ethereum-optimism/optimism op-challenger/v1.10.1

op-challenger v1.10.1

on GitHub

Overview

Other changes

Security

• op-challenger and cannon are built with Go 1.26.10, up from 1.26.8. Go 1.26.10 makes crypto/x509 reject the compromised eMudhra intermediate certificates (CVE-2026-111943), and Go 1.26.9 includes security fixes to the crypto/tls, html/template, net/http, net/textproto and os packages (#23546)
• rustls-webpki is updated from 0.103.15 to 0.103.16 (RUSTSEC-2026-0382), so the bundled kona-host rejects the compromised eMudhra intermediate certificates on its TLS connections to L1, L2 and beacon RPCs, including connections that use the system trust store. webpki-roots is updated from 1.0.7 to 1.0.10 (RUSTSEC-2026-0381), removing the eMudhra roots from the bundled Mozilla root set. Together these address CVE-2026-111943 (#23567)
• The image's CA trust store (ca-certificates-bundle 20260909-r3) no longer includes the eMudhra emSign Root CA G3, C1 and C3 roots (#23566)

Full Changelog: op-challenger/v1.10.0...op-challenger/v1.10.1

🚢 Docker Image:

• https://us-docker.pkg.dev/oplabs-tools-artifacts/images/op-challenger:v1.10.1