Polygon Labs announced Bor v2.10.3 for Polygon PoS mainnet and Amoy on 15 October. Its operator notice urges nodes running v2.10.2 or earlier to upgrade promptly. Nodes already running the corresponding private builds have the same code and can return to the public release channel at their next maintenance window.

No hard-fork activation

The notice says this is not a consensus-affecting release: there is no activation block, genesis change, database migration or resync requirement. Operators can upgrade nodes individually. That distinction matters: a software release should not be reported as a newly activated network fork.

A configuration value now takes effect

The official release notes confirm that the Heimdall request timeout now respects configuration. Older templates could explicitly set five seconds; the notes recommend removing that override or using 30 seconds unless a different value is needed.

The changelog also describes corrected parallel-execution balance reads across self-destruct boundaries, bounded shared caches, transaction-pool handling changes and RPC execution-slot improvements. These are developer descriptions, not an independent NetNapz code audit.

NetNapz assessment

The immediate relevance is operational: administrators need to establish their actual build and review configuration, rather than assume a version-number change alone completes maintenance. Existing private-build users and older public-build users should not be treated as equally unpatched.

The announcement does not establish a network exploit, user losses or a new POL-demand mechanism. Security maintenance and investment performance are separate questions. NetNapz has checked the published notice and release notes, but has not installed the software, tested the fixes or measured validator adoption.

16 October update: Lugano was a separate Heimdall fork

Polygon Labs’ retrospective published 16 October describes Lugano as a Heimdall-only hard fork that left Bor unchanged. It reports mainnet activation on 1 October 2026 at approximately 16:22 UTC, at Heimdall height 54,627,000—not on the retrospective’s publication date.

The team says the release hardened checkpoint bounds, block-sync resource limits and module validation. It describes potential availability and validation problems, says no funds were at risk, and reports clean activation. Those are the developer’s claims, not an independent NetNapz security audit.

The public v0.12.1 is described as functionally identical to the signed private build. The notice recommends v0.12.2 and says nodes that missed the required upgrade stopped at the fork height; a binary upgrade requires no state migration, genesis change or resync.

NetNapz assessment: operators should distinguish two maintenance tracks: Heimdall’s already-active Lugano requirements and Bor v2.10.3’s non-fork fixes. Neither a retrospective nor publication of equivalent private-release code establishes a new incident or fresh POL demand.

Update checked 16 October 2026 at 21:37 UTC / 22:37 BST. The official forum’s indexed announcement text was retrieved; direct page opening was unavailable.

Sources and dates

Reporting is based on Polygon Labs’ 15 October 2026 forum announcement and the linked Bor v2.10.3 GitHub release, checked 15 October. Both are first-party technical sources; the assessment above is NetNapz’s interpretation.