ethereum-optimism/optimism kona-node/v1.7.0 on GitHub

Overview

Note

kona-node is not production ready. Production deployments should prefer op-node.

cross_unsafe_l2 and the cross-unsafe block-label series removed (#22552). The cross_unsafe_l2 field is gone from optimism_syncStatus and from the sync status embedded in optimism_outputAtBlock; the cross-unsafe series is also gone from kona_node_block_labels. Dashboards, alerts, and tooling must switch to unsafe_l2. Older peers that still send the removed JSON field remain compatible.

New World Chain Karst activation times (#22624). The embedded superchain registry gains:
- sepolia/worldchain — karst_time = 1788868800 (Tue 8 Sep 2026 12:00:00 UTC)
- mainnet/worldchain — karst_time = 1789992000 (Mon 21 Sep 2026 12:00:00 UTC)
A World Chain kona-node on an earlier release, running the built-in --chain config, will not activate Karst and will diverge from the chain. No other chain's activation times change in this release.

Holocene span batch validation now verifies every batch element that overlaps the safe chain, preventing a conflicting overlap from splicing an invalidated lineage onto the canonical chain and keeping kona aligned with op-node (#22215)
Payload attributes and block consolidation now require canonical EIP-2718 transaction bytes. Bare RLP bodies for typed transactions, including deposits and PostExec transactions, are rejected instead of being accepted as alternate encodings (#22778)
Pipeline resets now key system-config and parent-block lookups by block hash rather than height, and a reorged-out parent triggers a reset instead of being retried indefinitely (#22465, #22467)

Beacon blob responses are deserialized without a roughly 1.3 MiB stack frame, preventing the SIGSEGV restart loop seen while deriving blob-backed channels on Tokio's default worker stack (#22517)
Deep catch-up behind a moving unsafe tip no longer exits with UnsafeHeadChangedSinceBuild while re-deriving and replacing the local unsafe chain (#22557)
Imported parent blocks now satisfy system-config lookups locally instead of requiring another full-block Engine API fetch on every block, reducing execution-client RPC load on both verifier and sequencer paths (#22466)

Kona's P2P stack moves off vulnerable Yamux 0.12 and Hickory 0.25 releases, addressing the Yamux remote-panic and Hickory NSEC3 validation-loop advisories; gossip protocol reporting is updated for meshsub 1.3.0 (#22714)
Gossip subscription announcements are restricted to the topics kona-node actually serves, preventing peers from creating an unbounded topic set and unbounded kona_node_gossip_events label values (#22661)
Rust workspace dependency updates refresh the directly used lru and OpenTelemetry families as part of the security dependency rollup (#22500)

--l1-chain-config now accepts either a direct L1 chain config or a full genesis document with the config under .config, matching op-node and allowing both clients to consume the same mounted genesis file (#22493)
The Keccak AltDA input-size limit can be set with da_max_input_size in the rollup config. Omitting it preserves the previous 130,672-byte limit (#22496)
WSS RPC connections now load platform-native certificate roots in addition to embedded public roots, allowing endpoints secured by operator-managed private CAs (#22604)

Stale span-batch and missing-L1-origin warnings now include chain, timestamp, lag, safe-head, inclusion-block, Holocene, and validity context so operators can distinguish expected replay from a derivation problem (#22623)

Full Changelog: kona-node/v1.6.4...kona-node/v1.7.0

🚢 Docker Image: