Overview
Important
This is a recommended release for all operators. It updates dependencies, the Go toolchain and the image's base packages to fix vulnerabilities that image scanners can report against v1.17.0, including CVE-2026-116591 and CVE-2026-84243. None of the vulnerable code is reachable in op-proposer, and there are no other operator-visible changes.
Other changes
Security
github.com/klauspost/compressis updated to v1.20.2, fixing CVE-2026-116591 (GHSA-fpmh-frq8-7rj8), a panic in the zstd decoder on two-block frames. op-proposer uses this decoder only to unpack go-ethereum's compiled-in superchain configs, so no external input reaches it (#23965)- The image ships Wolfi's
glibc-2.44andlibcrypt1-2.442.44-r18, which fix CVE-2026-84243 inlibcrypt1(fixed in2.44-r16) - op-proposer is built with Go 1.26.11, whose security fixes include CVE-2026-97054 in
net/http. op-proposer serves no HTTP handler wrapped inMaxBytesReaderorMaxBytesHandler, so it was not exposed. The other fixes are build-time cgo issues github.com/andybalholm/brotliis updated to v1.2.7, picking up the Go port of the fix for CVE-2026-111497. Go's bounds checks already made the old code memory-safe, and op-proposer never decodes brotli data (#23689)
Full Changelog: op-proposer/v1.17.0...op-proposer/v1.17.1
🚢 Docker Image: