morph-l2/morph-reth v1.4.1 on GitHub

Summary

morph-reth v1.4.1 is a hotfix release and a recommended upgrade for all nodes. It pins reth to a Morph-maintained tag that carries the upstream fix for an incremental state-root bug in reth's trie iterator, and moves several dependencies to patched releases for RustSec advisories. It is a drop-in replacement for v1.4.0, with no consensus-rule, database, configuration or CLI changes.

Highlights

Trie seek-boundary fix (#228) — reth v1.3.5 through v2.9.0 can compute an incorrect incremental state root in the serial StateRoot (paradigmxyz/reth#28264). morph-reth uses that path in the engine's serial state-root fallback, the payload builder, the pre-Jade state-root job and morph-proofs. Upstream first ships the fix in reth v2.10.0, but moving there from v2.5.2 also means taking on the revm → evm2 switch, so instead of upgrading, the reth crates now come from the morph-l2/reth tag v2.5.2-morph.1: upstream v2.5.2 plus a cherry-pick of that single fix, with no Morph logic. All reth crates stay at 2.5.2, and a regression test in morph-proofs pins the fix.

Other Changes

Dependencies moved to patched releases for RustSec advisories, lockfile only: tokio 1.53.3, rustls-webpki 0.103.16, webpki-roots and webpki-root-certs 1.0.11, zstd 0.13.4, zstd-safe 7.4.0, zstd-sys 2.1.2 and libz-sys 1.1.31. RUSTSEC-2026-0387 (crypto-bigint 0.5) and RUSTSEC-2026-0441 (pin-utils) have no compatible fix yet and are acknowledged in deny.toml (#228).
E2E CI job timeout raised from 15 to 30 minutes (#228).

Breaking Changes & Upgrade Notes

No breaking changes. v1.4.1 uses the same database format, CLI flags, RPC and chain configuration as v1.4.0. No migration or resync is needed: a rolling restart is enough, and rolling back means swapping the binary.
Upgrade every node, followers included.
No cross-client coordination: no consensus rule changes, so morph-geth nodes need no matching release.
Building from source: reth is now fetched from https://github.com/morph-l2/reth (tag v2.5.2-morph.1) instead of paradigmxyz/reth. Update any git-source allowlist or vendored dependency mirror accordingly. This is a temporary pin until the next reth upgrade moves back to an upstream tag.

All Changes

fix(deps): pin reth to morph-l2/reth v2.5.2-morph.1 for the trie seek-boundary fix (#228)

Binaries

System	Architecture	Binary
	x86_64	morph-reth-1.4.1-x86_64-linux.tar.gz
	aarch64	morph-reth-1.4.1-aarch64-linux.tar.gz
	Docker	ghcr.io/morph-l2/morph-reth:v1.4.1