> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cosmos.network/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Release history and changelog for Cosmos COMETBFT

<Info>
  This page tracks releases and changes for v0.40.0. For the full release history, see the [CHANGELOG](https://github.com/cometbft/cometbft/blob/main/CHANGELOG.md) on GitHub.
</Info>

<Update label="July 27, 2026" description="v0.40.0" tags={["COMETBFT", "Release"]}>
  ## BUG FIXES

  * `[blocksync]` tolerate late BlockResponse from honest peers after switching to consensus
    ([#5959](https://github.com/cometbft/cometbft/pull/5959))
  * `[mempool]` include proto framing overhead in AppReactor batch size to prevent peer teardown
    ([#5956](https://github.com/cometbft/cometbft/pull/5956))
  * `[blocksync]` document `adaptive_sync` equivocation risk for validator nodes
    ([#5953](https://github.com/cometbft/cometbft/pull/5953))
  * `[abci]` fix socket transport missing `InsertTx` and `ReapTxs` cases in
    `handleRequest` and `resMatchesReq`, causing `ErrUnexpectedResponse` and
    node self-kill when `mempool.type = "app"` with the default socket transport
    ([#5958](https://github.com/cometbft/cometbft/pull/5958))
  * `[flowrate]` fix flaky `TestWriter` by comparing `Idle` with a duration
    tolerance instead of exact equality
    ([#5929](https://github.com/cometbft/cometbft/pull/5929))
  * `[rpc]` escape the request `Host` in the endpoints listing page so it cannot
    break out of the generated HTML
    ([#5921](https://github.com/cometbft/cometbft/pull/5921))
  * `[consensus]` Fix `double_sign_check_height = 1` performing no double-sign
    checks due to off-by-one error in loop condition (`i < N` should be
    `i <= N`). The value `1` now correctly checks the previous block as intended.
    ([#5668](https://github.com/cometbft/cometbft/pull/5668))
  * `[rpc/jsonrpc]` reject non-finite, fractional, and out-of-int64-range
    numeric IDs in request decoding instead of silently saturating to
    `math.MinInt`, which previously made distinct large IDs collide.
    ([#5861](https://github.com/cometbft/cometbft/pull/5861))
  * `[consensus]` a proposer now self-verifies its own vote extension before
    broadcasting its precommit, so an application whose `ExtendVote` and
    `VerifyVoteExtension` handlers are inconsistent halts the node with a clear
    `CONSENSUS FAILURE` instead of stalling the whole network
    ([#5204](https://github.com/cometbft/cometbft/issues/5204))
  * `[blocksync]` fix deadlock in `AddBlock` caused by holding `pool.mtx` during
    `sendError`
    ([#5931](https://github.com/cometbft/cometbft/pull/5931))
  * `[blocksync]` hold `pool.mtx` and recompute `maxPeerHeight` in `Enable()`
    ([#5888](https://github.com/cometbft/cometbft/pull/5888))
  * `[inspect]` fix flaky `TestInspectRun` and consolidate start/stop handshake
    ([#5891](https://github.com/cometbft/cometbft/pull/5891))
  * `[p2p]` fix flaky switch tests by replacing fixed sleeps with deterministic peer-wait polling
    ([#5918](https://github.com/cometbft/cometbft/pull/5918))
  * `[p2p]` fix race and goroutine leak in `TestTransportMultiplexAcceptNonBlocking` test
    ([#5878](https://github.com/cometbft/cometbft/pull/5878))
  * `[evidence]` fix flaky `TestReactorsGossipNoCommittedEvidence` test
    ([#5870](https://github.com/cometbft/cometbft/pull/5870))
  * `[blocksync]` fix flaky `TestBlockPoolBasic` deadlock under `-race`
    ([#5867](https://github.com/cometbft/cometbft/pull/5867))
  * `[blocksync]` fix removeTimedoutPeers deadlock found via Byzantine prevote gossip race
    ([#5839](https://github.com/cometbft/cometbft/pull/5839))
  * `[mempool]` fix setRecheckFull/setDone race causing spurious ErrRecheckFull.
    ([#5837](https://github.com/cometbft/cometbft/pull/5837))
  * `[abci]` fix deadlock when response callback re-enters the client.
    ([#5850](https://github.com/cometbft/cometbft/pull/5850))
  * `[node]` use kernel-assigned ephemeral ports and fix `OnStart` cleanup
    ([#5868](https://github.com/cometbft/cometbft/pull/5868))
  * `[node]` close partial listeners on startRPC failure
    ([#5869](https://github.com/cometbft/cometbft/pull/5869))
  * `[lp2p]` remove `MaxStreamSize` clamp in `StreamReadSized`
    ([#5954](https://github.com/cometbft/cometbft/pull/5954))
  * `[lp2p]` fallback to conn remote addr when resolving inbound peer
    ([#5879](https://github.com/cometbft/cometbft/pull/5879))
  * `[consensus]` release cs.mtx before sending to statsMsgQueue
    ([#5813](https://github.com/cometbft/cometbft/pull/5813))
  * `[mempool]` truncate proto field number to int32 in filter's ReadTag
    ([#5948](https://github.com/cometbft/cometbft/pull/5948))
  * `[privval]` preempt sleep retries in privval signer client
    ([#5934](https://github.com/cometbft/cometbft/pull/5934))

  ## IMPROVEMENTS

  * `[blocksync]` replace `numPending int32` with `atomic.Int32` and document `BlockPool` field ownership
    ([#5889](https://github.com/cometbft/cometbft/pull/5889))
  * `[execution]` cache validator set within a block cycle.
    ([#5834](https://github.com/cometbft/cometbft/pull/5834))
  * `[state]` skip the proposer-priority advance when loading validators for the
    block-replay commit-info path (`LoadValidatorsFast`); up to \~900x faster at
    the largest checkpoint offsets.
    ([#5204](https://github.com/cometbft/cometbft/issues/5204))
  * `[consensus]` reuse encode/decode buffers in WALEncoder and WALDecoder.
    ([#5865](https://github.com/cometbft/cometbft/pull/5865))
  * `[blocksync]` validate blocksync response sender and signature count
    ([#5860](https://github.com/cometbft/cometbft/pull/5860))
  * `[autofile]` skip fsync in `FlushAndSync` when no new data was written
    ([#5866](https://github.com/cometbft/cometbft/pull/5866))
  * `[mempool]` Implement `MsgBytesFilter` in Reactor to prevent heap amplification attack
    ([#5946](https://github.com/cometbft/cometbft/pull/5946))
  * `[privval]` Dynamically calculate privval maxRemoteSignerMsgSize.
    ([#5985](https://github.com/cometbft/cometbft/pull/5985))
  * `[types]` Update default max block bytes param to account for increased signature size of mldsa65.
    ([#5987](https://github.com/cometbft/cometbft/pull/5987))
  * `[config]` Update the default max\_tx\_bytes to account for increased signature size of mlsdsa65.
    ([#5989](https://github.com/cometbft/cometbft/pull/5989))
  * `[crypto]` Add UnmarshalJSON to secp256k1eth key type.
    ([#5990](https://github.com/cometbft/cometbft/pull/5990))

  ## FEATURES

  * `[config]` Add EventBusBufferCapacity setting.
    ([#5849](https://github.com/cometbft/cometbft/pull/5849))
  * `[abci/server]` Accept pre-bound listener in socket and gRPC servers.
    ([#5904](https://github.com/cometbft/cometbft/pull/5904))
  * `[crypto]` Add ml-dsa-65 keytype.
    ([#5875](https://github.com/cometbft/cometbft/pull/5875))
  * `[crypto]` Add `secp256k1eth` keytype: go-ethereum-compatible secp256k1 signing
    (legacy Keccak-256, 65-byte `[R||S||V]` signatures, 20-byte Ethereum addresses).
    ([#5907](https://github.com/cometbft/cometbft/pull/5907))

  ## STATE-BREAKING

  * `[crypto]` `secp256k1eth` verification now requires exact 65-byte recoverable
    `[R||S||V]` signatures with canonical `V` in `{0,1}`.
  * `[state]` `MedianTime` skips `Nil` and `Absent` precommits, aligning with `VerifyCommit`'s commit tally.
    ([#5901](https://github.com/cometbft/cometbft/pull/5901))

  ## API-BREAKING

  * `[crypto]` Add ml-dsa-65 keytype.
    ([#5875](https://github.com/cometbft/cometbft/pull/5875))
</Update>