2E tests by @rootulp in #5397
• chore(deps): [medium] bump celestia-app to v10.6.0 and celestia-core to v0.42.8 by @vgonkivs in #5398

New Contributors

• @Bruce039 made their first contribution in #5284
• @HusseinAdeiza made their first contribution in #5349
• @Ravan002 made their first contribution in #5348
• @Snan0M made their first contribution in #5382

Full Changelog: v0.34.4-corto...v0.35.0-corto