build(deps): Bump the go-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #4817 · ObolNetwork/charon

dependabot · 2026-11-02T16:53:44Z

Bumps the go-dependencies group with 4 updates in the / directory: github.com/attestantio/go-builder-client, github.com/ethereum/go-ethereum, golang.org/x/net and github.com/bufbuild/buf.

Updates github.com/attestantio/go-builder-client from 0.8.0 to 0.9.1

Changelog

Sourced from github.com/attestantio/go-builder-client's changelog.

0.9.1:

regenerate ssz code with dynamic-ssz v1.4.0, matching the version required by go-eth2-client v0.30.2

0.9.0:

import gloas changes from go-eth2-client

add gloas api support for builderpreferences, builderrequest and signed builderrequest

Commits

51f5468 Merge pull request #67 from attestantio/regen-dynssz-v1.4.0
7360e18 Bump version.
1d4d258 Pin dynssz-gen install to v1.4.0 and tidy modules
91f098b Regenerate SSZ code with dynamic-ssz v1.4.0
b2ccc6a Merge pull request #66 from attestantio/gloas
d9995d2 Fix failing test too.
e5b3113 Pull in latest go-eth2-client.
1fbedf1 Gloas builder api types (#63)
e5767e8 Merge pull request #64 from attestantio/bump_eth2_gloas
6703ff0 Import gloas changes from go-eth2-client.
See full diff in compare view

Updates github.com/ethereum/go-ethereum from 1.17.8 to 1.17.10

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Soil Reducer (v1.17.10)

This is a quick release that postpones the Amsterdam fork on the Hoodi testnet, previously scheduled for Oct 26, 2026, 17:42:48 UTC. Hoodi node operators running v1.17.9 must upgrade before then. A new date will be set in a future release; other networks are unaffected.

Snap sync now switches to snap/2 automatically once Amsterdam is active. Use --snap.v2=false or --snap.v2=true to force a protocol.

Changes

Cancel the Amsterdam activation on Hoodi (#36001)

Use snap/2 automatically once Amsterdam is active (#35989)

Optimize DUP/SWAP dispatch in the interpreter (#35959)

For a full rundown of the changes please consult the Geth 1.17.10 release milestone.

As with all our previous releases, you can find the:

Pre-built binaries for all platforms on our downloads page

Docker images published under ethereum/client-go (use "stable" tag)

Ubuntu packages in our Launchpad PPA repository

macOS packages in our Homebrew Tap repository

Universal Semiconductor (v1.17.9)

This release enables the Amsterdam fork 🦩 on the Hoodi testnet at block timestamp 1793036568 (Mon, 26 Oct 2026 17:42:48 UTC).

It also contains changes to the EVM to improve the performance significantly.

This release is recommended for all users running their nodes on the Hoodi testnet.

Geth

Blsync now supports the Gloas beacon chain fork and had some bug fixes (#35956, #35385, #35957)

When running an archive node, you can now configure the transaction index history using --history.transactions flag. (#35907)

Core

Amsterdam fork is set to activate at block timestamp 1793036568. (#35974)

EVM interpreter opcode dispatching became 16% faster due to a new inlined switch implementation. (#35638)

Several fixes for database corruption on power failure (#35939, #35936)

Bug fix in trie database related to concurrent state reading (#35978)

RPC call concurrent with block processing could result in BAL corruption. (#35905)

State history committing is moved to the background, making newPayload 2% faster. (#35949)

Key-value database settings changed for improved write performance (#35691)

Fixed log index under history pruning beyond the checkpoint (#35875)

Networking

Fixed snap/2 restart issue by checking for pivot block reorg in the header chain (#35930, #35982)

... (truncated)

Commits

1df30b1 version: release 1.17.10 (#36002)
e8e61f7 cmd/evm/testdata: fix test (#36004)
c0816b8 core/types: improve transaction field validation (#36003)
1223cf3 core, params: revert schedule amsterdam fork on hoodi (#36001)
8b8bb43 cmd/utils: show automatic as the snap.v2 default in help (#35998)
6c63e48 build: upgrade -dlgo version to Go 1.27.3 (#35985)
ac7467e core/vm: fold DUP/SWAP into shared cases and fetch the next opcode per case (...
1c6b310 cmd, eth: auto-enable snapv2 with amsterdam activated (#35989)
ad4a087 version: start release cycle v1.17.10 (#35991)
9dffe6e version: release go-ethereum v1.17.9 stable (#35990)
Additional commits viewable in compare view

Updates golang.org/x/net from 0.61.0 to 0.62.0

Commits

3de643d html: check all ancestor namespace transitions when rendering raw text
05c76ee ipv4, ipv6: avoid slice bounds panics on empty batch or BPF filter
dad306f ipv6: avoid out-of-bounds panic in ICMPFilter
9c0565a ipv4: fix TTL control message parsing on big-endian Linux and Solaris
9425eb3 internal/socket, ipv4, ipv6: avoid panic on empty control message on non-Unix
4b10404 ipv4, ipv6: avoid nil parse function call in ControlMessage.Parse
afcf8cd ipv4: fix several missing bounds checks
4af4fce html: avoid quadratic complexity when coalescing text nodes
7e56200 quic: per-path connection ids
See full diff in compare view

Updates github.com/bufbuild/buf from 1.74.0 to 1.75.0

Release notes

Sourced from github.com/bufbuild/buf's releases.

v1.75.0

Fix buf build dropping message_set_wire_format, weak field options, and MessageSet extensions, and truncating MessageSet extension ranges, when a file has an unused import.

Fix LSP crash when hovering on a CEL string literal containing a byte that is not valid UTF-8, such as '\x95' in a protovalidate rule.

Add BUF_DEBUG, BUF_LOG_FORMAT, and BUF_TIMEOUT environment variables as defaults for the --debug, --log-format, and --timeout global flags. Flags take precedence when set.

Add support to images for option dependencies declared with the import option syntax in edition 2024 and later.

Add support for Protobuf edition 2026.

Update built-in Well-Known Types to Protobuf v36.2.

Update managed mode to skip cc_enable_arenas for edition 2026 files, where the option was removed.

Fix buf convert and buf curl ignoring the (pb.enumvalue.json).string option for enum value JSON names.

Changelog

Sourced from github.com/bufbuild/buf's changelog.

[v1.75.0] - 2026-10-21

Fix buf build dropping message_set_wire_format, weak field options, and MessageSet extensions, and truncating MessageSet extension ranges, when a file has an unused import.

Fix LSP crash when hovering on a CEL string literal containing a byte that is not valid UTF-8, such as '\x95' in a protovalidate rule.

Add BUF_DEBUG, BUF_LOG_FORMAT, and BUF_TIMEOUT environment variables as defaults for the --debug, --log-format, and --timeout global flags. Flags take precedence when set.

Add support to images for option dependencies declared with the import option syntax in edition 2024 and later.

Add support for Protobuf edition 2026.

Update built-in Well-Known Types to Protobuf v36.2.

Update managed mode to skip cc_enable_arenas for edition 2026 files, where the option was removed.

Fix buf convert and buf curl ignoring the (pb.enumvalue.json).string option for enum value JSON names.

Commits

1a3a05a Release v1.75.0 (#4761)
f1454f8 Bump github.com/klauspost/pgzip from 1.2.7 to 1.3.0 (#4759)
fac447e Bump connect-go v2.0.2 (#4760)
5e632f9 Ensure Dockerfile builds at latest versions (#4758)
4ef41d4 Fix handling of enum value JSON names (#4755)
61b910e Add support for edition 2026 (#4752)
7675c0e Add option dependency support to image (#4753)
4e84ec2 Fix legacy options being stripped from images when a file has an unused impor...
1c40cb3 Add environment variables as defaults for global flags (#4750)
e214652 Make upgrade (#4749)
Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/bufbuild/buf	[>= 1.73.a, < 1.74]

… updates Bumps the go-dependencies group with 4 updates in the / directory: [github.com/attestantio/go-builder-client](https://github.com/attestantio/go-builder-client), [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum), [golang.org/x/net](https://github.com/golang/net) and [github.com/bufbuild/buf](https://github.com/bufbuild/buf). Updates `github.com/attestantio/go-builder-client` from 0.8.0 to 0.9.1 - [Changelog](https://github.com/attestantio/go-builder-client/blob/master/CHANGELOG.md) - [Commits](attestantio/go-builder-client@v0.8.0...v0.9.1) Updates `github.com/ethereum/go-ethereum` from 1.17.8 to 1.17.10 - [Release notes](https://github.com/ethereum/go-ethereum/releases) - [Commits](ethereum/go-ethereum@v1.17.8...v1.17.10) Updates `golang.org/x/net` from 0.61.0 to 0.62.0 - [Commits](golang/net@v0.61.0...v0.62.0) Updates `github.com/bufbuild/buf` from 1.74.0 to 1.75.0 - [Release notes](https://github.com/bufbuild/buf/releases) - [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md) - [Commits](bufbuild/buf@v1.74.0...v1.75.0) --- updated-dependencies: - dependency-name: github.com/attestantio/go-builder-client dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/bufbuild/buf dependency-version: 1.75.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/ethereum/go-ethereum dependency-version: 1.17.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: golang.org/x/net dependency-version: 0.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

sonarqubecloud · 2026-11-05T16:26:38Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

codecov · 2026-11-05T16:39:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.77%. Comparing base (774315a) to head (7a84b32).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4817      +/-   ##
==========================================
+ Coverage   67.71%   67.77%   +0.05%     
==========================================
  Files         255      255              
  Lines       33711    33749      +38     
==========================================
+ Hits        22828    22873      +45     
+ Misses      10882    10875       -7     
  Partials        1        1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

* app: fix flaky TestStartChecker (#4654) (cherry picked from commit f0633d4) * core/tracker: fix inclusion trim underflow at chain start (#4662) * core/tracker: fix inclusion trim underflow at chain start The inclusion checker's slot arithmetic underflows on fresh chains: before genesis the wall-clock offset is negative, during the first InclCheckLag slots the checked slot goes negative, and until wall slot InclCheckLag+InclMissedLag the trim slot goes negative. The trim underflow makes Trim(huge) delete every pending submission and report each fresh duty as "duty not included on-chain", failing all early proposals on every fresh-genesis network. Skip ticks until a slot is old enough to check, and only trim once a slot can actually be declared missed. * core/tracker: check the genesis slot and deflake the regression test The zero-valued checkedSlot skipped slot 0 as already-checked; start from a MaxUint64 sentinel instead. Synchronize the chain-start regression test on the first inclusion check rather than sleeping, and pin it to the genesis slot so it covers both guards. * core/tracker: pin attestation-inclusion feature off in regression test The test wires only checkBlockFunc; disable the attestation_inclusion feature explicitly so Run cannot take the nil checkBlockAndAttsFunc path regardless of test ordering. (cherry picked from commit ad04571) * build(deps): Bump the docker-dependencies group across 2 directories with 1 update (#4661) * build(deps): Bump the docker-dependencies group across 2 directories with 1 update Bumps the docker-dependencies group with 1 update in the / directory: golang. Bumps the docker-dependencies group with 1 update in the /testutil/promrated directory: golang. Updates `golang` from 1.26.6-trixie to 1.27.0-trixie Updates `golang` from 1.26.6-trixie to 1.27.0-trixie Updates `golang` from 1.26.6-alpine to 1.27.0-alpine Updates `golang` from 1.26.6-alpine to 1.27.0-alpine --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.0-alpine dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-dependencies - dependency-name: golang dependency-version: 1.27.0-trixie dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * bump go to 1.27 * bump cockroachdb/swiss for go1.27 support --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com> (cherry picked from commit a67667d) * build(deps): Bump the go-dependencies group across 1 directory with 4 updates (#4687) Bumps the go-dependencies group with 4 updates in the / directory: [github.com/prometheus/client_model](https://github.com/prometheus/client_model), [github.com/showwin/speedtest-go](https://github.com/showwin/speedtest-go), [golang.org/x/crypto](https://github.com/golang/crypto) and [github.com/vektra/mockery/v2](https://github.com/vektra/mockery). Updates `github.com/prometheus/client_model` from 0.6.2 to 0.6.3 - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](prometheus/client_model@v0.6.2...v0.6.3) Updates `github.com/showwin/speedtest-go` from 1.8.2 to 1.8.3 - [Release notes](https://github.com/showwin/speedtest-go/releases) - [Changelog](https://github.com/showwin/speedtest-go/blob/master/docs/release.md) - [Commits](showwin/speedtest-go@v1.8.2...v1.8.3) Updates `golang.org/x/crypto` from 0.55.0 to 0.56.0 - [Commits](golang/crypto@v0.55.0...v0.56.0) Updates `github.com/vektra/mockery/v2` from 2.53.6 to 2.53.7 - [Release notes](https://github.com/vektra/mockery/releases) - [Commits](vektra/mockery@v2.53.6...v2.53.7) --- updated-dependencies: - dependency-name: github.com/prometheus/client_model dependency-version: 0.6.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/showwin/speedtest-go dependency-version: 1.8.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: golang.org/x/crypto dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/vektra/mockery/v2 dependency-version: 2.53.7 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 4eef0bd) * app/stacksnipe: redact secret flag values from exported command lines (#4688) The stack sniping collector read the full command line of every detected validator client and exported it verbatim, both as the cli_parameters label of the app_validator_stack_params gauge served on the monitoring endpoint, and as a field of a debug log line. Validator client command lines routinely carry secret material, for example keystore passwords, the paths of files holding them, and keymanager bearer tokens. Exporting them unmodified pushes that material into the metrics and log planes, whose readers and retention are usually much broader than the process table it came from. Redact the values of flags whose names look sensitive (auth, jwt, key, passphrase, password, secret, token) before the command line is logged or handed to the metrics callback. Both the "--flag value" and the "--flag=value" forms are handled, and flag names are preserved so the telemetry stays useful. A /proc cmdline is NUL separated, so redaction normally operates per argument; if the whole command line ever arrives as a single blob it is split on whitespace first, so redaction fails safe rather than passing the blob through untouched. Also warn at startup when --proc-directory is set, and note the disclosure tradeoff in the flag's help text, so the behaviour is not a surprise. The feature remains disabled by default. (cherry picked from commit d467312) * build(deps): Bump the go-dependencies group with 2 updates (#4690) Bumps the go-dependencies group with 2 updates: [golang.org/x/sync](https://github.com/golang/sync) and [golang.org/x/time](https://github.com/golang/time). Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](golang/sync@v0.22.0...v0.23.0) Updates `golang.org/x/time` from 0.15.0 to 0.16.0 - [Commits](golang/time@v0.15.0...v0.16.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/time dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 67f4b59) # Conflicts: # go.mod # go.sum * dkg/pedersen: buffer channels to not drop early bundles (#4683) * dkg/pedersen: buffer bundle channels to avoid dropping early bundles * test response and justification bundle paths (cherry picked from commit 7464e13) * dkg: retry transient p2p send failures during ceremonies (#4684) * p2p: include peer name in send errors * dkg: retry transient p2p send failures during ceremonies * p2p: address copilot review on send retries * dkg: add frost round 1 send retry test * dkg: apply 60s p2p send timeout to ceremony sends * dkg: increase ceremony send retries to 5 * p2p: bound send retries by the send timeout budget * p2p: bound stream creation by the send timeout budget * p2p: cap each send attempt at its slice of the timeout budget * p2p: bound each attempt's dial by its deadline slice * p2p: give each SendReceive attempt the full timeout, clamp negative retries * p2p: bound SendReceive by its send timeout without slicing the response wait * p2p: make send timeout per-attempt instead of a shared budget (cherry picked from commit c878ff0) * p2p: add message size, read error and concurrency metrics (#4680) * p2p: add message size and concurrency metrics * p2p: update inflight gauge under lock * p2p: cleanup idle inflight keys, observe sent after close write * p2p: consistent relay error handling, concurrency test * p2p: count direct-stream resets as read errors * p2p: observe received size before proto validation * p2p: named struct for inflight key (cherry picked from commit c6a6d42) * build(deps): Bump the go-dependencies group across 1 directory with 5 updates (#4698) Bumps the go-dependencies group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/crypto` from 0.56.0 to 0.57.0 - [Commits](golang/crypto@v0.56.0...v0.57.0) Updates `golang.org/x/net` from 0.58.0 to 0.59.0 - [Commits](golang/net@v0.58.0...v0.59.0) Updates `golang.org/x/term` from 0.45.0 to 0.46.0 - [Commits](golang/term@v0.45.0...v0.46.0) Updates `golang.org/x/text` from 0.41.0 to 0.42.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.41.0...v0.42.0) Updates `golang.org/x/tools` from 0.49.0 to 0.50.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.49.0...v0.50.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/net dependency-version: 0.59.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/term dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/text dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/tools dependency-version: 0.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 6b1e607) # Conflicts: # go.mod # go.sum * cmd/exit_sign: warn on validators with pending deposits and no index (#4702) (cherry picked from commit 1928fd0) * *: keep //nolint:revive from nolintlint false autofix (#4703) (cherry picked from commit 3f40e6c) * build(deps): Bump github.com/ethereum/go-ethereum (#4730) Bumps the go-dependencies group with 1 update: [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum). Updates `github.com/ethereum/go-ethereum` from 1.17.5 to 1.17.6 - [Release notes](https://github.com/ethereum/go-ethereum/releases) - [Commits](ethereum/go-ethereum@v1.17.5...v1.17.6) --- updated-dependencies: - dependency-name: github.com/ethereum/go-ethereum dependency-version: 1.17.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit bcd3f41) * build(deps): Bump the go-dependencies group with 7 updates (#4737) Bumps the go-dependencies group with 7 updates: | Package | From | To | | --- | --- | --- | | [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.17.6` | `1.17.7` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` | | [go.opentelemetry.io/otel/exporters/stdout/stdouttrace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` | | [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` | Updates `github.com/ethereum/go-ethereum` from 1.17.6 to 1.17.7 - [Release notes](https://github.com/ethereum/go-ethereum/releases) - [Commits](ethereum/go-ethereum@v1.17.6...v1.17.7) Updates `go.opentelemetry.io/otel` from 1.46.0 to 1.47.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.46.0 to 1.47.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.46.0 to 1.47.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0) Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.46.0 to 1.47.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0) Updates `go.opentelemetry.io/otel/sdk` from 1.46.0 to 1.47.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0) Updates `go.opentelemetry.io/otel/trace` from 1.46.0 to 1.47.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0) --- updated-dependencies: - dependency-name: github.com/ethereum/go-ethereum dependency-version: 1.17.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit ce7f7b2) * core/scheduler: fix flaky TestSchedulerWait clock rewind (#4726) (cherry picked from commit a818241) * p2p: label handler metrics from validated stream protocol (#4722) * p2p: label handler metrics from validated stream protocol * p2p: deflake metrics tests racing deferred observations (cherry picked from commit eb506a6) * p2p: restore message handler panics metric (#4706) * build(deps): Bump golang.org/x/tools (#4742) Bumps the go-dependencies group with 1 update: [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/tools` from 0.50.0 to 0.51.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.50.0...v0.51.0) --- updated-dependencies: - dependency-name: golang.org/x/tools dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 7c0ff60) * build(deps): Bump the go-dependencies group with 3 updates (#4770) Bumps the go-dependencies group with 3 updates: [github.com/drand/kyber](https://github.com/drand/kyber), [github.com/drand/kyber-bls12381](https://github.com/drand/kyber-bls12381) and [golang.org/x/sync](https://github.com/golang/sync). Updates `github.com/drand/kyber` from 1.3.2 to 1.3.3 - [Release notes](https://github.com/drand/kyber/releases) - [Commits](drand/kyber@v1.3.2...v1.3.3) Updates `github.com/drand/kyber-bls12381` from 0.3.4 to 0.3.5 - [Release notes](https://github.com/drand/kyber-bls12381/releases) - [Commits](drand/kyber-bls12381@v0.3.4...v0.3.5) Updates `golang.org/x/sync` from 0.23.0 to 0.24.0 - [Commits](golang/sync@v0.23.0...v0.24.0) --- updated-dependencies: - dependency-name: github.com/drand/kyber dependency-version: 1.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/drand/kyber-bls12381 dependency-version: 0.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: golang.org/x/sync dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 3c480a1) # Conflicts: # go.mod * app/eth2wrap: bind eth2http service lifetime to caller ctx (#4772) * app/eth2wrap: bind eth2http service lifetime to caller ctx * app/retry: retry eth2http not active and not synced errors (cherry picked from commit e76d179) * build(deps): Bump the go-dependencies group across 1 directory with 7 updates (#4778) Bumps the go-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.17.7` | `1.17.8` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` | | [golang.org/x/net](https://github.com/golang/net) | `0.60.0` | `0.61.0` | | [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` | | [golang.org/x/text](https://github.com/golang/text) | `0.42.0` | `0.43.0` | | [golang.org/x/tools](https://github.com/golang/tools) | `0.51.0` | `0.52.0` | Updates `github.com/ethereum/go-ethereum` from 1.17.7 to 1.17.8 - [Release notes](https://github.com/ethereum/go-ethereum/releases) - [Commits](ethereum/go-ethereum@v1.17.7...v1.17.8) Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.24.1...v1.25.0) Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0 - [Commits](golang/crypto@v0.57.0...v0.58.0) Updates `golang.org/x/net` from 0.60.0 to 0.61.0 - [Commits](golang/net@v0.60.0...v0.61.0) Updates `golang.org/x/term` from 0.46.0 to 0.47.0 - [Commits](golang/term@v0.46.0...v0.47.0) Updates `golang.org/x/text` from 0.42.0 to 0.43.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.42.0...v0.43.0) Updates `golang.org/x/tools` from 0.51.0 to 0.52.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.51.0...v0.52.0) --- updated-dependencies: - dependency-name: github.com/ethereum/go-ethereum dependency-version: 1.17.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/prometheus/client_golang dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/crypto dependency-version: 0.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/net dependency-version: 0.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/term dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/text dependency-version: 0.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/tools dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 6704e6a) * build(deps): Bump the go-dependencies group across 1 directory with 2 updates (#4790) * build(deps): Bump the go-dependencies group across 1 directory with 2 updates Bumps the go-dependencies group with 2 updates in the / directory: [github.com/bufbuild/buf](https://github.com/bufbuild/buf) and [github.com/vektra/mockery/v2](https://github.com/vektra/mockery). Updates `github.com/bufbuild/buf` from 1.72.0 to 1.74.0 - [Release notes](https://github.com/bufbuild/buf/releases) - [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md) - [Commits](bufbuild/buf@v1.72.0...v1.74.0) Updates `github.com/vektra/mockery/v2` from 2.53.7 to 2.53.8 - [Release notes](https://github.com/vektra/mockery/releases) - [Commits](vektra/mockery@v2.53.7...v2.53.8) --- updated-dependencies: - dependency-name: github.com/bufbuild/buf dependency-version: 1.74.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/vektra/mockery/v2 dependency-version: 2.53.8 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * *: bump go-libp2p to v0.50.0 for quic-go v0.63 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com> (cherry picked from commit dd58d17) # Conflicts: # go.mod # go.sum * core/tracker: debug log sync selection proof inconsistency (#4801) (cherry picked from commit 2b534eb) * app/obolapi: send a User-Agent and type 404s on POST (#4808) * app/obolapi: send a User-Agent and type 404s on POST * app/obolapi: make WithUserAgent override the default --------- Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com> (cherry picked from commit ae46490) * cmd: convert deposit sign withdrawal addresses to creds (#4804) * cmd: convert deposit sign withdrawal addresses to credentials charon deposit sign hex-decoded --withdrawal-addresses straight into DepositMessage.WithdrawalCredentials. A 20 byte address (as documented) was zero-padded by SSZ hashing, so operators signed and the API stored malformed deposits. Addresses are now converted to 0x01 (or 0x02 for compounding clusters) withdrawal credentials. Mixed case addresses must match their EIP-55 checksum. Full 32 byte credentials are still accepted if the prefix matches the cluster's compounding setting. deposit fetch rejects credentials from the API that are not 32 bytes. * eth2util/deposit: reuse withdrawalCredsFromAddr for 32 byte creds * cmd: test deposit sign zero address and compounding creds --------- Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com> (cherry picked from commit e7d8587) * cmd: validate addresses consistently across create and edit (#4805) Validates fee recipient and withdrawal addresses the same way in `create cluster`, `create dkg` and `edit add-validators`, and stores them in EIP-55 checksummed form. Before this, `create cluster` without a definition file skipped the withdrawal address check entirely. A zero address on mainnet or gnosis is an error in `create dkg` and a warning elsewhere (where it's legitimate, e.g. splitting the keys of validators that are already active). The "all-lowercase or all-uppercase, otherwise it must match EIP-55" rule now lives in one place, `eth2util.ValidateChecksumAddress`. It's used by these commands, by `feerecipient sign` (which wrongly rejected all-uppercase addresses) and by `deposit.WithdrawalCredsFromAddrOrCreds` (#4804). category: bug ticket: none (cherry picked from commit fd8c6fa) * build(deps): Bump the go-dependencies group across 1 directory with 4 updates (#4817) Partial backport: only golang.org/x/net v0.62.0. go-builder-client, go-eth2-client and go-ethereum v1.17.10 (requires go-eth2-client v0.30.1 and dynamic-ssz v1.4.0) are gloas-related and left out. (cherry picked from commit beea8ba) * *: bump golangci-lint to v2.14.0 (#4741) (cherry picked from commit 589fc22) * app/log: silence revive package-naming in redact.go --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: aly <16789036+aly-obol@users.noreply.github.com> Co-authored-by: Oisín Kyne <4981644+OisinKyne@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 2, 2026

dependabot Bot force-pushed the dependabot/go_modules/go-dependencies-6befcfc228 branch from 9f111cc to cb48558 Compare November 3, 2026 16:54

dependabot Bot force-pushed the dependabot/go_modules/go-dependencies-6befcfc228 branch from cb48558 to 4ca3fe5 Compare November 4, 2026 16:53

KaloyanTanev added 2 commits November 5, 2026 18:11

go.mod: hold buf at v1.74.0 until protobuf v1.37.0

d215caf

ci: retrigger PR sync

7a84b32

KaloyanTanev approved these changes Nov 5, 2026

View reviewed changes

OisinKyne approved these changes Nov 5, 2026

View reviewed changes

aly-obol merged commit beea8ba into main Nov 5, 2026
15 checks passed

aly-obol deleted the dependabot/go_modules/go-dependencies-6befcfc228 branch November 5, 2026 18:18

KaloyanTanev mentioned this pull request Nov 6, 2026

*: backport bugfixes to v1.11.4 #4824

Merged

Navigation Menu

Repository navigation

build(deps): Bump the go-dependencies group across 1 directory with 4 updates - #4817

build(deps): Bump the go-dependencies group across 1 directory with 4 updates#4817
aly-obol merged 3 commits into
mainfrom
dependabot/go_modules/go-dependencies-6befcfc228

dependabot Bot commented on behalf of github Nov 2, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Nov 5, 2026

Uh oh!

codecov Bot commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Soil Reducer (v1.17.10)

Changes

Universal Semiconductor (v1.17.9)

Geth

Core

Networking

v1.75.0

[v1.75.0] - 2026-10-21

Uh oh!

sonarqubecloud Bot commented Nov 5, 2026

Quality Gate passed

Uh oh!

codecov Bot commented Nov 5, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot Bot commented on behalf of github Nov 2, 2026 •

edited

Loading