chore: merge unstable into epbs-devnet-0 (resolve all conflicts) by lodekeeper · Pull Request #9099 · ChainSafe/lodestar

lodekeeper · 2026-03-23T22:56:58Z

Merges unstable into epbs-devnet-0 to resolve all conflicts so PR #9091 shows a clean diff.

64 conflict files, 278 conflict blocks resolved. Build and lint pass.

Key resolution patterns:

builderIndex/blockHashFromBid removed from ProtoBlock (PR feat: add gloas execution payload envelope import pipeline #8962) → use PayloadEnvelopeInput
CheckpointWithPayload → CheckpointWithPayloadStatus (renamed on unstable)
processState → processBlockState (renamed on unstable)
SeenExecutionPayloadEnvelopes → SeenPayloadEnvelopeInput (replaced by PR feat: add gloas execution payload envelope import pipeline #8962)
processExecutionPayloadEnvelope boolean arg → opts object
index2pubkey → pubkeyCache.getOrThrow/getPubkey
PendingEnvelope removed from ExecutionStatus enum

After merging, PR #9091 (epbs-devnet-0 → unstable) will show a clean diff of 93 files, +3172/-421 — only the ePBS-specific code not yet on unstable.

**Motivation** Need to add more `metrics` to the fork choice which makes it easier to have it's own dashboard. **Description** - Create new dashboard for the forkchoice - Remove fork choice visualizations from the block processing dashboard

**Motivation** - see ChainSafe#8650 **Description** - implement `IBeaconStateView` interface - implement the `ts` `BeaconStateView` blocked by ChainSafe#8728 to build successfully --------- Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com> Co-authored-by: Cayman <caymannava@gmail.com>

- helpful towards lodestar-z integration - combining index2pubkey and pubkey2index allows them to stay synchronized by construction

…nSafe#8896) ## Summary - ~~**Await `backfillSync.close()`**: Store the internal sync loop promise and await it in `close()`, ensuring in-flight DB writes complete before shutdown continues. Moved after `network.close()` so in-flight req/resp calls are terminated first.~~ **Edit nflaig**: I removed that change, the code is unused - **Await `monitoring.close()`**: After aborting the fetch controller, await the pending HTTP request so it resolves cleanly 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com>

…ChainSafe#8948) ## Summary PeerManager.connectedPeers map was empty at startup even when libp2p already had established connections (e.g., from bootnodes). This caused STATUS not being sent to peers, violating the consensus spec requirement that the dialing client MUST send a Status request upon connection. This is the same issue addressed in PR ChainSafe#8770 (`bal-devnet-2`), ported to `unstable`. ## Changes 1. Extract core peer-tracking logic from `onLibp2pPeerConnect` into a reusable `trackLibp2pConnection()` helper 2. Add `bootstrapAlreadyOpenConnections()` that seeds `connectedPeers` from existing libp2p connections at init 3. Defer initial status/ping sweep via `setTimeout` to avoid listener-order race ## Test plan - Added E2E test verifying peers connected before PeerManager init are tracked - Type check: `pnpm --filter @lodestar/beacon-node check-types` ✅ - Validated in cross-client EPBS devnet (LH+LS): resolved immediate peer disconnect at startup Closes ChainSafe#8779 > [!NOTE] > This PR was authored with AI assistance (Claude/Codex). --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

## Summary - Add `engineNotifyForkchoiceUpdateResult` metric to track the outcome of `notifyForkchoiceUpdate` calls to the execution engine - Replace fire-and-forget `.catch()` with `.then(onSuccess, onError)` to increment the metric on success (`VALID`) or failure (`error`) - Enables operators to alert on FCU failures that could indicate EL/CL head mismatches ## Test plan - [ ] Verify TypeScript compilation passes - [ ] Confirm new metric `lodestar_execution_engine_notify_forkchoice_update_result_total` is exposed in Prometheus output - [ ] Validate metric increments on successful and failed FCU calls 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com> Co-authored-by: Lodekeeper <258435968+lodekeeper@users.noreply.github.com> Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

## Summary Migrate from libp2p v2 to libp2p v3 (`libp2p` 2.9.0 -> 3.1.3). ### Key changes **libp2p v3 dependency bumps** (some important dependencies listed here) - `libp2p` 2.9.0 -> 3.1.3 - `@libp2p/interface` ^2.7.0 -> ^3.1.0 - `@chainsafe/discv5` ^11 -> ^12, `@chainsafe/enr` ^5 -> ^6 - `@multiformats/multiaddr` ^12 -> ^13 - Migrated from `@chainsafe/libp2p-gossipsub` to `@libp2p/gossipsub` ^15 **ReqResp: Replace `it-pipe`/async-iterator pattern with `byteStream`** - Replaced `it-pipe`, `it-all`, and the `BufferedSource`/`abortableSource`/`onChunk` utilities with direct `byteStream(stream)` usage from `@libp2p/utils` - Request/response encoders now take `Stream` directly instead of being `Sink`/`Source` transforms - Removed custom `it-pipe` type declarations (`types/it-pipe/index.d.ts`) - Snappy decompression rewritten to read from `ByteStream` instead of `BufferedSource` **Gossipsub: Composition instead of inheritance** - `Eth2Gossipsub` no longer extends `GossipSub` -- it wraps an instance via composition (`this.gossipsub`) - Uses the new `gossipsub()` factory function API from `@libp2p/gossipsub` - Internal gossipsub fields (`mesh`, `peers`, `score`, `direct`, `topics`) and public methods accessed through a `GossipSubInternal` type cast **Peer management: Identify moved to post-STATUS and connection handling** - Identify is now triggered after successful STATUS exchange instead of on connection open, avoiding wasted streams on peers that close identify early or turn out to be irrelevant - Concurrent identify attempts for the same peer are deduplicated via an `identifyInProgress` map keyed by connection ID - A passive `onPeerIdentify` event listener captures identify results from libp2p (e.g. identify-push) as a fallback for peers not explicitly identified - `onLibp2pPeerConnect` preserves existing peer data (agentVersion, metadata, status, timestamps) across multiple `connection:open` events for the same peer - `onLibp2pPeerDisconnect` ignores disconnect events while other connections for the same peer remain open **libp2p v3 API changes** - Stream handler signature changed from `({connection, stream})` to `(stream, connection)` - Multiaddr API migrated to component-based: `getPeerId()`, `protoNames()`, and `tuples()` replaced with `getComponents()` - Discv5 event handler type updated (`ENRData` -> `Multiaddr`) --------- Co-authored-by: Nico Flaig <nflaig@protonmail.com> Co-authored-by: Lodekeeper <258435968+lodekeeper@users.noreply.github.com> Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

@nazarhussain

**Motivation** as previously discussed, remove bun tests entirely. Extracted from ChainSafe#8900 cc @nazarhussain

Squash merged ChainSafe#8958 and reverted ChainSafe#8955. Deployed to `feat1`

…hainSafe#8961) ## What Sets up shared [Claude Code](https://code.claude.com/) configuration for the Lodestar project. This lets any team member using Claude Code get a curated set of permissions and Lodestar-specific skills out of the box. ## Changes ### `.claude/settings.json` — Permission Allowlist Pre-approves common dev commands so Claude Code doesn't prompt for confirmation on every: - Build/lint/test: `pnpm build`, `pnpm lint`, `pnpm check-types`, `pnpm test:unit`, `pnpm vitest` - Git operations: `git diff`, `git log`, `git branch`, `git fetch`, `git checkout`, `git merge`, `git worktree` - GitHub CLI: `gh pr`, `gh issue`, `gh api`, `gh run`, `gh release` - Read-only: `grep`, `find`, `cat`, `head`, `tail`, `ls`, `curl -s http://localhost:` Denies: `rm -rf /`, `sudo` ### `.claude/skills/` — Agent Skills Three skills that Claude Code auto-discovers based on task context: | Skill | What it does | |-------|-------------| | **kurtosis-devnet** | Run multi-client devnets — setup, config reference, debugging, fork transitions, assertoor testing, example topologies | | **release-notes** | Draft release notes — style guide, changelog analysis framework, operator-facing prioritization, Discord formatting | | **local-mainnet-debug** | Debug with real mainnet peers — checkpoint sync + engineMock, metrics scraping, A/B testing, libp2p instrumentation | ### `.gitignore` Update Changed from blanket `.claude/` ignore to selective: - ✅ Tracked: `settings.json`, `skills/`, `README.md` - 🚫 Ignored: `settings.local.json`, `plans/`, `CLAUDE.local.md` This lets personal/local config stay gitignored while sharing project-level config with the team. ### Shared Plugins (External) Cross-project plugins (ethereum-rnd, consensus-clients) live in [ChainSafe/lodestar-claude-plugins](https://github.com/ChainSafe/lodestar-claude-plugins) marketplace. Instructions in `.claude/README.md`. --- > This PR was authored by Lodekeeper (AI assistant). Skills adapted from battle-tested workflows used during EPBS devnet validation, v1.36-v1.40 releases, and libp2p debugging. --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com> Co-authored-by: Cayman <caymannava@gmail.com>

In Gloas, beacon blocks are valid immediately upon receipt (builder may not reveal payload). Execution payloads arrive separately and require data availability (all sampled columns) before being valid. This PR adds: - BlockInputNoData class - immediately complete block input (no DA requirements) - DAType.NoData and DataAvailabilityStatus.NotRequired - new enum values for ePBS - ExecutionStatus.PayloadSeparated - fork choice status for blocks without embedded payloads --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

…afe#8968) ## Description Fix off-by-one in gossip clock disparity boundary checks. The clock used strict less-than (`<`) instead of less-than-or-equal (`<=`) when comparing time differences against `MAXIMUM_GOSSIP_CLOCK_DISPARITY`, causing messages arriving at exactly the disparity boundary to be incorrectly rejected. ### Spec Reference The [consensus spec](https://github.com/ethereum/consensus-specs/blob/dev/specs/phase0/p2p-interface.md#beacon_block) defines the future slot check as: ```python block_time_ms = compute_time_at_slot_ms(state, block.slot) if current_time_ms + MAXIMUM_GOSSIP_CLOCK_DISPARITY < block_time_ms: raise GossipIgnore("block is from a future slot") ``` The spec uses strict `<` for the **rejection** condition, meaning a message should be **accepted** when: ``` current_time_ms + MAXIMUM_GOSSIP_CLOCK_DISPARITY >= block_time_ms ``` Which is equivalent to: ``` block_time_ms - current_time_ms <= MAXIMUM_GOSSIP_CLOCK_DISPARITY ``` ### The Bug Our clock was checking `nextSlotTime - Date.now() < MAXIMUM_GOSSIP_CLOCK_DISPARITY` (strict `<`), but the spec requires `<=` (inclusive). At exactly the boundary (e.g. exactly 500ms before the next slot), the clock would reject the message as a future slot when the spec says it should be accepted. This was caught by the [gossip validation spec tests](https://github.com/ethereum/consensus-specs/tree/dev/tests/minimal/phase0/networking/gossip_beacon_block) which include a test pair that validates the exact boundary: - `gossip_beacon_block__valid_within_clock_disparity`: `current_time_ms: 5500`, block at slot 1 (6000ms) → gap = 500ms → **expected: valid** - `gossip_beacon_block__ignore_future_slot`: `current_time_ms: 5499`, same block → gap = 501ms → **expected: ignore** ### Changes Changed `<` to `<=` in three places in `Clock`: 1. `currentSlotWithGossipDisparity` getter 2. `isCurrentSlotGivenGossipDisparity` — next slot boundary check 3. `isCurrentSlotGivenGossipDisparity` — previous slot boundary check ### Practical Impact Minimal — this only affects messages arriving at the exact millisecond boundary of the disparity window. But it aligns our implementation with the spec. --- *This PR was authored with AI assistance (Lodekeeper 🌟).* --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

…Safe#8970) ## Problem Build fails in `packages/beacon-node/src/network/libp2p/index.ts` with 3 TypeScript errors: ``` Type 'PeerMap<...>' is not assignable to type 'PeerMap<...>'. Types have separate declarations of a private property 'map'. ``` Root cause: `@libp2p/peer-collections` has two versions in the dependency tree (7.0.10 and 7.0.11). The `PeerMap` class has private properties that make the two versions structurally incompatible at the TypeScript level. ## Fix Bump all `@libp2p/*` packages to their latest patch versions, which converge on `@libp2p/peer-collections@7.0.11`: | Package | Old | New | |---------|-----|-----| | `@libp2p/bootstrap` | 12.0.11 | 12.0.12 | | `@libp2p/gossipsub` | 15.0.12 | 15.0.13 | | `@libp2p/identify` | 4.0.10 | 4.0.11 | | `@libp2p/mdns` | 12.0.11 | 12.0.12 | | `@libp2p/mplex` | 12.0.11 | 12.0.12 | | `@libp2p/prometheus-metrics` | 5.0.10 | 5.0.11 | | `@libp2p/tcp` | 11.0.10 | 11.0.11 | | `@libp2p/interface-internal` | 3.0.10 | 3.0.11 | | `@libp2p/utils` | 7.0.10 | 7.0.11 | Also excludes `@libp2p/*` from pnpm `minimumReleaseAge` to prevent future resolution delays when new patch versions are published. ## Verification - `pnpm build` ✅ — all packages compile cleanly - `pnpm lint` ✅ — no new warnings - Only 1 version of `@libp2p/peer-collections` (7.0.11) in lockfile --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

## Summary Bump `libp2p` from `3.1.3` to `3.1.4` in Lodestar packages that pin it directly, and align reqresp peer range with the same line. ## What changed - `package.json` - `libp2p`: `3.1.3` -> `3.1.4` - `packages/beacon-node/package.json` - `libp2p`: `3.1.3` -> `3.1.4` - `packages/reqresp/package.json` - `libp2p`: `3.1.3` -> `3.1.4` - `peerDependencies.libp2p`: `^3.1.3` -> `^3.1.4` - `pnpm-lock.yaml` - refreshed after rebasing/merging latest `unstable` and conflict resolution ## Validation - `pnpm build` ✅ - `pnpm lint` ✅ (existing warning-only suppression in light-client test file) AI assistance: OpenClaw/Codex --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com>

see ethereum/consensus-specs#4902

# Gloas Fork Choice Implementation (ePBS) This PR implements most of the [Gloas fork choice specification](https://github.com/ethereum/consensus-specs/blob/v1.7.0-alpha.0/specs/gloas/fork-choice.md). Blocks can now exist in multiple payload status variants (PENDING, EMPTY, FULL), allowing the beacon chain to progress before execution payloads arrive. For high level concept please read https://devlog.lodestar.casa/gloas-fork-choice ## Key Concept: Payload Status Variants **New enum** (`packages/fork-choice/src/protoArray/interface.ts:27-32`): ```typescript enum PayloadStatus { PENDING = 0, // Canonical variant, created when beacon block arrives EMPTY = 1, // Block without execution payload FULL = 2 // Block with execution payload } ``` - **Pre-Gloas**: Only FULL exists (payload embedded in block) - **Gloas**: PENDING + EMPTY created initially, FULL added when payload arrives --- ## Major Changes ### 1. Multi-Variant Node Storage **ProtoArray indices structure** (`packages/fork-choice/src/protoArray/protoArray.ts:41-50`): ```typescript // Before: indices = Map<RootHex, number> // After: indices = Map<RootHex, number[]> // Array: [PENDING_INDEX, EMPTY_INDEX, FULL_INDEX] ``` **Pre-Gloas**: `variants[0]` = FULL index (single variant) **Gloas**: `variants[PayloadStatus.PENDING/EMPTY/FULL]` = respective indices ### 2. Block Creation (`onBlock`) **Pre-Gloas** (`packages/fork-choice/src/protoArray/protoArray.ts:428-451`): - Creates single FULL node - Parent = parent block's FULL **Gloas** (`packages/fork-choice/src/protoArray/protoArray.ts:352-428`): - Creates PENDING + EMPTY nodes - PENDING parent = parent block's EMPTY or FULL (inter-block edge, determined by `parentBlockHash`) - EMPTY parent = own PENDING (intra-block edge) - Initializes PTC votes **Fork transition**: First Gloas block's PENDING correctly points to last Fulu block's FULL. ### 3. Payload Arrival (`onExecutionPayload`) When execution payload arrives (`packages/fork-choice/src/protoArray/protoArray.ts:519-585`): - Creates FULL variant as sibling to EMPTY - FULL parent = own PENDING (intra-block edge) - Updates bestChild pointers ### 4. PTC (Payload Timeliness Committee) **New voting mechanism** (`packages/fork-choice/src/protoArray/protoArray.ts:122-151, 753-823`): ```typescript ptcVote = Map<RootHex, boolean[]> // PTC_SIZE votes per block notifyPtcMessage(blockRoot, ptcIndices[], payloadPresent) isPayloadTimely(blockRoot) // true if >50% voted yes AND FULL exists ``` Used by `shouldExtendPayload()` to determine FULL vs EMPTY preference. ### 5. Parent Payload Status Determination **`getParentPayloadStatus()`** (`packages/fork-choice/src/protoArray/protoArray.ts:173-203`): ```typescript // Compare parentBlockHash from child's bid with parent's execution hash if (block.parentBlockHash == parent.executionPayloadBlockHash) return FULL // Child extends parent with payload else return EMPTY // Child extends parent without payload ``` ### 6. Head Selection Changes **`findHead()`** (`packages/fork-choice/src/protoArray/protoArray.ts:882-946`): - Now returns **ProtoNode** instead of `RootHex` - Starts from justified checkpoint's default variant - May return PENDING/EMPTY/FULL variant **`getAncestor()`** (`packages/fork-choice/src/protoArray/protoArray.ts:1327-1401`): - Now returns **ProtoNode** instead of `RootHex` - Determines correct parent variant based on `parentBlockHash` ### 7. EMPTY vs FULL Tiebreaker For comparing variants of **same block** from slot n-1 or n (`packages/fork-choice/src/protoArray/protoArray.ts:854-874, 1132-1299`): ```typescript getPayloadStatusTiebreaker(node, currentSlot, proposerBoostRoot): if (node.payloadStatus == PENDING) return 0 if (node.slot + 1 != currentSlot) return node.payloadStatus // For slot n-1: use should_extend_payload() logic if (node.payloadStatus == EMPTY) return 1 return shouldExtendPayload(node.blockRoot, proposerBoostRoot) ? 2 : 0 ``` **`shouldExtendPayload()`** returns true if: 1. Payload is timely (PTC >50%), OR 2. No proposer boost, OR 3. Proposer boost parent ≠ this block, OR 4. Proposer boost extends FULL parent ### 8. Vote Tracking (Epoch → Slot) **Changed to slot-based tracking** (`packages/fork-choice/src/forkChoice/forkChoice.ts:99-126`): ```typescript // Before: voteNextEpochs: Epoch[] // After: voteNextSlots: Slot[] addLatestMessage(validatorIndex, nextSlot, nextRoot, nextPayloadStatus) // Queued attestations now track payload status per validator queuedAttestations: Map<Slot, Map<RootHex, Map<ValidatorIndex, PayloadStatus>>> ``` **Attestation interpretation** (Gloas) (`packages/fork-choice/src/forkChoice/forkChoice.ts:836-876`): - `slot == block.slot` → vote PENDING - `slot > block.slot && index == 0` → vote EMPTY - `slot > block.slot && index == 1` → vote FULL **Note**: `voteCurrentIndices` and `voteNextIndices` now point to **exact variant node indices**, not just block indices. ### 9. Tree Traversal (Omit Variants) All tree walking methods **filter to default variants only** to avoid noise from EMPTY/FULL siblings (`packages/fork-choice/src/protoArray/protoArray.ts:1430-1632`): ```typescript private isDefaultVariant = (node: ProtoNode): boolean => { return node.payloadStatus === this.getDefaultVariant(node.blockRoot); }; ``` **Affected methods**: - `iterateAncestorNodes()` - Only yields PENDING (Gloas) or FULL (pre-Gloas) - `getAllAncestorNodes()`, `getAllNonAncestorNodes()` - Filter to default variants - `forwardIterateDescendants()` - Uses minimum variant index **Why**: EMPTY/FULL are payload variants, not distinct branches. Including them would make chains 3x longer with redundant entries. Tree operations care about **beacon block relationships**, not payload status. ### 10. Pruning Pruning now (`packages/fork-choice/src/protoArray/protoArray.ts:964-1022`): - Removes all variants of finalized blocks - Adjusts all variant indices in the Map - Cleans up PTC votes for pruned blocks ### 11. Fork Choice API Changes - Renamed getBlock() → getBlockDefaultStatus() throughout the codebase for calls that don't specify a variant - Updated getBlock() signature to require explicit PayloadStatus parameter: getBlock(blockRoot, payloadStatus) - Added new getBlockHexAndBlockHash() method to find blocks matching both beacon block root and execution payload block ha --- ## Node Relationships ``` Pre-Gloas: Block A [FULL] → Block B [FULL] → Block C [FULL] Gloas: Block A [PENDING] → Block B [PENDING] → Block C [PENDING] ↓ ↓ ↓ [EMPTY] [EMPTY] [EMPTY] ↓ ↓ ↓ [FULL] [FULL] [FULL] Inter-block: PENDING → parent's EMPTY/FULL (based on parentBlockHash) Intra-block: EMPTY/FULL → own PENDING ``` --- ## Testing New test file `packages/fork-choice/test/unit/protoArray/gloas.test.ts` covers: - Pre-Gloas backward compatibility - Gloas block creation (PENDING + EMPTY) - Fork transition (Fulu → Gloas) - `onExecutionPayload()` (FULL creation) - PTC voting and timeliness - Parent relationships - EMPTY vs FULL tiebreaker --- ## Outstanding Items - Proposer boost --------- Co-authored-by: twoeths <10568965+twoeths@users.noreply.github.com> Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

## Summary Bump libp2p and related @libp2p/* dependencies to the latest patch releases that include the recent upstream fixes. ### Updated - libp2p: 3.1.4 -> 3.1.5 - @libp2p/identify: ^4.0.11 -> ^4.0.12 - @libp2p/utils: ^7.0.11 -> ^7.0.12 - @libp2p/prometheus-metrics: ^5.0.11 -> ^5.0.13 - plus aligned patch bumps for bootstrap/mdns/mplex/tcp/gossipsub/interface-internal Also adds `libp2p` to `minimumReleaseAgeExclude` in `pnpm-workspace.yaml` so fresh libp2p patch releases can be pulled immediately (matching existing `@libp2p/*` exclude). ## Validation - pnpm build - pnpm lint (warning-only: pre-existing unused biome suppression in packages/light-client/test/unit/webEsmBundle.browser.test.ts) --- This PR was authored with AI assistance (Lodekeeper 🌟). Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

## Summary\nPin `ethspecify` to `0.3.7` in the `check-specrefs` workflow to avoid the current regression in `0.3.8` (false `MISSING FILE` failures).\n\n## Context\nPR ChainSafe#8984 merged before the pin commit landed, so this is a standalone follow-up PR carrying only the CI pin.\n\n## Validation\n- Reproduced failure with `ethspecify==0.3.8`\n- Confirmed pass with `ethspecify==0.3.7` (`All specification references (935) are valid`) --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

## Summary - bump `fastify` from `^5.7.4` to `^5.8.1` in `@lodestar/api`, `@lodestar/beacon-node`, `@lodestar/cli`, and `@lodestar/light-client` - refresh the lockfile to pin `fastify@5.8.1` and compatible transitive updates ## Validation - `pnpm lint` (biome check passes with one pre-existing warning in `packages/light-client/test/unit/webEsmBundle.browser.test.ts`) AI assistance: Prepared with OpenClaw (Lodekeeper). Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

) After Gloas, attestation.data.index signals payload status in fork-choice: - 0 = EMPTY / not present, 1 = FULL / present - same-slot attestations must always use index = 0 --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

We need the PTC cached for previous epoch in case of epoch boundary lookups, eg. simple case is slot N block validating slot N-1 attestation ~~but also if there are deeper reorgs / missed slots.~~ (this isn't required as ptc messages are only valid for one slot). See ChainSafe#8983 for more details.

@ensi321

… writes (ChainSafe#8974) **Motivation** - in preparation for [gloas](https://github.com/ChainSafe/lodestar/pull/8962/changes#diff-31556a76147b927f6429470ca658ba8ea013b8a869566247b9410f791988454fR32), columns and block could/should be written separately - the nice thing of having a `writeDataColumnsToDb()` function is gloas has to come up with the same interface, and reuse the code, especially `waitForComputedAllData()` to keep the same functionality we introduced in [allow block import after 64 columns](ChainSafe#8818) **Description** - separate`writeBlockInputToDb()` into `writeBlockAndBlobsToDb()` and `writeDataColumnsToDb()` - new `IDataColumnsInput` interface, gloas [PayloadEnvelopeInput](https://github.com/ChainSafe/lodestar/pull/8962/changes#diff-39f10cf452f670b2fe7018b493ee4c550bb6bf19d0eac2fed0a238ed7511cf36R54) is expected to implement this cc @ensi321 - only prune `this.serializedCache.clear();` for pre-gloas, need to call that after we write `PayloadEnvelopeInput` in gloas - simplify `writeDataColumnsToDb()` to accept a single `IDataColumnsInput` instead of an array because that's what the consumer need **AI Assistance Disclosure** 🤖 Generated with [Claude Code](https://claude.ai/code) --------- Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: NC <17676176+ensi321@users.noreply.github.com>

…PIs (ChainSafe#8996) ## Motivation The Gloas fork introduced block variants (FULL/EMPTY/PENDING) that share the same `blockRoot`. Previously, traversal methods in `ProtoArray`/`ForkChoice` used `getDefaultVariant()` internally to pick a canonical variant (PENDING for Gloas, FULL for pre-Gloas). This made callers unaware of which variant was being traversed and caused ambiguity when the caller already held a specific variant. ## Changes **`packages/fork-choice`** - `iterateAncestorBlocks`, `getAllAncestorBlocks`, `getAllNonAncestorBlocks`, `getAllAncestorAndNonAncestorBlocks`, `forwardIterateDescendants`, `isDescendant` — now require an explicit `payloadStatus` parameter instead of calling `getDefaultVariant()` internally - `getAllAncestorNodes` / `getAllAncestorAndNonAncestorNodes` — PENDING variants are now explicitly filtered out from returned results (previously only pre-Gloas FULL nodes were excluded via `isGloasBlock()` check) - `isDescendant` — self-equality now also requires matching `payloadStatus`, not just matching `blockRoot` - Removed TODO comment on `forwardIterateDescendants` about payload ambiguity — resolved by explicit parameter **`packages/beacon-node`** - `CheckpointWithHex` replaced with `CheckpointWithPayload` (`CheckpointWithHex & {payloadStatus}`) in `ArchiveStore`, `archiveBlocks`, `regen`, and `chain.ts` where payload status is semantically relevant - All call sites updated to pass explicit `payloadStatus` from the `ProtoBlock` they already hold ## Test plan - [ ] `pnpm test:unit` in `packages/fork-choice` and `packages/beacon-node` - [ ] `pnpm check-types` > Note: AI-assisted (Claude Sonnet 4.6) 🤖 Generated with [Claude Code](https://claude.ai/code) --------- Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Closes ChainSafe#7618

Bumps the actions group with 13 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.0` | | [actions/github-script](https://github.com/actions/github-script) | `7.1.0` | `8.0.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `8dca8a82e2fa1a2c8908956f711300f9c4a4f4f6` | `b8d3b6e8af63cde30bdc382c0bc28114f4346c88` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.0.0` | | [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.0.0` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `c5ba7f7862a0f64c1b1a05fbac13e0b8e86ba08c` | `41ff72655975bd51cab0327fa583b6e92b6d3061` | | [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) | `531492f4dd27f0593ca398f2ed225d1b92eec828` | `ac9fbc2d852c70d7e9d305a62bdd7b1517c50e3d` | | [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages) | `4a2e02b36f31d8974a0d09d3bb9f3172aa2d0d0d` | `373f7f263a76c20808c831209c920827a82a2847` | | [amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request) | `5` | `6` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `4.6.0` | `5.5.2` | Updates `actions/checkout` from 4.3.1 to 6.0.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>v6-beta by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li> <li>update readme/changelog for v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p> <h2>v6-beta</h2> <h2>What's Changed</h2> <p>Updated persist-credentials to store the credentials under <code>$RUNNER_TEMP</code> instead of directly in the local git config.</p> <p>This requires a minimum Actions Runner version of <a href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a> to access the persisted credentials for <a href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker container action</a> scenarios.</p> <h2>v5.0.1</h2> <h2>What's Changed</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p> <h2>v5.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> <li>Prepare v5.0.0 release by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li> </ul> <h2>⚠️ Minimum Compatible Runner Version</h2> <p><strong>v2.327.1</strong><br /> <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Release Notes</a></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <h2>v4.2.0</h2> <ul> <li>Add Ref and Commit outputs by <a href="https://github.com/lucacome"><code>@lucacome</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li> <li>Dependency updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>- <a href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>, <a href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li> </ul> <h2>v4.1.7</h2> <ul> <li>Bump the minor-npm-dependencies group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li> <li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li> <li>Check out other refs/* by commit by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li> <li>Pin actions/checkout's own workflows to a known, good, stable version. by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li> </ul> <h2>v4.1.6</h2> <ul> <li>Check platform to set archive extension appropriately by <a href="https://github.com/cory-miller"><code>@cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd"><code>de0fac2</code></a> Fix tag handling: preserve annotations and explicit fetch-tags (<a href="https://redirect.github.com/actions/checkout/issues/2356">#2356</a>)</li> <li><a href="https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49"><code>064fe7f</code></a> Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...</li> <li><a href="https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8"><code>8e8c483</code></a> Clarify v6 README (<a href="https://redirect.github.com/actions/checkout/issues/2328">#2328</a>)</li> <li><a href="https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1"><code>033fa0d</code></a> Add worktree support for persist-credentials includeIf (<a href="https://redirect.github.com/actions/checkout/issues/2327">#2327</a>)</li> <li><a href="https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5"><code>c2d88d3</code></a> Update all references from v5 and v4 to v6 (<a href="https://redirect.github.com/actions/checkout/issues/2314">#2314</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a> update readme/changelog for v6 (<a href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li> <li><a href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a> v6-beta (<a href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li> <li><a href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a> Persist creds to a separate file (<a href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a> Update README to include Node.js 24 support details and requirements (<a href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li> <li><a href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a> Prepare v5.0.0 release (<a href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v4.3.1...de0fac2e4500dabe0009e67214ff5f5447ce83dd">compare view</a></li> </ul> </details> <br /> Updates `actions/cache` from 4.3.0 to 5.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v5.0.3</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p> <h2>v.5.0.2</h2> <h1>v5.0.2</h1> <h2>What's Changed</h2> <p>When creating cache entries, 429s returned from the cache service will not be retried.</p> <h2>v5.0.1</h2> <blockquote> <p>[!IMPORTANT] <strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>.</strong></p> <p>If you are using self-hosted runners, ensure they are updated before upgrading.</p> </blockquote> <hr /> <h1>v5.0.1</h1> <h2>What's Changed</h2> <ul> <li>fix: update <code>@actions/cache</code> for Node.js 24 punycode deprecation by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1685">actions/cache#1685</a></li> <li>prepare release v5.0.1 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1686">actions/cache#1686</a></li> </ul> <h1>v5.0.0</h1> <h2>What's Changed</h2> <ul> <li>Upgrade to use node24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1630">actions/cache#1630</a></li> <li>Prepare v5.0.0 release by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1684">actions/cache#1684</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.1">https://github.com/actions/cache/compare/v5...v5.0.1</a></p> <h2>v5.0.0</h2> <blockquote> <p>[!IMPORTANT] <strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>.</strong></p> <p>If you are using self-hosted runners, ensure they are updated before upgrading.</p> </blockquote> <hr /> <h2>What's Changed</h2> <ul> <li>Upgrade to use node24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1630">actions/cache#1630</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/cdf6c1fa76f9f475f3d7449005a359c84ca0f306"><code>cdf6c1f</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1695">#1695</a> from actions/Link-/prepare-5.0.3</li> <li><a href="https://github.com/actions/cache/commit/a1bee22673bee4afb9ce4e0a1dc3da1c44060b7d"><code>a1bee22</code></a> Add review for the <code>@actions/http-client</code> license</li> <li><a href="https://github.com/actions/cache/commit/46957638dc5c5ff0c34c0143f443c07d3a7c769f"><code>4695763</code></a> Add licensed output</li> <li><a href="https://github.com/actions/cache/commit/dc73bb9f7bf74a733c05ccd2edfd1f2ac9e5f502"><code>dc73bb9</code></a> Upgrade dependencies and address security warnings</li> <li><a href="https://github.com/actions/cache/commit/345d5c2f761565bace4b6da356737147e9041e3a"><code>345d5c2</code></a> Add 5.0.3 builds</li> <li><a href="https://github.com/actions/cache/commit/8b402f58fbc84540c8b491a91e594a4576fec3d7"><code>8b402f5</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1692">#1692</a> from GhadimiR/main</li> <li><a href="https://github.com/actions/cache/commit/304ab5a0701ee61908ccb4b5822347949a2e2002"><code>304ab5a</code></a> license for httpclient</li> <li><a href="https://github.com/actions/cache/commit/609fc19e67cd310e97eb36af42355843ffcb35be"><code>609fc19</code></a> Update licensed record for cache</li> <li><a href="https://github.com/actions/cache/commit/b22231e43df11a67538c05e88835f1fa097599c5"><code>b22231e</code></a> Build</li> <li><a href="https://github.com/actions/cache/commit/93150cdfb36a9d84d4e8628c8870bec84aedcf8a"><code>93150cd</code></a> Add PR link to releases</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/v4.3.0...v5.0.3">compare view</a></li> </ul> </details> <br /> Updates `actions/upload-artifact` from 4.6.2 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>v7 What's new</h2> <h3>Direct Uploads</h3> <p>Adds support for uploading single files directly (unzipped). Callers can set the new <code>archive</code> parameter to <code>false</code> to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The <code>name</code> parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.</p> <h3>ESM</h3> <p>To support new versions of the <code>@actions/*</code> packages, we've upgraded the package to ESM.</p> <h2>What's Changed</h2> <ul> <li>Add proxy integration test by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li> <li>Upgrade the module to ESM and bump dependencies by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/762">actions/upload-artifact#762</a></li> <li>Support direct file uploads by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/764">actions/upload-artifact#764</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Link"><code>@Link</code></a>- made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v6...v7.0.0">https://github.com/actions/upload-artifact/compare/v6...v7.0.0</a></p> <h2>v6.0.0</h2> <h2>v6 - What's new</h2> <blockquote> <p>[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using: node24</code>) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.</p> </blockquote> <h3>Node.js 24</h3> <p>This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.</p> <h2>What's Changed</h2> <ul> <li>Upload Artifact Node 24 support by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/719">actions/upload-artifact#719</a></li> <li>fix: update <code>@actions/artifact</code> for Node.js 24 punycode deprecation by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/744">actions/upload-artifact#744</a></li> <li>prepare release v6.0.0 for Node.js 24 support by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/745">actions/upload-artifact#745</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0">https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0</a></p> <h2>v5.0.0</h2> <h2>What's Changed</h2> <p><strong>BREAKING CHANGE:</strong> this update supports Node <code>v24.x</code>. This is not a breaking change per-se but we're treating it as such.</p> <ul> <li>Update README.md by <a href="https://github.com/GhadimiR"><code>@GhadimiR</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li> <li>Readme: spell out the first use of GHES by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li> <li>Update GHES guidance to include reference to Node 20 version by <a href="https://github.com/patrikpolyak"><code>@patrikpolyak</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li> <li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li> <li>Prepare <code>v5.0.0</code> by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/734">actions/upload-artifact#734</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"><code>bbbca2d</code></a> Support direct file uploads (<a href="https://redirect.github.com/actions/upload-artifact/issues/764">#764</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296"><code>589182c</code></a> Upgrade the module to ESM and bump dependencies (<a href="https://redirect.github.com/actions/upload-artifact/issues/762">#762</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5"><code>47309c9</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/754">#754</a> from actions/Link-/add-proxy-integration-tests</li> <li><a href="https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0"><code>02a8460</code></a> Add proxy integration test</li> <li><a href="https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f"><code>b7c566a</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/745">#745</a> from actions/upload-artifact-v6-release</li> <li><a href="https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b"><code>e516bc8</code></a> docs: correct description of Node.js 24 support in README</li> <li><a href="https://github.com/actions/upload-artifact/commit/ddc45ed9bca9b38dbd643978d88e3981cdc91415"><code>ddc45ed</code></a> docs: update README to correct action name for Node.js 24 support</li> <li><a href="https://github.com/actions/upload-artifact/commit/615b319bd27bb32c3d64dca6b6ed6974d5fbe653"><code>615b319</code></a> chore: release v6.0.0 for Node.js 24 support</li> <li><a href="https://github.com/actions/upload-artifact/commit/017748b48f8610ca8e6af1222f4a618e84a9c703"><code>017748b</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/744">#744</a> from actions/fix-storage-blob</li> <li><a href="https://github.com/actions/upload-artifact/commit/38d4c7997f5510fcc41fc4aae2a6b97becdbe7fc"><code>38d4c79</code></a> chore: rebuild dist</li> <li>Additional commits viewable in <a href="https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f">compare view</a></li> </ul> </details> <br /> Updates `actions/github-script` from 7.1.0 to 8.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/github-script/releases">actions/github-script's releases</a>.</em></p> <blockquote> <h2>v8.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update Node.js version support to 24.x by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/637">actions/github-script#637</a></li> <li>README for updating actions/github-script from v7 to v8 by <a href="https://github.com/sneha-krip"><code>@sneha-krip</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/653">actions/github-script#653</a></li> </ul> <h2>⚠️ Minimum Compatible Runner Version</h2> <p><strong>v2.327.1</strong><br /> <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Release Notes</a></p> <p>Make sure your runner is updated to this version or newer to use this release.</p> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> made their first contribution in <a href="https://redirect.github.com/actions/github-script/pull/637">actions/github-script#637</a></li> <li><a href="https://github.com/sneha-krip"><code>@sneha-krip</code></a> made their first contribution in <a href="https://redirect.github.com/actions/github-script/pull/653">actions/github-script#653</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/github-script/compare/v7.1.0...v8.0.0">https://github.com/actions/github-script/compare/v7.1.0...v8.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/github-script/commit/ed597411d8f924073f98dfc5c65a23a2325f34cd"><code>ed59741</code></a> Merge pull request <a href="https://redirect.github.com/actions/github-script/issues/653">#653</a> from actions/sneha-krip/readme-for-v8</li> <li><a href="https://github.com/actions/github-script/commit/2dc352e4baefd91bec0d06f6ae2f1045d1687ca3"><code>2dc352e</code></a> Bold minimum Actions Runner version in README</li> <li><a href="https://github.com/actions/github-script/commit/01e118c8d0d22115597e46514b5794e7bc3d56f1"><code>01e118c</code></a> Update README for Node 24 runtime requirements</li> <li><a href="https://github.com/actions/github-script/commit/8b222ac82eda86dcad7795c9d49b839f7bf5b18b"><code>8b222ac</code></a> Apply suggestion from <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a></li> <li><a href="https://github.com/actions/github-script/commit/adc0eeac992408a7b276994ca87edde1c8ce4d25"><code>adc0eea</code></a> README for updating actions/github-script from v7 to v8</li> <li><a href="https://github.com/actions/github-script/commit/20fe497b3fe0c7be8aae5c9df711ac716dc9c425"><code>20fe497</code></a> Merge pull request <a href="https://redirect.github.com/actions/github-script/issues/637">#637</a> from actions/node24</li> <li><a href="https://github.com/actions/github-script/commit/e7b7f222b11a03e8b695c4c7afba89a02ea20164"><code>e7b7f22</code></a> update licenses</li> <li><a href="https://github.com/actions/github-script/commit/2c81ba05f308415d095291e6eeffe983d822345b"><code>2c81ba0</code></a> Update Node.js version support to 24.x</li> <li>See full diff in <a href="https://github.com/actions/github-script/compare/f28e40c7f34bde8b3046d885e986cb6290c5673b...ed597411d8f924073f98dfc5c65a23a2325f34cd">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action` from 8dca8a82e2fa1a2c8908956f711300f9c4a4f4f6 to b8d3b6e8af63cde30bdc382c0bc28114f4346c88 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>Fixed <a href="https://redirect.github.com/github/codeql-action/issues/3555">a bug</a> which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. <a href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></li> <li>The CodeQL Action now loads <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom repository properties</a> on GitHub Enterprise Server, enabling the customization of features such as <code>github-codeql-disable-overlay</code> that was previously only available on GitHub.com. <a href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></li> </ul> <h2>4.32.6 - 05 Mar 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3548">#3548</a></li> </ul> <h2>4.32.5 - 02 Mar 2026</h2> <ul> <li>Repositories owned by an organization can now set up the <code>github-codeql-disable-overlay</code> custom repository property to disable <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis for CodeQL</a>. First, create a custom repository property with the name <code>github-codeql-disable-overlay</code> and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to <code>true</code> to disable improved incremental analysis. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. This feature is not yet available on GitHub Enterprise Server. <a href="https://redirect.github.com/github/codeql-action/pull/3507">#3507</a></li> <li>Added an experimental change so that when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3487">#3487</a></li> <li>The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. <a href="https://redirect.github.com/github/codeql-action/pull/3515">#3515</a></li> <li>Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. <a href="https://redirect.github.com/github/codeql-action/pull/3516">#3516</a></li> <li>Added an experimental change which lowers the minimum disk space requirement for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3498">#3498</a></li> <li>Added an experimental change which allows the <code>start-proxy</code> action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3512">#3512</a></li> <li>The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. <a href="https://redirect.github.com/github/codeql-action/pull/3503">#3503</a>, <a href="https://redirect.github.com/github/codeql-action/pull/3504">#3504</a></li> </ul> <h2>4.32.4 - 20 Feb 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2">2.24.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3493">#3493</a></li> <li>Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries are configured</a>. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. <a href="https://redirect.github.com/github/codeql-action/pull/3473">#3473</a></li> <li>When the CodeQL Action is run <a href="https://docs.github.com/en/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup">with debugging enabled in Default Setup</a> and <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries are configured</a>, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. <a href="https://redirect.github.com/github/codeql-action/pull/3486">#3486</a></li> <li>Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. <a href="https://redirect.github.com/github/codeql-action/pull/3485">#3485</a></li> <li>Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a <a href="https://github.com/dsp-testing/codeql-cli-nightlies">nightly CodeQL CLI release</a> instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. <a href="https://redirect.github.com/github/codeql-action/pull/3484">#3484</a></li> </ul> <h2>4.32.3 - 13 Feb 2026</h2> <ul> <li>Added experimental support for testing connections to <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a>. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. <a href="https://redirect.github.com/github/codeql-action/pull/3466">#3466</a></li> </ul> <h2>4.32.2 - 05 Feb 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1">2.24.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3460">#3460</a></li> </ul> <h2>4.32.1 - 02 Feb 2026</h2> <ul> <li>A warning is now shown in Default Setup workflow logs if a <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registry is configured</a> using a GitHub Personal Access Token (PAT), but no username is configured. <a href="https://redirect.github.com/github/codeql-action/pull/3422">#3422</a></li> <li>Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. <a href="https://redirect.github.com/github/codeql-action/pull/3421">#3421</a></li> </ul> <h2>4.32.0 - 26 Jan 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0">2.24.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3425">#3425</a></li> </ul> <h2>4.31.11 - 23 Jan 2026</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/github/codeql-action/compare/8dca8a82e2fa1a2c8908956f711300f9c4a4f4f6...b8d3b6e8af63cde30bdc382c0bc28114f4346c88">compare view</a></li> </ul> </details> <br /> Updates `docker/setup-buildx-action` from 3.12.0 to 4.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's releases</a>.</em></p> <blockquote> <h2>v4.0.0</h2> <ul> <li>Node 24 as default runtime (requires <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Actions Runner v2.327.1</a> or later) by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/483">docker/setup-buildx-action#483</a></li> <li>Remove deprecated inputs/outputs by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/464">docker/setup-buildx-action#464</a></li> <li>Switch to ESM and update config/test wiring by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/481">docker/setup-buildx-action#481</a></li> <li>Bump <code>@actions/core</code> from 1.11.1 to 3.0.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/475">docker/setup-buildx-action#475</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.63.0 to 0.79.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/482">docker/setup-buildx-action#482</a> <a href="https://redirect.github.com/docker/setup-buildx-action/pull/485">docker/setup-buildx-action#485</a></li> <li>Bump js-yaml from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/452">docker/setup-buildx-action#452</a></li> <li>Bump lodash from 4.17.21 to 4.17.23 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/472">docker/setup-buildx-action#472</a></li> <li>Bump minimatch from 3.1.2 to 3.1.5 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/480">docker/setup-buildx-action#480</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/setup-buildx-action/compare/v3.12.0...v4.0.0">https://github.com/docker/setup-buildx-action/compare/v3.12.0...v4.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/setup-buildx-action/commit/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd"><code>4d04d5d</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/485">#485</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/cd74e05d9bae4eeec789f90ba15dc6fb4b60ae5d"><code>cd74e05</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/eee38ec7b3ed034ee896d3e212e5d11c04562b84"><code>eee38ec</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.77.0 to 0.79.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/7a83f65b5a215b3c81b210dafdc20362bd2b4e24"><code>7a83f65</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/484">#484</a> from docker/dependabot/github_actions/docker/setup-qe...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/a5aa96747d67f62520b42af91aeb306e7374b327"><code>a5aa967</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/464">#464</a> from crazy-max/rm-deprecated</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/e73d53fa4ed86ff46faaf2b13a228d6e93c51af3"><code>e73d53f</code></a> build(deps): bump docker/setup-qemu-action from 3 to 4</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/28a438e9ed9ef7ae2ebd0bf839039005c9501312"><code>28a438e</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/483">#483</a> from crazy-max/node24</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/034e9d37dd436b56b0167bea5a11ab731413e8cf"><code>034e9d3</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/b4664d8fd0ba15ff14560ab001737c666076d5be"><code>b4664d8</code></a> remove deprecated inputs/outputs</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/a8257dec35f244ad06b4ff6c90fdd2ba97f262ba"><code>a8257de</code></a> node 24 as default runtime</li> <li>Additional commits viewable in <a href="https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 3.7.0 to 4.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.0.0</h2> <ul> <li>Node 24 as default runtime (requires <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Actions Runner v2.327.1</a> or later) by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/929">docker/login-action#929</a></li> <li>Switch to ESM and update config/test wiring by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/927">docker/login-action#927</a></li> <li>Bump <code>@actions/core</code> from 1.11.1 to 3.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/919">docker/login-action#919</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> from 3.890.0 to 3.1000.0 in <a href="https://redirect.github.com/docker/login-action/pull/909">docker/login-action#909</a> <a href="https://redirect.github.com/docker/login-action/pull/920">docker/login-action#920</a></li> <li>Bump <code>@aws-sdk/client-ecr-public</code> from 3.890.0 to 3.1000.0 in <a href="https://redirect.github.com/docker/login-action/pull/909">docker/login-action#909</a> <a href="https://redirect.github.com/docker/login-action/pull/920">docker/login-action#920</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.63.0 to 0.77.0 in <a href="https://redirect.github.com/docker/login-action/pull/910">docker/login-action#910</a> <a href="https://redirect.github.com/docker/login-action/pull/928">docker/login-action#928</a></li> <li>Bump <code>@isaacs/brace-expansion</code> from 5.0.0 to 5.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/921">docker/login-action#921</a></li> <li>Bump js-yaml from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/901">docker/login-action#901</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v3.7.0...v4.0.0">https://github.com/docker/login-action/compare/v3.7.0...v4.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/b45d80f862d83dbcd57f89517bcf500b2ab88fb2"><code>b45d80f</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/929">#929</a> from crazy-max/node24</li> <li><a href="https://github.com/docker/login-action/commit/176cb9c12abea98dfe844071c0999ff6ee9688a7"><code>176cb9c</code></a> node 24 as default runtime</li> <li><a href="https://github.com/docker/login-action/commit/cad89843109a11cb6f69f52fe695c42cf69d57d3"><code>cad8984</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/920">#920</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li> <li><a href="https://github.com/docker/login-action/commit/92cbcb231ed341e7dc71693351b21f5ba65f8349"><code>92cbcb2</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/5a2d6a71bd3e0cb4abb6faae33f3dde61ece8e5b"><code>5a2d6a7</code></a> build(deps): bump the aws-sdk-dependencies group with 2 updates</li> <li><a href="https://github.com/docker/login-action/commit/44512b6b2e08b878e82b107b394fcd1af5748e63"><code>44512b6</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/928">#928</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/login-action/commit/28737a5e46bc0c62910ef429b2e55f9cabbbd5df"><code>28737a5</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/dac079354afbd8db4c3b58b8cc6946573479b2a6"><code>dac0793</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.76.0 to 0.77.0</li> <li><a href="https://github.com/docker/login-action/commit/62029f315d6d05c8646343320e4a1552e5f1c77a"><code>62029f3</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/919">#919</a> from docker/dependabot/npm_and_yarn/actions/core-3.0.0</li> <li><a href="https://github.com/docker/login-action/commit/08c8f064bf22a1c55918ee608a81d87b13cc4461"><code>08c8f06</code></a> chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2">compare view</a></li> </ul> </details> <br /> Updates `pnpm/action-setup` from c5ba7f7862a0f64c1b1a05fbac13e0b8e86ba08c to 41ff72655975bd51cab0327fa583b6e92b6d3061 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/pnpm/action-setup/compare/c5ba7f7862a0f64c1b1a05fbac13e0b8e86ba08c...41ff72655975bd51cab0327fa583b6e92b6d3061">compare view</a></li> </ul> </details> <br /> Updates `rojopolis/spellcheck-github-actions` from 531492f4dd27f0593ca398f2ed225d1b92eec828 to ac9fbc2d852c70d7e9d305a62bdd7b1517c50e3d <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md">rojopolis/spellcheck-github-actions's changelog</a>.</em></p> <blockquote> <h1>Change Log for spellcheck-github-actions</h1> <h2>0.59.0, 2026-03-02, feature release, update recommended</h2> <ul> <li> <p>Improvements have been added to the docker entrypoint, based on a PR from <a href="https://github.com/akohout-hai"><code>@akohout-hai</code></a> which fixes an issue with handling of spaces in files names and directories, see PR <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/322">#322</a> for details. This is his first contribution to the project and I want to thank him for his contribution, which is highly appreciated.</p> </li> <li> <p>Docker based image updated to Python 3.14.3 slim trixie via PR <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/320">#320</a> from Dependabot.</p> </li> </ul> <h2>0.58.0, 2026-01-20, security release, update not required</h2> <ul> <li>A minor security issue in the dependency: pymdown-extensions, which is used by the core component PySpelling <ul> <li><a href="https://github.com/advisories/GHSA-r6h4-mm7h-8pmq">https://github.com/advisories/GHSA-r6h4-mm7h-8pmq</a></li> <li>Original issue: <a href="https://redirect.github.com/facelessuser/pymdown-extensions/issues/2716">facelessuser/pymdown-extensions#2716</a></li> </ul> </li> </ul> <h2>0.57.0, 2026-01-14, maintenance release, update not required</h2> <ul> <li>Docker based image updated to Python 3.14.2 slim trixie via PR <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/310">#310</a> from Dependabot. The version is the same, the image has had updates.</li> </ul> <h2>0.56.0, 2025-12-27, feature and maintenance release, update not required</h2> <ul> <li>Support for Portuguese (Portugal and Brazil) for both Hunspell and Aspell, requested by: <a href="https://github.com/mdiazgoncalves"><code>@mdiazgoncalves</code></a> via issue <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/298">#298</a></li> <li>Docker image updated to Python 3.14.2 trixie slim <a href="https://docs.python.org/release/3.14.2/whatsnew/changelog.html">Release notes for Python 3.14.2</a></li> </ul> <h2>0.55.0, 2025-11-27, maintenance release, update not required</h2> <ul> <li>Via an issue <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/293">#293</a> from <a href="https://github.com/shoverbj"><code>@shoverbj</code></a>, an update to the core component <strong>PySpelling</strong> from version 2.12.0 to version <code>2.12.1</code> was made, this allows for use of large dictionaries with Aspell</li> </ul> <h2>0.54.0, 2025-11-05, feature release, update not required</h2> <ul> <li> <p>PySpelling the core component has been updated to version 2.12.0, which introduces support for maximum available cores. The feature is described in the <a href="https://github.com/facelessuser/pyspelling/releases/tag/2.12.0">release notes for PySpelling 2.12.0</a>. See the <a href="https://facelessuser.github.io/pyspelling/configuration/">documentation for PySpelling</a>.</p> </li> <li> <p>The flag was introduced with <a href="https://github.com/facelessuser/pyspelling/releases/tag/2.10.0">release 2.10 of PySpelling</a>, which was adopted in release 0.36.0 of this action.</p> </li> </ul> <h2>0.53.0, 2025-10-25, maintenance release, update not required</h2> <ul> <li> <p>Docker image updated to Python 3.14.0 trixie slim <a href="https://docs.python.org/release/3.14.0/whatsnew/changelog.html">Release notes for Python 3.14.0</a>, this originated from the PR mentioned below, however updated to Trixie from Bookworm and as always the slim variant is used</p> </li> <li> <p>Bumped the requirement for cython to <code>3.0.11</code> or above, addressing a build issue with lxml, located when testing the PR : <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/274">#274</a> from <a href="https://github.com/dependabot"><code>@dependabot</code></a>, the above update of Python</p> </li> <li> <p>In general the Docker build file had a few updates since the above changes required some tweaking of the Dockerfile</p> <ul> <li>Order of installation of dependencies adjusted to ensure that lxml can build correctly</li> <li>Installation of: <ul> <li>build-essential</li> <li>pkg-config</li> <li>libxml2-dev</li> <li>libxslt1-dev</li> <li>zlib1g-dev</li> </ul> </li> </ul> </li> </ul> <h2>0.52.0, 2025-09-10, feature release, update not required</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/rojopolis/spellcheck-github-actions/compare/531492f4dd27f0593ca398f2ed225d1b92eec828...ac9fbc2d852c70d7e9d305a62bdd7b1517c50e3d">compare view</a></li> </ul> </details> <br /> Updates `peaceiris/actions-gh-pages` from 4a2e02b36f31d8974a0d09d3bb9f3172aa2d0d0d to 373f7f263a76c20808c831209c920827a82a2847 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/peaceiris/actions-gh-pages/blob/main/CHANGELOG.md">peaceiris/actions-gh-pages's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file. See <a href="https://github.com/conventional-changelog/standard-version">standard-version</a> for commit guidelines.</p> <h1><a href="https://github.com/peaceiris/actions-gh-pages/compare/v3.9.3...v4.0.0">4.0.0</a> (2024-04-08)</h1> <h3>build</h3> <ul> <li>node 20.11.1 (<a href="https://github.com/peaceiris/actions-gh-pages/commit/5049354438ced05ab8a5da89ef20fd8efff107c7">5049354</a>)</li> </ul> <h3>chore</h3> <ul> <li>bump node16 to node20 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1067">#1067</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/4eb285e828117bca26638192c3ed309c622e7bad">4eb285e</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1067">#1067</a></li> <li>downgrade engines.npm to 8.0.0 (<a href="https://github.com/peaceiris/actions-gh-pages/commit/87231bc03a428df52f90a00b3b9e6bef82f7daf9">87231bc</a>)</li> </ul> <h3>ci</h3> <ul> <li>pin node-version to 18 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/981">#981</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/65ebf11929c082120c54719c87069f0827d2084c">65ebf11</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/981">#981</a></li> </ul> <h3>docs</h3> <ul> <li>add Release Strategy (<a href="https://github.com/peaceiris/actions-gh-pages/commit/67f80d94a1668353e4733223685dcb84340c44b5">67f80d9</a>)</li> <li>fix link to Nuxt github-pages (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/980">#980</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/88b4d2aa927893f8976712406df9928468be3c88">88b4d2a</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/980">#980</a></li> <li>remove braces in if conditions (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/920">#920</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/0fbd12244217a1fa04396b8a52d911a436893771">0fbd122</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/920">#920</a></li> </ul> <h2><a href="https://github.com/peaceiris/actions-gh-pages/compare/v3.9.2...v3.9.3">3.9.3</a> (2023-03-30)</h2> <h3>docs</h3> <ul> <li>fix typo, bump hugo version (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/851">#851</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/884a0224fd48faeb3bde89519e9d612d0585a679">884a022</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/851">#851</a></li> </ul> <h3>fix</h3> <ul> <li>fix error handling (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/841">#841</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/32e33dcd3ae1d0cf56ac5a88267de6cbf0359353">32e33dc</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/841">#841</a></li> <li>update known_hosts (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/871">#871</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/31c15f03292ac100ae41a50fd3055e00d1b11a32">31c15f0</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/871">#871</a></li> </ul> <h2><a href="https://github.com/peaceiris/actions-gh-pages/compare/v3.9.1...v3.9.2">3.9.2</a> (2023-01-17)</h2> <h3>chore</h3> <ul> <li>rename cicd (<a href="https://github.com/peaceiris/actions-gh-pages/commit/32c9288f553bbcbf66869cf553c82754431faf03">32c9288</a>)</li> <li>replace npm ci with install (<a href="https://github.com/peaceiris/actions-gh-pages/commit/983978086a87d25a1ff678aa1ef4c2acc413784a">9839780</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/peaceiris/actions-gh-pages/compare/4a2e02b36f31d8974a0d09d3bb9f3172aa2d0d0d...373f7f263a76c20808c831209c920827a82a2847">compare view</a></li> </ul> </details> <br /> Updates `amannn/action-semantic-pull-request` from 5 to 6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/amannn/action-semantic-pull-request/releases">amannn/action-semantic-pull-request's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v5.5.3...v6.0.0">6.0.0</a> (2025-08-13)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>Upgrade action to use Node.js 24 and ESM (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/287">#287</a>)</li> </ul> <h3>Features</h3> <ul> <li>Upgrade action to use Node.js 24 and ESM (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/287">#287</a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/bc0c9a79abfe07c0f08c498dd4a040bd22fe9b79">bc0c9a7</a>)</li> </ul> <h2>v5.5.3</h2> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v5.5.2...v5.5.3">5.5.3</a> (2024-06-28)</h2> <h3>Bug Fixes</h3> <ul> <li>Bump <code>braces</code> dependency (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/269">#269</a>. by <a href="https://github.com/EelcoLos"><code>@EelcoLos</code></a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/2d952a1bf90a6a7ab8f0293dc86f5fdf9acb1915">2d952a1</a>)</li> </ul> <h2>v5.5.2</h2> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v5.5.1...v5.5.2">5.5.2</a> (2024-04-24)</h2> <h3>Bug Fixes</h3> <ul> <li>Bump tar from 6.1.11 to 6.2.1 (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/262">#262</a> by <a href="https://github.com/EelcoLos"><code>@EelcoLos</code></a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/9a90d5a5ac979326e3bb9272750cdd4f192ce24a">9a90d5a</a>)</li> </ul> <h2>v5.5.1</h2> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v5.5.0...v5.5.1">5.5.1</a> (2024-04-24)</h2> <h3>Bug Fixes</h3> <ul> <li>Bump ip from 2.0.0 to 2.0.1 (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/263">#263</a> by <a href="https://github.com/EelcoLos"><code>@EelcoLos</code></a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/5e7e9acca3ddc6a9d7b640fe1f905c4fff131f4a">5e7e9ac</a>)</li> </ul> <h2>v5.5.0</h2> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v5.4.0...v5.5.0">5.5.0</a> (2024-04-23)</h2> <h3>Features</h3> <ul> <li>Add outputs for <code>type</code>, <code>scope</code> and <code>subject</code> (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/261">#261</a> by <a href="https://github.com/bcaurel"><code>@bcaurel</code></a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/b05f5f6423ef5cdfc7fdff00c4c10dd9a4f54aff">b05f5f6</a>)</li> </ul> <h2>v5.4.0</h2> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v5.3.0...v5.4.0">5.4.0</a> (2023-11-03)</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/amannn/action-semantic-pull-request/blob/main/CHANGELOG.md">amannn/action-semantic-pull-request's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v6.1.0...v6.1.1">6.1.1</a> (2025-08-22)</h2> <h3>Bug Fixes</h3> <ul> <li>Parse <code>headerPatternCorrespondence</code> properly (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/295">#295</a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/800da4c97f618e44f972ff9bc21ab5daecc97773">800da4c</a>)</li> </ul> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v6.0.1...v6.1.0">6.1.0</a> (2025-08-19)</h2> <h3>Features</h3> <ul> <li>Support providing regexps for types (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/292">#292</a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/a30288bf13b78cca17c3abdc144db5977476fc8b">a30288b</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Remove trailing whitespace from "unknown release type" error message (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/291">#291</a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/afa4edb1c465fb22230da8ff4776a163ab5facdf">afa4edb</a>)</li> </ul> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v6.0.0...v6.0.1">6.0.1</a> (2025-08-13)</h2> <h3>Bug Fixes</h3> <ul> <li>Actually execute action (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/289">#289</a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/58e4ab40f59be79f2c432bf003e34a31174e977a">58e4ab4</a>)</li> </ul> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v5.5.3...v6.0.0">6.0.0</a> (2025-08-13)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>Upgrade action to use Node.js 24 and ESM (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/287">#287</a>)</li> </ul> <h3>Features</h3> <ul> <li>Upgrade action to use Node.js 24 and ESM (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/287">#287</a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/bc0c9a79abfe07c0f08c498dd4a040bd22fe9b79">bc0c9a7</a>)</li> </ul> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v5.5.2...v5.5.3">5.5.3</a> (2024-06-28)</h2> <h3>Bug Fixes</h3> <ul> <li>Bump <code>braces</code> dependency (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/269">#269</a>. by <a href="https://github.com/EelcoLos"><code>@EelcoLos</code></a>) (<a href="https://github.com/amannn/action-semantic-pull-request/commit/2d952a1bf90a6a7ab8f0293dc86f5fdf9acb1915">2d952a1</a>)</li> </ul> <h2><a href="https://github.com/amannn/action-semantic-pull-request/compare/v5.5.1...v5.5.2">5.5.2</a> (2024-04-24)</h2> <h3>Bug Fixes</h3> <ul> <li>Bump tar from 6.1.11 to 6.2.1 (<a href="https://redirect.github.com/amannn/action-semantic-pull-request/issues/262">#262</a> by <a href="https://github.com/EelcoLos"><code>@EelcoLos</…

- add `getSerializedCacheKeys()` to block input variants - more closely couple `SerializedCache` and `SeenBlockInput` - delete only relevant serialized cache object references after block input is written - remove global `SerializedCache.clear()` usage to avoid premature cache eviction

) ## Summary - Refactor `processExecutionPayloadEnvelope` to clone the beacon state before mutating it and return the post-state, matching the pattern used by `stateTransition()` - Add `dontTransferCache` option to control SSZ cache transfer behavior during clone - Update `computeEnvelopeStateRoot` and spec test runner to use the returned post-state ## Test plan - [x] `pnpm build` passes - [x] `pnpm check-types` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

**Motivation** Do not use private imports **Description** - Move shared test utils to individual packages. - Fix private imports

## Summary Bump `libp2p` and direct `@libp2p/*` dependencies in Lodestar to the latest published versions currently on npm. ### Updated direct deps - `libp2p`: `3.1.5` -> `3.1.6` - `@libp2p/bootstrap`: `^12.0.13` -> `^12.0.14` - `@libp2p/gossipsub`: `^15.0.14` -> `^15.0.15` - `@libp2p/identify`: `^4.0.12` -> `^4.0.13` - `@libp2p/mdns`: `^12.0.13` -> `^12.0.14` - `@libp2p/mplex`: `^12.0.13` -> `^12.0.14` - `@libp2p/prometheus-metrics`: `^5.0.13` -> `^5.0.14` - `@libp2p/tcp`: `^11.0.12` -> `^11.0.13` - `@libp2p/interface-internal`: `^3.0.12` -> `^3.0.13` - `@libp2p/utils`: `^7.0.12` -> `^7.0.13` Lockfile refreshed accordingly. ## Validation - `pnpm build` - `pnpm lint` *(warning-only: pre-existing unused biome suppression in `packages/light-client/test/unit/webEsmBundle.browser.test.ts`)* ## AI disclosure This PR was authored with AI assistance (Lodekeeper 🌟). Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

## Summary Follow-up to ChainSafe#9035 — `@libp2p/utils` 7.0.13 was published after the lockfile was generated, causing `pnpm install` to produce a dirty lockfile on CI. ### Changes - Regenerated `pnpm-lock.yaml` to pick up `@libp2p/utils` 7.0.12 → 7.0.13 (transitive dep of `@libp2p/peer-store`) > [!NOTE] > This PR was authored with AI assistance (Lodekeeper 🌟) Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

…oop (ChainSafe#9040) ## Description In `applyScoreChanges`, the expression `proposerBoost?.root ?? null` was being evaluated on every iteration of the second loop (which iterates over all proto-array nodes in reverse). Since `proposerBoost` does not change during the loop, this is a loop-invariant computation that can be hoisted out. This is a micro-optimization but it applies to a hot path — `applyScoreChanges` runs on every attestation/block import and iterates over all fork-choice nodes. ### Changes - Hoist `proposerBoost?.root ?? null` into a `const proposerBoostRoot` before the loop - Pass the pre-computed value to `maybeUpdateBestChildAndDescendant` > This PR was authored with AI assistance (GitHub Copilot).

@lodekeeper

…ChainSafe#9049) ## Motivation Fixes ChainSafe#8808 — Lodestar nodes running dual-stack (IPv4 + IPv6) fail to auto-discover their external IPv6 address in the ENR. ## Description Bumps `@chainsafe/discv5` to v12.0.1 ([ChainSafe/discv5#334](ChainSafe/discv5#334)) and `@chainsafe/enr` to v6.0.1. ### Root causes fixed in discv5 v12.0.1 1. **Single vote pool** — IPv4 votes reach threshold first, `addVote()` calls `clear()` which wipes accumulated IPv6 votes 2. **No immediate ping on session establishment** — first PONG votes arrive only after `pingInterval` (5 min default) 3. **IPv4-mapped IPv6 addresses pollute IPv6 pool** — some peers report IPv4 as `::ffff:x.x.x.x`, routing to the wrong pool ### Changes in this PR - Bump `@chainsafe/discv5` from `^12.0.0` to `^12.0.1` - Bump `@chainsafe/enr` from `^6.0.0` to `^6.0.1` (required by discv5 v12.0.1) - Add `@chainsafe/discv5` and `@chainsafe/enr` to `minimumReleaseAgeExclude` in `pnpm-workspace.yaml` ### Testing Ran a local Lodestar beacon node (checkpoint sync + engineMock) on mainnet with the bumped discv5: - IPv4 discovered in ~1 min ✅ - IPv6 discovered in ~2 min ✅ - Both addresses stable for 8+ minutes across all samples - 75-92 connected peers *This PR was authored by an AI contributor — @lodekeeper, with human review by @nflaig.* --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

Bumps the actions group with 7 updates: | Package | From | To | | --- | --- | --- | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.3` | | [github/codeql-action](https://github.com/github/codeql-action) | `2.28.1` | `4.33.0` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4.2.0` | `4.4.0` | | [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) | `0.32.0` | `0.60.0` | | [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages) | `3.9.3` | `4.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.0` | `8.0.1` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.5.0` | `2.6.1` | Updates `actions/cache` from 4.3.0 to 5.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v5.0.3</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p> <h2>v.5.0.2</h2> <h1>v5.0.2</h1> <h2>What's Changed</h2> <p>When creating cache entries, 429s returned from the cache service will not be retried.</p> <h2>v5.0.1</h2> <blockquote> <p>[!IMPORTANT] <strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>.</strong></p> <p>If you are using self-hosted runners, ensure they are updated before upgrading.</p> </blockquote> <hr /> <h1>v5.0.1</h1> <h2>What's Changed</h2> <ul> <li>fix: update <code>@actions/cache</code> for Node.js 24 punycode deprecation by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1685">actions/cache#1685</a></li> <li>prepare release v5.0.1 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1686">actions/cache#1686</a></li> </ul> <h1>v5.0.0</h1> <h2>What's Changed</h2> <ul> <li>Upgrade to use node24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1630">actions/cache#1630</a></li> <li>Prepare v5.0.0 release by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1684">actions/cache#1684</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.1">https://github.com/actions/cache/compare/v5...v5.0.1</a></p> <h2>v5.0.0</h2> <blockquote> <p>[!IMPORTANT] <strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>.</strong></p> <p>If you are using self-hosted runners, ensure they are updated before upgrading.</p> </blockquote> <hr /> <h2>What's Changed</h2> <ul> <li>Upgrade to use node24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1630">actions/cache#1630</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE]<br /> Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.3 <a href="https://redirect.github.com/actions/cache/pull/1692">#1692</a></li> </ul> <h3>5.0.1</h3> <ul> <li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via <code>@actions/cache@5.0.1</code> <a href="https://redirect.github.com/actions/cache/pull/1685">#1685</a></li> </ul> <h3>5.0.0</h3> <blockquote> <p>[!IMPORTANT] <code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>. If you are using self-hosted runners, ensure they are updated before upgrading.</p> </blockquote> <h3>4.3.0</h3> <ul> <li>Bump <code>@actions/cache</code> to <a href="https://redirect.github.com/actions/toolkit/pull/2132">v4.1.0</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/cdf6c1fa76f9f475f3d7449005a359c84ca0f306"><code>cdf6c1f</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1695">#1695</a> from actions/Link-/prepare-5.0.3</li> <li><a href="https://github.com/actions/cache/commit/a1bee22673bee4afb9ce4e0a1dc3da1c44060b7d"><code>a1bee22</code></a> Add review for the <code>@actions/http-client</code> license</li> <li><a href="https://github.com/actions/cache/commit/46957638dc5c5ff0c34c0143f443c07d3a7c769f"><code>4695763</code></a> Add licensed output</li> <li><a href="https://github.com/actions/cache/commit/dc73bb9f7bf74a733c05ccd2edfd1f2ac9e5f502"><code>dc73bb9</code></a> Upgrade dependencies and address security warnings</li> <li><a href="https://github.com/actions/cache/commit/345d5c2f761565bace4b6da356737147e9041e3a"><code>345d5c2</code></a> Add 5.0.3 builds</li> <li><a href="https://github.com/actions/cache/commit/8b402f58fbc84540c8b491a91e594a4576fec3d7"><code>8b402f5</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1692">#1692</a> from GhadimiR/main</li> <li><a href="https://github.com/actions/cache/commit/304ab5a0701ee61908ccb4b5822347949a2e2002"><code>304ab5a</code></a> license for httpclient</li> <li><a href="https://github.com/actions/cache/commit/609fc19e67cd310e97eb36af42355843ffcb35be"><code>609fc19</code></a> Update licensed record for cache</li> <li><a href="https://github.com/actions/cache/commit/b22231e43df11a67538c05e88835f1fa097599c5"><code>b22231e</code></a> Build</li> <li><a href="https://github.com/actions/cache/commit/93150cdfb36a9d84d4e8628c8870bec84aedcf8a"><code>93150cd</code></a> Add PR link to releases</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/v4.3.0...cdf6c1fa76f9f475f3d7449005a359c84ca0f306">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action` from 2.28.1 to 4.33.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.33.0</h2> <ul> <li> <p>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p> <p>To opt out of this change:</p> <ul> <li><strong>Repositories owned by an organization:</strong> Create a custom repository property with the name <code>github-codeql-file-coverage-on-prs</code> and the type "True/false", then set this property to <code>true</code> in the repository's settings. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. Alternatively, if you are using an advanced setup workflow, you can set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using default setup:</strong> Switch to an advanced setup workflow and set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using advanced setup:</strong> Set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> </ul> </li> <li> <p>Fixed <a href="https://redirect.github.com/github/codeql-action/issues/3555">a bug</a> which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. <a href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p> </li> <li> <p>The CodeQL Action now loads <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom repository properties</a> on GitHub Enterprise Server, enabling the customization of features such as <code>github-codeql-disable-overlay</code> that was previously only available on GitHub.com. <a href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p> </li> <li> <p>Once <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a> can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. <a href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p> </li> <li> <p>Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". <a href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p> </li> <li> <p>A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p> </li> </ul> <h2>v4.32.6</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3548">#3548</a></li> </ul> <h2>v4.32.5</h2> <ul> <li>Repositories owned by an organization can now set up the <code>github-codeql-disable-overlay</code> custom repository property to disable <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis for CodeQL</a>. First, create a custom repository property with the name <code>github-codeql-disable-overlay</code> and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to <code>true</code> to disable improved incremental analysis. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. This feature is not yet available on GitHub Enterprise Server. <a href="https://redirect.github.com/github/codeql-action/pull/3507">#3507</a></li> <li>Added an experimental change so that when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3487">#3487</a></li> <li>The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. <a href="https://redirect.github.com/github/codeql-action/pull/3515">#3515</a></li> <li>Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. <a href="https://redirect.github.com/github/codeql-action/pull/3516">#3516</a></li> <li>Added an experimental change which lowers the minimum disk space requirement for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3498">#3498</a></li> <li>Added an experimental change which allows the <code>start-proxy</code> action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3512">#3512</a></li> <li>The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. <a href="https://redirect.github.com/github/codeql-action/pull/3503">#3503</a>, <a href="https://redirect.github.com/github/codeql-action/pull/3504">#3504</a></li> </ul> <h2>v4.32.4</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2">2.24.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3493">#3493</a></li> <li>Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries are configured</a>. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. <a href="https://redirect.github.com/github/codeql-action/pull/3473">#3473</a></li> <li>When the CodeQL Action is run <a href="https://docs.github.com/en/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup">with debugging enabled in Default Setup</a> and <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries are configured</a>, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. <a href="https://redirect.github.com/github/codeql-action/pull/3486">#3486</a></li> <li>Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. <a href="https://redirect.github.com/github/codeql-action/pull/3485">#3485</a></li> <li>Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a <a href="https://github.com/dsp-testing/codeql-cli-nightlies">nightly CodeQL CLI release</a> instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. <a href="https://redirect.github.com/github/codeql-action/pull/3484">#3484</a></li> </ul> <h2>v4.32.3</h2> <ul> <li>Added experimental support for testing connections to <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a>. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. <a href="https://redirect.github.com/github/codeql-action/pull/3466">#3466</a></li> </ul> <h2>v4.32.2</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1">2.24.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3460">#3460</a></li> </ul> <h2>v4.32.1</h2> <ul> <li>A warning is now shown in Default Setup workflow logs if a <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registry is configured</a> using a GitHub Personal Access Token (PAT), but no username is configured. <a href="https://redirect.github.com/github/codeql-action/pull/3422">#3422</a></li> <li>Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. <a href="https://redirect.github.com/github/codeql-action/pull/3421">#3421</a></li> </ul> <h2>v4.32.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0">2.24.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3425">#3425</a></li> </ul> <h2>v4.31.11</h2> <ul> <li>When running a Default Setup workflow with <a href="https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging">Actions debugging enabled</a>, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. <a href="https://redirect.github.com/github/codeql-action/pull/3409">#3409</a></li> <li>Improved error handling throughout the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3415">#3415</a></li> <li>Added experimental support for automatically excluding <a href="https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github">generated files</a> from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. <a href="https://redirect.github.com/github/codeql-action/pull/3318">#3318</a></li> <li>The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. <a href="https://redirect.github.com/github/codeql-action/pull/3403">#3403</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.33.0 - 16 Mar 2026</h2> <ul> <li> <p>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p> <p>To opt out of this change:</p> <ul> <li><strong>Repositories owned by an organization:</strong> Create a custom repository property with the name <code>github-codeql-file-coverage-on-prs</code> and the type "True/false", then set this property to <code>true</code> in the repository's settings. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. Alternatively, if you are using an advanced setup workflow, you can set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using default setup:</strong> Switch to an advanced setup workflow and set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using advanced setup:</strong> Set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> </ul> </li> <li> <p>Fixed <a href="https://redirect.github.com/github/codeql-action/issues/3555">a bug</a> which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. <a href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p> </li> <li> <p>The CodeQL Action now loads <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom repository properties</a> on GitHub Enterprise Server, enabling the customization of features such as <code>github-codeql-disable-overlay</code> that was previously only available on GitHub.com. <a href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p> </li> <li> <p>Once <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a> can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. <a href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p> </li> <li> <p>Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". <a href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p> </li> <li> <p>A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p> </li> </ul> <h2>4.32.6 - 05 Mar 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3548">#3548</a></li> </ul> <h2>4.32.5 - 02 Mar 2026</h2> <ul> <li>Repositories owned by an organization can now set up the <code>github-codeql-disable-overlay</code> custom repository property to disable <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis for CodeQL</a>. First, create a custom repository property with the name <code>github-codeql-disable-overlay</code> and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to <code>true</code> to disable improved incremental analysis. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. This feature is not yet available on GitHub Enterprise Server. <a href="https://redirect.github.com/github/codeql-action/pull/3507">#3507</a></li> <li>Added an experimental change so that when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3487">#3487</a></li> <li>The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. <a href="https://redirect.github.com/github/codeql-action/pull/3515">#3515</a></li> <li>Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. <a href="https://redirect.github.com/github/codeql-action/pull/3516">#3516</a></li> <li>Added an experimental change which lowers the minimum disk space requirement for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3498">#3498</a></li> <li>Added an experimental change which allows the <code>start-proxy</code> action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3512">#3512</a></li> <li>The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. <a href="https://redirect.github.com/github/codeql-action/pull/3503">#3503</a>, <a href="https://redirect.github.com/github/codeql-action/pull/3504">#3504</a></li> </ul> <h2>4.32.4 - 20 Feb 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2">2.24.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3493">#3493</a></li> <li>Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries are configured</a>. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. <a href="https://redirect.github.com/github/codeql-action/pull/3473">#3473</a></li> <li>When the CodeQL Action is run <a href="https://docs.github.com/en/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup">with debugging enabled in Default Setup</a> and <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries are configured</a>, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. <a href="https://redirect.github.com/github/codeql-action/pull/3486">#3486</a></li> <li>Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. <a href="https://redirect.github.com/github/codeql-action/pull/3485">#3485</a></li> <li>Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a <a href="https://github.com/dsp-testing/codeql-cli-nightlies">nightly CodeQL CLI release</a> instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. <a href="https://redirect.github.com/github/codeql-action/pull/3484">#3484</a></li> </ul> <h2>4.32.3 - 13 Feb 2026</h2> <ul> <li>Added experimental support for testing connections to <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a>. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. <a href="https://redirect.github.com/github/codeql-action/pull/3466">#3466</a></li> </ul> <h2>4.32.2 - 05 Feb 2026</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/b1bff81932f5cdfc8695c7752dcee935dcd061c8"><code>b1bff81</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3574">#3574</a> from github/update-v4.32.7-7dd76e6bf</li> <li><a href="https://github.com/github/codeql-action/commit/e682234222f60d9549e37004a04a8f097bbd5798"><code>e682234</code></a> Add changelog entry for <a href="https://redirect.github.com/github/codeql-action/issues/3570">#3570</a></li> <li><a href="https://github.com/github/codeql-action/commit/95be291f41a39216811b3ce1a63a8df71d40d405"><code>95be291</code></a> Bump minor version</li> <li><a href="https://github.com/github/codeql-action/commit/59bcb6025e4788109a6bb8f7ac4ad9c6a8d6beeb"><code>59bcb60</code></a> Update changelog for v4.32.7</li> <li><a href="https://github.com/github/codeql-action/commit/7dd76e6bf79d24133aa649887a6ee01d8b063816"><code>7dd76e6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3572">#3572</a> from github/mbg/pr-checks/eslint</li> <li><a href="https://github.com/github/codeql-action/commit/e3200e331bf51e47d45a8a5645d2a125c8a8a643"><code>e3200e3</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3563">#3563</a> from github/mbg/private-registry/oidc</li> <li><a href="https://github.com/github/codeql-action/commit/4c356c71a28eb968dbcf4fb717211e82f406874f"><code>4c356c7</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3570">#3570</a> from github/mbg/repo-props/warn-on-unexpected-props</li> <li><a href="https://github.com/github/codeql-action/commit/b4937c19e53d395cc647fe16c4e00788a4e7ded3"><code>b4937c1</code></a> Only emit one message with accumulated property names</li> <li><a href="https://github.com/github/codeql-action/commit/136b8ab3777165e3ec7a19faa7ef9732ace305da"><code>136b8ab</code></a> Remove <code>cache-dependency-path</code> options as well</li> <li><a href="https://github.com/github/codeql-action/commit/a5aba5952cd5add76ec9f971654d61461a3ac2bd"><code>a5aba59</code></a> Remove <code>package-lock.json</code> that's no longer needed</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/b8d3b6e8af63cde30bdc382c0bc28114f4346c88...b1bff81932f5cdfc8695c7752dcee935dcd061c8">compare view</a></li> </ul> </details> <br /> Updates `pnpm/action-setup` from 4.2.0 to 4.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pnpm/action-setup/releases">pnpm/action-setup's releases</a>.</em></p> <blockquote> <h2>v4.4.0</h2> <p>Updated the action to use Node.js 24.</p> <h2>v4.3.0</h2> <h2>What's Changed</h2> <ul> <li>docs: fix the run_install example in the Readme by <a href="https://github.com/dreyks"><code>@dreyks</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/175">pnpm/action-setup#175</a></li> <li>chore: remove unused <code>@types/node-fetch</code> dependency by <a href="https://github.com/silverwind"><code>@silverwind</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/186">pnpm/action-setup#186</a></li> <li>Clarify that package_json_file is relative to GITHUB_WORKSPACE by <a href="https://github.com/chris-martin"><code>@chris-martin</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/184">pnpm/action-setup#184</a></li> <li>feat: store caching by <a href="https://github.com/jrmajor"><code>@jrmajor</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/188">pnpm/action-setup#188</a></li> <li>refactor: remove star imports by <a href="https://github.com/KSXGitHub"><code>@KSXGitHub</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/196">pnpm/action-setup#196</a></li> <li>fix(ci): exclude macos by <a href="https://github.com/KSXGitHub"><code>@KSXGitHub</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/197">pnpm/action-setup#197</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dreyks"><code>@dreyks</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/175">pnpm/action-setup#175</a></li> <li><a href="https://github.com/silverwind"><code>@silverwind</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/186">pnpm/action-setup#186</a></li> <li><a href="https://github.com/chris-martin"><code>@chris-martin</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/184">pnpm/action-setup#184</a></li> <li><a href="https://github.com/jrmajor"><code>@jrmajor</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/188">pnpm/action-setup#188</a></li> <li><a href="https://github.com/Boosted-Bonobo"><code>@Boosted-Bonobo</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/199">pnpm/action-setup#199</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v4.2.0...v4.3.0">https://github.com/pnpm/action-setup/compare/v4.2.0...v4.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pnpm/action-setup/commit/fc06bc1257f339d1d5d8b3a19a8cae5388b55320"><code>fc06bc1</code></a> feat!: run the action on Node.js 24 (<a href="https://redirect.github.com/pnpm/action-setup/issues/205">#205</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/b906affcce14559ad1aafd4ab0e942779e9f58b1"><code>b906aff</code></a> Revert "feat!: run the action on Node.js 24 (<a href="https://redirect.github.com/pnpm/action-setup/issues/205">#205</a>)"</li> <li><a href="https://github.com/pnpm/action-setup/commit/9b5745cdf0a2e8c2620f0746130f809adb911c19"><code>9b5745c</code></a> feat!: run the action on Node.js 24 (<a href="https://redirect.github.com/pnpm/action-setup/issues/205">#205</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/1e1c8eafbd745f64b1ef30a7d7ed7965034c486c"><code>1e1c8ea</code></a> ci: pin github actions (<a href="https://redirect.github.com/pnpm/action-setup/issues/199">#199</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/b9e1dbc72ff7358f971cc0b7c62c7a0d83f1068b"><code>b9e1dbc</code></a> fix(ci): exclude macos (<a href="https://redirect.github.com/pnpm/action-setup/issues/197">#197</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/61bc82c7df449f480d8aa43c14cfced3c0aec42b"><code>61bc82c</code></a> refactor: remove star imports (<a href="https://redirect.github.com/pnpm/action-setup/issues/196">#196</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/e94b270858c939f4f8b43f5c1438fa1d9a67ad5d"><code>e94b270</code></a> feat: store caching (<a href="https://redirect.github.com/pnpm/action-setup/issues/188">#188</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/ee7b8711bd8dd0954f5783b045bb929cd6db2764"><code>ee7b871</code></a> Clarify that package_json_file is relative to GITHUB_WORKSPACE (<a href="https://redirect.github.com/pnpm/action-setup/issues/184">#184</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/3a0024f0665291c8c6c9957134b033a5e639e837"><code>3a0024f</code></a> Remove unused <code>@types/node-fetch</code> dependency (<a href="https://redirect.github.com/pnpm/action-setup/issues/186">#186</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/72f04517b7dbf772394a70a3066a5fd9811b0491"><code>72f0451</code></a> Update README.md (<a href="https://redirect.github.com/pnpm/action-setup/issues/175">#175</a>)</li> <li>See full diff in <a href="https://github.com/pnpm/action-setup/compare/41ff72655975bd51cab0327fa583b6e92b6d3061...fc06bc1257f339d1d5d8b3a19a8cae5388b55320">compare view</a></li> </ul> </details> <br /> Updates `rojopolis/spellcheck-github-actions` from 0.32.0 to 0.60.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rojopolis/spellcheck-github-actions/releases">rojopolis/spellcheck-github-actions's releases</a>.</em></p> <blockquote> <h2>0.60.0</h2> <h2>What's Changed</h2> <ul> <li>Bump rojopolis/spellcheck-github-actions from 0.58.0 to 0.59.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/327">rojopolis/spellcheck-github-actions#327</a></li> <li>Bump actions/upload-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/326">rojopolis/spellcheck-github-actions#326</a></li> <li>Bump docker/metadata-action from 5.10.0 to 6.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/332">rojopolis/spellcheck-github-actions#332</a></li> <li>Bump docker/login-action from 3.7.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/333">rojopolis/spellcheck-github-actions#333</a></li> <li>Bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/329">rojopolis/spellcheck-github-actions#329</a></li> <li>Bump docker/build-push-action from 6.19.2 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/330">rojopolis/spellcheck-github-actions#330</a></li> <li>Bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/331">rojopolis/spellcheck-github-actions#331</a></li> <li>Bump python from <code>486b809</code> to <code>6a27522</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/325">rojopolis/spellcheck-github-actions#325</a></li> <li>More correct error message, issue <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/328">#328</a> by <a href="https://github.com/jonasbn"><code>@jonasbn</code></a> in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/334">rojopolis/spellcheck-github-actions#334</a></li> <li>Preparing release 0.60.0 by <a href="https://github.com/jonasbn"><code>@jonasbn</code></a> in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/335">rojopolis/spellcheck-github-actions#335</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rojopolis/spellcheck-github-actions/compare/0.59.0...0.60.0">https://github.com/rojopolis/spellcheck-github-actions/compare/0.59.0...0.60.0</a></p> <h2>0.59.0</h2> <h2>What's Changed</h2> <ul> <li>Bump rojopolis/spellcheck-github-actions from 0.57.0 to 0.58.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/318">rojopolis/spellcheck-github-actions#318</a></li> <li>Bump actions/checkout from 6.0.1 to 6.0.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/317">rojopolis/spellcheck-github-actions#317</a></li> <li>Bump docker/login-action from 3.6.0 to 3.7.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/319">rojopolis/spellcheck-github-actions#319</a></li> <li>Bump docker/build-push-action from 6.18.0 to 6.19.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/321">rojopolis/spellcheck-github-actions#321</a></li> <li>Support spaces in file names by <a href="https://github.com/akohout-hai"><code>@akohout-hai</code></a> in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/322">rojopolis/spellcheck-github-actions#322</a></li> <li>Bump python from 3.14.2-slim-trixie to 3.14.3-slim-trixie by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/320">rojopolis/spellcheck-github-actions#320</a></li> <li>release 0.59.0 by <a href="https://github.com/jonasbn"><code>@jonasbn</code></a> in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/323">rojopolis/spellcheck-github-actions#323</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/akohout-hai"><code>@akohout-hai</code></a> made their first contribution in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/322">rojopolis/spellcheck-github-actions#322</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rojopolis/spellcheck-github-actions/compare/0.58.0...0.59.0">https://github.com/rojopolis/spellcheck-github-actions/compare/0.58.0...0.59.0</a></p> <h2>0.58.0</h2> <h2>What's Changed</h2> <ul> <li>Security patch for dependency pymdown-extensions by <a href="https://github.com/jonasbn"><code>@jonasbn</code></a> in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/313">rojopolis/spellcheck-github-actions#313</a></li> <li>Bump rojopolis/spellcheck-github-actions from 0.56.0 to 0.57.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/315">rojopolis/spellcheck-github-actions#315</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rojopolis/spellcheck-github-actions/compare/0.57.0...0.58.0">https://github.com/rojopolis/spellcheck-github-actions/compare/0.57.0...0.58.0</a></p> <h2>0.57.0</h2> <h2>What's Changed</h2> <ul> <li>Bump rojopolis/spellcheck-github-actions from 0.55.0 to 0.56.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/309">rojopolis/spellcheck-github-actions#309</a></li> <li>Bump python from <code>2751cbe</code> to <code>3955a7d</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/310">rojopolis/spellcheck-github-actions#310</a></li> <li>Updated base image, version intact. Maintenance release, update not required by <a href="https://github.com/jonasbn"><code>@jonasbn</code></a> in <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/311">rojopolis/spellcheck-github-actions#311</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rojopolis/spellcheck-github-actions/compare/0.56.0...0.57.0">https://github.com/rojopolis/spellcheck-github-actions/compare/0.56.0...0.57.0</a></p> <h2>0.56.0</h2> <h2>What's Changed</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md">rojopolis/spellcheck-github-actions's changelog</a>.</em></p> <blockquote> <h1>Change Log for spellcheck-github-actions</h1> <h2>0.60, 2026-03-14, minor feature release, update not required</h2> <ul> <li> <p>Docker based image updated for Python 3.14.3 slim trixie via PR <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/325">#325</a> from Dependabot.</p> </li> <li> <p>Cleaned up the error messaging, to address issue <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/328">#328</a> from <a href="https://github.com/akohout-hai"><code>@akohout-hai</code></a>, the error message is now more correct, but not improved in general</p> </li> </ul> <h2>0.59.0, 2026-03-02, feature release, update recommended</h2> <ul> <li> <p>Improvements have been added to the docker entrypoint, based on a PR from <a href="https://github.com/akohout-hai"><code>@akohout-hai</code></a> which fixes an issue with handling of spaces in files names and directories, see PR <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/322">#322</a> for details. This is his first contribution to the project and I want to thank him for his contribution, which is highly appreciated.</p> </li> <li> <p>Docker based image updated to Python 3.14.3 slim trixie via PR <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/320">#320</a> from Dependabot.</p> </li> </ul> <h2>0.58.0, 2026-01-20, security release, update not required</h2> <ul> <li>A minor security issue in the dependency: pymdown-extensions, which is used by the core component PySpelling <ul> <li><a href="https://github.com/advisories/GHSA-r6h4-mm7h-8pmq">https://github.com/advisories/GHSA-r6h4-mm7h-8pmq</a></li> <li>Original issue: <a href="https://redirect.github.com/facelessuser/pymdown-extensions/issues/2716">facelessuser/pymdown-extensions#2716</a></li> </ul> </li> </ul> <h2>0.57.0, 2026-01-14, maintenance release, update not required</h2> <ul> <li>Docker based image updated to Python 3.14.2 slim trixie via PR <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/310">#310</a> from Dependabot. The version is the same, the image has had updates.</li> </ul> <h2>0.56.0, 2025-12-27, feature and maintenance release, update not required</h2> <ul> <li>Support for Portuguese (Portugal and Brazil) for both Hunspell and Aspell, requested by: <a href="https://github.com/mdiazgoncalves"><code>@mdiazgoncalves</code></a> via issue <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/298">#298</a></li> <li>Docker image updated to Python 3.14.2 trixie slim <a href="https://docs.python.org/release/3.14.2/whatsnew/changelog.html">Release notes for Python 3.14.2</a></li> </ul> <h2>0.55.0, 2025-11-27, maintenance release, update not required</h2> <ul> <li>Via an issue <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/293">#293</a> from <a href="https://github.com/shoverbj"><code>@shoverbj</code></a>, an update to the core component <strong>PySpelling</strong> from version 2.12.0 to version <code>2.12.1</code> was made, this allows for use of large dictionaries with Aspell</li> </ul> <h2>0.54.0, 2025-11-05, feature release, update not required</h2> <ul> <li> <p>PySpelling the core component has been updated to version 2.12.0, which introduces support for maximum available cores. The feature is described in the <a href="https://github.com/facelessuser/pyspelling/releases/tag/2.12.0">release notes for PySpelling 2.12.0</a>. See the <a href="https://facelessuser.github.io/pyspelling/configuration/">documentation for PySpelling</a>.</p> </li> <li> <p>The flag was introduced with <a href="https://github.com/facelessuser/pyspelling/releases/tag/2.10.0">release 2.10 of PySpelling</a>, which was adopted in release 0.36.0 of this action.</p> </li> </ul> <h2>0.53.0, 2025-10-25, maintenance release, update not required</h2> <ul> <li> <p>Docker image updated to Python 3.14.0 trixie slim <a href="https://docs.python.org/release/3.14.0/whatsnew/changelog.html">Release notes for Python 3.14.0</a>, this originated from the PR mentioned below, however updated to Trixie from Bookworm and as always the slim variant is used</p> </li> <li> <p>Bumped the requirement for cython to <code>3.0.11</code> or above, addressing a build issue with lxml, located when testing the PR : <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/pull/274">#274</a> from <a href="https://github.com/dependabot"><code>@dependabot</code></a>, the above update of Python</p> </li> <li> <p>In general the Docker build file had a few updates since the above changes required some tweaking of the Dockerfile</p> <ul> <li>Order of installation of dependencies adjusted to ensure that lxml can build correctly</li> <li>Installation of: <ul> <li>build-essential</li> <li>pkg-config</li> </ul> </li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/e3cd8e9aec4587ec73bc0e60745aafd45c37aa2e"><code>e3cd8e9</code></a> Merge pull request <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/335">#335</a> from rojopolis/release_candidate_0.60.0</li> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/1d3820d9b26ef084245b638c1d9fcb5b9129563d"><code>1d3820d</code></a> Preparing release 0.60.0</li> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/bafc7d3a24cbbf829c4cb5655a3ac9b7e169f6aa"><code>bafc7d3</code></a> More correct error message, issue <a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/328">#328</a> (<a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/334">#334</a>)</li> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/df486cbbf353239a8399628c6a67d8b74ab66ce2"><code>df486cb</code></a> Added update of Docker base image</li> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/6d6eb5212677f699809f3a569889f025a963190f"><code>6d6eb52</code></a> Bump python from <code>486b809</code> to <code>6a27522</code> (<a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/325">#325</a>)</li> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/631e4a7ef7c75928431bcffdd8bd36735a654cf3"><code>631e4a7</code></a> Bump docker/setup-qemu-action from 3.7.0 to 4.0.0 (<a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/331">#331</a>)</li> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/ebefb9d3fa2925172adf5e5fe37c79dd2beb39ea"><code>ebefb9d</code></a> Bump docker/build-push-action from 6.19.2 to 7.0.0 (<a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/330">#330</a>)</li> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/b3b25807f4c05533aa3e253140a7ac27f08b14a4"><code>b3b2580</code></a> Bump docker/setup-buildx-action from 3.12.0 to 4.0.0 (<a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/329">#329</a>)</li> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/dc29b58808ae750a2306b61bb476c668f4aa7011"><code>dc29b58</code></a> Bump docker/login-action from 3.7.0 to 4.0.0 (<a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/333">#333</a>)</li> <li><a href="https://github.com/rojopolis/spellcheck-github-actions/commit/5d55413ba972eb6b71ac874a9d05ec5d11949046"><code>5d55413</code></a> Bump docker/metadata-action from 5.10.0 to 6.0.0 (<a href="https://redirect.github.com/rojopolis/spellcheck-github-actions/issues/332">#332</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rojopolis/spellcheck-github-actions/compare/ac9fbc2d852c70d7e9d305a62bdd7b1517c50e3d...e3cd8e9aec4587ec73bc0e60745aafd45c37aa2e">compare view</a></li> </ul> </details> <br /> Updates `peaceiris/actions-gh-pages` from 3.9.3 to 4.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/peaceiris/actions-gh-pages/releases">peaceiris/actions-gh-pages's releases</a>.</em></p> <blockquote> <h2>actions-github-pages v4.0.0</h2> <p>See <a href="https://github.com/peaceiris/actions-gh-pages/blob/v4.0.0/CHANGELOG.md">CHANGELOG.md</a> for more details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/peaceiris/actions-gh-pages/blob/main/CHANGELOG.md">peaceiris/actions-gh-pages's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file. See <a href="https://github.com/conventional-changelog/standard-version">standard-version</a> for commit guidelines.</p> <h1><a href="https://github.com/peaceiris/actions-gh-pages/compare/v3.9.3...v4.0.0">4.0.0</a> (2024-04-08)</h1> <h3>build</h3> <ul> <li>node 20.11.1 (<a href="https://github.com/peaceiris/actions-gh-pages/commit/5049354438ced05ab8a5da89ef20fd8efff107c7">5049354</a>)</li> </ul> <h3>chore</h3> <ul> <li>bump node16 to node20 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1067">#1067</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/4eb285e828117bca26638192c3ed309c622e7bad">4eb285e</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1067">#1067</a></li> <li>downgrade engines.npm to 8.0.0 (<a href="https://github.com/peaceiris/actions-gh-pages/commit/87231bc03a428df52f90a00b3b9e6bef82f7daf9">87231bc</a>)</li> </ul> <h3>ci</h3> <ul> <li>pin node-version to 18 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/981">#981</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/65ebf11929c082120c54719c87069f0827d2084c">65ebf11</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/981">#981</a></li> </ul> <h3>docs</h3> <ul> <li>add Release Strategy (<a href="https://github.com/peaceiris/actions-gh-pages/commit/67f80d94a1668353e4733223685dcb84340c44b5">67f80d9</a>)</li> <li>fix link to Nuxt github-pages (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/980">#980</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/88b4d2aa927893f8976712406df9928468be3c88">88b4d2a</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/980">#980</a></li> <li>remove braces in if conditions (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/920">#920</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/0fbd12244217a1fa04396b8a52d911a436893771">0fbd122</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/920">#920</a></li> </ul> <h2><a href="https://github.com/peaceiris/actions-gh-pages/compare/v3.9.2...v3.9.3">3.9.3</a> (2023-03-30)</h2> <h3>docs</h3> <ul> <li>fix typo, bump hugo version (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/851">#851</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/884a0224fd48faeb3bde89519e9d612d0585a679">884a022</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/851">#851</a></li> </ul> <h3>fix</h3> <ul> <li>fix error handling (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/841">#841</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/32e33dcd3ae1d0cf56ac5a88267de6cbf0359353">32e33dc</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/841">#841</a></li> <li>update known_hosts (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/871">#871</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/31c15f03292ac100ae41a50fd3055e00d1b11a32">31c15f0</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/871">#871</a></li> </ul> <h2><a href="https://github.com/peaceiris/actions-gh-pages/compare/v3.9.1...v3.9.2">3.9.2</a> (2023-01-17)</h2> <h3>chore</h3> <ul> <li>rename cicd (<a href="https://github.com/peaceiris/actions-gh-pages/commit/32c9288f553bbcbf66869cf553c82754431faf03">32c9288</a>)</li> <li>replace npm ci with install (<a href="https://github.com/peaceiris/actions-gh-pages/commit/983978086a87d25a1ff678aa1ef4c2acc413784a">9839780</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/4f9cc6602d3f66b9c108549d475ec49e8ef4d45e"><code>4f9cc66</code></a> chore(release): 4.0.0</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/9c75028a530dcac84f98f83ac112b3ecc5eec533"><code>9c75028</code></a> chore(release): Add build assets</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/5049354438ced05ab8a5da89ef20fd8efff107c7"><code>5049354</code></a> build: node 20.11.1</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/4eb285e828117bca26638192c3ed309c622e7bad"><code>4eb285e</code></a> chore: bump node16 to node20 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1067">#1067</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/cdc09a3baa7eac9b40de1dfa92172d75ca5bca5a"><code>cdc09a3</code></a> chore(deps): update dependency <code>@types/node</code> to v16.18.77 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1065">#1065</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/d830378ec6ffd7f902a3427b78b7941511f64de3"><code>d830378</code></a> chore(deps): update dependency <code>@types/node</code> to v16.18.76 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1063">#1063</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/80daa1d14446ef560c4b984b37ac7668a7db0ab4"><code>80daa1d</code></a> chore(deps): update dependency <code>@types/node</code> to v16.18.75 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1061">#1061</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/108285e909b33bc551c67972cdbdbee53b17a112"><code>108285e</code></a> chore(deps): update dependency ts-jest to v29.1.2 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1060">#1060</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/99c95ff54e31aa8b98a1f45d98910a945931c89c"><code>99c95ff</code></a> chore(deps): update dependency <code>@types/node</code> to v16.18.74 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1058">#1058</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/1f4653792dc64b25bbf4a3490ae085a487673e55"><code>1f46537</code></a> chore(deps): update dependency <code>@types/node</code> to v16.18.73 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1057">#1057</a>)</li> <li>Additional commits viewable in <a href="https://github.com/peaceiris/actions-gh-pages/compare/373f7f263a76c20808c831209c920827a82a2847...4f9cc6602d3f66b9c108549d475ec49e8ef4d45e">compare view</a></li> </ul> </details> <br /> Updates `actions/download-artifact` from 8.0.0 to 8.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/download-artifact/releases">actions/download-artifact's releases</a>.</em></p> <blockquote> <h2>v8.0.1</h2> <h2>What's Changed</h2> <ul> <li>Support for CJK characters in the artifact name by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/471">actions/download-artifact#471</a></li> <li>Add a regression test for artifact name + content-type mismatches by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/472">actions/download-artifact#472</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v8...v8.0.1">https://github.com/actions/download-artifact/compare/v8...v8.0.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/download-artifact/commit/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"><code>3e5f45b</code></a> Add regression tests for CJK characters (<a href="https://redirect.github.com/actions/download-artifact/issues/471">#471</a>)</li> <li><a href="https://github.com/actions/download-artifact/commit/e6d03f67377d4412c7aa56a8e2e4988e6ec479dd"><code>e6d03f6</code></a> Add a regression test for artifact name + content-type mismatches (<a href="https://redirect.github.com/actions/download-artifact/issues/472">#472</a>)</li> <li>See full diff in <a href="https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c">compare view</a></li> </ul> </details> <br /> Updates `softprops/action-gh-release` from 2.5.0 to 2.6.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/releases">softprops/action-gh-release's releases</a>.</em></p> <blockquote> <h2>v2.6.1</h2> <p><code>2.6.1</code> is a patch release focused on restoring linked discussion thread creation when <code>discussion_category_name</code> is set. It fixes <code>[#764](https://github.com/softprops/action-gh-release/issues/764)</code>, where the draft-first publish flow stopped carrying the discussion category through the final publish step.</p> <p>If you still hit an issue after upgrading, please open a report with the bug template and include a minimal…

**Motivation** - ChainSafe#8850 **Description** Resolves issues with peerDAS metrics. Credit: [Vedant](https://github.com/vedant-asati/lodestar/tree/fix-peerdas-metrics-clean) Issue_number ChainSafe#8850 --------- Co-authored-by: Vedant Asati <vedant.dev.jsr@gmail.com> Co-authored-by: Vedant Asati <114929867+vedant-asati@users.noreply.github.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Lodekeeper <258435968+lodekeeper@users.noreply.github.com> Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com> Co-authored-by: twoeths <10568965+twoeths@users.noreply.github.com> Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: Cayman <caymannava@gmail.com> Co-authored-by: NC <17676176+ensi321@users.noreply.github.com>

## What Adds a CI workflow that scans prebuilt native (`.node`) binaries for unconditional AVX/AVX2 instructions. Native modules using AVX **must** have CPUID-based runtime dispatch to avoid SIGILL crashes on CPUs without AVX support. ## Why Closes ChainSafe#9042. A user running Lodestar v1.40.0 on a Celeron N5105 (no AVX) hit exit code 132 (SIGILL). Root cause: [`@vekexasia/bigint-buffer2@1.1.0`](vekexasia/bigint-swissknife#6) is compiled with hard-coded `-C target-feature=+avx2,+bmi2`, producing 1292 AVX instructions with zero CPUID dispatch. All other native modules in our tree (`blst`, `node-eth-kzg`, `hashtree`, `libp2p-quic`) have proper CPUID-based runtime detection. ## How it works After `pnpm install`, the script: 1. Finds all `linux-x64` native `.node` files 2. Counts AVX instructions (YMM register references) via `objdump` 3. Counts CPUID calls (runtime CPU feature detection) 4. Fails if any module has AVX instructions but zero CPUID calls Triggers on dependency changes (`package.json`, `pnpm-lock.yaml`) and on `workflow_dispatch`. ## Example output ``` OK: @chainsafe/blst-linux-x64-gnu (104 AVX insns, 9 CPUID calls) OK: @chainsafe/hashtree-linux-x64-gnu (6067 AVX insns, 10 CPUID calls) OK: @chainsafe/libp2p-quic-linux-x64-gnu (6755 AVX insns, 21 CPUID calls) OK: @crate-crypto/node-eth-kzg-linux-x64-gnu (100 AVX insns, 11 CPUID calls) FAIL: @vekexasia/bigint-buffer2 1292 AVX instructions, 0 CPUID dispatch calls Binary will crash with SIGILL on CPUs without AVX (e.g. Celeron N5105) ``` Upstream issue filed: vekexasia/bigint-swissknife#6 --- > This PR was authored with AI assistance (Lodekeeper 🌟) --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com>

…hainSafe#9056) ## What Creates GitHub releases as draft first, uploads assets, then publishes (undrafts). Fixes the `Create Release` step failing on repos with immutable releases enabled. ## Why Closes the RC publish failure: https://github.com/ChainSafe/lodestar/actions/runs/23205012815/job/67438769695 ``` Error: Cannot upload asset lodestar-v1.41.0-rc.1-linux-arm64.tar.gz to an immutable release. GitHub only allows asset uploads before a release is published... ``` GitHub's immutable releases feature fires `release.published` immediately for prereleases, making the release immutable before assets finish uploading. The fix: create as `draft: true`, upload assets, then `gh release edit --draft=false`. ## Changes - **`publish-rc.yml`**: Add `draft: true` to release creation + publish step - **`publish-stable.yml`**: Same fix for stable releases The rollback step still works — it references `steps.create_release.outputs.id` which is set during draft creation. > This PR was authored by Lodekeeper 🌟 with AI assistance. --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com>

## Description Replace outdated circular orb favicon with the current diamond/iridescent Lodestar logo, matching the ENR app (enr.chainsafe.io) branding. ### What changed - `docs/static/images/favicon.ico` — updated to current Lodestar diamond logo (multi-size: 16x16 + 32x32) Preview: https://lodekeeper.github.io/lodestar/ --- *This PR was created with assistance from Lodekeeper 🌟* --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

## Summary This PR extends the **Gloas ePBS state cache architecture** to support dual state variants (block state and payload state) by threading the `payloadPresent` flag through the state cache layer, regeneration system, and archive store. ## Context Building on the fork choice changes in `nc/epbs-fc` (which stores checkpoints with payload status), this PR completes the state cache implementation for Gloas ePBS by: 1. Extending all checkpoint cache operations to track `payloadPresent` 2. Updating the regeneration layer to explicitly handle both state variants 3. Propagating payload status from block import through to checkpoint caching ## Key Changes ### 1. State Cache Type System Updates **`packages/beacon-node/src/chain/stateCache/types.ts`** (+208/-111 lines total across files): - Renamed `CheckpointHex` → `CheckpointHexPayload` with required `payloadPresent: boolean` field - Updated `CheckpointStateCache` interface methods to accept `payloadPresent` parameter: - `add(cp, state, payloadPresent)` - explicitly marks state variant when adding to cache - `getLatest(rootHex, maxEpoch, payloadPresent)` - retrieves specific state variant - `getOrReloadLatest(rootHex, maxEpoch, payloadPresent)` - reloads specific state variant from disk - `updatePreComputedCheckpoint(rootHex, epoch, payloadPresent)` - tracks payload status for pre-computed states - Kept `processState()` method signature unchanged (manages both variants internally) ### 2. PersistentCheckpointStateCache Implementation **`packages/beacon-node/src/chain/stateCache/persistentCheckpointsCache.ts`** (~289 lines modified): - Extended cache key format from `"epoch-rootHex"` to `"epoch-rootHex-payloadPresent"` - Updated `toCheckpointHexPayload()` helper to include payload status in keys - Modified all cache operations (add, get, getLatest, etc.) to handle dual state variants - Implemented logic to iterate both `payloadPresent` variants in `processPastEpoch()` for memory management - Updated cache metrics and debugging utilities to reflect dual state architecture ### 3. Regeneration Layer - Dual State Support **`packages/beacon-node/src/chain/regen/interface.ts`** & **`queued.ts`** & **`regen.ts`**: - Added `processPayloadState(payloadState)` method for explicit payload state caching (Gloas-only) - Called after `processExecutionPayloadEnvelope()` when payload is revealed - Complements `processState()` which handles block state caching - Updated `addCheckpointState(cp, state, payloadPresent)` to accept payload flag - Extended `updatePreComputedCheckpoint()` with `payloadPresent` parameter - Modified `getCheckpointState()` and related methods to pass `payloadPresent` through cache lookups ### 4. Block Import - Payload Status Propagation **`packages/beacon-node/src/chain/blocks/importBlock.ts`**: - Derive `payloadPresent` from block type: - **Pre-Gloas**: `payloadPresent = true` (execution payload embedded in block, always FULL variant) - **Post-Gloas**: `payloadPresent = false` (block state only, PENDING/EMPTY variant, payload not yet revealed) - Thread `payloadPresent` through checkpoint caching operations: - `regen.addCheckpointState(cp, checkpointState, payloadPresent)` ### 5. Archive Store - Historical State Management **`packages/beacon-node/src/chain/archiveStore/`**: - Updated `archiveStore.archiveState()` to accept `payloadPresent` parameter - Modified archival strategies (`frequencyStateArchiveStrategy`) to propagate payload status - Ensured historical states maintain proper metadata for state variant tracking ### 6. API & Validation Layer Updates **`packages/beacon-node/src/api/impl/`**: - Updated validator API to retrieve correct state variant with `payloadPresent` flag - Modified beacon state utilities to handle payload-aware checkpoint lookups - Ensured API endpoints return appropriate state variant based on block type ## Technical Details ### Checkpoint Key Format (Post-Gloas) ```typescript // Pre-Gloas (always single variant): "100-0x1234abcd" // epoch-rootHex // Post-Gloas (dual variants): "100-0x1234abcd-false" // epoch-rootHex-payloadPresent (block state) "100-0x1234abcd-true" // epoch-rootHex-payloadPresent (payload state) ``` ### State Variant Semantics - **Block State** (`payloadPresent = false`): State after processing beacon block, before execution payload - Only exists for Gloas blocks (PENDING/EMPTY variants) - **Payload State** (`payloadPresent = true`): State after processing execution payload - Exists for all pre-Gloas blocks (single variant) - Exists for Gloas blocks after payload revelation ## Migration & Compatibility - **Pre-Gloas blocks**: All state cache operations default to `payloadPresent = true` - **Backward compatibility**: Checkpoint cache can handle mix of pre-Gloas and post-Gloas states - **Cache key migration**: Existing cache entries remain valid (treated as `payloadPresent = true`) ## Depends On - `nc/epbs-fc` - Fork choice stores checkpoints with payload status (ChainSafe#8845) --- **AI Disclosure**: This PR was written primarily by Claude Code. --------- Co-authored-by: twoeths <10568965+twoeths@users.noreply.github.com> Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Cayman <caymannava@gmail.com>

Update code paths outside of state transition (namely gossip and api) to be able to handle builder voluntary exists. <img width="665" height="347" alt="image" src="https://github.com/user-attachments/assets/383555f1-8153-42a7-bb4b-2b8bfe884f40" />

Closes issue ChainSafe#8171 Please let me know if there's anything missing. --------- Co-authored-by: Nico Flaig <nflaig@protonmail.com>

…#8962) ## Summary - Implement the execution payload import pipeline for Gloas (ePBS) - Add `PayloadEnvelopeInput` class to track payload envelope + data columns - Add `importExecutionPayload` function for EL verification and execution payload state transition - Add `SeenPayloadEnvelopeInput` cache for managing payload inputs - Remove `SeenExecutionPayloadEnvelopes` in favour of `SeenPayloadEnvelopeInput` - Integrate with gossip handlers and API for payload publishing ## Background In Gloas (ePBS), beacon blocks and execution payloads have separate validity requirements: - **Beacon blocks** are valid immediately (builder may not reveal payload) - **Execution payloads** require data availability (payload envelope + sampled columns) ## Key Changes ### New Files - `payloadEnvelopeInput/payloadEnvelopeInput.ts` - Tracks bid + envelope + columns with 4-state machine - `importExecutionPayload.ts` - EL verification, signature check, execution payload state transition - `writePayloadEnvelopeInputToDb.ts` - Persists envelope + columns to DB - `seenPayloadEnvelopeInput.ts` - Cache with finalization pruning ### Modified Files - `importBlock.ts` - Creates `PayloadEnvelopeInput` during Gloas block import - `gossipHandlers.ts` - Handles `execution_payload` topic, triggers import on completion - `extractSlotRootFns.ts` - SSZ helpers for payload envelope queueing - `executionPayloadEnvelope.ts` - Validation using block post-state (not head state) - `fork-choice` - Removed `builderIndex`/`blockHashHex` from ProtoBlock (now in PayloadEnvelopeInput) ## TODO - Gloas `data_column_sidecar` gossip handler integration (commented, needs Gloas-specific validation) 🤖 Generated with [Claude Code](https://claude.ai/code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: twoeths <10568965+twoeths@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com> Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com>

Schedule Fulu fork for Gnosis mainnet. - Epoch: 1714688 - Timestamp: 1776168380 - UTC: Tue Apr 14 2026 12:06:20 Matches: gnosischain/configs#50, gnosischain/specs#92 --------- Co-authored-by: Nico Flaig <nflaig@protonmail.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

…ChainSafe#9075) ## Problem The Gnosis chain config inherits mainnet's `MIN_EPOCHS_FOR_DATA_COLUMN_SIDECARS_REQUESTS: 4096`, but the [official Gnosis config](https://github.com/gnosischain/configs/blob/main/mainnet/config.yaml) specifies `16384`. With Gnosis's faster block times (5s slots, 16 slots/epoch), this drastically shortens the data column retention window: | Config | Epochs | Retention | |--------|--------|-----------| | Mainnet (4096 × 32 slots × 12s) | 4096 | **~18.2 days** | | Gnosis with wrong 4096 (4096 × 16 slots × 5s) | 4096 | **~3.7 days** ❌ | | Gnosis with correct 16384 (16384 × 16 slots × 5s) | 16384 | **~15.2 days** ✅ | ### Impact (once Fulu activates on Gnosis) 1. **Premature pruning**: Lodestar prunes data columns after ~3.7 days instead of ~15 days 2. **Refuses serving**: `DataColumnSidecarsByRoot` handler rejects requests for columns older than ~3.7 days (`packages/beacon-node/src/network/reqresp/handlers/dataColumnSidecarsByRoot.ts:22-27`) 3. **Archive pruning**: Block archiver prunes data column sidecars too aggressively (`packages/beacon-node/src/chain/archiveStore/utils/archiveBlocks.ts:171-195`) 4. **Interop mismatch**: Other clients using the correct 16384 would retain data for ~15 days, causing Lodestar to diverge from the network ### Evidence - Official Gnosis config: [`MIN_EPOCHS_FOR_DATA_COLUMN_SIDECARS_REQUESTS: 16384`](https://github.com/gnosischain/configs/blob/main/mainnet/config.yaml) - The existing `MIN_EPOCHS_FOR_BLOB_SIDECARS_REQUESTS: 16384` override is already present in `gnosis.ts` (line 35) — this is the same pattern ## Fix Add `MIN_EPOCHS_FOR_DATA_COLUMN_SIDECARS_REQUESTS: 16384` to the Gnosis chain config, matching the official Gnosis config and the existing blob sidecars override. Flagged by @chatgpt-codex-connector in ChainSafe#9074 (comment) Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

ChainSafe#9077) ## Summary Improve AGENTS.md to better guide AI coding agents and human contributors. Adds new rules, consolidates duplicated guidance, and removes redundant sections. ### New content - **Critical rules section** at the top — quick-reference checklist for the most important rules (target branch, pre-push checks, `.js` imports, no `any`, no `lib/` edits, follow patterns, structured logging, incremental commits) - **Expanded `as any` guidance** — explicitly bans `(obj as any).field` in both production and test code, with `biome-ignore` escape hatch pattern - **`.js` import examples** — adds ✅/❌ examples showing correct `.js` vs wrong `.ts` extensions, clarifies this only applies to TS source files - **Pre-push checklist** — dedicated section: `pnpm lint`, `pnpm check-types`, `pnpm docs:lint`, no `lib/` edits ### Structural cleanup - **Removed "Common pitfalls" section** — rules moved into relevant sections (imports → Import organization, lint → Pre-push checklist, force push → PR etiquette, etc.) - **Removed "Important notes" section** — content merged into existing sections or the new Critical rules header - **Consolidated "Running specific tests"** — removed duplicate test commands already covered in Build commands - **Condensed "Style learnings from reviews"** — collapsed verbose code examples into concise bullet points - **Deduplicated fork list** — referenced from Architecture patterns instead of repeating ### Triggered by - `as any` in tests: ChainSafe#9068 (comment) - `.ts` imports: ChainSafe#8857 (comment) --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

@nflaig

## Description Enable `forceJsExtensions: true` in the Biome `useImportExtensions` rule. This makes Biome flag `.ts` import extensions and enforce `.js`, preventing a recurring bug where AI-assisted code uses `.ts` instead of `.js` in relative imports. ### Context Raised by @nflaig in [PR ChainSafe#8857 review](ChainSafe#8857 (comment)) — a `.ts` import was introduced by the refactor. The existing rule had `forceJsExtensions: false` which only checks that an extension exists, not that it's `.js` specifically. Flipping to `true` catches this at lint time. No code changes needed — the codebase already uses `.js` everywhere. Lint passes cleanly. > This PR was implemented with AI assistance (Claude). Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>

…eout (ChainSafe#9086) Closes ChainSafe#7806

**Motivation** found during review ChainSafe#9034 - `bestPeerForBlockInput()` is not used anywhere after [PR-8200](https://github.com/ChainSafe/lodestar/pull/8200/changes#diff-593e2f511966ad9d8cb737688f30aadb67c896c68766d1b09a33cf1e251f7860L649) - We have to handle `pendingColumns` as `Set<number> | null` for pre-fulu; we can simplify to `Set<number>` since fulu is the active fork already **Description** - Remove dead `bestPeerForBlockInput` method from `UnknownBlockPeerBalancer` and its test - Fix stale comments referencing non-existent functions (`fetchUnknownBlockRoot`, `fetchUnavailableBlockInput`) and a wrong field name (`peerIdStrs` → `peerIdStrings`) - Narrow `pendingColumns` type from `Set<number> | null` to `Set<number>` in `bestPeerForPendingColumns` and `filterPeers`, removing the pre-fulu null path **AI Assistance Disclosure** Used Claude Code to identify and implement this cleanup. --------- Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

## Motivation Fixes ChainSafe#8294 — Two gossip-layer bugs reduce sync aggregate participation. The effect is most visible in small devnets (~64% instead of 100%) but also affects mainnet, just with lower probability due to the larger validator set. ## Root Cause ### 1. `fastMsgIdFn` cross-topic dedup gossipsub's `fastMsgIdFn` only hashes `rpcMsg.data` without the topic. `SyncCommitteeMessage` is published to multiple `sync_committee_{subnet}` topics with identical data, so receiving nodes deduplicate the message after processing it on the first topic — dropping it for all other subnets. **Fix:** Use a topic-derived xxhash seed (cached per topic) to differentiate identical data across topics. Zero allocation on the hot path. ### 2. `getIndexInSubcommittee` returns first match only When a validator appears multiple times in the same subcommittee, only the first position is tracked in the gossip handler. The API path (`submitPoolSyncCommitteeSignatures`) correctly iterates all positions, but the gossip path does not. **Fix:** Return all matching positions and add the message to the pool for each one. ## Kurtosis Results (4 nodes × 64 validators) | Metric | Before | After | |--------|--------|-------| | Participation | 328/512 (64.1%) | 512/512 (100.0%) | | Consistency | Every block identical | Every block identical | Equivalent fix in Prysm: [OffchainLabs/prysm#15608](OffchainLabs/prysm#15608) > **Note:** This is an AI-generated PR created with assistance from Lodekeeper 🌟 --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com>

…tion (ChainSafe#9089) This doesn't fix a real bug, we are passing the test added already without any changes, so ChainSafe#9088 doesn't make sense. But we can simplify the code and avoid the extra `indices.at(-1)` since `prev` is already the highest index.

# Conflicts: # packages/api/src/beacon/routes/events.ts # packages/api/test/unit/beacon/testData/events.ts # packages/beacon-node/src/api/impl/beacon/blocks/index.ts # packages/beacon-node/src/api/impl/beacon/state/utils.ts # packages/beacon-node/src/api/impl/validator/index.ts # packages/beacon-node/src/chain/archiveStore/archiveStore.ts # packages/beacon-node/src/chain/archiveStore/interface.ts # packages/beacon-node/src/chain/archiveStore/strategies/frequencyStateArchiveStrategy.ts # packages/beacon-node/src/chain/archiveStore/utils/archiveBlocks.ts # packages/beacon-node/src/chain/blocks/blockInput/blockInput.ts # packages/beacon-node/src/chain/blocks/blockInput/types.ts # packages/beacon-node/src/chain/blocks/importBlock.ts # packages/beacon-node/src/chain/blocks/verifyBlocksExecutionPayloads.ts # packages/beacon-node/src/chain/blocks/verifyBlocksSanityChecks.ts # packages/beacon-node/src/chain/blocks/verifyBlocksSignatures.ts # packages/beacon-node/src/chain/chain.ts # packages/beacon-node/src/chain/emitter.ts # packages/beacon-node/src/chain/forkChoice/index.ts # packages/beacon-node/src/chain/interface.ts # packages/beacon-node/src/chain/prepareNextSlot.ts # packages/beacon-node/src/chain/produceBlock/produceBlockBody.ts # packages/beacon-node/src/chain/regen/interface.ts # packages/beacon-node/src/chain/regen/queued.ts # packages/beacon-node/src/chain/regen/regen.ts # packages/beacon-node/src/chain/seenCache/index.ts # packages/beacon-node/src/chain/seenCache/seenGossipBlockInput.ts # packages/beacon-node/src/chain/stateCache/fifoBlockStateCache.ts # packages/beacon-node/src/chain/stateCache/persistentCheckpointsCache.ts # packages/beacon-node/src/chain/stateCache/types.ts # packages/beacon-node/src/chain/validation/block.ts # packages/beacon-node/src/chain/validation/dataColumnSidecar.ts # packages/beacon-node/src/chain/validation/executionPayloadEnvelope.ts # packages/beacon-node/src/chain/validation/voluntaryExit.ts # packages/beacon-node/src/network/peers/peerManager.ts # packages/beacon-node/src/network/processor/gossipHandlers.ts # packages/beacon-node/src/network/reqresp/handlers/beaconBlocksByRange.ts # packages/beacon-node/src/network/reqresp/handlers/blobSidecarsByRange.ts # packages/beacon-node/src/network/reqresp/handlers/dataColumnSidecarsByRange.ts # packages/beacon-node/src/sync/utils/downloadByRange.ts # packages/beacon-node/src/sync/utils/downloadByRoot.ts # packages/beacon-node/test/perf/chain/opPools/aggregatedAttestationPool.test.ts # packages/beacon-node/test/unit-minimal/chain/stateCache/persistentCheckpointsCache.test.ts # packages/beacon-node/test/unit/chain/archiveStore/blockArchiver.test.ts # packages/beacon-node/test/unit/chain/forkChoice/forkChoice.test.ts # packages/beacon-node/test/unit/chain/seenCache/seenBlockInput.test.ts # packages/beacon-node/test/utils/state.ts # packages/beacon-node/test/utils/validationData/attestation.ts # packages/fork-choice/src/forkChoice/forkChoice.ts # packages/fork-choice/src/forkChoice/interface.ts # packages/fork-choice/src/forkChoice/store.ts # packages/fork-choice/src/index.ts # packages/fork-choice/src/protoArray/interface.ts # packages/fork-choice/src/protoArray/protoArray.ts # packages/fork-choice/test/perf/forkChoice/util.ts # packages/fork-choice/test/unit/forkChoice/forkChoice.test.ts # packages/fork-choice/test/unit/forkChoice/getProposerHead.test.ts # packages/fork-choice/test/unit/forkChoice/shouldOverrideForkChoiceUpdate.test.ts # packages/fork-choice/test/unit/protoArray/executionStatusUpdates.test.ts # packages/fork-choice/test/unit/protoArray/getCommonAncestor.test.ts # packages/fork-choice/test/unit/protoArray/gloas.test.ts # packages/fork-choice/test/unit/protoArray/protoArray.test.ts # packages/state-transition/src/block/processVoluntaryExit.ts # packages/state-transition/src/signatureSets/index.ts # packages/state-transition/src/signatureSets/voluntaryExits.ts

gemini-code-assist · 2026-03-23T22:59:56Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on enhancing Lodestar's network capabilities by introducing QUIC transport support and updating core components to align with the latest Ethereum consensus specifications. It also includes significant refactoring and dependency updates to improve performance, stability, and maintainability.

Highlights

QUIC Transport Support: Introduces QUIC as a supported transport protocol alongside TCP, enhancing network performance and security.
Gloas Fork Updates: Implements changes to support the Gloas fork, including updates to data availability handling and fork choice mechanisms.
Dependency Updates: Updates various dependencies, including libp2p and other core libraries, to their latest versions.
Code Improvements and Refactoring: Refactors code for better organization and performance, including removing deprecated code and improving error handling.
Telemetry and Monitoring Enhancements: Adds new metrics and updates existing ones to improve monitoring and debugging capabilities.
Build Process Improvements: Migrates from tsc to tsgo for faster and more efficient TypeScript compilation.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

Ignored by pattern: .github/workflows/** (21)
- .github/workflows/benchmark.yml
- .github/workflows/binaries.yml
- .github/workflows/build-debug-node.yml
- .github/workflows/check-specrefs.yml
- .github/workflows/codeql-analysis.yml
- .github/workflows/docker.yml
- .github/workflows/docs-backfill.yml
- .github/workflows/docs-check.yml
- .github/workflows/docs-version.yml
- .github/workflows/docs.yml
- .github/workflows/kurtosis.yml
- .github/workflows/lint-pr-title.yml
- .github/workflows/native-portability.yml
- .github/workflows/publish-dev.yml
- .github/workflows/publish-manual.yml
- .github/workflows/publish-nextfork.yml
- .github/workflows/publish-rc.yml
- .github/workflows/publish-stable.yml
- .github/workflows/test-bun.yml
- .github/workflows/test-sim.yml
- .github/workflows/test.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e44b7c293a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-23T23:03:40Z

+  // 7. Cache payload state
+  // TODO GLOAS: Enable when PR #8868 merged (adds processPayloadState)
+  // this.regen.processPayloadState(postPayloadState);
+  // if epoch boundary also call
+  // this.regen.addCheckpointState(cp, checkpointState, true);


Cache the FULL payload state after importing an envelope

This path writes postPayloadStateRoot into fork choice but never stores postPayloadState in the regen caches. Unlike the existing BeaconChain.importExecutionPayloadEnvelope() flow in chain.ts, any later regen.getState() / getBlockSlotState() for that FULL variant can only seed from the sibling PENDING state, replay the beacon block from DB, and recompute the pre-payload root, which then fails with INVALID_STATE_ROOT. In practice this breaks head/state lookups once a block whose envelope was imported through processExecutionPayload() becomes the selected FULL block.

Useful? React with 👍 / 👎.

Correct observation — this is a pre-existing TODO GLOAS on line 218: the regen.processPayloadState() call is commented out waiting for PR #8868. Not introduced by this merge. Tracked as a known gap in the ePBS implementation.

chatgpt-codex-connector · 2026-03-23T23:03:40Z


-      await chain.importExecutionPayloadEnvelope(executionPayloadEnvelope);
+      // TODO GLOAS: Emit execution_payload_gossip event for gossip receipt.
+      chain.processExecutionPayload(payloadInput, {validSignature: true}).catch((e) => {


Retry payload import when data columns arrive after the envelope

The new gossip flow only calls processExecutionPayload(payloadInput) once, but PayloadEnvelopeProcessor.processPayloadEnvelopeJob() returns immediately until payloadInput.isComplete(). Because the data-column gossip handler now leaves the PayloadEnvelopeInput.addColumn(...)/processExecutionPayload(...) hook as a TODO, a Gloas block whose envelope arrives before all sampled columns are present is never retried when those columns show up later via gossip. In that timing, the block stays PENDING even though the node eventually has both the envelope and the required columns.

Useful? React with 👍 / 👎.

Correct — line 665 has an explicit TODO GLOAS for this exact pattern. The data-column → payload retry path is commented out and not wired up yet. Pre-existing known gap in the ePBS implementation, not introduced by this merge.

chatgpt-codex-connector · 2026-03-23T23:03:40Z

+  if (!payloadInput) {
+    // PayloadEnvelopeInput should have been created during block import
+    throw new ExecutionPayloadEnvelopeError(GossipAction.IGNORE, {
+      code: ExecutionPayloadEnvelopeErrorCode.PAYLOAD_ENVELOPE_INPUT_MISSING,


Keep accepting late envelopes when the in-memory payload cache is empty

This now treats a missing seenPayloadEnvelopeInputCache entry as an IGNORE, but that cache is purely in-memory and is only populated during fresh block import (SeenPayloadEnvelopeInput starts empty and importBlock() is the only place that calls add()). After a restart, or any path that rebuilds fork choice from DB, known PENDING Gloas blocks will not have a cache entry, so late gossip/API envelopes are dropped even though the block and pre-payload state are still available. The previous implementation explicitly fell back to fork-choice metadata for this case.

Useful? React with 👍 / 👎.

Valid concern about restart behavior. The seenPayloadEnvelopeInputCache is purely in-memory and not rebuilt from DB/fork-choice on startup. Late envelopes for blocks imported before restart would be IGNOREd. This is the same pattern I flagged in my review of PR #8962 (finding #4 — IGNORE vs REJECT inconsistency + TOCTOU race). Pre-existing, not introduced by this merge.

gemini-code-assist

Code Review

This pull request is a large merge from unstable into epbs-devnet-0, resolving numerous conflicts to prepare for a clean diff in a subsequent PR. The changes are extensive, touching upon documentation, tooling configuration, dependency upgrades (notably libp2p and TypeScript), and significant refactoring related to ePBS (enshrined Proposer-Builder Separation) and the Gloas fork. Key improvements include the addition of QUIC transport support, enhanced gossip message ID generation to prevent cross-topic deduplication, and a more robust handling of execution payloads. The code review confirms that the changes are consistent and well-reasoned, with many being correctness fixes or necessary updates for new features and dependencies. No issues were found that require action.

nflaig and others added 30 commits February 23, 2026 10:09

fix: log payload attestations for gloas block bodies (ChainSafe#8942)

0b3690a

refactor: unified pubkey cache (ChainSafe#8945)

f225223

- helpful towards lodestar-z integration - combining index2pubkey and pubkey2index allows them to stay synchronized by construction

ci: remove bun tests (ChainSafe#8959)

afd4462

**Motivation** as previously discussed, remove bun tests entirely. Extracted from ChainSafe#8900 cc @nazarhussain

fix: libp2p v3 unknown peers (ChainSafe#8960)

6eb5502

Squash merged ChainSafe#8958 and reverted ChainSafe#8955. Deployed to `feat1`

feat: integrate gossip validation spec tests (ChainSafe#8965)

192806a

see ethereum/consensus-specs#4902

chore: pin pnpm with sha512 integrity in package.json (ChainSafe#9008)

bb27317

chore: pin github actions by commit hash (ChainSafe#9017)

0df1876

Closes ChainSafe#7618

chore: fix private imports (ChainSafe#8990)

be5acbb

**Motivation** Do not use private imports **Description** - Move shared test utils to individual packages. - Fix private imports

lodekeeper and others added 25 commits March 14, 2026 10:22

chore: bump package versions to 1.41.0

e8653ab

chore: v1.41.0 release (ChainSafe#9038)

13e882a

chore: merge stable 1.41.0 back to unstable (ChainSafe#9066)

5f2fffc

chore: use permalinks for spec references (ChainSafe#9065)

4411584

Closes issue ChainSafe#8171 Please let me know if there's anything missing. --------- Co-authored-by: Nico Flaig <nflaig@protonmail.com>

feat: add --http.requestTimeout flag to configure vc http request tim…

d73eccf

…eout (ChainSafe#9086) Closes ChainSafe#7806

lodekeeper requested a review from a team as a code owner March 23, 2026 22:56

chatgpt-codex-connector Bot reviewed Mar 23, 2026

View reviewed changes

gemini-code-assist Bot reviewed Mar 23, 2026

View reviewed changes

lodekeeper closed this Mar 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore: merge unstable into epbs-devnet-0 (resolve all conflicts) - #9099

chore: merge unstable into epbs-devnet-0 (resolve all conflicts)#9099
lodekeeper wants to merge 66 commits into
ChainSafe:epbs-devnet-0from
lodekeeper:epbs-devnet-0

lodekeeper commented Mar 23, 2026

Uh oh!

gemini-code-assist Bot commented Mar 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Mar 23, 2026

Uh oh!

lodekeeper Mar 23, 2026

Uh oh!

chatgpt-codex-connector Bot Mar 23, 2026

Uh oh!

lodekeeper Mar 23, 2026

Uh oh!

chatgpt-codex-connector Bot Mar 23, 2026

Uh oh!

lodekeeper Mar 23, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

Uh oh!

Uh oh!

Conversation

lodekeeper commented Mar 23, 2026

Uh oh!

gemini-code-assist Bot commented Mar 23, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

lodekeeper Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

lodekeeper Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

lodekeeper Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants