Overview
Important
This is a recommended release for all op-challenger operators. It updates dependencies, the Go toolchain and the image's base packages to fix vulnerabilities that image scanners can report against v1.11.0, including CVE-2026-116591, CVE-2026-84243 and GHSA-53rm-773f-4q8c. None of the vulnerable code is reachable in op-challenger, cannon or kona-host, and there are no other operator-visible changes.
Other changes
Security
github.com/klauspost/compressis updated from v1.18.7 to v1.20.2, fixing CVE-2026-116591 (GHSA-fpmh-frq8-7rj8), a panic in its zstd decoder on two-block frames. op-challenger uses that decoder only to read the superchain registry built into the binary, so no external input reaches it (#23965)- The image's
glibc-2.44andlibcrypt1-2.44packages move from2.44-r9to2.44-r18, which fixes CVE-2026-84243 inlibcrypt1(fixed in2.44-r16). The fixed packages come from rebuilding the image; no code changed - op-challenger and cannon are built with Go 1.26.11, whose security fixes include CVE-2026-97054 in
net/http. Neither binary serves an HTTP handler wrapped inMaxBytesReaderorMaxBytesHandler, so neither was exposed. The other fixes are build-time cgo issues quinn-protois updated from 0.11.16 to 0.11.19 in the Rust lockfile, clearing GHSA-53rm-773f-4q8c. No binary in the image linksquinn-proto; the update only stops image scanners from reporting it (#23777)- The bundled kona-host's
tokiois updated from 1.53.1 to 1.53.3 for RUSTSEC-2026-0386, an I/O-safety flaw inAsyncFd's safe constructors, which kona-host does not reach (#23633)
Full Changelog: op-challenger/v1.11.0...op-challenger/v1.12.0
🚢 Docker Image: