Polygon hardforked its mainnet this morning. The source code showed up afterward.
Heimdall's Karwar upgrade went live on Polygon PoS at 08:54 UTC Nov. 3 (3:54 AM ET). Validators ran a private build first. The public v0.13.2, "functionally identical," was published once the fork was already active. Listed changes: size-bounded vote extensions and canonical checkpoint signatures.
Same playbook as Kyoto in August and Lugano in October, which Polygon called a "private security release." Nodes that missed the memo "stopped at the Karwar height."
Patching quietly before attackers can read the diff is defensible. It also makes it open source on a tape delay.
Source: Polygon Community Forum: Heimdall v0.13.2 released for Mainnet and Amoy