Optimism Updates op-reth With Rust Advisories and Import Changes

Optimism’s op-reth v2.5.0 release updates two Rust dependencies and removes legacy history-import commands, requiring some node operators to change their setup before upgrading.

The release removes import-op and import-receipts-op, which were used to import pre-Bedrock OVM history. Before upgrading, operators who used either command need to bootstrap Bedrock state with op-reth init-state --without-ovm; an l2geth instance must provide the older history.

The update moves rustls to version 0.23.45 to address a TLS 1.3 handshake issue. Affected messages could be accepted across encryption-level boundaries, but the handshake remains authenticated; the issue does not allow an attacker to alter or complete it.

The release also updates imbl to version 7.0.2. The associated issue involves a double-free condition when an element’s destructor panics. The vulnerable package is imbl-sized-chunks, and the issue can also cause use-after-free. The affected component is used by the transaction pool.

The OP Stack is an open-source software stack used by OP Mainnet and other blockchains, including Base. The v2.5.0 changes affect node software and operator workflows.