Update to latest main#11
Open
aleksraiden wants to merge 30 commits into
Open
Conversation
aleksraiden
commented
Jul 2, 2026
aleksraiden
commented
Owner
…1693) (#5857) Closes #1693. For replay paths that only need validator addresses + voting powers (`buildLastCommitInfo`, `buildExtendedCommitInfo`), advancing proposer priorities forward from the most recent stored checkpoint is wasted work. The advance is `O(height % valSetCheckpointInterval)` and dominates replay time on chains with infrequent validator-set changes. The original issue reports ~10x slowdown observed in production. This PR's benchmark on a 100-validator set shows up to **903x** at worst case (load at `checkpoint + 99,999`). ## Changes - Add `Store.LoadValidatorsFast(height)` that returns the `*ValidatorSet` without `IncrementProposerPriority`. The returned set has correct addresses, public keys, and voting powers; `ProposerPriority` reflects the last stored checkpoint, not the requested height. Documented that callers needing accurate proposer priority must continue to use `LoadValidators`. - Wire `buildLastCommitInfoFromStore` and `buildExtendedCommitInfoFromStore` to use the fast path. Both downstream paths only call `TM2PB.Validator` (`types/protobuf.go:41`) which reads `PubKey.Address()` and `VotingPower` only — no proposer priority access. - Refactor `LoadValidators` internals into a shared `loadValidatorsAtHeight` helper so both fast and full paths share the lookup logic. - Update mock `state/mocks/store.go`. ## Bench `state/store_test.go::BenchmarkLoadValidatorsSawtooth` on AMD EPYC, 100-validator set, ValidatorsInfo header persisted at the queried height but ValidatorSet only stored at checkpoint: | Offset from checkpoint | LoadValidators | LoadValidatorsFast | Speedup | |------------------------|----------------|--------------------|---------| | at_checkpoint | 165 µs | 158 µs | 1.04x | | +1 | 149 µs | 137 µs | 1.09x | | +100 | 270 µs | 134 µs | 2.0x | | +10,000 | 12.4 ms | 132 µs | 94x | | +99,999 | 126 ms | 140 µs | **903x** | The sawtooth pattern described in the issue is reproduced and eliminated. Reproduce locally: ``` go test ./state -bench BenchmarkLoadValidatorsSawtooth -benchtime=1s -run=^$ ``` ## Compatibility - `LoadValidators` semantics unchanged (still advances proposer priority). - `LoadValidatorsFast` is additive — no caller is forced to migrate. - Interface change is additive — third-party `state.Store` implementations need to add the new method, but this is a single small addition (mock provided as a template in the diff). Signed-off-by: satyakwok <119509589+satyakwok@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
…timize retry timer (#5592) Three improvements to the blocksync block requester: **Fix: redo events no longer silently dropped** `redoCh` was typed `chan p2p.ID` with capacity 1. In the dual-peer scenario, if `redo(peerA)` was already pending in the channel, a concurrent `redo(peerB)` would be silently dropped — peerB would stall until the retry timer fired. Replace with `chan struct{}` (capacity 1) as a coalesced wake-up signal. Peer IDs are appended to a mutex-protected `redoPeers` slice in `redo()`, so no event is ever lost regardless of call frequency. **Fix: stale redo events no longer cancel new requests** When the retry timer fired and restarted the outer loop, any pending redo events in `redoPeers` carried over to the next iteration. If the new iteration happened to pick the same peer, those stale events would cancel a valid new request. A generation counter is incremented at the start of each outer loop. `redo()` records the current generation alongside the peer ID; events from a previous generation are silently discarded. The retry timer path also clears `redoPeers` before restarting. **Perf: reuse retry timer instead of allocating a new one each loop** Before (new timer allocated per OUTER_LOOP iteration): - 19396 ns/op, 63488 B/op, 768 allocs/op After (single timer, reset on each iteration): - 7589 ns/op, 248 B/op, 3 allocs/op #### PR checklist - [x] Tests written/updated - [x] Changelog entry added in `.changelog` (we use [unclog](https://github.com/informalsystems/unclog) to manage our changelog) - [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments --------- Co-authored-by: Alex | Cosmos Labs <alex@cosmoslabs.io> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
… in Idle (#5929) ## Description Fix CI failure at: https://github.com/cometbft/cometbft/actions/runs/27431355897/job/81082257035?pr=5879 `statusesAreEqual` compared `Status.Idle` with exact equality (`==`) while every other time-derived field (`Duration`, `TimeRem`, the rates) allowed a deviation. `Idle` is the difference of two timestamps each rounded to the 20ms `clockRate`, so scheduling jitter on loaded runners can push the two reads onto adjacent ticks, producing a spurious 20ms idle and failing the strict `==`. This compares `Idle` with the same `maxDeviationForDuration` tolerance, and makes `durationsAreEqual` symmetric (absolute diff) so it bounds drift in both directions. --- #### PR checklist - [x] Tests written/updated - [x] Changelog entry added in `CHANGELOG.md` - [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.20.0 to 0.21.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/sync/commit/5071ed6a9f1617117556b66384f765c934de3698"><code>5071ed6</code></a> all: fix some comments to improve readability</li> <li>See full diff in <a href="https://github.com/golang/sync/compare/v0.20.0...v0.21.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
…uring sendError (#5931) ## Summary Fix CI failure at: https://github.com/cometbft/cometbft/actions/runs/27214146296/job/80350996164 - `AddBlock` held `pool.mtx` via a deferred `Unlock` while calling `sendError` on an unbuffered channel. Any concurrent caller that also needed `pool.mtx` would deadlock until the channel was drained. - Fix by collecting the error in `sendErr` and dispatching it inside the `defer` after the mutex is released. - Adds a regression test `TestAddBlockDoesNotDeadlockOnSendError`. --- #### PR checklist - [x] Tests written/updated - [x] Changelog entry added in `CHANGELOG.md` - [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.55.0 to 0.56.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/9e7fdbfadb32b0cc7524100014c5cf9b6adc7729"><code>9e7fdbf</code></a> internal/http3: fix wrong argument being given when validating header value</li> <li><a href="https://github.com/golang/net/commit/b686e5f3573e5f55120d664fc283ed7e80c1af3c"><code>b686e5f</code></a> internal/http3: add gzip support to transport</li> <li><a href="https://github.com/golang/net/commit/8a348850ed6818306667722af2b42a6fc63473e0"><code>8a34885</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/72eaf98743302f6e0ad10883163dfc46dc8e8183"><code>72eaf98</code></a> dns/dnsmessage: correctly validate SVCB record parameter order</li> <li><a href="https://github.com/golang/net/commit/82e7868a02167540748b74780b0bf825985256f7"><code>82e7868</code></a> dns/dnsmessage: avoid panic when parsing SVCB record with truncated data</li> <li><a href="https://github.com/golang/net/commit/b64f1fa4c615965246e5b9e5c9d614916fa8967d"><code>b64f1fa</code></a> internal/http3: add server support for "Trailer:" magic prefix</li> <li><a href="https://github.com/golang/net/commit/2707ee21efea70599446dd35979b1d1aedf44ada"><code>2707ee2</code></a> internal/http3: implement HTTP/3 clientConn methods</li> <li><a href="https://github.com/golang/net/commit/31358cc259a764905194e3d6c597375b0ff366c1"><code>31358cc</code></a> internal/http3: snapshot response headers at WriteHeader time</li> <li><a href="https://github.com/golang/net/commit/8ecbaa95fea823c19fa74c5c3b53e0bccd473828"><code>8ecbaa9</code></a> html: don't adjust xml:base</li> <li><a href="https://github.com/golang/net/commit/8ae811abe5c2daa55c68d51a101af1c5751a4d55"><code>8ae811a</code></a> html: properly handle end script tag in fragment mode</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.55.0...v0.56.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Co-authored-by: Alex Cozart <alex@cosmoslabs.io> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
…5879) ## Summary `handleStream` calls `resolvePeer` to look up or provision the incoming peer, but `resolvePeer` relies on the peerstore having the peer's address. libp2p's identify protocol populates the peerstore asynchronously — there is a window where A has opened a CometBFT stream to B but B's peerstore is still empty for A, causing `resolvePeer` to fail and the first message to be dropped. The fix passes the connection's remote multiaddr directly into `resolvePeer` as a fallback. When the peerstore has no addresses for the peer, `resolvePeer` constructs the `addrInfo` inline from the live connection instead of returning an error. This closes the race without any peerstore side effects. --- #### PR checklist - [x] Tests written/updated - [x] Changelog entry added in `CHANGELOG.md` - [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Fixes #2143. `respondToPeer` was calling `store.LoadBlock`, which internally unmarshal the raw DB bytes into a `cmtproto.Block` and then calls `BlockFromProto` to get a `*types.Block`. The function then immediately called `block.ToProto()` to get back a `cmtproto.Block` for the wire response. The intermediate Go struct was never used. Added `LoadBlockProto` to `BlockStore` that stops after the `proto.Unmarshal` step and returns the `*cmtproto.Block` directly. `LoadBlock` now delegates to it. `respondToPeer` type-asserts to `*store.BlockStore` and calls `LoadBlockProto` when possible, with a fallback for the interface case (used in tests with mocks). Tested: added `TestLoadBlockProto` to `store/store_test.go` that checks nil on missing height, correct hash round-trip, and consistency with `LoadBlock`. Full `./store/...` and `./blocksync/...` suites pass. --------- Co-authored-by: Dmitry S <11892559+swift1337@users.noreply.github.com> Co-authored-by: Alex | Cosmos Labs <alex@cosmoslabs.io> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
--- Remove kms in favor of https://github.com/cosmos/kms
…mplification (#5946) Implements the optional p2p.MsgBytesFilter interface (defined in p2p/base_reactor.go) for this reactor. When provided, this filter runs against the raw message bytes before unmarshalling, allowing oversized or malformed messages to be rejected up front. This closes a heap-amplification vector where a small, count-packed wire payload could be unmarshalled into a disproportionately large in-memory structure, exhausting memory. Motivation: Previously the message bytes went straight to unmarshal with no pre-decode size/validity check. A crafted gossip message could exploit this to trigger excessive heap allocation. Rejecting bad messages before unmarshal eliminates the attack surface. --- #### PR checklist - [ ] Tests written/updated - [ ] Changelog entry added in `CHANGELOG.md` - [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments --------- Co-authored-by: Dmitry S <11892559+swift1337@users.noreply.github.com>
\`StreamReadSized\` enforces a per-read size limit passed in by the caller (the reactor's \`RecvMessageCapacity\`). The 4 MB \`MaxStreamSize\` constant is intended as a default fallback for callers that don't specify a limit. ## Problem \`StreamReadSized\` applied \`payloadLimit := min(maxSize, MaxStreamSize)\`, clamping the caller-supplied limit down to 4 MB regardless of what the reactor configured. Blocksync sets \`RecvMessageCapacity = MaxBlockSizeBytes + 5 ≈ 100 MB\`; any block >4 MB was rejected with "payload is too large" and the stream was reset. The send side (\`StreamWrite\`) has no cap and serialises the full block, so a peer could send a 50 MB block that the receiver would always reject — a liveness failure for any lp2p node behind on a chain producing >4 MB blocks. Statesync's 16 MB chunks were similarly affected. ## Fix Use \`maxSize\` directly. \`MaxStreamSize\` is now a fallback only when \`maxSize == 0\` (unset), not a hard global cap. Adds a regression test for \`maxSize > MaxStreamSize\`. ## Remaining issue \`readExactly\` does \`make([]byte, payloadSize)\` immediately after reading the length-prefix header, so a malicious peer can force a receiver to allocate up to \`RecvMessageCapacity\` bytes before any payload data arrives. The old 4 MB clamp was inadvertently limiting this to 4 MB per stream. The correct fix is to replace \`readExactly\` with \`io.ReadAll(io.LimitReader(...))\` so allocation grows only as data arrives. This is left as a follow-up to keep this PR minimal; the real guard in the meantime is the libp2p resource manager and \`RecvMessageCapacity\` being set to the consensus-enforced max block size. --- #### PR checklist - [x] Tests written/updated - [x] Changelog entry added in \`CHANGELOG.md\` - [ ] Updated relevant documentation (\`docs/\` or \`spec/\`) and code comments
--- Updates the privval RetrySignerClient to check on shutdown before retrying. Without this change it is possible to get into the following shutdown state: * Node is requesting a signature from a remote signer * Shutdown happens on remote signer * Shutdown happens on node In this case we have to wait `retries × (timeoutAccept + timeout) ≈ 155s` before the node will shut down. With these changes we will wait a maximum of a single retry timeout before seeing that `Close` has been called (~3s) and shutdown will happen after that. --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v6...v7">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
### Problem The socket server (`handleRequest`) and client (`resMatchesReq`) were missing cases for `Request_InsertTx` and `Request_ReapTxs`, which were added in the Krakatoa merge (#5615) but never wired into the socket type-switches. With `mempool.type = "app"` and the default `abci = "socket"` transport (out-of-process app): - Every `ReapTxs` response fails the `resMatchesReq` type-match check - Returns `ErrUnexpectedResponse` → `stopForError` → `killTMOnClientError` → `cmtos.Kill()` (SIGTERM) - `ReapTxs` fires every `ReapInterval` (~500ms), so the node self-kills within ~500ms of startup The local and gRPC transports were correctly implemented; only socket was missed. `ToResponseInsertTx`/`ToResponseReapTxs` helpers were also missing from `messages.go` (the `ToRequest*` counterparts existed). ### Fix - Add `Request_InsertTx` and `Request_ReapTxs` cases to `resMatchesReq` in `abci/client/socket_client.go` - Add `Request_InsertTx` and `Request_ReapTxs` cases to `handleRequest` in `abci/server/socket_server.go` - Add `ToResponseInsertTx` and `ToResponseReapTxs` helpers to `abci/types/messages.go` - Add `TestInsertTxReapTxsSocket` round-trip test over a real socket server/client pair --- #### PR checklist - [x] Tests written/updated - [x] Changelog entry added in `CHANGELOG.md` - [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments --------- Co-authored-by: Dmitry S <11892559+swift1337@users.noreply.github.com>
#5948) Fixing a small bug in PR #5946 ReadTag decoded protobuf field numbers as a platform-width int `int(v>>3)`, but the generated gogoproto unmarshaller uses `int32(wire>>3)`. On 64-bit platforms this let a crafted tag whose high bits differ (e.g. 8a 80 80 80 80 01, field 2^32+1) be classified as a different field by the pre-scan than by proto.Unmarshal As a result, the filter skips the entry while Unmarshal still decoded it as the real repeated`txs` field, slipping empty entries past the empty-entry rejection as part of the filter rule As an evidence https://github.com/cometbft/cometbft/blob/main/proto/tendermint/mempool/types.pb.go#L327 #### PR checklist - [x] Tests written/updated - [x] Changelog entry added in `CHANGELOG.md` - [x] Updated relevant documentation (`docs/` or `spec/`) and code comments Co-authored-by: dianab-cl <diana@cosmoslabs.io>
…ors (#5953) With `adaptive_sync=true`, consensus starts immediately (`consensusWaitForSync=false`) and `signAddVote` fires whenever the node is in the validator set. A catching-up validator can sign a vote for block B at height H while the blocksync ingestor concurrently commits a different block B' at H (already decided by the network). The HRS file and KMS are not sufficient backstops — the conflicting messages are at different (H,R,step) tuples so `CheckHRS` never fires. This is a known tradeoff: validators on high-performance chains (sub-1000ms blocks, high TPS) benefit from adaptive sync to avoid falling behind and being jailed. The risk is deliberate and operator-owned. ## Fix Documentation only — no behavior change: - `docs/core/block-sync.md`: add explicit equivocation risk warning to the Adaptive Sync section - `config/toml.go`: add the same warning to the `adaptive_sync` config comment --- #### PR checklist - [ ] Tests written/updated - [ ] Changelog entry added in `CHANGELOG.md` - [x] Updated relevant documentation (`docs/` or `spec/`) and code comments
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.21.0 to 0.22.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/sync/commit/1eb64d4bc0cde6da1bb8ebc7f178bb577508e5d0"><code>1eb64d4</code></a> semaphore: panic on negative weights</li> <li>See full diff in <a href="https://github.com/golang/sync/compare/v0.21.0...v0.22.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.53.0 to 0.54.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62"><code>cdce021</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/d9474cc4853d9ef1a29356975408d4771e5770c6"><code>d9474cc</code></a> openpgp: make the deprecation message more explicit</li> <li><a href="https://github.com/golang/crypto/commit/7626c5025624025bb44739a805f431cf93c06d6e"><code>7626c50</code></a> ssh: verify declared key type matches decoded key in authorized_keys</li> <li><a href="https://github.com/golang/crypto/commit/0471e7969e6740594dfe354646bf03e5e89de52d"><code>0471e79</code></a> ssh/agent: enforce strict limits on DSA key parameters</li> <li><a href="https://github.com/golang/crypto/commit/6435c37ab681759aff37ba751d0f2238b3043767"><code>6435c37</code></a> ssh: sanitize client disconnect messages</li> <li><a href="https://github.com/golang/crypto/commit/7d695da948bfa44ed6eedcebc8f43bcb50e94a57"><code>7d695da</code></a> ssh/agent: drain channel stderr in agent forwarders</li> <li><a href="https://github.com/golang/crypto/commit/5b7f84159940519e89df4d95465538c1797cee8b"><code>5b7f841</code></a> acme/autocert: fix data race in Manager.createCert</li> <li><a href="https://github.com/golang/crypto/commit/0b316e7ee409f8e5789a0535679d34155cecc75e"><code>0b316e7</code></a> argon2: update RFC 9106 parameter recommendations</li> <li><a href="https://github.com/golang/crypto/commit/55aec0a86b4c522b4f7366e69db55349e9f7ff5c"><code>55aec0a</code></a> x509roots/fallback: update bundle</li> <li><a href="https://github.com/golang/crypto/commit/5f2de1a9f1e29059fbb9f3d34321bd0da935556b"><code>5f2de1a</code></a> internal: remove wycheproof tests</li> <li>See full diff in <a href="https://github.com/golang/crypto/compare/v0.53.0...v0.54.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… to prevent peer teardown (#5956) ### Problem `AppReactor.chunkTxs` sized batches by raw `len(tx)` bytes, ignoring the 2–4 bytes of protobuf wire overhead each entry adds (1-byte field tag + varint length prefix). A batch of small txs near `MaxTxBytes` serializes to `MaxTxBytes + N*(2–4)` bytes, exceeding the receiver's `RecvMessageCapacity`. The connection layer returns "received message exceeds available capacity" and tears down the peer. Example overflows (default `MaxTxBytes = 1 MB`): - 1 000-byte txs: ~+2 564 bytes over capacity - 1-byte txs: ~+2 097 149 bytes over capacity Second issue: `GetChannels` sized `RecvMessageCapacity` for a single `MaxTxBytes`-sized tx while `OnStart` used `MaxBatchBytes` when set, so configs with `MaxBatchBytes > MaxTxBytes` would overflow at the capacity check itself. ### Fix - Add `internal/protowire.RepeatedBytesEntrySize(dataLen int) int` — exact wire bytes proto adds per `repeated bytes` entry (1-byte tag + varint(len)), verified against `proto.Size` at all varint boundary values; panics on negative input. - `chunkTxs` accounts for this overhead per tx so no encoded batch exceeds `RecvMessageCapacity`. - Extract `effectiveMaxBatchBytes()` to deduplicate the `MaxBatchBytes`/`MaxTxBytes` fallback logic shared by `OnStart` and `GetChannels`. - `GetChannels` derives `RecvMessageCapacity` from `effectiveMaxBatchBytes()`, keeping the advertised capacity in sync with the actual send ceiling. --- #### PR checklist - [x] Tests written/updated - [x] Changelog entry added in `CHANGELOG.md` - [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments --------- Co-authored-by: Dmitry S <11892559+swift1337@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.56.0 to 0.57.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5"><code>b8f09f6</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/f05f21be5927155a88b371674c298ada54b71cf5"><code>f05f21b</code></a> idna: reject all-ASCII xn-- labels on all Go versions</li> <li><a href="https://github.com/golang/net/commit/0f748cfbba95084c87723e3b7eb7dad9241fc2dd"><code>0f748cf</code></a> internal/http3: clean up stream I/O methods usages in tests</li> <li><a href="https://github.com/golang/net/commit/0bb961e45132c680e2a0117e1df951538a19da61"><code>0bb961e</code></a> internal/http3: add net/http.ResponseController support</li> <li><a href="https://github.com/golang/net/commit/0ca694d2a5adcce7f36d4d65e5f8d72390d94051"><code>0ca694d</code></a> webdav: document Dir's lack of defense against filesystem modification</li> <li><a href="https://github.com/golang/net/commit/bd5f1dcf71cf0d6d2424021d0a04f191396a46a7"><code>bd5f1dc</code></a> http2: initialize Transport on NewClientConn</li> <li><a href="https://github.com/golang/net/commit/488ff63197ffddbcef2d01107f8a89906a4f28d1"><code>488ff63</code></a> bpf: add security considerations to package docs</li> <li><a href="https://github.com/golang/net/commit/93d1f25be95961edfdf488b9398e53fb9f05f193"><code>93d1f25</code></a> xsrftoken: avoid token collisions</li> <li><a href="https://github.com/golang/net/commit/5a3baee349e65853c34b4377bebe7676a64dbc87"><code>5a3baee</code></a> internal/http3: prevent panic in QPACK decoder due to overflow</li> <li>See full diff in <a href="https://github.com/golang/net/compare/v0.56.0...v0.57.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
…5973) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.68.1 to 0.70.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/releases">github.com/prometheus/common's releases</a>.</em></p> <blockquote> <h2>v0.70.0</h2> <h2>What's Changed</h2> <ul> <li>config: fix TLSVersion.String() printing pointer address by <a href="https://github.com/s3onghyun"><code>@s3onghyun</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/929">prometheus/common#929</a></li> <li>build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/933">prometheus/common#933</a></li> <li>Manually go mod tidy by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/934">prometheus/common#934</a></li> <li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/937">prometheus/common#937</a></li> <li>route: add support for the QUERY HTTP method by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/932">prometheus/common#932</a></li> <li>Combine and extend Prometheus text and OpenMetrics 1.0 encoder benchmarks by <a href="https://github.com/dashpole"><code>@dashpole</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/943">prometheus/common#943</a></li> <li>build(deps): bump the codeql group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/938">prometheus/common#938</a></li> <li>build(deps): bump actions/setup-go from 6.2.0 to 6.5.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/940">prometheus/common#940</a></li> <li>build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/942">prometheus/common#942</a></li> <li>build(deps): bump ossf/scorecard-action from 2.1.2 to 2.4.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/939">prometheus/common#939</a></li> <li>build(deps): bump actions/checkout from 3.1.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/prometheus/common/pull/941">prometheus/common#941</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/s3onghyun"><code>@s3onghyun</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/929">prometheus/common#929</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">https://github.com/prometheus/common/compare/v0.69.0...v0.70.0</a></p> <h2>v0.69.0</h2> <h2>What's Changed</h2> <ul> <li>config: strip credentials on cross-host redirects by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/901">prometheus/common#901</a></li> <li>Modernize Go by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/919">prometheus/common#919</a></li> <li>config: make isCrossHostRedirect sticky across the redirect chain by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/920">prometheus/common#920</a></li> <li>config: check cross-host redirect before OAuth2 token fetch by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/921">prometheus/common#921</a></li> <li>expfmt: fix nil pointer panic when parsing empty braces "{}" by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/922">prometheus/common#922</a></li> <li>model: reduce allocations in Time.UnmarshalJSON by <a href="https://github.com/bboreham"><code>@bboreham</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/918">prometheus/common#918</a></li> <li>config: resolve LoadHTTPConfigFile paths relative to the config file by <a href="https://github.com/roidelapluie"><code>@roidelapluie</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/925">prometheus/common#925</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prometheus/common/blob/main/CHANGELOG.md">github.com/prometheus/common's changelog</a>.</em></p> <blockquote> <h2>v0.70.0 / 2026-07-10</h2> <h3>Enhancements</h3> <ul> <li>route: add support for the QUERY HTTP method. <a href="https://redirect.github.com/prometheus/common/issues/932">#932</a></li> </ul> <h3>Bugfixes</h3> <ul> <li>config: fix <code>TLSVersion.String()</code> printing a pointer address instead of the numeric version for unknown TLS versions. <a href="https://redirect.github.com/prometheus/common/issues/929">#929</a></li> </ul> <h3>Internal</h3> <ul> <li>expfmt: add <code>BenchmarkConvertMetricFamily</code> comparing the Prometheus text and OpenMetrics 1.0 encoders. <a href="https://redirect.github.com/prometheus/common/issues/943">#943</a></li> <li>Update Go dependencies. <a href="https://redirect.github.com/prometheus/common/issues/933">#933</a> <a href="https://redirect.github.com/prometheus/common/issues/934">#934</a></li> <li>Synchronize common files from prometheus/prometheus. <a href="https://redirect.github.com/prometheus/common/issues/923">#923</a> <a href="https://redirect.github.com/prometheus/common/issues/927">#927</a> <a href="https://redirect.github.com/prometheus/common/issues/930">#930</a> <a href="https://redirect.github.com/prometheus/common/issues/937">#937</a></li> <li>Update GitHub Actions. <a href="https://redirect.github.com/prometheus/common/issues/938">#938</a> <a href="https://redirect.github.com/prometheus/common/issues/939">#939</a> <a href="https://redirect.github.com/prometheus/common/issues/940">#940</a> <a href="https://redirect.github.com/prometheus/common/issues/941">#941</a> <a href="https://redirect.github.com/prometheus/common/issues/942">#942</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.69.0...v0.70.0">https://github.com/prometheus/common/compare/v0.69.0...v0.70.0</a></p> <h2>v0.69.0 / 2026-06-17</h2> <h3>Security / behavior changes</h3> <ul> <li><strong>config: credentials are no longer forwarded across cross-host redirects.</strong> When <code>FollowRedirects</code> is enabled, the HTTP client now strips <code>Authorization</code>, <code>Cookie</code>, <code>Proxy-Authorization</code> and other sensitive headers, and skips basic-auth, bearer-token and OAuth2 credentials, when a redirect points to a different host. This aligns with Go's <code>net/http</code> behavior. Callers that relied on credentials being sent to a redirect target on another host will need to target that host directly. <a href="https://redirect.github.com/prometheus/common/issues/901">#901</a> <a href="https://redirect.github.com/prometheus/common/issues/920">#920</a> <a href="https://redirect.github.com/prometheus/common/issues/921">#921</a></li> <li>config: <code>LoadHTTPConfigFile</code> now resolves relative file paths (e.g. <code>*_file</code> credentials, <code>http_headers</code> files) against the config file's own directory instead of its parent directory. Configs that worked around the old behavior by prefixing paths with the config's directory name must drop that prefix. <a href="https://redirect.github.com/prometheus/common/issues/925">#925</a></li> </ul> <h3>Bugfixes</h3> <ul> <li>expfmt: fix nil pointer panic when parsing empty braces <code>{}</code>. <a href="https://redirect.github.com/prometheus/common/issues/922">#922</a></li> <li>model: fix <code>Time.UnmarshalJSON</code> for larger negative numbers. <a href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li> </ul> <h3>Performance</h3> <ul> <li>model: reduce allocations in <code>Time.UnmarshalJSON</code>. <a href="https://redirect.github.com/prometheus/common/issues/918">#918</a></li> </ul> <h3>Internal</h3> <ul> <li>Synchronize common files from prometheus/prometheus. <a href="https://redirect.github.com/prometheus/common/issues/917">#917</a></li> <li>Modernize Go. <a href="https://redirect.github.com/prometheus/common/issues/919">#919</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.68.1...v0.69.0">https://github.com/prometheus/common/compare/v0.68.1...v0.69.0</a></p> <h2>v0.67.2 / 2025-10-28</h2> <h2>What's Changed</h2> <ul> <li>config: Fix panic in <code>tlsRoundTripper</code> when CA file is absent by <a href="https://github.com/ndk"><code>@ndk</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li> <li>Cleanup linting issues by <a href="https://github.com/SuperQ"><code>@SuperQ</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/860">prometheus/common#860</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ndk"><code>@ndk</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/792">prometheus/common#792</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prometheus/common/commit/5eff7a827920b6f175ea02b222f7c827a0fe80ad"><code>5eff7a8</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/941">#941</a> from prometheus/dependabot/github_actions/actions/che...</li> <li><a href="https://github.com/prometheus/common/commit/a23c5b344ad9200c0073133920fe60a9882c9d28"><code>a23c5b3</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/939">#939</a> from prometheus/dependabot/github_actions/ossf/scorec...</li> <li><a href="https://github.com/prometheus/common/commit/9e1eb871ced38b03648a38558ac3de66edeff2b5"><code>9e1eb87</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/942">#942</a> from prometheus/dependabot/github_actions/actions/upl...</li> <li><a href="https://github.com/prometheus/common/commit/ab2736d28a9fce77b0186e36b5d3318b74115298"><code>ab2736d</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/940">#940</a> from prometheus/dependabot/github_actions/actions/set...</li> <li><a href="https://github.com/prometheus/common/commit/e596873192a72855876b1c38cdb634bb73f5ba00"><code>e596873</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/938">#938</a> from prometheus/dependabot/github_actions/codeql-ac07...</li> <li><a href="https://github.com/prometheus/common/commit/97c066a87b2345f146b345141f0f14aaab7ad387"><code>97c066a</code></a> Add BenchmarkConvertMetricFamily comparing Prometheus text and OpenMetrics 1....</li> <li><a href="https://github.com/prometheus/common/commit/62e9d0f61d355b574225f66628a5f94be2bc1c29"><code>62e9d0f</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/932">#932</a> from roidelapluie/roidelapluie/route-query</li> <li><a href="https://github.com/prometheus/common/commit/6c312397a5da723c995ee9c16263f252c1d6b4a1"><code>6c31239</code></a> build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1</li> <li><a href="https://github.com/prometheus/common/commit/755e9d686dec00400191cc8483872831aff1b9cd"><code>755e9d6</code></a> build(deps): bump actions/checkout from 3.1.0 to 7.0.0</li> <li><a href="https://github.com/prometheus/common/commit/556d7402ea9a80cab60297e4dc98149b5410e24f"><code>556d740</code></a> build(deps): bump actions/setup-go from 6.2.0 to 6.5.0</li> <li>Additional commits viewable in <a href="https://github.com/prometheus/common/compare/v0.68.1...v0.70.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
…5980) Bumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) from 3.0.3 to 4.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/slackapi/slack-github-action/releases">slackapi/slack-github-action's releases</a>.</em></p> <blockquote> <h2>Slack GitHub Action v4.0.0</h2> <h3>Major Changes</h3> <ul> <li> <p>b1974f0: build: parse yaml with more strict multiline indentation rules</p> <p>Internal dependencies of <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md#500---2026-06-20"><code>js-yaml@v5</code></a> make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value.</p> <p>See the YAML <a href="https://yaml.org/spec/1.2.2/#63-line-prefixes">line prefixes</a> spec for the expected indentation rule:</p> <pre lang="diff"><code> channel: "C0123" text: "first line <ul> <li>second line"</li> </ul> <ul> <li>second line"<br /> </code></pre></li> </ul> </li> </ul> <h3>Patch Changes</h3> <ul> <li>654bb72: chore: provide global fetch proxied configurations with updates to web api and webhook packages</li> </ul> <h2>Slack GitHub Action v3.0.5</h2> <h3>Patch Changes</h3> <ul> <li>96fddbe: fix: revert multiline yaml parsing indentation change</li> </ul> <h2>Slack GitHub Action v3.0.4</h2> <h3>Patch Changes</h3> <ul> <li>fa03fe4: refactor: send webhooks with the <a href="https://docs.slack.dev/tools/node-slack-sdk/webhook"><code>@slack/webhook</code></a> package</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md">slackapi/slack-github-action's changelog</a>.</em></p> <blockquote> <h2>4.0.0</h2> <h3>Major Changes</h3> <ul> <li> <p>b1974f0: build: parse yaml with more strict multiline indentation rules</p> <p>Internal dependencies of <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md#500---2026-06-20"><code>js-yaml@v5</code></a> make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value.</p> <p>See the YAML <a href="https://yaml.org/spec/1.2.2/#63-line-prefixes">line prefixes</a> spec for the expected indentation rule:</p> <pre lang="diff"><code> channel: "C0123" text: "first line <ul> <li>second line"</li> </ul> <ul> <li>second line"<br /> </code></pre></li> </ul> </li> </ul> <h3>Patch Changes</h3> <ul> <li>654bb72: chore: provide global fetch proxied configurations with updates to web api and webhook packages</li> </ul> <h2>3.0.5</h2> <h3>Patch Changes</h3> <ul> <li>96fddbe: fix: revert multiline yaml parsing indentation change</li> </ul> <h2>3.0.4</h2> <h3>Patch Changes</h3> <ul> <li>fa03fe4: refactor: send webhooks with the <a href="https://docs.slack.dev/tools/node-slack-sdk/webhook"><code>@slack/webhook</code></a> package</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/slackapi/slack-github-action/commit/dcb1066f776dd043e64d0e8ba94ca15cc7e1875d"><code>dcb1066</code></a> chore: release</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/53861e0291660faf57ba686eabf046d5a47fa304"><code>53861e0</code></a> chore: release (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/645">#645</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/b1974f0d29f2b6150fc5a376312d365bd75fdd9b"><code>b1974f0</code></a> build!: parse yaml with more strict multiline indentation rules (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/640">#640</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/947ed0677cba8e56cf374d88bfd2d8f72aa9100c"><code>947ed06</code></a> build(deps): bump undici from 7.28.0 to 8.7.0 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/653">#653</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/03922a90c917c4d3d3b1c0f35984c2ac23955560"><code>03922a9</code></a> chore: track undici-types to the resolved undici version (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/652">#652</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/31d473e1d0da2837ee5149493a62a54103e5b45a"><code>31d473e</code></a> build(deps-dev): bump typescript from 6.0.3 to 7.0.2 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/651">#651</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/3ca6997fb72e86b0babe7037ff2ca4a5908b6148"><code>3ca6997</code></a> build(deps-dev): bump sinon and <code>@types/sinon</code> (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/649">#649</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/26a5ad3c5af9cde63a5bb0667fc9e40accce2710"><code>26a5ad3</code></a> build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/647">#647</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/5092efb0558a5d075f0dd02279f332a116a461ef"><code>5092efb</code></a> build(deps-dev): bump <code>@biomejs/biome</code> from 2.5.3 to 2.5.4 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/650">#650</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/3548c3e9500515cd56aa64222b12088f5e6bd6fe"><code>3548c3e</code></a> build(deps): bump slackapi/slack-github-action from 3.0.3 to 3.0.5 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/646">#646</a>)</li> <li>Additional commits viewable in <a href="https://github.com/slackapi/slack-github-action/compare/v3.0.3...v4.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…witching to consensus (#5959) ### Problem `FilterMsgBytes` returned an error for any `BlockResponse` once the block pool had stopped (`!r.pool.IsRunning()`). That error panicked inside `p2p/peer.go`'s `onReceive` and was recovered into `StopPeerForError` — a hard disconnect. Because requests for the last blocks are typically still in-flight when the catch-up ticker fires and `pool.Stop()` is called, both request targets (primary and secondary peer) were disconnected on every normal sync completion, exactly when the node needs them for consensus gossip. Root cause introduced by #5860 (`FilterMsgBytes`). Not covered by #5950, which handles the second-peer race while the pool is still running. ### Fix Split the single `||` guard into two branches: - `!r.enabled.Load()` — node never ran blocksync; any `BlockResponse` is genuinely unsolicited → reject (unchanged behaviour) - `!r.pool.IsRunning()` — pool stopped for consensus switch; requests we sent before the transition are still in-flight; the peers are honest → allow, but still run `validateMaxVotes` on the response The `AddBlock` call that follows returns `"already committed block"` and logs it; no peer state is mutated and no disconnect occurs. `pool.sendError` is already a no-op once the pool is stopped (it guards on `!pool.IsRunning()`), so the pre-fix punishment for genuinely out-of-window responses in this window was already silently dropped the moment `poolEventsRoutine` exited. The post-stop branch skips the `HasPendingRequestFrom` peer-identity check (any peer, not just the one we solicited, may legitimately answer a stale request) but still enforces `validateMaxVotes` — once the pool stops, any connected peer can reach this path, and the commit-signature cap exists to prevent a heap-amplification DoS regardless of sender. Caught by review on this PR; added a dedicated regression test (`rejects oversized BlockResponse after pool stops for consensus switch`) so an oversized response is still rejected in this window. --- #### PR checklist - [x] Tests written/updated - [x] Changelog entry added in `CHANGELOG.md` - [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments --------- Co-authored-by: dianab-cl <diana@cosmoslabs.io>
--- Changes DefaultBlockParams to a higher MaxBytes value in order to account for the larger size of mldsa65 signatures. Also adds comments to ensure users are aware that incorrect values can lead to chain halts and this is the expected behaviour.
--- Updates the privval's max message size to account for larger signature size of mldsa keys. #### PR checklist - [ ] Tests written/updated - [ ] Changelog entry added in `CHANGELOG.md` - [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments
…ng in the pip group across 1 directory (#5986) Bumps the pip group with 1 update in the /scripts/qa/reporting directory: [pillow](https://github.com/python-pillow/Pillow). Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/cometbft/cometbft/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
--- Bumps max tx bytes to account for the potential of larger txs due to the need to incorporate validator signatures such as IBC txns or evidence. In terms of picking a sane default, a chain w/ 100 validators all using mldsa65 signatures a `MsgSubmitMisbehaviour` which carries 2 full block headers would take ~1.5MB. 4MB here gives us plenty of overhead.
…tes (#5988) Bumps the go_modules group with 2 updates in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go) and [github.com/opencontainers/runc](https://github.com/opencontainers/runc). Updates `google.golang.org/grpc` from 1.81.1 to 1.82.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a> Change version to 1.82.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a> Cherry-pick commits (<a href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a> Change version to 1.82.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1">compare view</a></li> </ul> </details> <br /> Updates `github.com/opencontainers/runc` from 1.2.8 to 1.3.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/opencontainers/runc/releases">github.com/opencontainers/runc's releases</a>.</em></p> <blockquote> <h2>runc v1.3.5 -- "Lo viejo funciona!"</h2> <p>This is the fifth patch release of the 1.3.z release series of runc, and primarily contains a few fixes for issues found in 1.3.4.</p> <h3>Fixed</h3> <ul> <li>Recursive atime-related mount flags (rrelatime et al.) are now applied properly. (<a href="https://redirect.github.com/opencontainers/runc/issues/5115">#5115</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5098">#5098</a>)</li> <li>PR <a href="https://redirect.github.com/opencontainers/runc/issues/4757">#4757</a> caused a regression that resulted in spurious <code>cannot start a container that has stopped</code> errors when running <code>runc create</code> and has thus been reverted. (<a href="https://redirect.github.com/opencontainers/runc/issues/5158">#5158</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5153">#5153</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5151">#5151</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4645">#4645</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/4757">#4757</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Updated builds to Go 1.25, libseccomp v2.6.0. (<a href="https://redirect.github.com/opencontainers/runc/issues/5111">#5111</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5053">#5053</a>)</li> <li>Minor signing keyring updates. (<a href="https://redirect.github.com/opencontainers/runc/issues/5146">#5146</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5139">#5139</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5144">#5144</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5148">#5148</a>)</li> </ul> <h3>Static Linking Notices</h3> <p>The <code>runc</code> binary distributed with this release are <em>statically linked</em> with the following <a href="https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html">GNU LGPL-2.1</a> licensed libraries, with <code>runc</code> acting as a "work that uses the Library":</p> <ul> <li><a href="https://github.com/seccomp/libseccomp">libseccomp</a></li> </ul> <p>The versions of these libraries were not modified from their upstream versions, but in order to comply with the LGPL-2.1 (§6(a)), we have attached the complete source code for those libraries which (when combined with the attached runc source code) may be used to exercise your rights under the LGPL-2.1.</p> <p>However we strongly suggest that you make use of your distribution's packages or download them from the authoritative upstream sources, especially since these libraries are related to the security of your containers.</p> <hr /> <p>Thanks to the following contributors for making this release possible:</p> <ul> <li>Aleksa Sarai <a href="mailto:cyphar@cyphar.com">cyphar@cyphar.com</a></li> <li>Kir Kolyshkin <a href="mailto:kolyshkin@gmail.com">kolyshkin@gmail.com</a></li> <li>Li Fu Bang <a href="mailto:lifubang@acmcoder.com">lifubang@acmcoder.com</a></li> <li>Ricardo Branco <a href="mailto:rbranco@suse.de">rbranco@suse.de</a></li> </ul> <h2>runc v1.3.3 -- "奴らに支配されていた恐怖を"</h2> <blockquote> <p>[!NOTE] Some vendors were given a pre-release version of this release. This public release includes two extra patches to fix regressions discovered very late during the embargo period and were thus not included in the pre-release versions. Please update to this version.</p> </blockquote> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/opencontainers/runc/blob/main/CHANGELOG.md">github.com/opencontainers/runc's changelog</a>.</em></p> <blockquote> <h2>[1.3.6] - 2026-06-13</h2> <blockquote> <p>On no account should you allow a Vogon to read poetry at you.</p> </blockquote> <h3>Security</h3> <p>This release includes a fix for the following low-severity security issue:</p> <ul> <li> <p><a href="https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47">CVE-2026-41579</a> allowed a malicious image with a <code>/dev</code> symlink to have limited write access to the host filesystem in ways that our analysis indicates was too limited to be problematic in practice. This bug was very similar to those fixed in [CVE-2025-31133][], [CVE-2025-52565][], [CVE-2025-31133][] and was simply missed at the time when we hardened the rootfs preparation code. We have conducted a deeper audit and not found any other problematic cases.</p> <p>This patchset required backports for <a href="https://redirect.github.com/opencontainers/runc/issues/5190">#5190</a> and <a href="https://redirect.github.com/opencontainers/runc/issues/5285">#5285</a>, which were primarily code reorganisations that were already backported to runc 1.4 and 1.5.</p> </li> </ul> <h3>Fixed</h3> <ul> <li>A regression in runc v1.3.0 which can result in a stuck <code>runc exec</code> or <code>runc run</code> when the container process runs for a short time. (<a href="https://redirect.github.com/opencontainers/runc/issues/5208">#5208</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5210">#5210</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5215">#5215</a>)</li> <li>Various integration test improvements. (<a href="https://redirect.github.com/opencontainers/runc/issues/5159">#5159</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5188">#5188</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5226">#5226</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5228">#5228</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5239">#5239</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5253">#5253</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5269">#5269</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5288">#5288</a>)</li> </ul> <h3>Changed</h3> <ul> <li>When masking directories with <code>maskPaths</code>, runc will now reuse a single <code>tmpfs</code> instance (which is not writable) to reduce the number <code>tmpfs</code> superblocks that need to be reaped when containers die (in particular, Kubernetes applies masks to per-CPU sysfs directories which get expensive quickly). (<a href="https://redirect.github.com/opencontainers/runc/issues/5275">#5275</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5281">#5281</a>)</li> </ul> <h2>[1.5.0-rc.2] - 2026-04-02</h2> <blockquote> <p>いざやいざや、見に行かん</p> </blockquote> <blockquote> <p>[!NOTE] runc v1.5.0-rc.2 includes all of the patches backported to runc v1.4.2.</p> </blockquote> <h3>Fixed</h3> <ul> <li>Building with libpathrs for systems that use non-GNU awk, e.g. Debian. (<a href="https://redirect.github.com/opencontainers/runc/issues/5196">#5196</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5194">#5194</a>)</li> </ul> <h3>Added</h3> <ul> <li>Installation notes for libpathrs. (<a href="https://redirect.github.com/opencontainers/runc/issues/5199">#5199</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5195">#5195</a>)</li> <li>Support for specs.LinuxSeccompFlagWaitKillableRecv. (<a href="https://redirect.github.com/opencontainers/runc/issues/5183">#5183</a>, <a href="https://redirect.github.com/opencontainers/runc/issues/5172">#5172</a>)</li> <li>When building runc, <code>RUNC_BUILDTAGS</code> make or shell environment variable can</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/opencontainers/runc/commit/491b69bab9fa206b984fb26ba07d3110d62e671f"><code>491b69b</code></a> VERSION: release v1.3.6</li> <li><a href="https://github.com/opencontainers/runc/commit/d934454b2eb966118137b85a35518bbfb43bc4c1"><code>d934454</code></a> merge CVE-2026-41579 fixes into release-1.3</li> <li><a href="https://github.com/opencontainers/runc/commit/9432ad3a96f5fe99e5d2805f9b6807d43af639a1"><code>9432ad3</code></a> rootfs: make cgroupv1 subsystem symlinks fd-based</li> <li><a href="https://github.com/opencontainers/runc/commit/a8e53f2c6d6d25cb3dd643cc514f118aab44b097"><code>a8e53f2</code></a> rootfs: make /dev initialisation code fd-based</li> <li><a href="https://github.com/opencontainers/runc/commit/78c50d4a5f31758ada2645cb45cfbc1a3c5bb4a8"><code>78c50d4</code></a> rootfs: switch createDevices argument order</li> <li><a href="https://github.com/opencontainers/runc/commit/083e21ed0f58ad38fbe0a298783a6f25556ddfa6"><code>083e21e</code></a> libct: use preopened rootfs more</li> <li><a href="https://github.com/opencontainers/runc/commit/42cfcbe4533a094cbffd23d17dc355bbb25938a1"><code>42cfcbe</code></a> Pre-open container root directory</li> <li><a href="https://github.com/opencontainers/runc/commit/2e9b6a8a16767f09feb341918669bf2a16758e68"><code>2e9b6a8</code></a> libct: minor refactor in mountToRootfs</li> <li><a href="https://github.com/opencontainers/runc/commit/edf5328b9b91190e763c64c900fe441b8df17ea0"><code>edf5328</code></a> libct: mountCgroupV1: address TODO</li> <li><a href="https://github.com/opencontainers/runc/commit/3661a9d4b36568db23784275c115ec0db8af5e2e"><code>3661a9d</code></a> integration: add some tests for bind mount through dangling symlinks</li> <li>Additional commits viewable in <a href="https://github.com/opencontainers/runc/compare/v1.2.8...v1.3.6">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/cometbft/cometbft/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-go/releases">actions/setup-go's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/763">actions/setup-go#763</a></li> <li>chore(deps): bump <code>@actions/cache</code> to 6.2.0 by <a href="https://github.com/philip-gai"><code>@philip-gai</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/771">actions/setup-go#771</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/philip-gai"><code>@philip-gai</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/771">actions/setup-go#771</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v7.0.0">https://github.com/actions/setup-go/compare/v6...v7.0.0</a></p> <h2>v6.5.0</h2> <h2>What's Changed</h2> <h3>Dependency update</h3> <ul> <li>Upgrade actions dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/744">actions/setup-go#744</a></li> <li>Upgrade <code>@types/node</code> and typescript-eslint dependencies to resolve npm audit findings by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/755">actions/setup-go#755</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/758">actions/setup-go#758</a></li> <li>Upgrade version to 6.5.0 in package.json and package-lock.json by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/762">actions/setup-go#762</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/744">actions/setup-go#744</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/758">actions/setup-go#758</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.5.0">https://github.com/actions/setup-go/compare/v6...v6.5.0</a></p> <h2>v6.4.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add go-download-base-url input for custom Go distributions by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/727">actions/setup-go#727</a></li> </ul> <h3>Documentation update</h3> <ul> <li>Rearrange README.md, add advanced-usage.md by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/724">actions/setup-go#724</a></li> <li>Fix Microsoft build of Go link by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/734">actions/setup-go#734</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gdams"><code>@gdams</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.4.0">https://github.com/actions/setup-go/compare/v6...v6.4.0</a></p> <h2>v6.3.0</h2> <h2>What's Changed</h2> <ul> <li>Update default Go module caching to use go.mod by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/705">actions/setup-go#705</a></li> <li>Fix golang download url to go.dev by <a href="https://github.com/178inaba"><code>@178inaba</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/469">actions/setup-go#469</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.3.0">https://github.com/actions/setup-go/compare/v6...v6.3.0</a></p> <h2>v6.2.0</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-go/commit/b7ad1dad31e06c5925ef5d2fc7ad053ef454303e"><code>b7ad1da</code></a> chore(deps): bump <code>@actions/cache</code> to 6.2.0 (<a href="https://redirect.github.com/actions/setup-go/issues/771">#771</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/0778a10ce47b5d450cf60fb94fafad4330008a35"><code>0778a10</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-go/issues/763">#763</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-go/compare/v6...v7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> Co-authored-by: srdtrk <59252793+srdtrk@users.noreply.github.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1330">actions/setup-python#1330</a></li> <li>Pin SHA commits and update docs with latest versions by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1338">actions/setup-python#1338</a></li> <li>Remove the pip-install input by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1336">actions/setup-python#1336</a></li> </ul> <h3>Bug Fix</h3> <ul> <li>Fix to Classify stderr warning messages as warnings instead of errors in annotations by <a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li> <li>Validate and retry manifest fetch to prevent silent failures by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1332">actions/setup-python#1332</a></li> </ul> <h3>Dependency Upgrade</h3> <ul> <li>Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1328">actions/setup-python#1328</a></li> <li>Remove EOL Python versions and Bumps numpy text fixture by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1333">actions/setup-python#1333</a></li> <li>Upgrade <code>@actions/cache</code> to 6.2.0 by <a href="https://github.com/philip-gai"><code>@philip-gai</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li> <li><a href="https://github.com/philip-gai"><code>@philip-gai</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v7.0.0">https://github.com/actions/setup-python/compare/v6...v7.0.0</a></p> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add RHEL support and include Linux distro in cache keys by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li> <li>Fix pip cache error handling on Windows by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li> <li>Upgrade actions dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li>Upgrade dependency versions and test workflow configuration by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li> </ul> <h3>Documentation</h3> <ul> <li>Update advanced-usage.md by <a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li><a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p> <h2>v6.2.0</h2> <h2>What's Changed</h2> <h3>Dependency Upgrades</h3> <ul> <li>Upgrade dependencies to Node 24 compatible versions by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97"><code>5fda3b9</code></a> Pin SHA commits and update docs with latest versions (<a href="https://redirect.github.com/actions/setup-python/issues/1338">#1338</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e"><code>4ab7e95</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-python/issues/1337">#1337</a> from actions/philip-gai/bump-actions-cache-6-2-0</li> <li><a href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c"><code>0f3a009</code></a> Remove the pip-install input (<a href="https://redirect.github.com/actions/setup-python/issues/1336">#1336</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932"><code>f8cf429</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-python/issues/1330">#1330</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5"><code>54baeea</code></a> Validate and retry manifest fetch to prevent silent failures (<a href="https://redirect.github.com/actions/setup-python/issues/1332">#1332</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5"><code>c709277</code></a> Annotation code fix (<a href="https://redirect.github.com/actions/setup-python/issues/1335">#1335</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a"><code>6849080</code></a> remove EOL Python versions and Bumps numpy text fixture (<a href="https://redirect.github.com/actions/setup-python/issues/1333">#1333</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e"><code>0903b46</code></a> Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data (<a href="https://redirect.github.com/actions/setup-python/issues/1328">#1328</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-python/compare/v6...v7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.