ethereum-optimism/optimism op-deployer/v0.9.0-rc.3

op-deployer v0.9.0-rc.3

on GitHub

Overview

This is a pre-release. The embedded contracts and the standard OPCM addresses may change before op-contracts/v9.0.0.

Other changes

Deploy

• init --intent-type standard* and the standard intent checks now target the op-contracts/v9.0.0-rc.1 OPCM from the superchain registry: 0x160f0fe4dc1b3f4026687e8dd4b7f800879939cc on Sepolia and 0x2d91e6f2bcf6cd1df90e1faf9714e18705ea331f on Mainnet. The embedded contract artifacts are the op-contracts/v9.0.0-rc.1 build (#23816)
• The default --genesis-time-offset (DEPLOYER_GENESIS_TIME_OFFSET) for prepare drops from 21600 seconds (6 hours) to 10800 (3 hours), and prepare now rejects values below 3600 with genesis time offset must be at least 3600 seconds (#22512)
• Chains deployed through prepare and continue with the default SUPER_PERMISSIONED game now start from a real super-root anchor computed at prepare, as permissionless super-root chains already did, instead of the placeholder anchor (#22937)

Forge

• With --use-forge, op-deployer now downloads and runs Foundry v1.8.3 (previously v1.2.3). A new opt-in --forge-slow-broadcast (DEPLOYER_FORGE_SLOW_BROADCAST) on apply, bootstrap superchain and bootstrap implementations waits for each broadcast transaction to confirm before sending the next, for L1 nodes such as anvil 1.8 that can strand concurrently broadcast transactions (#22913)

Genesis

• L1 dev genesis (--deployment-target genesis) now includes the Prague and Amsterdam request-queue system contracts (withdrawal, consolidation, builder deposit and builder exit), which released geth requires to build post-Prague payloads (#23152)

Security

• Built with Go 1.26.10 (previously 1.26.5), which refuses TLS chains through the compromised eMudhra intermediate certificates (CVE-2026-111943), and with golang.org/x/crypto v0.56.0 and golang.org/x/mod v0.40.0, picking up security fixes (#23917, #22424, #22750, #22425)
• The docker image pins ca-certificates-bundle>=20260909-r3, the Wolfi build that removes the eMudhra emSign roots from the trust store (#23917)

Full Changelog: op-deployer/v0.8.1...op-deployer/v0.9.0-rc.3

🚢 Docker Image:

• https://us-docker.pkg.dev/oplabs-tools-artifacts/images/op-deployer:v0.9.0-rc.3