This is a major release of celestia-core with several breaking changes, important security fixes, and performance improvements. It requires Go 1.26.1+.

Breaking Changes

  • PebbleDB is now the only supported database backend (https://github.com/celestiaorg/celestia-core/pull/2867). All other backends (GoLevelDB, CLevelDB, BoltDB, RocksDB, BadgerDB) have been removed. cometbft-db is
    bumped from v0.14.1 to v1.0.4 — PebbleDB no longer requires a build tag. Operators using any other backend must migrate to PebbleDB before upgrading.
  • Non-CAT mempool implementations removed (https://github.com/celestiaorg/celestia-core/pull/2803). The v0 (flood/CListMempool) and v1 (priority) mempool implementations are removed. The CAT mempool is now the only
    supported mempool type (besides nop). Since celestia-app v6 already forcibly overrode any non-CAT configuration, real-world impact is minimal.
  • Mempool type field removed from config.toml template (https://github.com/celestiaorg/celestia-core/pull/2811). Newly generated configs will no longer contain the mempool type field. Existing config files are unaffected — the field still parses without error.
  • Node halts on consensus failures (https://github.com/celestiaorg/celestia-core/pull/2547). Nodes now panic on consensus failures rather than continuing in a potentially inconsistent state.

Security Fixes

  • BlobTx crash replay determinism (https://github.com/celestiaorg/celestia-core/pull/2846). ExecCommitBlock now strips BlobTx wrappers to match applyBlock behavior, fixing a crash recovery replay issue where
    different transaction bytes were sent to FinalizeBlock during replay vs normal execution. (CELESTIA-215, via HackenProof)
  • CompactBlock proof cache poisoning (https://github.com/celestiaorg/celestia-core/pull/2847). CompactBlock.Proofs() now validates Merkle root hashes before committing to the cache, preventing invalid proofs from
    being served on subsequent calls. (CELESTIA-216, via HackenProof)
  • LCA evidence PubKey-Address binding (https://github.com/celestiaorg/celestia-core/pull/2848). validateABCIEvidence now verifies that PubKey.Address() matches the Address field, preventing LightClientAttackEvidence with swapped PubKeys from redirecting slash attribution to innocent validators. (CELESTIA-220, via HackenProof)
  • Socket client DoS via QuerySequence (https://github.com/celestiaorg/celestia-core/pull/2844). Added missing QuerySequence case to resMatchesReq in the socket ABCI client, which previously caused the client to treat a valid response as unexpected and terminate the node. (via HackenProof)
  • P2P receive buffer memory pinning (https://github.com/celestiaorg/celestia-core/pull/2815). Fixed a memory pinning issue where large P2P receive buffers (~128 MiB per connection on the BLOCKSYNC channel) were
    retained for the entire connection lifetime, potentially pinning ~5 GiB of heap with 40 inbound peers.
  • State sync peer poisoning (https://github.com/celestiaorg/celestia-core/pull/2814). Peers rejected by the ABCI application during state sync are now disconnected at the P2P layer, preventing malicious peers from continuously sending poisoned ChunkResponse messages in an infinite retry loop.
  • Propagation reactor liveness (https://github.com/celestiaorg/celestia-core/pull/2813). Added a default case to handleHaves select to prevent the reactor's message-processing goroutine from blocking indefinitely
    when a per-peer channel is full. (CELESTIA-185)
  • Unbounded Txs message validation (unreleased changelog entry). Peers that send a Txs message with more than one transaction, empty transactions, or an entirely empty array are now disconnected, preventing unbounded CPU and memory growth from malicious batched messages.

Bug Fixes

Improvements

What's Changed

Full Changelog: https://github.com/celestiaorg/celestia-core/compare/0.39.25...v0.40.0