Overview
Note
This is an optional release for all operators. It contains two removals that are breaking for operators who still use them, the --sequencer.max-safe-lag flag and the built-in Holesky L1 chain config, and a brotli dependency update for CVE-2026-111497.
Breaking changes
--sequencer.max-safe-lagremoved (#23738). The sequencer no longer pauses block production when the safe head falls behind the unsafe head. op-node now refuses to start with--sequencer.max-safe-lag, so remove it from your launch configuration before upgrading. A leftoverOP_NODE_SEQUENCER_MAX_SAFE_LAGis ignored, with anUnknown env varwarning at startup.- Built-in Holesky L1 chain config removed (#23554). Holesky has shut down. An op-node whose L1 is Holesky now fails to start unless it is given the L1 chain config with
--rollup.l1-chain-config, like any other L1 without a built-in config. The built-in configs for Ethereum Mainnet, Sepolia and Hoodi are unchanged.
Other changes
github.com/andybalholm/brotliis updated to v1.2.7 for CVE-2026-111497. Go's bounds checks already kept op-node memory-safe, so it was not exposed. Malformed brotli channels are now rejected earlier, and derivation results are unchanged (#23689)
Full Changelog: op-node/v1.20.0...op-node/v1.20.1
🚢 Docker Image: