chore(deps): update obolnetwork/charon docker tag to v1.11.0

[renovate]

This PR contains the following updates:

Package	Update	Change
obolnetwork/charon	minor	1.10.0 → 1.11.0
obolnetwork/charon	minor	v1.10.0 → v1.11.0

---

Release Notes

obolnetwork/charon (obolnetwork/charon)

v1.11.0

Compare Source

v1.11.0 - 2026-08-25

This is Charon's v1.11.0 release. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

This release focuses on hardening and stability across consensus, DKG and networking. The release includes one wire-format change - a new per-subcommittee sync committee contribution format is negotiated automatically between nodes, only activating once a threshold of cluster peers advertise v1.11 or newer and otherwise falling back to the previous format. As always, we recommend upgrading all nodes in a cluster in close succession.

Read the rest of the release notes for more:

Full Changelog: v1.10.3..v1.11.0

Hardening and stability

This release is a substantial hardening and stability release. It bundles a large batch of QBFT consensus correctness fixes (rejecting zero-value and equivocating-leader messages, preserving local values on comparison failure), DKG and cluster definition/lock validation hardening, more robust partial signature exchange and p2p stream handling, a per-subcommittee sync committee contribution fix, and a fix for a potential code-injection vector in CI. See the Bug and Refactor sections below for the full list.

NAT hole punching improvements

Charon now uses libp2p's native EnableHolePunching() to establish direct connections between NAT'd peers, replacing the previous ForceDirectConnections approach that only succeeded when both peers happened to dial at the same moment. This should improve peer connectivity for operators behind NATs without requiring manual port forwarding.

Feature

• Add support for cluster-definition v1.11 format #​4265 (#​4291)
• Check fee recipient against local node configuration (#​4474)
• Surface remote cluster state in the list command (#​4497)
• Adopt beacon node v2 API endpoints (#​4504)
• Add p2p message send duration histogram metric (#​4506)
• Add metric tracking insufficient round-change messages #​4478 (#​4512)
• Improve NAT hole punching for peer connectivity #​4233 (#​4516)
• Adopt versioned proposer duties v2 endpoints (#​4564)
• Add metric for sync committee message cohorts (#​4587)
• Opt-in loading of incomplete validator_keys store (#​4591)
• Add dv_client field to the peerinfo protocol (#​4632)

Bug

• Fix CI, release workflow, and nightly test issues (#​4451,#​4452,#​4513,#​4588)
• Fix pointer mutation bug in app/eth2wrap (#​4486)
• Improve fee recipient handling and defaults (#​4490)
• Fix SSE event proxying to validator clients (#​4495)
• Harden DKG and cluster definition/lock validation (#​4514,#​4590,#​4634,#​4635,#​4636,#​4638)
• Fix various charon CLI command behaviours (#​4523,#​4559,#​4577,#​4579)
• Fix deposit data fetching from the beacon API (#​4526)
• Add SSZ offset validation when decoding (#​4529)
• Fix non-deterministic QBFT linear round timer (#​4537)
• Fix voluntary exit signature aggregation (#​4542)
• Key DutyDB by committee index for aggregation #​4006 (#​4544)
• Rework duty deadliner scheduling logic (#​4552)
• Fix metrics cardinality and proxy path labels (#​4553,#​4581)
• Fix early duty fetch on head event (#​4561)
• Allow parsing of incomplete validator_keys store (#​4576)
• Fix potential code injection in CI workflow (#​4598)
• Harden partial signature exchange against malformed data (#​4599)
• Fix sync committee contribution and selection handling (#​4602,#​4610,#​4615,#​4641)
• Fix core/priority protocol sorting and duty gating (#​4611,#​4643)
• Fix QBFT consensus correctness and equivocation handling (#​4619,#​4622,#​4623,#​4624,#​4628)
• Fix p2p stream closing and relay query responses (#​4626,#​4629,#​4642)
• Fix slog handler panic on named types (#​4640)

Refactor

• Remove deprecated holesky testnet support (#​4485)
• Refactor consensus and QBFT message handling (#​4505,#​4557)
• Harden fee recipient signing and fetching paths (#​4571)
• Improve DKG reshare and ceremony robustness (#​4574,#​4616,#​4650)
• Correct typo in p2p error message (#​4578)
• Add leading slash to priority protocol ID (#​4605)
• Remove noisy QUIC happy-path debug logs (#​4645)

Docs

• Refresh stale CLAUDE.md and README.md docs (#​4573)
• Refresh architecture and package structure documentation (#​4580)
• Auto-fetch latest client versions for release notes (#​4597)

Test

• Fix Kurtosis alerts fetching scripts (#​4450,#​4458)
• Fix multiple flaky tests across packages (#​4509,#​4545,#​4547,#​4606,#​4627)

Misc

• Improve CI, Renovate, and release tooling (#​4463,#​4492,#​4596)
• Bump libp2p, golangci-lint, and Debian base image (#​4475,#​4568,#​4575,#​4584)
• Bump version through v1.11 dev, rc, and stable (#​4494,#​4589,#​4664)
• Adjust Kurtosis and CI test infrastructure (#​4508,#​4511,#​4539,#​4540,#​4583)
• Strengthen cluster lock and deposit validation (#​4541,#​4620)
• Clean up error messages and QUIC false-error logs (#​4582,#​4585)
• Remove legacy un-versioned attestation support (#​4621)
• Set 1MB limit on peerinfo protocol messages (#​4625)

Compatibility Matrix

❗ An issue between Lodestar BN and Lighthouse, Nimbus and Prysm VCs has been discovered. It has surfaced with testing latest versions of the above mentioned clients, however, it is applicable for multiple older Lodestar CL versions. Those duty failures are not related to Charon v1.11.0. If node operators are using any of those 3 combinations and are experiencing issues, we strongly recommend switching to different VC or BN until patches are released. We will keep this section of the release notes up to date with latest updates.

This release of Charon is backwards compatible with Charon >= v1.0, though only v1.7 and newer are Fulu-ready.

The below matrix details a combination of beacon node (consensus layer) + validator clients and their corresponding versions the DV Labs team have tested with this Charon release. More validator and consensus clients will be added to this list as they are supported in our automated testing framework.

Legend

• ✅: All duties succeed in testing
• 🟡: All duties succeed in testing, except non-penalised aggregation duties
• 🟠: Duties may fail for this combination
• 🔴: One or more duties fail consistently

Validator 👉 Consensus 👇	Teku v26.8.0	Lighthouse v8.2.2	Lodestar v1.46.0	Nimbus v26.7.0	Prysm v7.1.8	Vouch v1.13.0 ❗
Teku v26.8.0 ❗	✅	✅	✅	✅	✅	🟡
Lighthouse v8.2.2	✅	✅	✅	✅	✅	🟡
Lodestar v1.46.0	✅	🟠	✅	🟠	🟠	🟡
Nimbus v26.7.0	✅	✅	✅	✅	✅	🟡
Prysm v7.1.8	✅	✅	✅	✅	✅	🟡
Grandine v2.0.6	✅	✅	✅	✅	✅	🟡

What's Changed

• *: add cluster definition v1.11 (#​4291)
• scripts: fixed alerts fetching (#​4450)
• testutil/integration: fix nightly test (#​4451)
• *: downgrade action-gh-release to v2.5.0 (#​4452)
• *: kurtosis report link (#​4457)
• scripts: fixed kurtosis alerts script (#​4458)
• fix: enforce semantic commits in renovate config (#​4463)
• testutil: fixing nightly tests (#​4464)
• *: check fee recipient on local (#​4474)
• *: bumped debian base (#​4475)
• *: removed holesky (#​4485)
• app/eth2wrap: fix mutation of pointer (#​4486)
• app: improved feerecipient behavior (#​4490)
• *: release actions improvements (#​4492)
• app: bump version to v1.11-dev (#​4494)
• core/validatorapi: fix SSE proxying (#​4495)
• cmd: surface remote state in list (#​4497)
• *: bn version v2 (#​4504)
• core/consensus: skip redundant proposal hash (#​4505)
• *: add p2p send duration metric (#​4506)
• *: improve slack notification on Kurtosis (#​4508)
• *: fix flaky monitoringapi test (#​4509)
• *: remove aws size selector (#​4511)
• *: insufficient round change metric (#​4512)
• *: fix test commands racing (#​4513)
• *: fix lock share binding validation (#​4514)
• *: improve NAT hole punching (#​4516)
• scripts: reworked alerts script (#​4521)
• cmd: redact header flag values in config log (#​4523)
• *: fix deposit fetch (#​4526)
• core: ssz offset validation (#​4529)
• core: fixed linear timer (#​4537)
• *: longer kurtosis test window (#​4539)
• *: revert - longer kurtosis test window (#​4540)
• *: strenghten checks for fetching deposits from API (#​4541)
• *: fix exit sig agg (#​4542)
• core/*: use comm idx as key in DutyDB for agg duty (#​4544)
• *: fix flaky test (#​4545)
• testutil/relay: fix relays flaky test (#​4547)
• *: rework deadliner (#​4552)
• core/validatorapi: fix dynamic path proxy metric (#​4553)
• core: qbft improvements (#​4557)
• cmd: fix external def file in create cluster (#​4559)
• *: early fetch on head (#​4561)
• core/validatorapi: proposer duties v2 (#​4564)
• *: bump libp2p (#​4568)
• *: harden feerecipient sign and fetch (#​4571)
• *: fix pre-commit lint tooling (#​4572)
• *: fix stale project docs (#​4573)
• *: fix remove-operators threshold default and harden reshare (#​4574)
• *: bump golangci-lint to v2.12.2 (#​4575)
• *: allow incomplete validator_keys store when parsing (#​4576)
• cmd: improve split keys behavior (#​4577)
• p2p: fix typo in error msg (#​4578)
• *: fix invalid flag names in user-facing messages (#​4579)
• docs: refresh stale architecture and structure docs (#​4580)
• *: fix metrics high cardinality risks (#​4581)
• *: fix grammar and clarity of error messages (#​4582)
• *: stop kurtosis smoke tests (#​4583)
• *: dependabot update specific indirects (#​4584)
• *: fix QUIC false error (#​4585)
• *: add metric with sync message cohorts (#​4587)
• *: fix actions release for double digit minors (#​4588)
• app/version: bump minor version to v1.11-rc (#​4589)
• *: fix DKG exchanger deadlock (#​4590)
• *: opt in for incomplete validator_keys (#​4591)
• *: rotate PAT (#​4596)
• *: fetch latest versions release notes (#​4597)
• *: fix potential code injection (#​4598)
• *: harden partial signature exchange (#​4599)
• *: sync contributions per subcommittee (#​4602)
• core/priority: add leading slash to protocol ID (#​4605)
• p2p: fix flaky TestWithReceiveTimeout on QUIC (#​4606)
• core/deadline: increase sync message deadline (#​4610)
• core/priority: use stable sort for scored priorities (#​4611)
• *: optimise sync contribution fetching (#​4615)
• dkg: fail fast on peer restart or death during ceremonies (#​4616)
• core/qbft: reject zero-value PRE-PREPARE from leader (#​4619)
• cluster/*: reject lock with val count mismatch (#​4620)
• *: remove legacy un-versioned attestations (#​4621)
• core/consensus: fix qbft optimistic first qcommit (#​4622)
• core/consensus: fix proposer short second round (#​4623)
• core/qbft: prevent double PREPARE on equivocating leader (#​4624)
• app/peerinfo: set 1MB limit to the peer info messages (#​4625)
• *: close streams on all SendReceive and Send paths (#​4626)
• dkg: fix flaky peer death test (#​4627)
• core/qbft: preserve local value on comparison failure (#​4628)
• *: fix libp2p logger routing (#​4629)
• ci: fix sonarcloud supply-chain vulnerabilities (#​4631)
• app/peerinfo: add dv_client field to peerinfo protocol (#​4632)
• dkg: validate cluster definition threshold (#​4634)
• cluster: dedup definition peers by peer ID (#​4635)
• cluster: fix dead deposit amounts validation in unmarshalers (#​4636)
• dkg/bcast: bind broadcast signatures to cluster session (#​4638)
• app/log: fix slog handler panic on named types (#​4640)
• core/validatorapi: preserve sync selections response order (#​4641)
• p2p: bound relay address query responses (#​4642)
• core/priority: gate duties received from peers (#​4643)
• p2p: remove noisy QUIC happy-path debug logs (#​4645)
• dkg: improved reshare logging (#​4650)
• app/version: bump v1.11 to stable (#​4664)

v1.10.3

Compare Source

v1.10.3 - 2026-06-24

This is recommended patch release of Charon v1.10.3. This patch fixes proposer duties fetching in Lighthouse VC v8.2.0 and improves fetch_att_on_block feature flag. It also includes couple of dependency bumps. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

Read the rest of the release notes for more:

Full Changelog: v1.10.2..v1.10.3

Compatibility Matrix

This release of Charon is backwards compatible with Charon >= v1.0., though only v1.7. and newer are Fulu-ready.

The below matrix details a combination of beacon node (consensus layer) + validator clients and their corresponding versions the DV Labs team have tested with this Charon release. More validator and consensus client will be added to this list as they are supported in our automated testing framework.

Legend

• ✅: All duties succeed in testing
• 🟡: All duties succeed in testing, except non-penalised aggregation duties
• 🟠: Duties may fail for this combination
• 🔴: One or more duties fails consistently

Validator 👉 Consensus 👇	Teku v26.4.0	Lighthouse v8.1.3	Lodestar v1.42.0	Nimbus v26.3.1	Prysm v7.1.3	Vouch v1.12.1 ❗
Teku v26.4.0 ❗	✅	✅	✅	✅	✅	🟡
Lighthouse v8.1.3	✅	✅	✅	✅	✅	🟡
Lodestar v1.42.0	✅	✅	✅	✅	✅	🟡
Nimbus v26.3.1	✅	✅	✅	✅	✅	🟡
Prysm v7.1.3	✅	✅	✅	✅	✅	🟡
Grandine v2.0.4	✅	✅	✅	✅	✅	🟡

What's Changed

• app: bump patch version to v1.10-rc (#​4565)

• *: v1.10.3-rc1 (#​4567)

• app/version: bump v1.10 to stable (#​4569)

v1.10.2

Compare Source

v1.10.2 - 2026-06-10

This is highly recommended patch release of Charon v1.10.2. This patch has numerous security and performance fixes. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

Read the rest of the release notes for more:

Full Changelog: v1.10.1..v1.10.2

Bugfix

• Fix memory leak of prometheus metrics, growing cardinality uncontrollably #​4553
• Do not store expired duties in ParSigDB; rework deadliner #​4552
• Fix key in the KV in-memory storage of aggregation duties in DutyDB #​4544
• Fix charon exit fetch signature aggregation #​4542

Compatibility Matrix

This release of Charon is backwards compatible with Charon >= v1.0., though only v1.7. and newer are Fulu-ready.

The below matrix details a combination of beacon node (consensus layer) + validator clients and their corresponding versions the DV Labs team have tested with this Charon release. More validator and consensus client will be added to this list as they are supported in our automated testing framework.

Legend

• ✅: All duties succeed in testing
• 🟡: All duties succeed in testing, except non-penalised aggregation duties
• 🟠: Duties may fail for this combination
• 🔴: One or more duties fails consistently

Validator 👉 Consensus 👇	Teku v26.4.0	Lighthouse v8.1.3	Lodestar v1.42.0	Nimbus v26.3.1	Prysm v7.1.3	Vouch v1.12.1 ❗
Teku v26.4.0 ❗	✅	✅	✅	✅	✅	🟡
Lighthouse v8.1.3	✅	✅	✅	✅	✅	🟡
Lodestar v1.42.0	✅	✅	✅	✅	✅	🟡
Nimbus v26.3.1	✅	✅	✅	✅	✅	🟡
Prysm v7.1.3	✅	✅	✅	✅	✅	🟡
Grandine v2.0.4	✅	✅	✅	✅	✅	🟡

What's Changed

• app: bump patch version to v1.10-rc (#​4548)

• *: v1.10.2-rc1 (#​4549)

• *: cherry-picks for v1.10.2-rc2 (#​4555)

• app/version: bump v1.10 to stable (#​4556)

v1.10.1

Compare Source

v1.10.1 - 2026-05-20

This is highly recommended patch release of Charon v1.10.1. This patch fixes an issue with Charon node panic-ing on unknown payload from another Charon node. There is also a fix of deposit fetch command that failed to verify signature in certain cases. Feedback is welcome and appreciated, please use github issues or discord if you have trouble with this release.

Read the rest of the release notes for more:

Full Changelog: v1.10.0..v1.10.1

Bugfix

• Fix panic on unknown unsigned data #​4529
• Fix deposit fetch #​4526

Compatibility Matrix

This release of Charon is backwards compatible with Charon >= v1.0., though only v1.7. and newer are Fulu-ready.

The below matrix details a combination of beacon node (consensus layer) + validator clients and their corresponding versions the DV Labs team have tested with this Charon release. More validator and consensus client will be added to this list as they are supported in our automated testing framework.

Legend

• ✅: All duties succeed in testing
• 🟡: All duties succeed in testing, except non-penalised aggregation duties
• 🟠: Duties may fail for this combination
• 🔴: One or more duties fails consistently

Validator 👉 Consensus 👇	Teku v26.4.0	Lighthouse v8.1.3	Lodestar v1.42.0	Nimbus v26.3.1	Prysm v7.1.3	Vouch v1.12.1 ❗
Teku v26.4.0 ❗	✅	✅	✅	✅	✅	🟡
Lighthouse v8.1.3	✅	✅	✅	✅	✅	🟡
Lodestar v1.42.0	✅	✅	✅	✅	✅	🟡
Nimbus v26.3.1	✅	✅	✅	✅	✅	🟡
Prysm v7.1.3	✅	✅	✅	✅	✅	🟡
Grandine v2.0.4	✅	✅	✅	✅	✅	🟡

What's Changed

• Cherry-pick #​4526 PR (#​4532)

• core: ssz offset validation (#​4529) (#​4530)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Every minute (* * * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.