Skip to content

*: backport bugfixes to v1.11.4 - #4824

Merged
KaloyanTanev merged 29 commits into
main-v1.11from
kalo/v1.11.4-backports
Nov 6, 2026
Merged

KaloyanTanev merged 29 commits into
main-v1.11from
kalo/v1.11.4-backports

Conversation

@KaloyanTanev

@KaloyanTanev KaloyanTanev commented Nov 6, 2026 •

Copy link
Copy Markdown
Collaborator

Backports the following to the v1.11 release branch for v1.11.4.

Bugfixes:

Tests:

Misc:

Version bumps:

#4655 and #4673 were already covered by #4674. #4803 is backported separately in #4816.

category: bug
ticket: none

KaloyanTanev and others added 28 commits November 6, 2026 12:09
* core/tracker: fix inclusion trim underflow at chain start

The inclusion checker's slot arithmetic underflows on fresh chains:
before genesis the wall-clock offset is negative, during the first
InclCheckLag slots the checked slot goes negative, and until wall slot
InclCheckLag+InclMissedLag the trim slot goes negative. The trim
underflow makes Trim(huge) delete every pending submission and report
each fresh duty as "duty not included on-chain", failing all early
proposals on every fresh-genesis network.

Skip ticks until a slot is old enough to check, and only trim once a
slot can actually be declared missed.

* core/tracker: check the genesis slot and deflake the regression test

The zero-valued checkedSlot skipped slot 0 as already-checked; start
from a MaxUint64 sentinel instead. Synchronize the chain-start
regression test on the first inclusion check rather than sleeping,
and pin it to the genesis slot so it covers both guards.

* core/tracker: pin attestation-inclusion feature off in regression test

The test wires only checkBlockFunc; disable the attestation_inclusion
feature explicitly so Run cannot take the nil checkBlockAndAttsFunc
path regardless of test ordering.

(cherry picked from commit ad04571)
…with 1 update (#4661)

* build(deps): Bump the docker-dependencies group across 2 directories with 1 update

Bumps the docker-dependencies group with 1 update in the / directory: golang.
Bumps the docker-dependencies group with 1 update in the /testutil/promrated directory: golang.

Updates `golang` from 1.26.6-trixie to 1.27.0-trixie

Updates `golang` from 1.26.6-trixie to 1.27.0-trixie

Updates `golang` from 1.26.6-alpine to 1.27.0-alpine

Updates `golang` from 1.26.6-alpine to 1.27.0-alpine

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.27.0-alpine
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-dependencies
- dependency-name: golang
  dependency-version: 1.27.0-trixie
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* bump go to 1.27

* bump cockroachdb/swiss for go1.27 support

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit a67667d)
… updates (#4687)

Bumps the go-dependencies group with 4 updates in the / directory: [github.com/prometheus/client_model](https://github.com/prometheus/client_model), [github.com/showwin/speedtest-go](https://github.com/showwin/speedtest-go), [golang.org/x/crypto](https://github.com/golang/crypto) and [github.com/vektra/mockery/v2](https://github.com/vektra/mockery).

Updates `github.com/prometheus/client_model` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/prometheus/client_model/releases)
- [Commits](prometheus/client_model@v0.6.2...v0.6.3)

Updates `github.com/showwin/speedtest-go` from 1.8.2 to 1.8.3
- [Release notes](https://github.com/showwin/speedtest-go/releases)
- [Changelog](https://github.com/showwin/speedtest-go/blob/master/docs/release.md)
- [Commits](showwin/speedtest-go@v1.8.2...v1.8.3)

Updates `golang.org/x/crypto` from 0.55.0 to 0.56.0
- [Commits](golang/crypto@v0.55.0...v0.56.0)

Updates `github.com/vektra/mockery/v2` from 2.53.6 to 2.53.7
- [Release notes](https://github.com/vektra/mockery/releases)
- [Commits](vektra/mockery@v2.53.6...v2.53.7)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_model
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/showwin/speedtest-go
  dependency-version: 1.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/vektra/mockery/v2
  dependency-version: 2.53.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 4eef0bd)
…#4688)

The stack sniping collector read the full command line of every detected
validator client and exported it verbatim, both as the cli_parameters label
of the app_validator_stack_params gauge served on the monitoring endpoint,
and as a field of a debug log line.

Validator client command lines routinely carry secret material, for example
keystore passwords, the paths of files holding them, and keymanager bearer
tokens. Exporting them unmodified pushes that material into the metrics and
log planes, whose readers and retention are usually much broader than the
process table it came from.

Redact the values of flags whose names look sensitive (auth, jwt, key,
passphrase, password, secret, token) before the command line is logged or
handed to the metrics callback. Both the "--flag value" and the
"--flag=value" forms are handled, and flag names are preserved so the
telemetry stays useful. A /proc cmdline is NUL separated, so redaction
normally operates per argument; if the whole command line ever arrives as a
single blob it is split on whitespace first, so redaction fails safe rather
than passing the blob through untouched.

Also warn at startup when --proc-directory is set, and note the disclosure
tradeoff in the flag's help text, so the behaviour is not a surprise.

The feature remains disabled by default.

(cherry picked from commit d467312)
Bumps the go-dependencies group with 2 updates: [golang.org/x/sync](https://github.com/golang/sync) and [golang.org/x/time](https://github.com/golang/time).

Updates `golang.org/x/sync` from 0.22.0 to 0.23.0
- [Commits](golang/sync@v0.22.0...v0.23.0)

Updates `golang.org/x/time` from 0.15.0 to 0.16.0
- [Commits](golang/time@v0.15.0...v0.16.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/time
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 67f4b59)

# Conflicts:
#	go.mod
#	go.sum
* dkg/pedersen: buffer bundle channels to avoid dropping early bundles

* test response and justification bundle paths

(cherry picked from commit 7464e13)
* p2p: include peer name in send errors

* dkg: retry transient p2p send failures during ceremonies

* p2p: address copilot review on send retries

* dkg: add frost round 1 send retry test

* dkg: apply 60s p2p send timeout to ceremony sends

* dkg: increase ceremony send retries to 5

* p2p: bound send retries by the send timeout budget

* p2p: bound stream creation by the send timeout budget

* p2p: cap each send attempt at its slice of the timeout budget

* p2p: bound each attempt's dial by its deadline slice

* p2p: give each SendReceive attempt the full timeout, clamp negative retries

* p2p: bound SendReceive by its send timeout without slicing the response wait

* p2p: make send timeout per-attempt instead of a shared budget

(cherry picked from commit c878ff0)
* p2p: add message size and concurrency metrics

* p2p: update inflight gauge under lock

* p2p: cleanup idle inflight keys, observe sent after close write

* p2p: consistent relay error handling, concurrency test

* p2p: count direct-stream resets as read errors

* p2p: observe received size before proto validation

* p2p: named struct for inflight key

(cherry picked from commit c6a6d42)
… updates (#4698)

Bumps the go-dependencies group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/crypto` from 0.56.0 to 0.57.0
- [Commits](golang/crypto@v0.56.0...v0.57.0)

Updates `golang.org/x/net` from 0.58.0 to 0.59.0
- [Commits](golang/net@v0.58.0...v0.59.0)

Updates `golang.org/x/term` from 0.45.0 to 0.46.0
- [Commits](golang/term@v0.45.0...v0.46.0)

Updates `golang.org/x/text` from 0.41.0 to 0.42.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.41.0...v0.42.0)

Updates `golang.org/x/tools` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.49.0...v0.50.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 6b1e607)

# Conflicts:
#	go.mod
#	go.sum
Bumps the go-dependencies group with 1 update: [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum).

Updates `github.com/ethereum/go-ethereum` from 1.17.5 to 1.17.6
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.5...v1.17.6)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit bcd3f41)
Bumps the go-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.17.6` | `1.17.7` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/stdout/stdouttrace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |

Updates `github.com/ethereum/go-ethereum` from 1.17.6 to 1.17.7
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.6...v1.17.7)

Updates `go.opentelemetry.io/otel` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/trace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit ce7f7b2)
* p2p: label handler metrics from validated stream protocol

* p2p: deflake metrics tests racing deferred observations
(cherry picked from commit eb506a6)
Bumps the go-dependencies group with 1 update: [golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/tools` from 0.50.0 to 0.51.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.50.0...v0.51.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 7c0ff60)
Bumps the go-dependencies group with 3 updates: [github.com/drand/kyber](https://github.com/drand/kyber), [github.com/drand/kyber-bls12381](https://github.com/drand/kyber-bls12381) and [golang.org/x/sync](https://github.com/golang/sync).

Updates `github.com/drand/kyber` from 1.3.2 to 1.3.3
- [Release notes](https://github.com/drand/kyber/releases)
- [Commits](drand/kyber@v1.3.2...v1.3.3)

Updates `github.com/drand/kyber-bls12381` from 0.3.4 to 0.3.5
- [Release notes](https://github.com/drand/kyber-bls12381/releases)
- [Commits](drand/kyber-bls12381@v0.3.4...v0.3.5)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](golang/sync@v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: github.com/drand/kyber
  dependency-version: 1.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/drand/kyber-bls12381
  dependency-version: 0.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 3c480a1)

# Conflicts:
#	go.mod
* app/eth2wrap: bind eth2http service lifetime to caller ctx

* app/retry: retry eth2http not active and not synced errors

(cherry picked from commit e76d179)
… updates (#4778)

Bumps the go-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.17.7` | `1.17.8` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.60.0` | `0.61.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.42.0` | `0.43.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.51.0` | `0.52.0` |

Updates `github.com/ethereum/go-ethereum` from 1.17.7 to 1.17.8
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.7...v1.17.8)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/net` from 0.60.0 to 0.61.0
- [Commits](golang/net@v0.60.0...v0.61.0)

Updates `golang.org/x/term` from 0.46.0 to 0.47.0
- [Commits](golang/term@v0.46.0...v0.47.0)

Updates `golang.org/x/text` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.42.0...v0.43.0)

Updates `golang.org/x/tools` from 0.51.0 to 0.52.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.51.0...v0.52.0)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 6704e6a)
… updates (#4790)

* build(deps): Bump the go-dependencies group across 1 directory with 2 updates

Bumps the go-dependencies group with 2 updates in the / directory: [github.com/bufbuild/buf](https://github.com/bufbuild/buf) and [github.com/vektra/mockery/v2](https://github.com/vektra/mockery).

Updates `github.com/bufbuild/buf` from 1.72.0 to 1.74.0
- [Release notes](https://github.com/bufbuild/buf/releases)
- [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md)
- [Commits](bufbuild/buf@v1.72.0...v1.74.0)

Updates `github.com/vektra/mockery/v2` from 2.53.7 to 2.53.8
- [Release notes](https://github.com/vektra/mockery/releases)
- [Commits](vektra/mockery@v2.53.7...v2.53.8)

---
updated-dependencies:
- dependency-name: github.com/bufbuild/buf
  dependency-version: 1.74.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/vektra/mockery/v2
  dependency-version: 2.53.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* *: bump go-libp2p to v0.50.0 for quic-go v0.63

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit dd58d17)

# Conflicts:
#	go.mod
#	go.sum
* app/obolapi: send a User-Agent and type 404s on POST

* app/obolapi: make WithUserAgent override the default

---------

Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit ae46490)
* cmd: convert deposit sign withdrawal addresses to credentials

charon deposit sign hex-decoded --withdrawal-addresses straight into
DepositMessage.WithdrawalCredentials. A 20 byte address (as documented)
was zero-padded by SSZ hashing, so operators signed and the API stored
malformed deposits.

Addresses are now converted to 0x01 (or 0x02 for compounding clusters)
withdrawal credentials. Mixed case addresses must match their EIP-55
checksum. Full 32 byte credentials are still accepted if the prefix
matches the cluster's compounding setting. deposit fetch rejects
credentials from the API that are not 32 bytes.

* eth2util/deposit: reuse withdrawalCredsFromAddr for 32 byte creds

* cmd: test deposit sign zero address and compounding creds

---------

Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit e7d8587)
Validates fee recipient and withdrawal addresses the same way in `create cluster`, `create dkg` and `edit add-validators`, and stores them in EIP-55 checksummed form. Before this, `create cluster` without a definition file skipped the withdrawal address check entirely. A zero address on mainnet or gnosis is an error in `create dkg` and a warning elsewhere (where it's legitimate, e.g. splitting the keys of validators that are already active).

The "all-lowercase or all-uppercase, otherwise it must match EIP-55" rule now lives in one place, `eth2util.ValidateChecksumAddress`. It's used by these commands, by `feerecipient sign` (which wrongly rejected all-uppercase addresses) and by `deposit.WithdrawalCredsFromAddrOrCreds` (#4804).

category: bug
ticket: none
(cherry picked from commit fd8c6fa)
… updates (#4817)

Partial backport: only golang.org/x/net v0.62.0. go-builder-client, go-eth2-client and go-ethereum v1.17.10 (requires go-eth2-client v0.30.1 and dynamic-ssz v1.4.0) are gloas-related and left out.

(cherry picked from commit beea8ba)
@KaloyanTanev KaloyanTanev self-assigned this Nov 6, 2026
@sonarqubecloud

sonarqubecloud Bot commented Nov 6, 2026

Copy link
Copy Markdown

@codecov

codecov Bot commented Nov 6, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 89.46136% with 45 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.88%. Comparing base (8e0bcdf) to head (0d7f1ba).
⚠️ Report is 1 commits behind head on main-v1.11.

Files with missing lines Patch % Lines
app/eth2wrap/eth2wrap_gen.go 0.00% 14 Missing ⚠️
p2p/sender.go 85.36% 6 Missing ⚠️
app/obolapi/feerecipient.go 0.00% 4 Missing ⚠️
cmd/createcluster.go 89.18% 4 Missing ⚠️
p2p/receive.go 75.00% 4 Missing ⚠️
app/app.go 0.00% 3 Missing ⚠️
cmd/exit_sign.go 94.11% 3 Missing ⚠️
core/tracker/inclusion.go 71.42% 2 Missing ⚠️
app/eth2wrap/eth2wrap.go 85.71% 1 Missing ⚠️
app/obolapi/exit.go 66.66% 1 Missing ⚠️
... and 3 more
Additional details and impacted files
@@              Coverage Diff               @@
##           main-v1.11    #4824      +/-   ##
==============================================
+ Coverage       58.48%   65.88%   +7.39%     
==============================================
  Files             248      248              
  Lines           34242    30396    -3846     
==============================================
- Hits            20026    20025       -1     
+ Misses          11739    10370    -1369     
+ Partials         2477        1    -2476     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@KaloyanTanev
KaloyanTanev merged commit 4e9ab50 into main-v1.11 Nov 6, 2026
13 checks passed
@KaloyanTanev
KaloyanTanev deleted the kalo/v1.11.4-backports branch November 6, 2026 11:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants