This week's Tempo update enhances security by hiding the telemetry URL from CLI output and updates the core `reth` dependency to the latest version.
> impact
This week, we've shipped two important updates to the Tempo protocol and SDK. First, commit 57f8cf1 addresses a security concern by preventing the `telemetry-url` environment variable from being exposed in the command-line interface (CLI) output. Second, we've updated our dependency on `reth`, the underlying Rust-based Ethereum execution client, to the latest version from its main branch.
The telemetry URL fix was prioritized to enhance privacy and security for all node operators. Exposing potentially sensitive configuration details in logs or terminal outputs is a security risk we have now mitigated. The `reth` dependency update is part of our routine maintenance to ensure Tempo stays aligned with the cutting edge of Ethereum execution layer development, inheriting the latest performance optimizations, bug fixes, and features from the upstream project.
For developers and node operators, this means a more secure operating environment out-of-the-box. The telemetry URL fix requires no action but provides immediate hardening. The `reth` update means that anyone running a Tempo node should be aware of the new underlying client version. We recommend reviewing the latest `reth` changelogs to stay informed about any significant changes that might impact node performance or behavior.
> Try this now
try this
# To ensure you're running the latest, most secure version of Tempo,
# follow these steps to update your local instance.
# 1. Navigate to your local Tempo repository.
cd path/to/your/tempo/repo
# 2. Pull the latest changes from the main branch.
# This will fetch the security patch and the updated dependencies.
git pull origin main
# 3. Rebuild the project to apply the changes.
# This step compiles the new code, including the updated `reth` client.
cargo build --release
# 4. Run your node.
# Observe the CLI output; the telemetry URL will no longer be displayed,
# confirming the security patch is active.
./target/release/tempo-node --your-usual-flags