build(deps): consolidated dependabot updates (2026-05-27)

[ibutterbot]

Consolidated Dependabot Updates

This PR consolidates the following dependabot dependency bumps into a single PR to avoid poetry.lock conflicts:

• build(deps): bump pytest-rerunfailures from 16.1 to 16.2 #20952 — bump pytest-rerunfailures from 16.1 to 16.2
• build(deps): bump ruff from 0.15.8 to 0.15.13 #20951 — bump ruff from 0.15.8 to 0.15.13
• build(deps): bump boto3 from 1.43.11 to 1.43.13 #20950 — bump boto3 from 1.43.8 to 1.43.11
• build(deps): bump lxml from 6.1.0 to 6.1.1 #20949 — bump lxml from 6.1.0 to 6.1.1
• build(deps): bump types-pyyaml from 6.0.12.20260510 to 6.0.12.20260518 #20948 — bump types-pyyaml from 6.0.12.20260510 to 6.0.12.20260518
• build(deps): bump types-aiofiles from 25.1.0.20260508 to 25.1.0.20260518 #20947 — bump types-aiofiles from 25.1.0.20260508 to 25.1.0.20260518
• build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 #20944 — bump github/codeql-action from 4.35.4 to 4.35.5
• build(deps): bump chialisp from 0.4.1 to 0.4.5 #20919 — bump chialisp from 0.4.1 to 0.4.5
• build(deps): bump aiohttp from 3.13.4 to 3.13.5 #20796 — bump aiohttp from 3.13.4 to 3.13.5

poetry.lock has been regenerated.

---

Generated by dependabot-consolidator

---

Note

High Risk
Wallet sync rollback, backtrack caps, and untrusted-peak fallback directly affect reorgs and peer trust; transaction broadcast changes alter mempool interaction and could change spend delivery behavior.

Overview
This PR pins and bumps GitHub Actions (Node setup, artifact upload/download, CodeQL, AWS credentials, Apple codesign) and moves macOS CI to macos-15 with MACOSX_DEPLOYMENT_TARGET 15, dropping older macOS 13/14 test matrix entries.

The substantive application change is in WalletNode sync and transaction broadcast:

• Short backtrack sync is capped (LONG_SYNC_THRESHOLD); exceeding it returns None and triggers long sync instead of unbounded header walks. Chain discontinuities disconnect the peer; genesis rollback is fixed when existing wallet state must be cleared.
• new_peak_from_untrusted no longer falls through to long sync when short sync fails due to stale/equal weight, a closed peer, or cap hit without appropriate synced_peers cleanup; multi-peer vs single-peer long-sync mode is covered by new tests.
• Transaction resend: peers with FAILED acks are skipped like SUCCESS; _retry_fee_failed_transactions re-pokes peers on new transaction blocks for low-fee errors only; sends go through _send_transaction_message with in-flight tracking and closed-peer guards.
• Coin-state validation treats None from addition/removal checks as failure; subscription/header fetches use priority parameters.

test_wallet_node.py adds broad coverage for backtrack, peak handling, fee retry, and resend/duplicate-ack behavior.

^{Reviewed by Cursor Bugbot for commit c2255d6. Bugbot is set up for automated code reviews on this repo. Configure here.}