ethereum-optimism/optimism kona-host/v1.9.0

kona-host v1.9.0

on GitHub

Overview

Breaking changes

• kona-host refuses to start with an unusable --depset-cfg (#23276). If the file passed to --depset-cfg is missing, unreadable or doesn't parse, kona-host now exits with an error naming the file, instead of serving an empty dependency set. A dependency set whose overrideMessageExpiryWindow is above 604800 seconds (7 days) is also rejected. op-challenger passes --depset-cfg only when a dependency set file is configured with --depset-config or its --cannon-kona-depset-config / --super-cannon-kona-depset-config variants; operators relying on --network are unaffected. Operators who set it must check that the file exists, parses, and has no override above 7 days before upgrading.

Other changes

Host

• Includes the eMudhra certificate authority fixes (CVE-2026-111943) first released in v1.8.1: rustls-webpki 0.103.16 (RUSTSEC-2026-0382) rejects the compromised eMudhra intermediates on kona-host's TLS connections to L1, L2 and beacon RPCs, webpki-roots 1.0.10 (RUSTSEC-2026-0381) removes the eMudhra roots from the bundled root set, and the image's CA trust store (ca-certificates-bundle 20260909-r3) no longer includes the emSign Root CA G3, C1 and C3 roots (#23567, #23566)
• kona-host now reads the beacon slot duration from SLOT_DURATION_MS in the beacon node's /eth/v1/config/spec, falling back to SECONDS_PER_SLOT, so it keeps fetching blobs from consensus clients that no longer serve SECONDS_PER_SLOT. If neither key is present, it fails with an error naming both (#23138)
• rustls is updated to 0.23.46 for RUSTSEC-2026-0349, a low-severity post-quantum key-exchange downgrade. It affects kona-host's TLS connections to L1, L2 and beacon RPCs (#23433)

Full Changelog: kona-host/v1.8.1...kona-host/v1.9.0

🚢 Docker Image:

• https://us-docker.pkg.dev/oplabs-tools-artifacts/images/kona-host:v1.9.0