chore: v1.44.0 release#9495
Draft
matthewkeil wants to merge 74 commits into
Draft
Conversation
**Motivation** - #8892 **Description** - move light-client spec functions to state-transition/light-client - move the rest of the light-client and the whole prover to a separate monorepo - remove the lightclient cli command **AI Assistance Disclosure** - codex assistance
**Motivation** Follow consensus-specs PR ethereum/consensus-specs#5222. `compute_ptc` samples PTC seats by effective balance and may place the same validator at multiple positions in a slot's PTC. The previous `on_payload_attestation_message` recorded the vote only at `ptc.index(validator_index)` (first occurrence), leaving the other duplicate seats as `None`. With enough duplicates this can make `PAYLOAD_TIMELY_THRESHOLD = PTC_SIZE // 2` unreachable, particularly in testnets with many `0x02` validators. Sync committee already counts duplicate votes; PTC should match. **Description** - replace `getIndexInPayloadTimelinessCommittee` with `getIndicesInPayloadTimelinessCommittee` returning every PTC position a validator occupies - handle `PayloadAttestationPool.add()` to support multiple validator committee indices **AI Assistance Disclosure** Used Claude Code. Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com>
**Motivation** - Implements [ethereum/consensus-specs#5254](ethereum/consensus-specs#5254). Avoid eager BLS signature verification of the whole `pending_deposits` queue when onboarding builders at the Gloas fork transition. - Also improve `processDepositRequest()` in Gloas to avoid eager BLS signature verification of the whole `pending_deposits` queue. This does not need a spec change. **Description** - implement `PendingDepositsLookup` grouped by pubkey, track verified deposits so we will never do it again. This is also a preparation when we move it to EpochCache or higher level cache. - Reworks `onboardBuildersFromPendingDeposits` at the Fulu→Gloas fork transition to mirror the new spec structure. Behavior change from the spec PR: invalid-signature validator deposits now stay in the pending queue (previously dropped). - Threads a shared lookup through `applyParentExecutionPayload → processDepositRequest` so successive deposit-requests in the same envelope share verification results. The lookup is kept as a faithful mirror of `state.pendingDeposits`. - Adds unit tests for `PendingDepositsLookup`. **AI Assistance Disclosure** Used Claude Code. --------- Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com>
**Motivation** - gloas **Description** - Add proposer preferences API endpoints ethereum/beacon-APIs#593 - Add proposer preferences pool - Use proposer preference during execution bid gossip validation - Add proposer preference validator service (publish `SLOTS_PER_EPOCH / 4` slots before proposal) **AI Assistance Disclosure** - claude assistance --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com>
# Summary Fixes Lodestar's handling of proposer duties under the post-Fulu (EIP-7917) deterministic 1-epoch proposer lookahead. Surfaced while reviewing #9377: the validator was never querying `currentEpoch + 1` proposer duties post-Fulu, and the BN's dep_root computation was wrong when serving duties for an epoch other than `state.epoch`. Contains two related stories: 1. **BN-side bug fixes + lookahead support** so `getProposerDutiesV2` correctly serves `currentEpoch + 1` (and `currentEpoch + 2` near the boundary). 2. **Validator-side refactor** to consume that lookahead through an event-driven model that mirrors `AttestationDutiesService`, instead of per-slot polling. # BN side **`proposerShufflingDecisionRoot` bug fix** (`state-transition/src/util/shuffling.ts`) Previously derived the decision slot from `state.epoch`, which gave the wrong dep_root whenever the state was one epoch off the requested epoch (e.g. serving `state.epoch + 1` duties from the head state). Now takes `proposalEpoch` explicitly: - Pre-Fulu: `dep_root(E) = block@(startSlot(E) - 1)` — unchanged - Post-Fulu (MIN_SEED_LOOKAHEAD = 1): `dep_root(E) = block@(startSlot(E - 1) - 1)` — shifted back one epoch **`getProposerDuties` (`beacon-node/src/api/impl/validator/index.ts`)** Allows `epoch === currentEpoch + 2` near the next-epoch boundary post-Fulu. The duties are served from the upcoming-epoch (`currentEpoch + 1`) checkpoint state's `nextProposers`, which is populated by the `proposer_lookahead` field. The existing `nearNextEpoch` gate (`msToNextEpoch < prepareNextSlotLookAheadMs`) determines availability. # Validator side Original draft of this PR added a fork-aware `pollBeaconProposers` that, post-Fulu, polled `nextEpoch` every slot and `nextEpoch + nextEpoch+1` at the boundary. That was functional but raised a fair concern in review: *why fetch two epochs at the boundary, and why poll next-epoch every slot if its dep_root is stable post-Fulu?* The refactor (`refactor(validator): event-driven proposer duties via SSE head events`) replaces that with an attester-style model: | Trigger | Action | |---------|--------| | `clock.runEveryEpoch(epoch)` | Fetch `epoch` (+ `epoch + 1` post-Fulu, using the EIP-7917 lookahead) | | `chainHeaderTracker.runOnNewHead(headEvent)` | Compare incoming dep_roots against cache; refetch only the affected epoch on mismatch | | `clock.runEverySlot(slot)` | Notify block production from cache; pre-Fulu only — schedule the 1s-before-boundary fetch for `nextEpoch` (its dep_root only stabilizes at the boundary and isn't exposed via SSE) | The SSE head event already carries everything needed for both forks via a nice coincidence in the dep_root math: - **Pre-Fulu:** `currentDutyDependentRoot ≡ proposer_dep_root(currentEpoch)` - **Post-Fulu:** `previousDutyDependentRoot ≡ proposer_dep_root(currentEpoch)`, `currentDutyDependentRoot ≡ proposer_dep_root(nextEpoch)` No spec/event changes required — the same fields the validator already uses for attester duties cover the post-Fulu proposer lookahead window. A per-slot notification dedup (`notifiedSlot` / `notifiedProposers`) replaces the old "two-pass with `differenceHex`" pattern so any source of cache update (SSE refetch, cold-cache back-fill, epoch tick) only notifies *newly discovered* proposers and never duplicates `createAndPublishBlock` calls. # Results In steady state, the validator now makes **2 proposer-duty calls per epoch** (current + next epoch pre-fetch) plus refetches only on dep_root changes — matching the per-epoch cadence of `AttestationDutiesService` (which previously had been 32× more frequent). # Tests - 11 new `BlockDutiesService` unit tests covering: post-Fulu pre-fetch of next epoch, pre-Fulu vs post-Fulu fork detection, SSE-driven refetch on dep_root mismatch, no-op on dep_root match, cold-cache back-fill, pre-Fulu boundary scheduling + post-Fulu suppression, signer removal across epochs. - BN-side `getProposerDuties` tests updated to exercise the V2 path with a post-Fulu config. - E2E tests verified: `proposerBoostReorg`, `finalizedSync`, `checkpointSync` (Fulu fork crossings, reorgs, checkpoint sync) — all pass, all 30+ block proposals fire correctly, no new errors. # Known follow-ups (non-blocking) 1. **Genesis-state dep_root quirk (BN-side, cosmetic).** At very early genesis, the BN's `getProposerDuties` returns `genesisBlockRoot` via the `state.slot === decisionSlot` fallback, but later returns `state.getBlockRootAtSlot(0)` for the same epoch — they're cosmetically different roots for the same logical block. The old code didn't observe this because it didn't pre-fetch `nextEpoch` until ~1s before the boundary; the new code pre-fetches at the start of epoch 0 and sees one or two spurious `Proposer duties re-org` warnings per VC at startup. Duties are correct — pure metric noise. Worth a small BN-side normalization or a "skip pre-fetch on first epoch tick" guard. 2. **Concurrent `pollBeaconProposers` race.** If `onNewHead` and `runEveryEpochTask` race on the same epoch with asymmetric HTTP latencies, last-write-wins can briefly leave a stale dep_root cached. In practice the same BN serves both calls and returns identical payloads. Documented in a code comment; a per-epoch sequence number would harden it if it ever becomes a real problem. 3. **Gloas timing.** `BLOCK_DUTIES_LOOKAHEAD_BPS` may want to flip from "1s before the boundary" to "1s after" post-Gloas. Existing `TODO GLOAS: re-evaluate timing` is preserved. # AI disclosure Refactor designed and implemented with AI assistance. --------- Co-authored-by: Cayman <caymannava@gmail.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com>
…oas graffiti (#9381) ## Summary Fixes two issues with auto-graffiti for blocks proposed by Lodestar: 1. **Ethrex EL code mapped to `XX`.** `ClientCode` is missing an `EX` entry, so `engine_getClientVersionV1` responses from Ethrex (`code: "EX"`) fall through to `ClientCode.XX` in `http.ts:getClientVersion`. Result on chain: `XX2123LS...` instead of `EX2123LS...`. Adds `EX = "EX", // ethrex`. 2. **CL commit suffix dropped in `produceBlockV4` (Gloas).** The pre-Gloas path (`produceBlockV3`) calls `getLodestarClientVersion(opts)` so `commit` is populated; the Gloas path calls `getLodestarClientVersion()` with no argument, leaving `commit` as `""`. `getDefaultGraffiti` then produces 8-byte `<EL><EL_commit><LS>` instead of the intended 12-byte `<EL><EL_commit><LS><LS_commit>`. Result on chain: `NMd654LS` / `XX2123LS` for every post-Gloas Lodestar block, regardless of EL pair. Aligns the Gloas call site with the pre-Gloas one by passing the in-scope `opts: ApiOptions`. Observed on a glamsterdam-devnet-4 kurtosis enclave (Lodestar v1.42.0 \`a07e25c\`, \`gloas_fork_epoch=1\`, \`preset=minimal\`). Pre-Gloas first block from a Lodestar+Ethrex pair: graffiti \`XX2123LSa07e\`. All later post-Gloas slots from the same proposer: \`XX2123LS\`. Nethermind+Lodestar pairs show the same truncation: \`NMd654LS\`. ## Test plan - [x] Existing \`graffiti.test.ts\` and \`metadata.test.ts\` still pass (no behavior change in those units) - [ ] Manual: rebuild + re-run kurtosis enclave with Ethrex+Lodestar, confirm graffiti is \`EX<el_commit>LS<ls_commit>\` (12 bytes) for post-Gloas slots
**Motivation** Upgrade Lodestar to the `v1.7.0-alpha.8` following #9375 **What's changed since #9375** - consume ProposerPreferencesPool in #9377 - use `PAYLOAD_DUE_BPS` instead of `PAYLOAD_ATTESTATION_DUE_BPS` - the onboard builder is implemented in #9374, reenable spec tests **Detailed Description** - Bump `spec-tests-version.json` to `v1.7.0-alpha.8` and apply the matching `specrefs/*` updates. - Config: `MIN_BUILDER_WITHDRAWABILITY_DELAY` `64 → 8192`; add `PAYLOAD_DUE_BPS` (mainnet/minimal/types + validator critical params). - Add Gloas `targetGasLimit` to `PayloadAttributes` (SSZ, execution-engine `PayloadAttributes`/RPC + serialize/deserialize). - Rename `ProposerPreferences.gasLimit → targetGasLimit` (alpha.8) and update the unstable-only consumers not present on the #9375 branch: `validatorStore.signProposerPreferences`, gossip `validateExecutionPayloadBid`, and test/event fixtures. The gossip bid-validation rule keeps strict equality (rename only); `is_gas_limit_target_compatible` is a separate follow-up. - `upgradeStateToGloas`: set `latestExecutionPayloadBid.gasLimit` from the Fulu header and bump the spec-comment URL. The existing `onboardBuildersFromPendingDeposits` is already spec-equivalent and is left as-is; the previously-skipped `fork_invalid_validator_deposit_followed_by_builder_credentials` spec test is re-enabled and passes. - `produceBlockBody`: resolve the Gloas payload-attributes `targetGasLimit` from the `ProposerPreferencesPool` (same `(slot, dependent_root)` lookup as bid validation), falling back to the parent payload gas limit when no preferences are pooled. Addresses the #9375 review note that the builder-registration source was incorrect. - Add `getPayloadDueMs()` to `forkConfig` (spec `get_payload_due_ms`, `PAYLOAD_DUE_BPS`) and gate `producePayloadAttestationData`'s `payloadPresent` on the execution payload envelope being seen before that deadline (uses the envelope's own arrival time). Addresses the #9375 review note about using `PAYLOAD_DUE_BPS` instead of `PAYLOAD_ATTESTATION_DUE_BPS`. - Skip the new `gloas/fork_choice/on_payload_attestation_message` spec suite (PTC fork choice not yet implemented). **AI Assistance Disclosure** Used Claude Code to port and adapt the changes, address the PR review comments, and run verification. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com> Co-authored-by: Cayman <caymannava@gmail.com>
## Summary Installs Zig 0.16.0 in the build paths that will exercise the `lodestar-z` prepare script when `@chainsafe/lodestar-z` is added _as a git dependency_. This unblocks the lodestar-z development workflow: building, testing, deploying lodestar with an _unpublished_ lodestar-z. This doesn't negatively affect the production release, eg bloating the production docker image. Careful attention will still be needed to ensure that only a published lodestar-z is used in in releases. ## What's added **Build images** (`Dockerfile`, `Dockerfile.dev`): - Manual curl + tar unpack of zig toolchain - Multi-arch zig install (`TARGETARCH` → zig's `x86_64`/`aarch64` naming) - SHA256 verification of each tarball against ziglang.org's release manifest - Symlink onto `/usr/local/bin/zig` so `prepare` finds it via `PATH` **CI** (4 files, covering 11 workflows): - Uses [`mlugg/setup-zig`](https://github.com/mlugg/setup-zig) v2.2.1, pinned by commit SHA per repo convention. - `.github/actions/setup-and-build` — composite action used by `test`, `test-sim`, `benchmark`, `nightly-spec-tests`, `binaries`, `publish-rc`, `publish-stable`, `docs-check` - `native-portability.yml`, `docs.yml`, `publish-dev.yml`, `publish-nextfork.yml` — standalone workflows that don't use the composite --------- Co-authored-by: Cayman <caymannava@gmail.com>
**Motivation** - alpha.8 spec **Description** - implement ethereum/consensus-specs#5236 **AI Assistance Disclosure** - codex --------- Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com>
**Motivation** - know more details about the execution payload **Description** - mimic what's currently in receive/import block flow Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com>
**Motivation** - implement `shouldBuildOnFull()` as in ethereum/consensus-specs#5186 **Description** - track blob data available in a new `daVotes` - thread blob data available from block import, gossip handler and api - track ptc voted in a new `ptcAttested` - count NO votes and implement `shouldBuildOnFull()` when producing block **AI Assistance Disclosure** Created with Claude --------- Co-authored-by: Tuyen Nguyen <twoeths@users.noreply.github.com> Co-authored-by: Cayman <caymannava@gmail.com>
As title. Also add publishExecutionPayloadBid beacon api endpoint --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Cayman <caymannava@gmail.com>
closes #9231 --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary - Browser Tests CI has been hanging for ~6h on every PR run, hitting GitHub Actions' default job timeout. - Root cause: `pnpm playwright install` hangs after Chromium download completes due to a yauzl zip extraction lifecycle regression in Node 24.16.0+ ([microsoft/playwright#40724](microsoft/playwright#40724)). Our CI runs Node v24.16.0, so it hits this bug. Fixed upstream in playwright 1.60.0 via [microsoft/playwright#40747](microsoft/playwright#40747). Additional CI hardening: - Cache `~/.cache/ms-playwright` keyed on `pnpm-lock.yaml` hash so subsequent runs skip the download entirely. - Install only the browsers we actually use: `chromium`, `chromium-headless-shell`, `firefox` (skips webkit + ffmpeg). - Add `timeout-minutes: 15` so any future install hang fails fast instead of consuming a 6h job slot. ## Test plan - [x] `pnpm install` resolves all `playwright` / `playwright-core` entries in `pnpm-lock.yaml` to `1.60.0` - [x] `pnpm playwright install chromium chromium-headless-shell firefox` completes without hang locally - [x] `pnpm test:browsers` passes locally (52 files, 606/606 tests, ~60s) on darwin/arm64 - [X] Browser Tests CI job completes successfully (verified on this PR) ## AI disclosure This change was investigated and implemented with AI assistance (Claude Code). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
**Motivation** - gloas spec `should_extend_payload` requires `(payload_is_timely AND payload_data_is_available)`; lodestar checks only timely. With PTC voting timely=YES + data=NO, fork-choice keeps extending FULL while `shouldBuildOnFull` reorgs the producer onto EMPTY — producer-policy and head-policy disagree and locally-produced blocks get orphaned. Observed on glamsterdam-devnet-4: head stuck at slot 22903 for 27+ slots. - found when investigating #9415 **Description** - AND `isPayloadDataAvailable` into condition 1 of `shouldExtendPayload` **AI Assistance Disclosure** Created with Claude --------- Co-authored-by: twoeths <twoeths@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com>
**Motivation** `lodestar_bls_thread_pool_same_message_jobs_retries_total` and its sibling `..._same_message_sets_retries_total` are emitted by `retryJobItemSameMessage` but were not plotted anywhere in dashboards. They diagnose the same class of event as batch_retries_total — a BLS verification fast-path failing and forcing a slow-path re-verification — just for the **same message / aggregated pubkey** optimization instead of the regular batch optimization. Without them on the dashboard, regressions in the same-message path are invisible. **Description** Adds two series to the existing "BLS thread pool - Error rates" panel in dashboards/lodestar_bls_thread_pool.json, alongside batch_retries: - rate(lodestar_bls_thread_pool_same_message_jobs_retries_total[$rate_interval]) → same_message_job_retries - rate(lodestar_bls_thread_pool_same_message_sets_retries_total[$rate_interval]) → same_message_set_retries Both should stay near zero; sustained non-zero values mean the same-message optimization is paying off less often and CPU is being wasted on re-verification.
### Motivation - The release binary workflow used `npx -y -p @chainsafe/caxa@3.0.6 ...` which dynamically fetched and executed an npm package at release time, bypassing the repository's `pnpm` lockfile and `pnpm-workspace.yaml` supply-chain protections. - Running unpinned/npm-resolved tooling during artifact creation creates a supply-chain risk where an attacker could tamper with release artifacts or access workflow secrets if a packaged dependency is compromised. ### Description - Replace runtime `npx -p` invocation with a locked invocation by calling `pnpm exec caxa` in `.github/workflows/binaries.yml` so the packager is resolved from the workspace dependency graph and lockfile. - Add `@chainsafe/caxa@3.0.6` to the root `devDependencies` in `package.json` so `caxa` is pinned and installed via `pnpm` rather than fetched by `npx` at release time. - Update `pnpm-lock.yaml` to include the pinned `@chainsafe/caxa@3.0.6` resolution and its transitive entries so CI will install the exact package graph under `pnpm` policy. - Files changed: `.github/workflows/binaries.yml`, `package.json`, and `pnpm-lock.yaml`. ### Testing - Ran `pnpm lint` and it passed successfully. - Ran `pnpm check-types` which failed in this environment due to pre-existing missing built artifacts (unrelated to the workflow change) and is documented here as an environment issue. - Ran `pnpm test:unit` which failed in this environment due to missing generated/linked `@lodestar/params` artifacts (unrelated to this change) and is documented here as an environment issue. > This PR was written primarily by Claude Code. ------ [Codex Task](https://chatgpt.com/codex/cloud/tasks/task_e_6a1704b7f0b0833199c777ff75468ac7)
**Motivation** - it's tricky to use BitArray, which is defined in ssz for binding, see this [concern](ChainSafe/lodestar-z#368 (comment)) **Description** - the native binding does not have to do anything with `BitArray`, use `{uint8Array: Uint8Array; bitLen: number}` instead, the binding needs to conform to`IBeaconStateViewNative` overall - implement `NativeBeaconStateView` wrapper that conform to the public api of `IBeaconStateViewLatestFork` so `beacon-node` does not need to change. It also contains a cache layer so that it does not need to fetch native multiple times for the same data --------- Co-authored-by: twoeths <twoeths@users.noreply.github.com>
…#9405) Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.4` | `4.36.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `5.0.0` | `6.0.8` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `6.4.0` | | [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages) | `4.0.0` | `4.1.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` | Updates `github/codeql-action` from 4.35.4 to 4.36.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.36.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>v4.35.5</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>4.35.4 - 07 May 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <h2>4.35.2 - 15 Apr 2026</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <h2>4.35.1 - 27 Mar 2026</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>4.35.0 - 27 Mar 2026</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/7211b7c8077ea37d8641b6271f6a365a22a5fbfa"><code>7211b7c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3927">#3927</a> from github/update-v4.36.0-ebc2d9e2b</li> <li><a href="https://github.com/github/codeql-action/commit/7740f2fb21add1d46278215acea47540db22f022"><code>7740f2f</code></a> Update changelog for v4.36.0</li> <li><a href="https://github.com/github/codeql-action/commit/ebc2d9e2bc247eec51bee8d4df806c4030eb0761"><code>ebc2d9e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3926">#3926</a> from github/update-bundle/codeql-bundle-v2.25.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1f74b777c95c777bf4f42ce4b250bc916e745c7"><code>d1f74b7</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/2dc40cec39bdc63d3561d74fa6100cebb0418ff4"><code>2dc40ce</code></a> Update default bundle to codeql-bundle-v2.25.5</li> <li><a href="https://github.com/github/codeql-action/commit/84498526a009a99c875e83ef4821a8ba52de7c22"><code>8449852</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3910">#3910</a> from github/henrymercer/repo-size-diff-check</li> <li><a href="https://github.com/github/codeql-action/commit/72ac23c6d16b29fbe801e87e3439941558c53094"><code>72ac23c</code></a> Update excluded required check list</li> <li><a href="https://github.com/github/codeql-action/commit/c5297a28a2c3e6a8062041b58858bd7117cebe37"><code>c5297a2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3919">#3919</a> from github/henrymercer/workflow-concurrency</li> <li><a href="https://github.com/github/codeql-action/commit/8ffeae7d05bc1b914a009d197e64e4f5c9e14503"><code>8ffeae7</code></a> CI: Automatically cancel non-generated workflows</li> <li><a href="https://github.com/github/codeql-action/commit/f3f52bf568dc44a1069faafa538caa6b1fec40c9"><code>f3f52bf</code></a> Revert <code>getErrorMessage</code> import</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...7211b7c8077ea37d8641b6271f6a365a22a5fbfa">compare view</a></li> </ul> </details> <br /> Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <ul> <li>Bump <code>@docker/actions-toolkit</code> from 0.79.0 to 0.90.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/489">docker/setup-buildx-action#489</a></li> <li>Bump brace-expansion from 1.1.12 to 5.0.6 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/547">docker/setup-buildx-action#547</a> <a href="https://redirect.github.com/docker/setup-buildx-action/pull/508">docker/setup-buildx-action#508</a></li> <li>Bump fast-xml-builder from 1.0.0 to 1.2.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/540">docker/setup-buildx-action#540</a></li> <li>Bump fast-xml-parser from 5.4.2 to 5.8.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/496">docker/setup-buildx-action#496</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/499">docker/setup-buildx-action#499</a></li> <li>Bump glob from 10.3.12 to 13.0.6 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/495">docker/setup-buildx-action#495</a></li> <li>Bump handlebars from 4.7.8 to 4.7.9 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/504">docker/setup-buildx-action#504</a></li> <li>Bump lodash from 4.17.23 to 4.18.1 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/523">docker/setup-buildx-action#523</a></li> <li>Bump picomatch from 4.0.3 to 4.0.4 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/503">docker/setup-buildx-action#503</a></li> <li>Bump postcss from 8.5.6 to 8.5.10 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/537">docker/setup-buildx-action#537</a></li> <li>Bump tar from 6.2.1 to 7.5.15 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/545">docker/setup-buildx-action#545</a></li> <li>Bump undici from 6.23.0 to 6.25.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/492">docker/setup-buildx-action#492</a></li> <li>Bump vite from 7.3.1 to 7.3.2 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/520">docker/setup-buildx-action#520</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0">https://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/setup-buildx-action/commit/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5"><code>d7f5e7f</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/489">#489</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/92bc5c9777806d0a73d9d668ba2114fa1177f164"><code>92bc5c9</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/da11e35abee0f20cb4f1c1b7c461d37c29be52f5"><code>da11e35</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.79.0 to 0.90.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/f021e162ef95b6fba51af1c6674f537f25bce851"><code>f021e16</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/492">#492</a> from docker/dependabot/npm_and_yarn/undici-6.24.1</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/b5af94fab700aee0c64d6077e0e34ae987815b67"><code>b5af94f</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/16ad9776a801d0c47f0a05f007b88a3789aa8ab6"><code>16ad977</code></a> build(deps): bump undici from 6.23.0 to 6.25.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/d7a12d7df895b33bd02a9b4bf62a12f2b9a24458"><code>d7a12d7</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/495">#495</a> from docker/dependabot/npm_and_yarn/glob-10.5.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/28ff27de4eed7518d361591f2cd1dfb69c34a7cb"><code>28ff27d</code></a> build(deps): bump glob from 10.3.12 to 13.0.6</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/daf436b50e13d9053b9730cbc16516891878b019"><code>daf436b</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/496">#496</a> from docker/dependabot/npm_and_yarn/fast-xml-parser-5...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/9725348367859764880f2f2e688a6b0c353e3f35"><code>9725348</code></a> chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 4.1.0 to 4.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.2.0</h2> <ul> <li>Bump <code>@actions/core</code> from 3.0.0 to 3.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1050.0 in <a href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in <a href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li> <li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li> <li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li> <li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li> <li>Bump postcss from 8.5.6 to 8.5.10 in <a href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li> <li>Bump tar from 6.2.1 to 7.5.15 in <a href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li> <li>Bump vite from 7.3.1 to 7.3.3 in <a href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/650006c6eb7dba73a995cc03b0b2d7f5ca915bee"><code>650006c</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/960">#960</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li> <li><a href="https://github.com/docker/login-action/commit/99df1a3f6d65e48177ea57671a50e2242eae4b63"><code>99df1a3</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/3ab375f324f46da5f6901efeda4be4e2566ebaa2"><code>3ab375f</code></a> build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...</li> <li><a href="https://github.com/docker/login-action/commit/39d85804ae465a1816c68ff58158ec66883981b4"><code>39d8580</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/970">#970</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/login-action/commit/4eefcd33ca7213989697445a78b6730274bfaba6"><code>4eefcd3</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/56d092c8b3f04006c22f4fc20a2b3d2442caed56"><code>56d092c</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.86.0 to 0.90.0</li> <li><a href="https://github.com/docker/login-action/commit/e2e31ca87063ae00fd41ad3b9c548dd8ec24c5ff"><code>e2e31ca</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/976">#976</a> from docker/dependabot/npm_and_yarn/actions/core-3.0.1</li> <li><a href="https://github.com/docker/login-action/commit/0bced941e843afc786fbfd58b1c6c13ca11e09c9"><code>0bced94</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/3e75a0f266b07e09777a621d0ca5f4432ef9f10c"><code>3e75a0f</code></a> build(deps): bump <code>@actions/core</code> from 3.0.0 to 3.0.1</li> <li><a href="https://github.com/docker/login-action/commit/365bebd9d646160567ebad47824f026e09ee6970"><code>365bebd</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/984">#984</a> from docker/dependabot/github_actions/aws-actions/con...</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee">compare view</a></li> </ul> </details> <br /> Updates `pnpm/action-setup` from 5.0.0 to 6.0.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pnpm/action-setup/releases">pnpm/action-setup's releases</a>.</em></p> <blockquote> <h2>v6.0.8</h2> <h2>What's Changed</h2> <ul> <li>docs(README): fix <code>cache_dependency_path</code> type by <a href="https://github.com/haines"><code>@haines</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/257">pnpm/action-setup#257</a></li> <li>fix: drop patchPnpmEnv so standalone+self-update works on Windows by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/258">pnpm/action-setup#258</a></li> <li>fix: update pnpm to 11.1.1 by <a href="https://github.com/mungodewar"><code>@mungodewar</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/248">pnpm/action-setup#248</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mungodewar"><code>@mungodewar</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/248">pnpm/action-setup#248</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8">https://github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8</a></p> <h2>v6.0.7</h2> <h2>What's Changed</h2> <ul> <li>fix: honor devEngines.packageManager.onFail=error (<a href="https://redirect.github.com/pnpm/action-setup/issues/252">#252</a>) by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/254">pnpm/action-setup#254</a></li> <li>fix: restore inputs from state in post by <a href="https://github.com/haines"><code>@haines</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/255">pnpm/action-setup#255</a></li> <li>fix: self-update bootstrap to packageManager-pinned version (<a href="https://redirect.github.com/pnpm/action-setup/issues/233">#233</a>) by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/256">pnpm/action-setup#256</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/haines"><code>@haines</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/255">pnpm/action-setup#255</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7">https://github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7</a></p> <h2>v6.0.6</h2> <h2>What's Changed</h2> <ul> <li>fix: bin_dest output points to self-updated pnpm, not bootstrap by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/249">pnpm/action-setup#249</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6">https://github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6</a></p> <h2>v6.0.5</h2> <h2>What's Changed</h2> <ul> <li>fix: append (not prepend) action node dir to PATH for npm bootstrap by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/241">pnpm/action-setup#241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.4...v6.0.5">https://github.com/pnpm/action-setup/compare/v6.0.4...v6.0.5</a></p> <h2>v6.0.4</h2> <h2>What's Changed</h2> <ul> <li>fix: use npm co-located with the action node binary by <a href="https://github.com/benquarmby"><code>@benquarmby</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/239">pnpm/action-setup#239</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/benquarmby"><code>@benquarmby</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/239">pnpm/action-setup#239</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.3...v6.0.4">https://github.com/pnpm/action-setup/compare/v6.0.3...v6.0.4</a></p> <h2>v6.0.3</h2> <p>Updated pnpm to v11.0.0-rc.5</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.2...v6.0.3">https://github.com/pnpm/action-setup/compare/v6.0.2...v6.0.3</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pnpm/action-setup/commit/0e279bb959325dab635dd2c09392533439d90093"><code>0e279bb</code></a> fix: update pnpm to 11.1.1 (<a href="https://redirect.github.com/pnpm/action-setup/issues/248">#248</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/3e835812ef01165f4f8ae08ade56da44427ed4e0"><code>3e83581</code></a> fix: drop patchPnpmEnv so standalone+self-update works on Windows (<a href="https://redirect.github.com/pnpm/action-setup/issues/258">#258</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/551b42e879e37e74d986effdd2a1647d2b02d464"><code>551b42e</code></a> docs(README): fix <code>cache_dependency_path</code> type (<a href="https://redirect.github.com/pnpm/action-setup/issues/257">#257</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/739bfe42ca9233c5e6aca07c1a25a9d34aca49b0"><code>739bfe4</code></a> fix: self-update bootstrap to packageManager-pinned version (<a href="https://redirect.github.com/pnpm/action-setup/issues/233">#233</a>) (<a href="https://redirect.github.com/pnpm/action-setup/issues/256">#256</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/f61705d907761b3b5209e83910fafd1fea50c5a1"><code>f61705d</code></a> chore: add CODEOWNERS</li> <li><a href="https://github.com/pnpm/action-setup/commit/7a5507b117647ab83e96e9db317ba2234056ebf3"><code>7a5507b</code></a> fix: restore inputs from state in post (<a href="https://redirect.github.com/pnpm/action-setup/issues/255">#255</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/1155470f3e5fb872accd4d104b8dfcda41f676ce"><code>1155470</code></a> fix: honor devEngines.packageManager.onFail=error (<a href="https://redirect.github.com/pnpm/action-setup/issues/252">#252</a>) (<a href="https://redirect.github.com/pnpm/action-setup/issues/254">#254</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/91ab88e2619ed1f46221f0ba42d1492c02baf788"><code>91ab88e</code></a> fix: bin_dest output points to self-updated pnpm, not bootstrap (<a href="https://redirect.github.com/pnpm/action-setup/issues/249">#249</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/e578e19d19d31b011b841ba2aca34731a5f706a5"><code>e578e19</code></a> fix: update pnpm to 11.0.4</li> <li><a href="https://github.com/pnpm/action-setup/commit/8912a9102ac27614460f54aedde9e1e7f9aec20d"><code>8912a91</code></a> fix: append (not prepend) action node dir to PATH for npm bootstrap (<a href="https://redirect.github.com/pnpm/action-setup/issues/241">#241</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pnpm/action-setup/compare/fc06bc1257f339d1d5d8b3a19a8cae5388b55320...0e279bb959325dab635dd2c09392533439d90093">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-node` from 6.3.0 to 6.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-node/releases">actions/setup-node's releases</a>.</em></p> <blockquote> <h2>v6.4.0</h2> <h2>What's Changed</h2> <h3>Dependency updates:</h3> <ul> <li>Upgrade <a href="https://github.com/actions"><code>@actions</code></a> dependencies by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li> <li>Update Node.js versions in versions.yml and bump package to v6.4.0 by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1533">actions/setup-node#1533</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v6.4.0">https://github.com/actions/setup-node/compare/v6...v6.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-node/commit/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"><code>48b55a0</code></a> Update Node.js versions in versions.yml and bump package to v6.4.0 (<a href="https://redirect.github.com/actions/setup-node/issues/1533">#1533</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/ab72c7e7eba0eaa11f8cab0f5679243900c2cac9"><code>ab72c7e</code></a> Upgrade <a href="https://github.com/actions"><code>@actions</code></a> dependencies (<a href="https://redirect.github.com/actions/setup-node/issues/1525">#1525</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e">compare view</a></li> </ul> </details> <br /> Updates `peaceiris/actions-gh-pages` from 4.0.0 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/peaceiris/actions-gh-pages/releases">peaceiris/actions-gh-pages's releases</a>.</em></p> <blockquote> <h2>actions-github-pages v4.1.0</h2> <p>See <a href="https://github.com/peaceiris/actions-gh-pages/blob/v4.1.0/CHANGELOG.md">CHANGELOG.md</a> for more details.</p> <h2>What's Changed</h2> <ul> <li>Actions examples: update to modern versions of actions by <a href="https://github.com/clintonsteiner"><code>@clintonsteiner</code></a> in <a href="https://redirect.github.com/peaceiris/actions-gh-pages/pull/1117">peaceiris/actions-gh-pages#1117</a></li> <li>chore: update Node runtime and dependencies by <a href="https://github.com/peaceiris"><code>@peaceiris</code></a> in <a href="https://redirect.github.com/peaceiris/actions-gh-pages/pull/1147">peaceiris/actions-gh-pages#1147</a></li> <li>ci: harden GitHub Actions workflows by <a href="https://github.com/peaceiris"><code>@peaceiris</code></a> in <a href="https://redirect.github.com/peaceiris/actions-gh-pages/pull/1156">peaceiris/actions-gh-pages#1156</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/clintonsteiner"><code>@clintonsteiner</code></a> made their first contribution in <a href="https://redirect.github.com/peaceiris/actions-gh-pages/pull/1117">peaceiris/actions-gh-pages#1117</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/peaceiris/actions-gh-pages/compare/v4.0.0...v4.1.0">https://github.com/peaceiris/actions-gh-pages/compare/v4.0.0...v4.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/peaceiris/actions-gh-pages/blob/main/CHANGELOG.md">peaceiris/actions-gh-pages's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file. See <a href="https://github.com/conventional-changelog/standard-version">standard-version</a> for commit guidelines.</p> <h1><a href="https://github.com/peaceiris/actions-gh-pages/compare/v4.0.0...v4.1.0">4.1.0</a> (2026-05-12)</h1> <h3>chore</h3> <ul> <li>add .codex/ (<a href="https://github.com/peaceiris/actions-gh-pages/commit/94ae2d2c73d9417ae30f61ddead523dc54d56dab">94ae2d2</a>)</li> <li>add hasInstallScript true (<a href="https://github.com/peaceiris/actions-gh-pages/commit/494ec9b2cc029a46119b4e13ff65f91eacbe1cf3">494ec9b</a>)</li> <li>update Node runtime and dependencies (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1147">#1147</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/954f6bf8259a6185f366f5cf13baee63745e0f79">954f6bf</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1147">#1147</a></li> </ul> <h3>ci</h3> <ul> <li>change automerge to false (<a href="https://github.com/peaceiris/actions-gh-pages/commit/4b09552702d0b65573696410d4707c765da2630b">4b09552</a>)</li> <li>harden GitHub Actions workflows (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1156">#1156</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/aa0466c1792bb558ed327a96629c4dd4ec390e48">aa0466c</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1156">#1156</a></li> </ul> <h3>docs</h3> <ul> <li>add repository guidelines (<a href="https://github.com/peaceiris/actions-gh-pages/commit/a1f94b504729eaee11b94d0f21ef5630241e8a52">a1f94b5</a>)</li> <li>bump to v4 from v3 (<a href="https://github.com/peaceiris/actions-gh-pages/commit/a16b61f0780be556cf97931905d261429ee79342">a16b61f</a>)</li> <li>fix note style (<a href="https://github.com/peaceiris/actions-gh-pages/commit/0b7567fde6f7517edcc13d8ffa2d89cd8734d47c">0b7567f</a>)</li> <li>update versions of actions (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1117">#1117</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/aa83d0c2cfc3d813560e13068d3152aa21490171">aa83d0c</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1117">#1117</a></li> </ul> <h1><a href="https://github.com/peaceiris/actions-gh-pages/compare/v3.9.3...v4.0.0">4.0.0</a> (2024-04-08)</h1> <h3>build</h3> <ul> <li>node 20.11.1 (<a href="https://github.com/peaceiris/actions-gh-pages/commit/5049354438ced05ab8a5da89ef20fd8efff107c7">5049354</a>)</li> </ul> <h3>chore</h3> <ul> <li>bump node16 to node20 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1067">#1067</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/4eb285e828117bca26638192c3ed309c622e7bad">4eb285e</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1067">#1067</a></li> <li>downgrade engines.npm to 8.0.0 (<a href="https://github.com/peaceiris/actions-gh-pages/commit/87231bc03a428df52f90a00b3b9e6bef82f7daf9">87231bc</a>)</li> </ul> <h3>ci</h3> <ul> <li>pin node-version to 18 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/981">#981</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/65ebf11929c082120c54719c87069f0827d2084c">65ebf11</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/981">#981</a></li> </ul> <h3>docs</h3> <ul> <li>add Release Strategy (<a href="https://github.com/peaceiris/actions-gh-pages/commit/67f80d94a1668353e4733223685dcb84340c44b5">67f80d9</a>)</li> <li>fix link to Nuxt github-pages (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/980">#980</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/88b4d2aa927893f8976712406df9928468be3c88">88b4d2a</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/980">#980</a></li> <li>remove braces in if conditions (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/920">#920</a>) (<a href="https://github.com/peaceiris/actions-gh-pages/commit/0fbd12244217a1fa04396b8a52d911a436893771">0fbd122</a>), closes <a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/920">#920</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/84c30a85c19949d7eee79c4ff27748b70285e453"><code>84c30a8</code></a> chore(release): 4.1.0</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/6fa0f50907221d627dfc1f22925e09fc46a95139"><code>6fa0f50</code></a> chore(release): Add build assets</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/3b7506a0311b775872374907835d53bcfbbb7464"><code>3b7506a</code></a> chore(deps): update dependency trim-newlines to v5 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1158">#1158</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/aa0466c1792bb558ed327a96629c4dd4ec390e48"><code>aa0466c</code></a> ci: harden GitHub Actions workflows (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1156">#1156</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/31835fbbe39cd0ffade1ab81fac14a532b529633"><code>31835fb</code></a> chore(deps): update actions/labeler action to v6 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1153">#1153</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/f4f1bc416d16988941232658cea5c06368f3373b"><code>f4f1bc4</code></a> chore(deps): update peaceiris/actions-mdbook action to v2 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1161">#1161</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/a5e49793f6bdcb5cae6355701f7370ac849c8f20"><code>a5e4979</code></a> chore(deps): update dependency ubuntu to v24 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1159">#1159</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/6cc3bac1ca327126c11b95063230514c80197c9c"><code>6cc3bac</code></a> chore(deps): update github/codeql-action action to v4 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1160">#1160</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/0d6e9f4a6f26532ada0e15a7e783b34f9faad71a"><code>0d6e9f4</code></a> chore(deps): update actions/setup-node action to v6 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1154">#1154</a>)</li> <li><a href="https://github.com/peaceiris/actions-gh-pages/commit/d70c101088107fa90acab16aa67e6db280eda929"><code>d70c101</code></a> chore(deps): update actions/upload-artifact action to v7 (<a href="https://redirect.github.com/peaceiris/actions-gh-pages/issues/1155">#1155</a>)</li> <li>Additional commits viewable in <a href="https://github.com/peaceiris/actions-gh-pages/compare/4f9cc6602d3f66b9c108549d475ec49e8ef4d45e...84c30a85c19949d7eee79c4ff27748b70285e453">compare view</a></li> </ul> </details> <br /> Updates `codecov/codecov-action` from 6.0.0 to 6.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's releases</a>.</em></p> <blockquote> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>fix: prevent template injection in run: steps (VULN-1652) by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1947">codecov/codecov-action#1947</a></li> <li>chore(release): 6.0.1 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1949">codecov/codecov-action#1949</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1">https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md">codecov/codecov-action's changelog</a>.</em></p> <blockquote> <h2>v5.5.2</h2> <h3>What's Changed</h3> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2</a></p> <h2>v5.5.1</h2> <h3>What's Changed</h3> <ul> <li>fix: overwrite pr number on fork by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1871">codecov/codecov-action#1871</a></li> <li>build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1868">codecov/codecov-action#1868</a></li> <li>build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1867">codecov/codecov-action#1867</a></li> <li>fix: update to use local app/ dir by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1872">codecov/codecov-action#1872</a></li> <li>docs: fix typo in README by <a href="https://github.com/datalater"><code>@datalater</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1866">codecov/codecov-action#1866</a></li> <li>Document a <code>codecov-cli</code> version reference example by <a href="https://github.com/webknjaz"><code>@webknjaz</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1774">codecov/codecov-action#1774</a></li> <li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1861">codecov/codecov-action#1861</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1833">codecov/codecov-action#1833</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1">https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1</a></p> <h2>v5.5.0</h2> <h3>What's Changed</h3> <ul> <li>feat: upgrade wrapper to 0.2.4 by <a href="https://github.com/jviall"><code>@jviall</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1864">codecov/codecov-action#1864</a></li> <li>Pin actions/github-script by Git SHA by <a href="https://github.com/martincostello"><code>@martincostello</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1859">codecov/codecov-action#1859</a></li> <li>fix: check reqs exist by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1835">codecov/codecov-action#1835</a></li> <li>fix: Typo in README by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1838">codecov/codecov-action#1838</a></li> <li>docs: Refine OIDC docs by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1837">codecov/codecov-action#1837</a></li> <li>build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1829">codecov/codecov-action#1829</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0">https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0</a></p> <h2>v5.4.3</h2> <h3>What's Changed</h3> <ul> <li>build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1822">codecov/codecov-action#1822</a></li> <li>fix: OIDC on forks by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1823">codecov/codecov-action#1823</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3">https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3</a></p> <h2>v5.4.2</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/codecov/codecov-action/commit/e79a6962e0d4c0c17b229090214935d2e33f8354"><code>e79a696</code></a> chore(release): 6.0.1 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1949">#1949</a>)</li> <li><a href="https://github.com/codecov/codecov-action/commit/51e64229ac331acb0d7f7b17c67423995f991c79"><code>51e6422</code></a> fix: prevent template injection in run: steps (VULN-1652) (<a href="https://redirect.github.com/codecov/codecov-action/issues/1947">#1947</a>)</li> <li>See full diff in <a href="https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com>
…9425) **Motivation** adhere to spec `notify_ptc_messages` ```python # PTC votes can only change the vote for their assigned beacon block, return early otherwise if data.slot != state.slot: return ``` see #9415 (comment), this caused issues on `glamsterdam-devnet-4` **Description** Ignore PTC votes whose slot does not match the referenced block
## Motivation Align the private field name in `ProtoArray` with the gloas fork-choice spec, which calls this store entry [`payload_timeliness_vote`](https://github.com/ethereum/consensus-specs/blob/dev/specs/gloas/fork-choice.md#modified-store). The companion field for blob-data availability is already tracked via the existing `daVotes` map. This was the last unmerged piece of lodekeeper#8 — the data-availability tracking landed independently in #9416 and force-reorg in #9387, so only the rename is left. ## Changes - `packages/fork-choice/src/protoArray/protoArray.ts`: rename `private ptcVotes` → `private payloadTimelinessVotes` and all 6 in-class references. - `packages/fork-choice/test/unit/protoArray/gloas.test.ts`: update 2 comments that reference the old field name. Pure rename — no behavior change. Public `getPTCVotes()` API, `isPayloadTimely`/`isPayloadNotTimely`, and surrounding spec comments are unchanged. ## Verification - `pnpm check-types` clean in `packages/fork-choice`. - `pnpm biome check` clean on the two touched files. - `vitest run test/unit/protoArray/gloas.test.ts` → 80/80 pass. 🤖 Generated with AI assistance --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>
…9406) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com>
no idea what broke it but this works again
see ethereum/consensus-specs#5309 and related issue #9415
) **Motivation** The consensus-specs repo added new fork choice test vectors for on_payload_attestation_message (ethereum/consensus-specs#5206). Lodestar's spec test runner needs a handler for this step type so the nightly spec tests can run these vectors instead of failing on an unrecognized step. **Description** Adds test infrastructure to handle `on_payload_attestation_message` steps in fork choice spec tests: - OnPayloadAttestationMessage step type and `isPayloadAttestationMessage` type guard - SSZ fixture loader for `payload_attestation_message_*.ssz_snappy` files - Step handler that deserializes the message and calls `notifyPtcMessages` Closes #9364
…t_available_slot (#9454) **Motivation** - lodestar silently return 0-block response if requested range is before the earliest_available_slot **Description** - throw resource_unavailable error in that case found when reviewing #9417 --------- Co-authored-by: twoeths <twoeths@users.noreply.github.com>
## Summary Mirror the getBlobsV2 path in `getDataColumnSidecarsFromExecution` and align with Lighthouse/Prysm by publishing only the sampled (custody + sampling) columns after matrix recovery, instead of cross-seeding every recovered column to non-subscribed subnets. Per consensus-specs [PR #4657](ethereum/consensus-specs#4657) ("Only require nodes to publish custody columns from reconstruction"), eager fanout for non-custody columns floods the network with duplicates because the sender lacks visibility into which peers already saw the message via the topic mesh. > Lighthouse (and probably Prysm too) currently just publishes its own sampling/custody columns for that reason. — [@jimmygchen on the spec PR](ethereum/consensus-specs#4657 (comment)) A node custodying 65 columns ends up publishing at least 64 (63 non-custody + 1 missing custody) columns every reconstruction, which is more outbound bandwidth than a supernode. This change brings Lodestar in line with the other clients. ## Change `packages/beacon-node/src/util/dataColumns.ts` — `recoverDataColumnSidecars`: - Capture `input.getMissingSampledColumnMeta().missing` before adding reconstructed columns (otherwise the indices are no longer "missing" after `addColumn`). - Still add every recovered sidecar to the input so DA accounting is unchanged. - Only push to `sidecarsToPublish` when the index is in the captured missing-sampled set. - Split metric reporting: `peerDas.reconstructedColumns` and `dataColumns.bySource{source=recovery}` now correctly count reconstructed columns (`sidecarsReconstructed.length`) instead of accidentally tracking only published ones — they happened to be equal under the old behavior, but diverge now. The existing getBlobsV2 path in `util/execution.ts:198-203` already follows this "publish iff subscribed" pattern using the same `getMissingSampledColumnMeta()` API; matrix recovery now matches. ## Spec note Spec PR #4657 also tightens the reconstruction trigger ("custodies more than 50%") and softens the cross-seed clause (SHOULD → MAY). This PR only implements the publish-side change, which is what Lighthouse/Prysm already do in practice. The trigger-side wording change does not require a Lodestar code change (we already only attempt reconstruction when we have ≥50%, gated by sampling). ## Test plan - [ ] tsgo / biome clean on touched file (verified locally) - [ ] Sim / devnet observation: confirm reduced outbound column traffic from non-supernodes after reconstruction - [ ] No existing unit tests for `recoverDataColumnSidecars` or the equivalent execution.ts publish path; covered by integration/sim. Happy to add a dedicated unit test if reviewers want it — it would need real KZG + a mocked `BlockInputColumns`. 🤖 Generated with AI assistance Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com> Co-authored-by: matthewkeil <me@matthewkeil.com>
## Motivation Fixes #9228. In multi-node setups (e.g. DVT clusters or fallback configurations), the same block is often submitted to multiple beacon nodes. When one node receives the block via gossip slightly before the `POST eth/v2/beacon/blocks` REST call, the gossip validation raises `BLOCK_ERROR_REPEAT_PROPOSAL` from the `seenBlockProposers` check, which currently propagates as an unhandled exception and returns HTTP 500 to the caller. Nothing is actually wrong with the submitted block. ## Description Extend the existing `ALREADY_KNOWN` handler in `publishBlock` to also swallow `REPEAT_PROPOSAL`. Both are thrown as `BlockGossipError` with `GossipAction.IGNORE`, so they share the same remediation — log at debug and return silently so the API caller sees a successful response. This mirrors the handler added in #6457 for `ALREADY_KNOWN`. Only the `gossip` broadcast-validation path is affected; `consensus` / `consensusAndEquivocation` paths use `verifyBlocksInEpoch` and do not go through `validateGossipBlock`, so they cannot hit `REPEAT_PROPOSAL`. No new tests added — the existing handler for `ALREADY_KNOWN` was introduced without tests (#6457), and the underlying validation error is already tested at the gossip layer in `test/unit/chain/validation/block.test.ts`.
**Motivation** Three Gloas `on_attestation` spec test vectors added in ethereum/consensus-specs#5275 were skipped in #9422 with a TODO pending investigation. This PR resolves that investigation and re-enables the tests. **Description** The validation logic in `validateAttestationData` was already correct — all three payload-status checks were implemented and firing as expected. The root cause was that the attestation step handler in `fork_choice.test.ts` had no `valid` flag handling: it called `onAttestation` unconditionally and let any thrown `ForkChoiceError` propagate as a test failure, even when the spec vector marks the attestation as `valid: false`. Fix: wrap `onAttestation` in the same `try/catch` + `isValid` pattern already used by the `execution_payload` step handler, then unskip the three tests. Closes #9447
## Summary - `codecov-action@v6.0.1` started failing on `unstable` because Codecov lost write access to the `codecovsecurity` keybase account, bricked it, and migrated to `codecovsecops`. v6.0.1 hardcodes the old URL, so the wrapper's GPG key import 404s, signature verify fails, and the `Upload coverage data` step exits 1 (example: [Unit Tests (24) on 79c77e2](https://github.com/ChainSafe/lodestar/actions/runs/27069917312/job/79898204341)). - Codecov shipped `v6.0.2` as a literal copy of `v7.0.0` (same commit) so v6 consumers can adopt the fix without crossing a major. See codecov/codecov-action#1955 / codecov/codecov-action#1956. - The only runtime change vs `v6.0.1` is the keybase URL swap (`codecovsecurity` → `codecovsecops`); GPG integrity verification of the uploader binary is preserved — no `use_pypi` / `skip_validation` workaround needed. ## Test plan - [ ] Tests workflow runs to completion on this PR - [ ] `Upload coverage data` step in Unit Tests (24) succeeds (no `gpg: no valid OpenPGP data found` / `Could not verify signature`) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: lodekeeper <nflaig@protonmail.com>
**Motivation** Introduce assumption based fast confirmation rule. **Description** Specs: ethereum/consensus-specs#4747
…ers (#9170) ## Motivation `unknownBlockGossipsubMessagesCount` and `unknownPayloadGossipsubMessagesCount` getters iterate over all sets in the awaiting maps to calculate the total count. This is O(N) where N = number of unique unknown roots. These getters are called on **every gossip message** in `onPendingGossipsubMessage` (hot path). While map sizes are typically small (1–3 roots in normal operation), the linear scan is unnecessary when a simple counter can be maintained at O(1). Flagged by gemini-code-assist on #9169, assigned by @nflaig. ## Changes - Add private `awaitingBlockMessageCount` and `awaitingPayloadMessageCount` counters - Increment on `.add()` (2 sites: AwaitBlock + AwaitEnvelope cases) - Decrement by `.size` before `.delete()` (4 sites: onBlockProcessed, onPayloadEnvelopeProcessed, 2× onClockSlot expiry) - Replace O(N) iteration in getters with direct counter return 1 file changed, 10 insertions, 10 deletions. --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com> Co-authored-by: Nico Flaig <nflaig@protonmail.com>
We are queuing payload envelopes in the network processor already, this **TODO** has been resolved
**Motivation** - track payload timing on Networking dashboard **Description** - also tweak `elapsedTimeTillReceived` bucket <img width="1368" height="393" alt="Screenshot 2026-06-09 at 11 02 57" src="https://github.com/user-attachments/assets/c796e8fe-d32d-4919-8925-4196e906ffff" /> --------- Co-authored-by: twoeths <twoeths@users.noreply.github.com>
**Motivation** - we throw `TOO_MANY_SKIPPED_SLOT` block error but still let the gossip block run through the sync **Description** - it's best to just remove it, lighthouse remove a long time ago - record in metrics + logs Closes #9483 **AI Assistance Disclosure** - created with the help of Claude Co-authored-by: twoeths <twoeths@users.noreply.github.com>
**Motivation** - UnknownBlockSync failed `validateGossipExecutionPayloadEnvelope()` because block was not in forkchoce - there was a gap where PayloadEnvelopeInput existed but block was not imported to forkchoice yet **Description** - check block was in forkchoice instead Closes #9478 **AI Assistance Disclosure** - created with the help of Claude Co-authored-by: twoeths <twoeths@users.noreply.github.com>
- Wires the new `fast_confirmation` Server-Sent Event from beacon-APIs PR [#598](ethereum/beacon-APIs#598). The event fires once per slot whenever the Fast Confirmation Rule executes and carries `{block, slot}`, where `slot` is the slot of the confirmed beacon block. - Crosses the fork-choice ↔ beacon-node boundary via a new optional `onFastConfirmation` callback on `ForkChoiceStore`, mirroring the existing `onJustified` / `onFinalized` plumbing. The emit is invoked from `ForkChoice.runFastConfirmation()` after the rule succeeds. - Removes the now-redundant Lodestar-namespace endpoint `GET /eth/v1/lodestar/fast_confirmation_info` (and its `getConfirmedBlock` helper) — the standard SSE event supersedes it, and the head/checkpoint fields it bundled are already available via standard beacon-API endpoints. This PR is aligned with the changes proposed in ethereum/beacon-APIs#616 ### Architecture ``` Chain.onClockSlot → forkChoice.updateTime └── (per tick) runFastConfirmation └── fcStore.notifyFastConfirmation({block, slot}) └── ChainEventEmitter.emit(EventType.fastConfirmation, {block, slot}) └── SSE subscribers via /eth/v1/events?topics=fast_confirmation ``` `ApiEvents` in `ChainEventEmitter` is derived from `routes.events.EventType`, so adding the new variant flows through automatically — no per-event boilerplate in the chain or events API layers. ### Edge cases | Scenario | Behavior | |---|---| | `--chain.fastConfirmation` disabled (default) | No emit (FCR doesn't run) | | FCR rule throws | No emit; existing warn-and-continue catch is unchanged | | Confirmed root not in `protoArray` (defensive) | Warn log with `slot`+`confirmedRoot`, skip emit | | `updateTime` advances multiple slots | One emit per tick |
**Motivation** - alternative to #9394 **Description** - update gossipsub to latest version (15->16 is just a 'breaking' bugfix to apply the rpc decoding limits to control messages)
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request bumps the version of the project and all of its packages from 1.43.0 to 1.44.0. I have no feedback to provide as there are no review comments and the changes are straightforward version updates.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Contributor
Performance Report✔️ no performance regression detected Full benchmark results
|
**Motivation** - better logs + metrics for `BlockInputSync`, this is very useful to debug unstable networks **Description** - dedup unknown block vs unknown payload metrics - add `delaySec` whenever we have a slot, more logs - add slot to `ChainEvent.unknownEnvelopeBlockRoot` event
## Motivation `fastConfirmation.test.ts` perf bench was flaky on CI. ## Summary The per-iteration `everyoneVotes(...)` (100K–1M validator loop) and `updateHead()` in `beforeEach` created GC pressure inside the µs-scale measurement window. The "flip votes" logic was also a silent no-op — `addLatestMessage` rejects same-epoch votes. Since `runFastConfirmationRules` doesn't mutate `store`, `beforeEach` is now a pass-through. Locally: ~80K–160K samples/config (was 25–424), ~0.3–5s wall time/config (was 2–17s). ## Follow-ups (separate PR) - Rename to `runFastConfirmationRules.test.ts` to match the bench `id`. - Add a state-backed bench that exercises `findLatestConfirmedDescendant` end-to-end using `generatePerfTestCachedStateElectra` from `@lodestar/state-transition/test-utils`. ## Test plan - [x] `pnpm benchmark:files 'packages/fork-choice/test/perf/forkChoice/fastConfirmation.test.ts'` — stable across 3 consecutive runs. - [x] `check-types` + `lint` clean. - [ ] CI bench job. 🤖 AI-assisted with Claude Code (Opus 4.7). --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Lodekeeper <258435968+lodekeeper@users.noreply.github.com> Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>
5094 resolved this on the spec side
## Motivation `bench` runs on `unstable` have been failing with `1 benchmark(s) failed: unknown error` ([example run](https://github.com/ChainSafe/lodestar/actions/runs/27218604384/job/80367013945)). All 8 `send data - 1000 NB messages` cases throw on every iteration: ``` StreamResetError: The stream has been reset at EncryptedMessageStream.onRemoteReset (.../abstract-message-stream.js:260:21) at MockMuxedStream.noiseOnClose (.../@chainsafe/libp2p-noise@17.0.0/dist/src/utils.js:83:26) at MockMuxer.onMessage (.../@libp2p/utils@7.2.2/.../mock-muxer.js:155:20) ``` Reproduces locally and on multiple recent unstable runs (`27225662417` b00d95d, `27203232811` 8d5a6a4). ## Root cause When `connA.close()` lands after sending all 1000 messages, `MockMuxer` routes the close as a **reset frame** to the inbound side (`mock-muxer.js:155` → `stream.onRemoteReset()`). That dispatches a `close` event the noise layer is subscribed to (`libp2p-noise/utils.js:77-89`), which calls `EncryptedMessageStream.onRemoteReset()` and puts the encrypted stream into `reset` status while the inbound `for await (const _chunk of connB)` is still draining. The async iterator then throws `StreamResetError` on its next pull. The throw propagates through `Promise.all` and `fn`'s `await`, the bench harness reports the iteration as failed, and the whole file is reported as `unknown error`. The existing `process.on("uncaughtException", ...)` only suppresses `StreamStateError` from the **drain** race — it can't catch this one because the error is a normal async throw inside `fn`, not an uncaught exception. ## Fix Wrap the inbound `for await` in a `try/catch` that swallows `StreamResetError` only. Rethrow anything else. ## Test plan - [x] Reproduced the failure locally on `unstable@b00d95d` — all 8 cases fail with the same stack. - [x] After the fix, all 8 cases pass locally: ``` ✔ send data - 1000 256B messages 250.06 ops/s 3.999 ms/op 28 runs ✔ send data - 1000 512B messages 236.67 ops/s 4.225 ms/op 18 runs ✔ send data - 1000 1024B messages 212.73 ops/s 4.701 ms/op 17 runs ✔ send data - 1000 1200B messages 212.85 ops/s 4.698 ms/op 17 runs ✔ send data - 1000 2048B messages 190.46 ops/s 5.251 ms/op 23 runs ✔ send data - 1000 4096B messages 172.39 ops/s 5.801 ms/op 22 runs ✔ send data - 1000 16384B messages 87.81 ops/s 11.389 ms/op 12 runs ✔ send data - 1000 65536B messages 29.22 ops/s 34.222 ms/op 10 runs 8 passing, 0 failed ``` - [x] `lint` clean. - [ ] CI bench job. 🤖 AI-assisted with Claude Code (Opus 4.7). --------- Co-authored-by: lodekeeper <lodekeeper@users.noreply.github.com>
CHURN_LIMIT_QUOTIENT_GLOAS, CONSOLIDATION_CHURN_LIMIT_QUOTIENT and MAX_PER_EPOCH_ACTIVATION_CHURN_LIMIT_GLOAS are now present in local chainConfig and match the spec, so drop them from ignoredRemoteConfigFields.
**Motivation** - got this error from vero ``` consensus-1 | Jun-09 21:45:56.328[rest] error: Req req-qi getProposerDuties error - Can only get block root in the past currentSlot=14518127 slot=14518143 consensus-1 | Error: Can only get block root in the past currentSlot=14518127 slot=14518143 consensus-1 | at getBlockRootAtSlot (file:///usr/app/packages/state-transition/src/util/blockRoot.ts:21:11) consensus-1 | at BeaconStateView.getBlockRootAtSlot (file:///usr/app/packages/state-transition/src/stateView/beaconStateView.ts:157:12) consensus-1 | at proposerShufflingDecisionRoot (file:///usr/app/packages/state-transition/src/util/shuffling.ts:36:16) consensus-1 | at Object.getProposerDuties (file:///usr/app/packages/beacon-node/src/api/impl/validator/index.ts:1298:9) consensus-1 | at processTicksAndRejections (node:internal/process/task_queues:104:5) consensus-1 | at Object.<anonymous> (file:///usr/app/packages/api/src/utils/server/handler.ts:105:22) ``` - #9380 was too strict, vero still querying `get_proposer_duties()` v1 **Description** - this is how it was broken for unstable and how it worked for v1.43 ``` ### lodestar unstable vero requested for v1 at epoch 453692, lodestar detected it's not v2 => fork is phase0 => decision epoch = 453692 => decision slot = 14 518 143 => throw error ### lodestar v1.43 did not care about requested epoch => based on state slot 14518127, decisionSlot is 14.518.111, which is luckily correct for requested epoch 453692 (previous slot of epoch 453691) ``` => fallback to`get_proposer_duties()` v1, which is how it worked for v1.43 **AI Assistance Disclosure** - created with the help of Claude Co-authored-by: twoeths <twoeths@users.noreply.github.com>
per #9380 (comment), we cannot use getProposerDutiesV2 before gloas as clients might not have it implemented yet
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.