memecore-foundation/Go-MemeCore v1.15.4

on GitHub

Overview

This release fixes a remote node crash in the debug tracing API, updates third-party libraries that had published vulnerabilities, moves builds and CI to Go 1.27 and fixes the failing CI tests. All node operators are encouraged to upgrade. Nodes that expose the debug RPC namespace should upgrade immediately.

This release has no consensus, database or configuration changes.

Security Fixes

Node crash in keccak256PreimageTracer on trace timeout (ethereum/go-ethereum#35858)

When a trace hit its timeout, the tracing API called the tracer’s Stop hook, which keccak256PreimageTracer did not implement, and the node process crashed. Any trace request that selected this tracer and timed out could trigger it. This affects v1.15.1 to v1.15.3.

• eth/tracers/native: Added Stop() to keccak256PreimageTracer, cherry-picked from go-ethereum. After a stop, the tracer ignores further opcodes and reports the stop reason, so a timed-out request now returns an execution timeout error and the node keeps running.
• eth/tracers: Added regression tests for the tracer Stop hook and for the timeout path of TraceBlockByNumber.

Note: If you cannot upgrade yet, do not expose the debug namespace (--http.api, --ws.api) to untrusted clients.

Library Vulnerability Fixes

Updated to versions that fix published advisories. The table lists the newest advisories fixed by each update. The golang.org/x/net and golang.org/x/crypto updates also fix older advisories that are not listed.

• pion/stun: GO-2026-4479 affects pion/dtls, which has no fixed v2 release. pion/stun therefore moves to v3, which uses pion/dtls/v3 v3.1.5. In p2p/nat/stun.go only the import path changes.

Build and CI

• Go 1.27: Release binaries, Docker images and CI now use Go 1.27 (golang:1.27-alpine, 1.27.x). go.mod now requires Go 1.26.0 or later (previously 1.24.0), and the previous Go 1.23 and 1.24 Docker and CI settings are older than that.
• golangci-lint: Upgraded from v2.0.2 to v2.15.0, because v2.0.2 cannot lint a module that targets Go 1.26.
• Lint findings: Existing findings are fixed. The changes are formatting, reflect.Ptr to reflect.Pointer and one redundant loop variable copy removed from a test. The compiled node code is unchanged. Unused symbols kept for upstream parity are excluded from the nused linter by name.
• CI test job: Fixed. These are test and CI changes only.
  • Upstream tests that assumed Ethereum gas prices now fund their accounts and set tips for the gmeme base fee floor.
  • The devp2p eth and snap suites are skipped, because their test chain was generated with upstream base fee rules that gmeme does not accept.
  • Two tests that did not compile on 386 and two tests that failed at random are fixed.
  • CI runs test packages one at a time with a 45 minute timeout, as build/ci.go test already does.

Upgrade Notes

• Upgrade is recommended for all nodes. Nodes that expose the debug RPC namespace should upgrade immediately.

• This release maintains backward compatibility. Upgrading requires only a binary replacement with no configuration changes. Validators can be upgraded one at a time.

• To build from source, use the latest Go 1.27 release or newer. Go 1.26.0 has standard-library vulnerabilities that later releases fix.

• After the upgrade, gmeme version should report:

  Version: 1.15.4-stable
  

Release Date: November 6, 2026

This release fixes a remote node crash in the debug tracing API, updates third-party libraries that had published vulnerabilities, moves builds and CI to Go 1.27 and fixes the failing CI tests. All node operators are encouraged to upgrade. Nodes that expose the debug RPC namespace should upgrade immediately.

This release has no consensus, database or configuration changes.

Security Fixes

Node crash in keccak256PreimageTracer on trace timeout (ethereum/go-ethereum#35858)

When a trace hit its timeout, the tracing API called the tracer’s Stop hook, which keccak256PreimageTracer did not implement, and the node process crashed. Any trace request that selected this tracer and timed out could trigger it. This affects v1.15.1 to v1.15.3.

• eth/tracers/native: Added Stop() to keccak256PreimageTracer, cherry-picked from go-ethereum. After a stop, the tracer ignores further opcodes and reports the stop reason, so a timed-out request now returns an execution timeout error and the node keeps running.
• eth/tracers: Added regression tests for the tracer Stop hook and for the timeout path of TraceBlockByNumber.

Note: If you cannot upgrade yet, do not expose the debug namespace (--http.api, --ws.api) to untrusted clients.

Library Vulnerability Fixes

Updated to versions that fix published advisories. The table lists the newest advisories fixed by each update. The golang.org/x/net and golang.org/x/crypto updates also fix older advisories that are not listed.

• pion/stun: GO-2026-4479 affects pion/dtls, which has no fixed v2 release. pion/stun therefore moves to v3, which uses pion/dtls/v3 v3.1.5. In p2p/nat/stun.go only the import path changes.

Build and CI

• Go 1.27: Release binaries, Docker images and CI now use Go 1.27 (golang:1.27-alpine, 1.27.x). go.mod now requires Go 1.26.0 or later (previously 1.24.0), and the previous Go 1.23 and 1.24 Docker and CI settings are older than that.
• golangci-lint: Upgraded from v2.0.2 to v2.15.0, because v2.0.2 cannot lint a module that targets Go 1.26.
• Lint findings: Existing findings are fixed. The changes are formatting, reflect.Ptr to reflect.Pointer and one redundant loop variable copy removed from a test. The compiled node code is unchanged. Unused symbols kept for upstream parity are excluded from the nused linter by name.
• CI test job: Fixed. These are test and CI changes only.
  • Upstream tests that assumed Ethereum gas prices now fund their accounts and set tips for the gmeme base fee floor.
  • The devp2p eth and snap suites are skipped, because their test chain was generated with upstream base fee rules that gmeme does not accept.
  • Two tests that did not compile on 386 and two tests that failed at random are fixed.
  • CI runs test packages one at a time with a 45 minute timeout, as build/ci.go test already does.

Upgrade Notes

• Upgrade is recommended for all nodes. Nodes that expose the debug RPC namespace should upgrade immediately.

• This release maintains backward compatibility. Upgrading requires only a binary replacement with no configuration changes. Validators can be upgraded one at a time.

• To build from source, use the latest Go 1.27 release or newer. Go 1.26.0 has standard-library vulnerabilities that later releases fix.

• After the upgrade, gmeme version should report:

  Version: 1.15.4-stable
  

Release Date: November 6, 2026