An open index of dependabot pull requests across open source projects.

build(deps): Bump the all-go group across 5 directories with 6 updates

Open
Number: #2881
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 3
Created: November 24, 2025 at 09:10 AM UTC
(8 months ago)
Updated: November 27, 2025 at 09:01 AM UTC
(8 months ago)
Labels:
T:dependencies
Description:

Bumps the all-go group with 1 update in the / directory: github.com/celestiaorg/go-header.
Bumps the all-go group with 1 update in the /execution/evm directory: github.com/ethereum/go-ethereum.
Bumps the all-go group with 2 updates in the /execution/grpc directory: golang.org/x/net and github.com/evstack/ev-node.
Bumps the all-go group with 2 updates in the /test/docker-e2e directory: github.com/ethereum/go-ethereum and github.com/docker/docker.
Bumps the all-go group with 2 updates in the /test/e2e directory: github.com/ethereum/go-ethereum and github.com/celestiaorg/tastora.

Updates github.com/celestiaorg/go-header from 0.7.3 to 0.7.4

Release notes

Sourced from github.com/celestiaorg/go-header's releases.

v0.7.4

What's Changed

Full Changelog: https://github.com/celestiaorg/go-header/compare/v0.7.3...v0.7.4

Commits
  • 425f0dc fix(headertest): add locking to header test suite for concurrent use (#356)
  • 62199e0 fix(store): fixes rare race condition where 2 workers attempt to close errCh ...
  • See full diff in compare view

Updates github.com/ethereum/go-ethereum from 1.16.6 to 1.16.7

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Ballistic Drift Stabilizer (v1.16.7)

This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.

This release enables the Fusaka hardfork on Ethereum mainnet.

The Fusaka fork is scheduled to occur at 2025-12-03 21:49:11 UTC. Please upgrade your node to v1.16.7 in time for the fork.

This release also enables two blob-parameter-only (BPO) upgrades. These upgrades change protocol parameters to increase the available blob capacity.

  • BPO1 on2025-12-09
  • BPO2 on 2026-01-07

Fusaka

  • Set mainnet timestamps for Osaka (#33063)
  • Enable Fusaka for geth --dev mode (#32917)

RPC

  • Add eth_sendRawTransactionSync which waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)
  • Add support for eth_simulateV1 in ethclient (#32856)
  • Fix for an issue that might crash debug_traceCall (#33015)
  • Fix for an issuer where local transactions were not persisted to the journal (#32921)

Core

  • Fix for a cryptographic vulnerability in c-kzg-4844. This is only exploitable post-Fusaka. (#33093)
  • Add geth --genesis flag as an alternative to running geth init genesis.json (#32844)
  • Fix for receipt insertion during ERA file import. (#32934)
  • Work on getting the trie node history in order to serve historical eth_getProof request with the new path-based archive node. (#32907, #32914, #32937)
  • Further work on cmd/keeper, our guest program for zkVMs (#32816)
  • Various optimizations (#32971, #32916, #32965, #32946)

Networking

  • New metrics for tracking slow peers (#32964)
  • Fix for an issue where disconnected peers were not removed in txFetcher (#32947)

For a full rundown of the changes please consult the Geth 1.16.6 and 1.16.7 release milestones.

As with all our previous releases, you can find the:

... (truncated)

Commits

Updates github.com/ethereum/go-ethereum from 1.16.6 to 1.16.7

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Ballistic Drift Stabilizer (v1.16.7)

This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.

This release enables the Fusaka hardfork on Ethereum mainnet.

The Fusaka fork is scheduled to occur at 2025-12-03 21:49:11 UTC. Please upgrade your node to v1.16.7 in time for the fork.

This release also enables two blob-parameter-only (BPO) upgrades. These upgrades change protocol parameters to increase the available blob capacity.

  • BPO1 on2025-12-09
  • BPO2 on 2026-01-07

Fusaka

  • Set mainnet timestamps for Osaka (#33063)
  • Enable Fusaka for geth --dev mode (#32917)

RPC

  • Add eth_sendRawTransactionSync which waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)
  • Add support for eth_simulateV1 in ethclient (#32856)
  • Fix for an issue that might crash debug_traceCall (#33015)
  • Fix for an issuer where local transactions were not persisted to the journal (#32921)

Core

  • Fix for a cryptographic vulnerability in c-kzg-4844. This is only exploitable post-Fusaka. (#33093)
  • Add geth --genesis flag as an alternative to running geth init genesis.json (#32844)
  • Fix for receipt insertion during ERA file import. (#32934)
  • Work on getting the trie node history in order to serve historical eth_getProof request with the new path-based archive node. (#32907, #32914, #32937)
  • Further work on cmd/keeper, our guest program for zkVMs (#32816)
  • Various optimizations (#32971, #32916, #32965, #32946)

Networking

  • New metrics for tracking slow peers (#32964)
  • Fix for an issue where disconnected peers were not removed in txFetcher (#32947)

For a full rundown of the changes please consult the Geth 1.16.6 and 1.16.7 release milestones.

As with all our previous releases, you can find the:

... (truncated)

Commits

Updates github.com/ethereum/go-ethereum from 1.16.6 to 1.16.7

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Ballistic Drift Stabilizer (v1.16.7)

This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.

This release enables the Fusaka hardfork on Ethereum mainnet.

The Fusaka fork is scheduled to occur at 2025-12-03 21:49:11 UTC. Please upgrade your node to v1.16.7 in time for the fork.

This release also enables two blob-parameter-only (BPO) upgrades. These upgrades change protocol parameters to increase the available blob capacity.

  • BPO1 on2025-12-09
  • BPO2 on 2026-01-07

Fusaka

  • Set mainnet timestamps for Osaka (#33063)
  • Enable Fusaka for geth --dev mode (#32917)

RPC

  • Add eth_sendRawTransactionSync which waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)
  • Add support for eth_simulateV1 in ethclient (#32856)
  • Fix for an issue that might crash debug_traceCall (#33015)
  • Fix for an issuer where local transactions were not persisted to the journal (#32921)

Core

  • Fix for a cryptographic vulnerability in c-kzg-4844. This is only exploitable post-Fusaka. (#33093)
  • Add geth --genesis flag as an alternative to running geth init genesis.json (#32844)
  • Fix for receipt insertion during ERA file import. (#32934)
  • Work on getting the trie node history in order to serve historical eth_getProof request with the new path-based archive node. (#32907, #32914, #32937)
  • Further work on cmd/keeper, our guest program for zkVMs (#32816)
  • Various optimizations (#32971, #32916, #32965, #32946)

Networking

  • New metrics for tracking slow peers (#32964)
  • Fix for an issue where disconnected peers were not removed in txFetcher (#32947)

For a full rundown of the changes please consult the Geth 1.16.6 and 1.16.7 release milestones.

As with all our previous releases, you can find the:

... (truncated)

Commits

Updates golang.org/x/net from 0.46.0 to 0.47.0

Commits
  • 9a29643 go.mod: update golang.org/x dependencies
  • 07cefd8 context: deprecate
  • 5ac9dac publicsuffix: don't treat ip addresses as domain names
  • d1f64cc quic: use testing/synctest
  • fff0469 http2: document that RFC 7540 prioritization does not work with small payloads
  • f35e3a4 http2: fix weight overflow in RFC 7540 write scheduler
  • 89adc90 http2: fix typo referring to RFC 9218 as RFC 9128 instead
  • 8d76a2c quic: don't defer MAX_STREAMS frames indefinitely
  • 027f8b7 quic: fix expected ACK Delay in client's ACK after HANDSHAKE_DONE
  • dec9fe7 dns/dnsmessage: update SVCB packing to prohibit name compression
  • Additional commits viewable in compare view

Updates github.com/evstack/ev-node from 1.0.0-beta.9 to 1.0.0-beta.10

Changelog

Sourced from github.com/evstack/ev-node's changelog.

v1.0.0-beta.10

Added

  • Enhanced health check system with separate liveness (/health/live) and readiness (/health/ready) HTTP endpoints. Readiness endpoint includes P2P listening check and aggregator block production rate validation (5x block time threshold). (#2800)
  • Added GetP2PStoreInfo RPC method to retrieve head/tail metadata for go-header stores used by P2P sync (#2835)
  • Added protobuf definitions for P2PStoreEntry and P2PStoreSnapshot messages to support P2P store inspection

Changed

  • Remove GasPrice and GasMultiplier from DA interface and configuration to use celestia-node's native fee estimation. (#2822)
  • Use cache instead of in memory store for reaper. Persist cache on reload. Autoclean after 24 hours. (#2811)
  • Improved P2P sync service store initialization to be atomic and prevent race conditions (#2838)
  • Enhanced P2P bootstrap behavior to intelligently detect starting height from local store instead of requiring trusted hash
  • Relaxed execution layer height validation in block replay to allow execution to be ahead of target height, enabling recovery from manual intervention scenarios

Removed

  • BREAKING: Removed evnode.v1.HealthService gRPC endpoint. Use HTTP endpoints: GET /health/live and GET /health/ready. (#2800)
  • BREAKING: Removed TrustedHash configuration option and --evnode.node.trusted_hash flag. Sync service now automatically determines starting height from local store state (#2838)

Fixed

  • Fixed sync service initialization issue when node is not on genesis but has an empty store
Commits
  • d7eda60 refactor(syncer,cache): use compare and swap loop and add comments (#2873)
  • 9a5eba1 refactor: use state da height as well (#2872)
  • faabb32 refactor: retrieve highest da height in cache (#2870)
  • 6badca1 chore: change from event count to start and end height (#2871)
  • 12b9559 chore: bump da (#2866)
  • d8d1709 chore: bump core (#2865)
  • e5aa2c3 chore: reduce log noise (#2864)
  • 9d4c64c fix: sync service for non zero height starts with empty store (#2834)
  • 3ad84b8 build(deps): Bump golang.org/x/crypto from 0.43.0 to 0.45.0 in /execution/evm...
  • 2b45d45 chore: minor improvement for docs (#2862)
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.46.0 to 0.47.0

Commits
  • 9a29643 go.mod: update golang.org/x dependencies
  • 07cefd8 context: deprecate
  • 5ac9dac publicsuffix: don't treat ip addresses as domain names
  • d1f64cc quic: use testing/synctest
  • fff0469 http2: document that RFC 7540 prioritization does not work with small payloads
  • f35e3a4 http2: fix weight overflow in RFC 7540 write scheduler
  • 89adc90 http2: fix typo referring to RFC 9218 as RFC 9128 instead
  • 8d76a2c quic: don't defer MAX_STREAMS frames indefinitely
  • 027f8b7 quic: fix expected ACK Delay in client's ACK after HANDSHAKE_DONE
  • dec9fe7 dns/dnsmessage: update SVCB packing to prohibit name compression
  • Additional commits viewable in compare view

Updates github.com/ethereum/go-ethereum from 1.16.6 to 1.16.7

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Ballistic Drift Stabilizer (v1.16.7)

This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.

This release enables the Fusaka hardfork on Ethereum mainnet.

The Fusaka fork is scheduled to occur at 2025-12-03 21:49:11 UTC. Please upgrade your node to v1.16.7 in time for the fork.

This release also enables two blob-parameter-only (BPO) upgrades. These upgrades change protocol parameters to increase the available blob capacity.

  • BPO1 on2025-12-09
  • BPO2 on 2026-01-07

Fusaka

  • Set mainnet timestamps for Osaka (#33063)
  • Enable Fusaka for geth --dev mode (#32917)

RPC

  • Add eth_sendRawTransactionSync which waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)
  • Add support for eth_simulateV1 in ethclient (#32856)
  • Fix for an issue that might crash debug_traceCall (#33015)
  • Fix for an issuer where local transactions were not persisted to the journal (#32921)

Core

  • Fix for a cryptographic vulnerability in c-kzg-4844. This is only exploitable post-Fusaka. (#33093)
  • Add geth --genesis flag as an alternative to running geth init genesis.json (#32844)
  • Fix for receipt insertion during ERA file import. (#32934)
  • Work on getting the trie node history in order to serve historical eth_getProof request with the new path-based archive node. (#32907, #32914, #32937)
  • Further work on cmd/keeper, our guest program for zkVMs (#32816)
  • Various optimizations (#32971, #32916, #32965, #32946)

Networking

  • New metrics for tracking slow peers (#32964)
  • Fix for an issue where disconnected peers were not removed in txFetcher (#32947)

For a full rundown of the changes please consult the Geth 1.16.6 and 1.16.7 release milestones.

As with all our previous releases, you can find the:

... (truncated)

Commits

Updates github.com/ethereum/go-ethereum from 1.16.6 to 1.16.7

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Ballistic Drift Stabilizer (v1.16.7)

This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.

This release enables the Fusaka hardfork on Ethereum mainnet.

The Fusaka fork is scheduled to occur at 2025-12-03 21:49:11 UTC. Please upgrade your node to v1.16.7 in time for the fork.

This release also enables two blob-parameter-only (BPO) upgrades. These upgrades change protocol parameters to increase the available blob capacity.

  • BPO1 on2025-12-09
  • BPO2 on 2026-01-07

Fusaka

  • Set mainnet timestamps for Osaka (#33063)
  • Enable Fusaka for geth --dev mode (#32917)

RPC

  • Add eth_sendRawTransactionSync which waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)
  • Add support for eth_simulateV1 in ethclient (#32856)
  • Fix for an issue that might crash debug_traceCall (#33015)
  • Fix for an issuer where local transactions were not persisted to the journal (#32921)

Core

  • Fix for a cryptographic vulnerability in c-kzg-4844. This is only exploitable post-Fusaka. (#33093)
  • Add geth --genesis flag as an alternative to running geth init genesis.json (#32844)
  • Fix for receipt insertion during ERA file import. (#32934)
  • Work on getting the trie node history in order to serve historical eth_getProof request with the new path-based archive node. (#32907, #32914, #32937)
  • Further work on cmd/keeper, our guest program for zkVMs (#32816)
  • Various optimizations (#32971, #32916, #32965, #32946)

Networking

  • New metrics for tracking slow peers (#32964)
  • Fix for an issue where disconnected peers were not removed in txFetcher (#32947)

For a full rundown of the changes please consult the Geth 1.16.6 and 1.16.7 release milestones.

As with all our previous releases, you can find the:

... (truncated)

Commits

Updates github.com/docker/docker from 28.5.1+incompatible to 28.5.2+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v28.5.2

28.5.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

[!CAUTION] This release contains fixes for three high-severity security vulnerabilities in runc:

All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files.

Packaging updates

Bug fixes and enhancements

Deprecations

  • Go-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610
  • Go-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560
  • Go-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560
  • Go-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560
Commits
  • 89c5e8f Merge pull request #51396 from thaJeztah/28.x_backport_api_docs
  • 9b93878 Merge pull request #51395 from thaJeztah/28.x_backport_rootless_reject
  • 6178456 Merge pull request #51398 from vvoland/51397-28.x
  • 0cae4e5 vendor: github.com/moby/buildkit v0.25.2
  • 33cc06f Merge pull request #51394 from vvoland/51393-28.x
  • d525277 api/docs: remove BuildCache.Parent field for API v1.42 and up
  • 2fbc51b dockerd-rootless.sh: reject DOCKERD_ROOTLESS_ROOTLESSKIT_NET=host
  • bd98008 integration-cli: Adjust nofile limits
  • 1967515 Dockerfile: update runc binary to v1.3.3
  • 4489660 Merge pull request #51387 from thaJeztah/28.x_bump_go
  • Additional commits viewable in compare view

Updates github.com/ethereum/go-ethereum from 1.16.6 to 1.16.7

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Ballistic Drift Stabilizer (v1.16.7)

This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.

This release enables the Fusaka hardfork on Ethereum mainnet.

The Fusaka fork is scheduled to occur at 2025-12-03 21:49:11 UTC. Please upgrade your node to v1.16.7 in time for the fork.

This release also enables two blob-parameter-only (BPO) upgrades. These upgrades change protocol parameters to increase the available blob capacity.

  • BPO1 on2025-12-09
  • BPO2 on 2026-01-07

Fusaka

  • Set mainnet timestamps for Osaka (#33063)
  • Enable Fusaka for geth --dev mode (#32917)

RPC

  • Add eth_sendRawTransactionSync which waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)
  • Add support for eth_simulateV1 in ethclient (#32856)
  • Fix for an issue that might crash debug_traceCall (#33015)
  • Fix for an issuer where local transactions were not persisted to the journal (#32921)

Core

  • Fix for a cryptographic vulnerability in c-kzg-4844. This is only exploitable post-Fusaka. (#33093)
  • Add geth --genesis flag as an alternative to running geth init genesis.json (#32844)
  • Fix for receipt insertion during ERA file import. (#32934)
  • Work on getting the trie node history in order to serve historical eth_getProof request with the new path-based archive node. (#32907, #32914, #32937)
  • Further work on cmd/keeper, our guest program for zkVMs (#32816)
  • Various optimizations (#32971, #32916, #32965, #32946)

Networking

  • New metrics for tracking slow peers (#32964)
  • Fix for an issue where disconnected peers were not removed in txFetcher (#32947)

For a full rundown of the changes please consult the Geth 1.16.6 and 1.16.7 release milestones.

As with all our previous releases, you can find the:

... (truncated)

Commits

Updates github.com/ethereum/go-ethereum from 1.16.6 to 1.16.7

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Ballistic Drift Stabilizer (v1.16.7)

This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.

This release enables the Fusaka hardfork on Ethereum mainnet.

The Fusaka fork is scheduled to occur at 2025-12-03 21:49:11 UTC. Please upgrade your node to v1.16.7 in time for the fork.

This release also enables two blob-parameter-only (BPO) upgrades. These upgrades change protocol parameters to increase the available blob capacity.

  • BPO1 on2025-12-09
  • BPO2 on 2026-01-07

Fusaka

  • Set mainnet timestamps for Osaka (#33063)
  • Enable Fusaka for geth --dev mode (#32917)

RPC

  • Add eth_sendRawTransactionSync which waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)
  • Add support for eth_simulateV1 in ethclient (#32856)
  • Fix for an issue that might crash debug_traceCall (#33015)
  • Fix for an issuer where local transactions were not persisted to the journal (#32921)

Core

  • Fix for a cryptographic vulnerability in c-kzg-4844. This is only exploitable post-Fusaka. (#33093)
  • Add geth --genesis flag as an alternative to running geth init genesis.json (#32844)
  • Fix for receipt insertion during ERA file import. (#32934)
  • Work on getting the trie node history in order to serve historical eth_getProof request with the new path-based archive node. (#32907, #32914, #32937)
  • Further work on cmd/keeper, our guest program for zkVMs (#32816)
  • Various optimizations (#32971, #32916, #32965, #32946)

Networking

  • New metrics for tracking slow peers (#32964)
  • Fix for an issue where disconnected peers were not removed in txFetcher (#32947)

For a full rundown of the changes please consult the Geth 1.16.6 and 1.16.7 release milestones.

As with all our previous releases, you can find the:

... (truncated)

Commits

Updates github.com/celestiaorg/tastora from 0.7.5 to 0.8.0

Release notes

Sourced from github.com/celestiaorg/tastora's releases.

v0.8.0

What's Changed

Full Changelog: https://github.com/celestiaorg/tastora/compare/v0.7.5...v0.8.0

Commits

Updates github.com/ethereum/go-ethereum from 1.16.6 to 1.16.7

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Ballistic Drift Stabilizer (v1.16.7)

This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.

This release enables the Fusaka hardfork on Ethereum mainnet.

The Fusaka fork is scheduled to occur at 2025-12-03 21:49:11 UTC. Please upgrade your node to v1.16.7 in time for the fork.

This release also enables two blob-parameter-only (BPO) upgrades. These upgrades change protocol parameters to increase the available blob capacity.

  • BPO1 on2025-12-09
  • BPO2 on 2026-01-07

Fusaka

  • Set mainnet timestamps for Osaka (#33063)
  • Enable Fusaka for geth --dev mode (#32917)

RPC

  • Add eth_sendRawTransactionSync which waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)
  • Add support for eth_simulateV1 in ethclient (#32856)
  • Fix for an issue that might crash debug_traceCall (#33015)
  • Fix for an issuer where local transactions were not persisted to the journal (#32921)

Core

  • Fix for a cryptographic vulnerability in c-kzg-4844. This is only exploitable post-Fusaka. (#33093)
  • Add geth --genesis flag as an alternative to running geth init genesis.json (#32844)
  • Fix for receipt insertion during ERA file import. (#32934)
  • Work on getting the trie node history in order to serve historical eth_getProof request with the new path-based archive node. (#32907, #32914, #32937)
  • Further work on cmd/keeper, our guest program for zkVMs (#32816)
  • Various optimizations (#32971, #32916, #32965, #32946)

Networking

  • New metrics for tracking slow peers (#32964)
  • Fix for an issue where disconnected peers were not removed in txFetcher (#32947)

For a full rundown of the changes please consult the Geth 1.16.6 and 1.16.7 release milestones.

As with all our previous releases, you can find the:

... (truncated)

Commits

Updates github.com/celestiaorg/tastora from 0.7.5 to 0.8.0

Release notes

Sourced from github.com/celestiaorg/tastora's releases.

v0.8.0

What's Changed

Full Changelog: https://github.com/celestiaorg/tastora/compare/v0.7.5...v0.8.0

Commits
Technical Details
ID: 11417787
UUID: 3657864742
Node ID: PR_kwDOFABrEc61JNUb
Host: GitHub
Repository: evstack/ev-node