Skip to content

deps: Bump the nethermind group with 2 updates - #561

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/nethermind-3ccbe8d206
Closed

deps: Bump the nethermind group with 2 updates#561
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/nethermind-3ccbe8d206

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated Nethermind.Numerics.Int256 from 1.5.0 to 1.6.0.

Release notes

Sourced from Nethermind.Numerics.Int256's releases.

1.6.0

What's Changed

New Contributors

Full Changelog: NethermindEth/int256@v1.5.0...v1.6.0

Commits viewable in compare view.

Updated Nethermind.ReferenceAssemblies from 1.37.1 to 1.39.2.

Release notes

Sourced from Nethermind.ReferenceAssemblies's releases.

1.39.2

[!IMPORTANT]
Given the number of CVEs from Microsoft this release fixes it is mandatory for all node operators.

Release notes

This is a patch release on top of 1.39.1 that updates the .NET dependencies to Microsoft's July 2026 servicing release (10.0.10), which 17 CVE security fixes, and makes the eth_getLogs block-range limit explicit and configurable.

Overview

4 changes since 1.39.1:

  • .NET packages updated to 10.0.10 — Microsoft's July 2026 servicing update, which addresses several security vulnerabilities in .NET (#​12449)
  • Explicit, configurable eth_getLogs block-range limit — the Receipt.MaxBlockDepth option (default 10,000 blocks) is now documented and applied consistently, including when "useIndex": false is requested; requests exceeding the range are rejected with an "invalid params" (32602) error. Set to 0 to disable; ignored when the log index is enabled (#​12509)
  • Routine dependency bumps: Microsoft.IdentityModel.JsonWebTokens, System.CommandLine, Nethermind.Crypto.SecP256r1, and a RocksDB package rebuild (10.10.1.649 → 10.10.1.1747; same native RocksDB version) (#​12449, #​12491)

What's Changed

Full Changelog: NethermindEth/nethermind@1.39.1...1.39.2

Build signatures

The packages are signed with the following OpenPGP key: AD12 7976 5093 C675 9CD8 A400 24A7 7461 6F1E 617E

1.39.1

Release notes

This is a patch release on top of 1.39.0 with a round of bug fixes and reliability improvements across snap sync, networking, JSON-RPC, and the experimental Flat DB.

Overview

Full diff: NethermindEth/nethermind@1.39.0...1.39.1

8 changes since 1.39.0. Highlights:

  • Flat DB (experimental, opt-in) — fixed a disposal race between shutdown and in-flight trie-warmer jobs (#​12237)
  • eth_simulateV1 now bounds the total block expansion, not just each inter-block gap (#​12210)
  • Bad-block store is bounded by entry count as intended, instead of comparing against the DB byte size (#​12225)
  • Quieter logs — RLP limit diagnostics toned down (#​12130)

Highlights

Sync

  • Reject malformed snap range proofs instead of throwing (#​12187)
  • Verify the hash of trie nodes recovered via snap heal (#​12200)

Networking

  • Reject zero-size RLPx frames in ZeroFrameDecoder (#​12202)
  • Tone down RLP limit logging (#​12130)

JSON-RPC & Engine API

  • Bound eth_simulateV1 total block expansion, not just each gap (#​12210)
  • Side-effect-free invalid-chain query and atomic node get-or-create in the invalid-chain tracker (#​12208)

Storage & state

  • Bound BadBlockStore by entry count, not DB byte size (#​12225)
  • Flat DB (experimental, opt-in): lease the read-only bundle for in-flight trie-warmer jobs (#​12237, fixes #​12079)

What's Changed

... (truncated)

1.39.0

Release notes

This release focuses on node robustness, Flat DB durability — alongside the eth/71 wire protocol, a reworked discovery stack, a large JSON-RPC features-and-correctness batch, continued Block-level Access Lists (EIP-7928) maturation, and a broad round of EVM, precompile, and state performance work.

OP Karst reminder: the OP Karst hardfork (shipped in 1.38.1 and included here) activates on OP Mainnet: Wed, Jul 8, 2026 at 16:00:01 UTC. OP Stack operators must be on 1.38.1 or later before then.

Overview

Full diff: https://github.com/NethermindEth/nethermind/compare/1.38.1…1.39.0

337 changes since 1.38.1. Highlights include restart-safety fixes for header sync and pivot selection, a Flat DB durability overhaul, the eth/71 wire protocol, a rework of discv4 discovery, SSZ-REST transport for the Engine API, eight new JSON-RPC methods with a large correctness batch, EIP-7928 (BALs) devnet-7 support with major performance work, EraE fixes, and chain-specific improvements for XDC, Taiko, Optimism, and Arbitrum.

Highlights

Sync & restart safety

  • Recover header sync after a lost chain level on unclean shutdown (#​11994, fixes #​8029)
  • Unwedge UpdatingPivot for nodes restarted before the first pivot update (#​11995)
  • Flush all column families in ColumnsDb.Flush — makes column-DB writes (incl. Flat DB) durable across restarts (#​12223, fixes #​11993)
  • Refresh snap pivot instead of punishing the only peer (#​11569, fixes #​6803); support infinite pivot-update attempts via 1 (#​11600, fixes #​5992)
  • Fix shutdown race in SnapProvider (#​11807); accept receipts with zero bloom from peers (#​11743); prevent negative RequestSize crash when the beacon pivot advances mid-sync (#​11478)
  • New Sync.StaticSnapPivot option for fixed-pivot snap sync from a frozen peer (#​11943)

Flat DB (experimental, opt-in) durability & hardening

  • Crash-durable snap finalize with a cheap restart wipe (#​11997); preserve format markers when clearing the flat DB (#​11996)
  • Force-persist the head-reachable fork instead of an arbitrary one (#​11967); persistence cache (#​12035); prune orphaned non-canonical snapshots on persist (#​11739)
  • RLP-wrap storage slot values behind a versioned flag (#​11909) with legacy-DB detection (#​11975); improved state-backend compatibility and auto-detection (#​11911, #​11404)
  • Stagger compaction per instance (#​11756) with a CompactionOffset config to pin the schedule (#​11958)

Networking & discovery

  • eth/71 wire protocol (#​10844); eth/70 hardening (#​11456, #​11615, #​11754); eth/69 BlockRangeUpdate validation (#​11796)
  • discv4 rework (#​8616) and discovery now defaults to V4 (#​11614); faster discv4 timeout handling (#​11859)
  • Disconnect peers on unknown protocol message type (#​11266); reduced per-message and per-peer allocations across Eth, Snap, and RLPx (#​11639)

JSON-RPC

  • New methods: eth_getHeaderByHash/eth_getHeaderByNumber (#​11531), eth_getRawTransactionByBlockHashAndIndex/eth_getRawTransactionByBlockNumberAndIndex/eth_sendRawTransactionSync (#​11521), eth_signTransaction (#​11517), eth_baseFee (#​11522), debug_intermediateRoots (#​11524), eth_capabilities (#​11438), proof_call (#​11732), proof_getProofWithMeta (#​11498)
  • Streaming responses for debug_* and trace_* (#​11693, #​11755, #​11781) with a synchronous-wait fix (#​12006)
  • Correctness batch: eth_estimateGas zero/revert semantics (#​11780, #​11783), reject EIP-1898 blockHash+blockNumber (#​11777), reject oversized blob calls (#​11782), eth_simulateV1 fixes (#​11506, #​11665, #​11841), eth_createAccessList reverted-frame accesses (#​11431), omit non-spec error field from receipts (#​11454), zero hashes for absent eth_getProof accounts (#​11912)
  • Route eth_call through a shareable tx-processor pool (#​11548); drain in-flight requests before disposing databases on shutdown (#​11845)

Engine API

  • SSZ-REST transport (#​11301) with Accept-negotiation fix (#​11856) and capabilities-warning fix (#​12176)
  • Fix forkchoice validation order (#​11681); validate FCU safe/finalized by ancestry when main-chain markers are outdated (#​11746); guard against null safe/finalized hash (#​12110)
  • Bound dangling block-cache growth (#​11426); capture bad blocks at pre-process rejection stages (#​11696)
    ... (truncated)

1.38.1

Release notes

This is a patch release focused on Optimism / OP Stack support. It adds the OP Karst fork, refreshes the Superchain registry chains, and removes the bundled Base mainnet and sepolia configurations.

Sepolia: Wed, Jun 17, 2026 at 16:00:01 UTC
Mainnet: Wed, Jul 8, 2026 at 16:00:01 UTC

Overview

Full diff: NethermindEth/nethermind@1.38.0...1.38.1

5 changes since 1.38.0, all OP Stack–related. Highlights:

  • OP Karst fork added, with the precompile input-size caps and Engine API capability gating that go with it.
  • Superchain registry refresh across all bundled OP chains.
  • Base removed from the shipped chain configs and node profiles.

Highlights

Optimism

  • Add OP Karst fork (#​11917) — Karst timestamp plumbing across the OP forks, Osaka EIPs enabled, propagation of release spec and precompile input-size limits, and ForkInfo support. Includes a refactor that isolates all OP-specific fork flags and transition timestamps inside Nethermind.Optimism (mirroring the Taiko plugin pattern), so Core/Specs/Merge.Plugin/Evm.Precompiles no longer reference any OP fork flag. OP precompile caps now live in dedicated wrapper precompiles registered via OptimismPrecompileProvider, and Engine API V4 is gated behind OP Isthmus activation.
  • Update OP Superchain chains (#​11855, #​11733)

Chain configs

  • Update OP Superchain chains, removes Base (#​11655) — removes base-mainnet and base-sepolia (including archive configs, profiles, and logo) from the bundled chains, adds support for handling chains deleted from the Superchain registry, and removes arena-z and swell-mainnet.

⚠️ Breaking changes

  • Base is no longer bundled. The base-mainnet, base-sepolia, and their _archive configurations have been removed from the shipped chain configs. Operators running Base via Nethermind's built-in configs must supply their own chainspec/config.
  • arena-z and swell-mainnet chain configs were also removed as part of the Superchain registry sync.

What's Changed

Full Changelog: NethermindEth/nethermind@1.38.0...1.38.1

Build signatures

The packages are signed with the following OpenPGP key: AD12 7976 5093 C675 9CD8 A400 24A7 7461 6F1E 617E

1.38.0

Release notes

This release improves node robustness, restart safety, RPC compatibility, and runtime performance, especially for Flat DB users, RPC-heavy workloads, and chains relying on upcoming hardfork or EIP support.

Overview

Full diff: https://github.com/NethermindEth/nethermind/compare/1.37.2…release/1.38.0

372 changes since 1.37.2. Highlights include the Taiko Unzen hardfork, parallel transaction execution with Block-level Access Lists (EIP-7928), new EIPs (EIP-7981 access-list token floor pricing, EIP-7976 calldata floor cost, EIP-4444 EraE history expiry), Flat DB layout persistence, a large round of JSON-RPC correctness fixes, and EVM/state hot-path optimizations.

Highlights

Consensus & EIPs

  • Taiko Unzen hardfork implemented (#​11281)
  • Parallel transaction execution with BALs (#​9182), additional BAL hive tests (#​11285)
  • EIP-7981 — Access list token floor pricing (#​11311)
  • EIP-7976 — Increase calldata floor cost (#​11293)
  • EIP-4444 EraE support (#​10812)
  • Enforce EIP-3675 uncle ban at the spec level (#​11302)
  • Gnosis Osaka (#​10906)

State & storage

  • Persist FlatLayout and refuse mismatched restarts (#​11271)
  • Flat-state storage cleanup and snapshot fixes (#​11133, #​11401, #​11414)
  • Reduce dirty nodes lock contention (#​11297)
  • StateComposition plugin — real-time state metrics (#​10995)

Performance

  • Embed Address bytes inline to remove secondary allocation (#​11469)
  • Optimize EVM stack (#​11230) and EvmMemory (#​11247)
  • Optimise parallel execution: reduce worldstate / txprocessor allocations (#​11318)
  • More optimizations for precompile caching (#​11373, #​11309)

RPC & correctness

  • admin_* peer-management endpoints improvements (#​11489)
  • Numerous eth_simulateV1, eth_call, eth_estimateGas error-code and gas-cap fixes
  • txpool_content / txpool_contentFrom / txpool_status fixes (#​11305, #​11417)
  • /health endpoint ClUnavailable regression fix (#​11474)

Networking & sync

  • Upgrade discv5 (#​11419)
  • Lock-free sync allocation slots per peer (#​11361)
  • Remove NodeData satellite protocol (#​11359) and long-range catch-up sync (#​11123)

... (truncated)

1.37.2

Release notes

Release notes

Overview

This release fixes healthcheck and Archive Invalid Block issues on 1.37.1

What's Changed

Full Changelog: NethermindEth/nethermind@1.37.1...1.37.2

Build signatures

The packages are signed with the following OpenPGP key: AD12 7976 5093 C675 9CD8 A400 24A7 7461 6F1E 617E

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: Bump the nethermind group with 2 updates
bb55fd0 
Bumps Nethermind.Numerics.Int256 from 1.5.0 to 1.6.0
Bumps Nethermind.ReferenceAssemblies from 1.37.1 to 1.39.2

---
updated-dependencies:
- dependency-name: Nethermind.Numerics.Int256
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nethermind
- dependency-name: Nethermind.ReferenceAssemblies
  dependency-version: 1.39.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nethermind
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: nuget. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

socket-security Bot commented Aug 3, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednuget/​nethermind.referenceassemblies@​1.37.1 ⏵ 1.39.21001008810070
Updatednuget/​nethermind.numerics.int256@​1.5.0 ⏵ 1.6.010010090100100

View full report

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit bb55fd0.

@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 10, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/nethermind-3ccbe8d206 branch August 10, 2026 03:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants