github ethersphere/bee v2.8.3
on GitHub

2 hours ago

Bee v2.8.3 is a stability and operator release. It includes a security fix, so upgrade promptly. There are no P2P protocol changes and no manual migration; any node on v2.8.0 or later can upgrade independently.

📖 Release announcement · 💬 Discord #node-operators

Action required

If you… Then…
run any node Upgrade. The first start runs a one-time reserve migration that verifies chunks recorded as non-content-addressed and removes invalid ones; it logs the count. (#5634)
upload with Swarm-Act on POST /chunks or POST /soc Switch to /bytes or /bzz. ACT headers on these two endpoints are now ignored and a plain reference is returned. (#5572)
generate clients from the OpenAPI spec Regenerate. The spec version is now 8.2.1 (was 8.1.1). (#5614, #5654)
have dashboards or alerts on libp2p connection metrics Update queries. bee_libp2p_created_connection_count and bee_libp2p_handled_connection_count are now labeled by transport and public; bee_libp2p_public_address_connections_total and bee_libp2p_private_address_connections_total are removed. Wrap in sum(...); do not use count(...) as a per-node denominator. (#5565)
alert on log text Update patterns. stream handler: handshake: handle failed is now warning, not error. The "swarmageddon" error text is now erasure coded content not found. (#5604, #5606)
override gas-limit-fallback Review it. The default is now 900,000 (was 500,000) and commit/reveal/claim use a floor of 800,000 after Glamsterdam gas changes. (#5655)
use an RPC provider that limits eth_getLogs ranges (Nethermind 2.0) Nothing. Postage sync now pages 1,000 blocks by default. Raise postage-sync-block-range if your provider allows it; catching up from far behind makes more calls. (#5627)

Breaking changes

  • ACT removed from POST /chunks and POST /soc. Swarm-Act and Swarm-Act-History-Address are no longer handled and the Swarm-Act-History-Address response header is gone. ACT never worked correctly on these endpoints. Existing ACT references still resolve through /bytes and /bzz. (#5572)
  • OpenAPI 8.2.1. Adds PATCH /redistributionstate, minimumDeposit on GET /stake, a 400 body on POST /stake/{amount}, GSOC subscription parameters; removes the ACT parameters above. (#5614, #5654)
  • libp2p connection metrics changed from counters to labeled counter vectors; two metrics removed. See the table above. (#5565)

Security

  • File metadata from untrusted chunks. Span-derived size and shard arithmetic in the joiner and the decryption path is now bounds-checked and overflow-safe; malformed tries are rejected. (#5664)
  • Stamp issuer store. Declared lengths are validated before msgpack decoding; fuzzing found inputs that triggered multi-gigabyte allocations. (#5663)
  • Single-owner chunks from peers. Pushsync, pullsync and the reserve now verify that a SOC address matches its owner and identifier before storing it. (#5640)
  • Broken cheque records. A stored cheque with no cumulative payout is rejected instead of crashing settlements or resetting the next cheque to zero. (#5656)
  • Per-peer pullsync stream limit. Max 128 pullsync and 4 cursors streams per peer; a peer over the limit is disconnected and counted in bee_pullsync_stream_limit_exceeded. (#5658)

Added

  • Pause redistribution without restart. PATCH /redistributionstate with {"enabled": false} skips new rounds; sampling continues, an already committed round still reveals and claims. GET /redistributionstate and the bee_storageincentives_redistribution_enabled gauge expose the state. Not persisted across restarts. (#5580)
  • GSOC field selection. GET /gsoc/subscribe/{address} accepts swarm-soc-fields (header or query) to choose which SOC fields each message carries; default is still payload. swarm-cache-wrapped-chunk caches the wrapped chunk so it resolves through /bytes. Backlog per subscription is capped at 256 messages, oldest dropped. (#5614)
  • Staking pre-checks. Deposits are validated against the contract rules before sending. Too-small deposits return 400 with minimumDeposit; GET /stake reports minimumDeposit. (#5571, #5654)
  • postage-sync-block-range option (BEE_POSTAGE_SYNC_BLOCK_RANGE), default 1000. (#5627)
  • Metrics. bee_api_* metrics restored (#5583); transport and public/private labels on connection counters (#5565); hive gossip_coalesce_* and kademlia announce_* series (#5520).

Fixed

  • Uploads stalled permanently on one invalid chunk, including across restarts. The chunk is now dropped and push-sync continues. (#5647)
  • Postage listener hammered the RPC endpoint after a failed call while paging history; backoff now applies. (#5586)
  • Neighborhood rebroadcast sent wrong peer lists to all but the first neighbor. (#5595)
  • Crash on Linux x86-64 with --use-simd-hashing under heavy hashing load (stack alignment in keccak assembly). (#5636)
  • Range reads with Swarm-Lookahead-Buffer-Size: 0 could return incomplete data. (#5619)
  • GSOC subscriptions could miss the first update delivered right after the WebSocket upgrade. (#5639)
  • PUT /stewardship did not restore dispersed replicas of the root chunk at non-zero redundancy levels. (#5594)
  • AutoTLS: registration against load-balanced endpoints, health-gated first issuance, renewal of certificates that expired while offline, bounded broker HTTP timeout. (#5605)
  • Addressbook remove now takes the lock. (#5573)
  • Protobuf reader/writer checks context cancellation before I/O. (#5591)

Changed

  • Reserve sampling reuses buffers, loads payloads only for sample candidates and filters excluded batches early; sampling memory more than halved in testing, sample output unchanged. (#5612, #5634)
  • Sync convergence: pullsync offers are sent after 250 ms instead of 1 s, historical rate window is 10 min instead of 15. (#5630)
  • Hive gossip coalesces single-peer broadcasts per addressee and flushes them in batches. (#5520)
  • Postage snapshot uses batch-archive's slim encoding (only the log fields Bee reads) and is refreshed to v0.1.3. (#5587, #5665)
  • Gas estimation replaces hardcoded limits for chequebook deployment and redistribution transactions. (#5655)

Dependencies

go-libp2p 0.49.0, p2p-forge 0.10.1, certmagic 0.25.3, google.golang.org/grpc 1.83.2, OpenTelemetry 1.45.0, prometheus/client_golang 1.24.1, batch-archive 0.1.3. (#5605, #5590, #5603, #5620, #5621, #5665)

Internal

Fuzz targets across the codebase and fuzzing guidelines in CODING.md (#5602, #5638); CI moved off self-hosted runners, docs-only PRs satisfy required checks, swarm-cli bump on tag push, test merge race fixed (#5582, #5643, #5607, #5635, #5567).

What's Changed

Full Changelog: v2.8.2...v2.8.3

Check out latest releases or
releases around ethersphere/bee v2.8.3

Don't miss a new bee release

NewReleases is sending notifications on new releases.

Get notifications