This release contains important security fixes. We recommend all chains upgrade to this patch release as soon as possible using a coordinated upgrade.
This release is state breaking.
What's Changed
- fix: Change otel env var (backport #26390) by @mergify[bot] in #26391
- chore: bump Go baseline to 1.26.3 and relax goconst linting (backport #26407) by @mergify[bot] in #26412
- build(deps): Bump actions/dependency-review-action from 4 to 5 (backport #26402) by @mergify[bot] in #26411
- fix(distribution): add strict + fallback behavior when withdrawing delegator rewards (backport #26406) by @mergify[bot] in #26409
- build(deps): Bump actions/add-to-project from 1.0.2 to 2.0.0 (backport #26384) by @mergify[bot] in #26393
- chore(deps): bump x/net, x/sys, x/text (backport #26442) by @mergify[bot] in #26445
- fix: resolve pre-existing lint and test failures (backport #26457) by @mergify[bot] in #26459
- ci: bump go to 1.26.4 and source CI Go version from go.mod (backport #26486) by @mergify[bot] in #26496
- fix(x/staking): handle redelegation when unbonded source is removed (backport #26408) by @mergify[bot] in #26416
- test(x/gov): expand genesis InitGenesis/ExportGenesis coverage (backport #26354) by @mergify[bot] in #26446
- feat: add Block-STM configuration support (backport #26208) by @mergify[bot] in #26495
- ci: bump remaining Dockerfile/scripts go to 1.26.4 (backport #26494) by @mergify[bot] in #26500
- chore(x/auth): human-readable error (backport #26567) by @mergify[bot] in #26577
- fix: Guard against bstm estimate failure (backport #26627) by @mergify[bot] in #26636
- build(deps): consolidated deps bump on release/v0.54.x by @swift1337 in #26671
- fix(x/auth/tx): avoid nil pointer panic in GetSigningTxData (backport #26527) by @mergify[bot] in #26660
- fix: bound multisig signature and pubkey indexing by slice lengths (backport #26515) by @mergify[bot] in #26650
- fix(x/auth/tx): avoid nil pointer panic in GetSigningTxData for multisig ModeInfo with a nil Multi or nil Bitarray (backport #26571) by @mergify[bot] in #26657
- build(deps): bump google.golang.org/grpc to v1.82.1 on release/v0.54.x by @swift1337 in #26676
- fix: bound compact bit array index by elems length (backport #26509) by @mergify[bot] in #26656
- fix: reject tx with mismatched signer info and signature counts (backport #26517) by @mergify[bot] in #26652
- fix(x/auth/ante): reject tx with extra SignerInfos in SetPubKeyDecorator (backport #26573) by @mergify[bot] in #26658
- fix(x/distribution): return errors for missing historical rewards internally (backport #26518) by @mergify[bot] in #26654
- fix(blockstm): normalize non-positive worker count in STMRunner.Run (backport #26591) by @mergify[bot] in #26659
- fix(blockstm): count validation tasks before advancing validationIdx to prevent lost updates (backport #26583) by @mergify[bot] in #26667
- fix(crypto): validate secp256k1 pubkey SEC1 tag byte (backport #26529) by @mergify[bot] in #26666
- feat: update comet and changelog by @swift1337 in #26690
Full Changelog: v0.54.3...v0.54.4