Bor v2.11.1-priv

Announcements
1

Hello everyone,

We have released bor v2.11.1-priv for the Polygon Amoy and mainnet networks. It includes important security and stability fixes on top of v2.11.0. Access to the source code will be provided once the corresponding stable release is deployed to mainnet.

Action required

All Amoy node operators should upgrade at their earliest convenience. The same binary serves both networks: we are rolling it out on Amoy first, and we will let mainnet operators know when to upgrade after the Amoy soak.

This release is not a hardfork and is not consensus-affecting. There is no activation block, no chain config or genesis change, no database schema change, and no resync. Nodes can be upgraded one at a time, in any order, and v2.11.0 and v2.11.1 nodes interoperate normally.

Release artifacts

Packages, raw binaries and container image archives are published for amd64 and arm64. Each set has a SHA256 manifest, and the manifest is GPG-signed with the Polygon private-release key.

  • Debian packages: bor-v2.11.1-priv-amd64.deb, bor-v2.11.1-priv-arm64.deb
  • Raw binaries: bor-v2.11.1-priv-amd64, bor-v2.11.1-priv-arm64
  • Container image tarballs: bor-v2.11.1-priv-amd64.tar.gz, bor-v2.11.1-priv-arm64.tar.gz

They are served from https://storage.googleapis.com/pos-mainnet-snapshots/bor-private/.

Install with the private-release installer (recommended)

The installer checks the GPG signature and the artifact checksum before installing anything.

1. First-time setup

First-time setup only: download the installer, the public key and the guide, and check the key fingerprint. Confirm the primary fingerprint 79E0B57D414727B48F3F9BA3759DA68F40672C2C through a separate, trusted Polygon source.

(
  set -euo pipefail
  for file in polygon-private-install.sh polygon-private-releases-public.asc README.md; do
    curl --proto '=https' --proto-redir '=https' --tlsv1.2 -fL \
      --retry 5 --retry-connrefused --retry-max-time 300 \
      --connect-timeout 30 --max-time 1800 \
      "https://storage.googleapis.com/pos-mainnet-snapshots/private-release-tools/${file}" \
      -o "./${file}"
  done
  KEY_DIR="$(mktemp -d)"
  trap 'rm -rf -- "$KEY_DIR"' EXIT
  PRIMARY="$(gpg --homedir "$KEY_DIR" --batch --with-colons \
    --show-keys ./polygon-private-releases-public.asc |
    awk -F: '$1 == "fpr" && !seen { print $10; seen=1 }')"
  test "$PRIMARY" = "79E0B57D414727B48F3F9BA3759DA68F40672C2C"
  echo "Polygon public key is correct"
)

Continue only when you see Polygon public key is correct. If you already have the installer from a previous release, download it again so you have the latest version.

2. Run the installer

Run one of the following, from the same directory, depending on how you run Bor. The installer detects amd64 / arm64 automatically.

Debian package:

bash ./polygon-private-install.sh bor v2.11.1-priv package

Raw binary (replaces /usr/bin/bor on an existing node):

bash ./polygon-private-install.sh bor v2.11.1-priv binary

Docker (loads the verified image; then update your container with your usual process):

bash ./polygon-private-install.sh bor v2.11.1-priv docker

Package and binary modes stop bor if it is running, install, check the version and start the service again. A service that was not running, such as a standby node, stays stopped. A successful upgrade of a running node ends with The bor service is active.

3. Check the version

/usr/bin/bor version
# Version: 2.11.1-private

The binary reports 2.11.1-private.

If you prefer to download and verify the files manually, follow the “Direct downloads” section of the README.md downloaded in step 1.

Configuration

No configuration change is required.

Behaviour changes

  • eth_simulateV1 calls that include blob hashes now return blob base fee unavailable, unless the call overrides the blob base fee. eth_call, eth_estimateGas and the tracers are unchanged.

This release also includes stateless sync and transaction processing improvements. It is built with the same Go 1.26.10 toolchain as v2.11.0.

Thank you for your cooperation.

Regards,
Polygon Labs