Source hash: 715953bc5a
Remaining commits: 1
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **High Risk**
> Changes full-node sync banning, block prevalidation validation state,
and wallet coin-state ingestion—security-critical paths with wide
behavioral impact across nodes and wallets.
>
> **Overview**
> This release merge adds **consensus and P2P defenses** plus broader
wallet and validation hardening, with extensive regression tests.
>
> **Full node long sync** now snapshots peers that advertised the chosen
peak (`get_advertisers_of_peak`) and, during peer confirmation, bans
those advertisers if the block weight from `RequestBlock` does not match
the advertised weight or if no peer can serve the peak—**before**
weight-proof validation. `SyncStore` drops peers from old peaks when
they move to a new `NewPeak`. Short backtrack block fetches use a
**15s** timeout.
>
> **NewPeak admission control** drops inbound `NewPeak` when the limited
semaphore is full and at least one outbound full-node peer exists;
`LimitedSemaphore.locked()` supports this.
>
> **Block prevalidation** derives expected sub-slot iters/difficulty via
`get_next_sub_slot_iters_and_difficulty` when a sub-slot announces
changes, and simplifies `add_prevalidated_blocks` sub-slot handling.
>
> **Wallet**: bounded timestamp backtrack and stricter header-block
validation (including peak-hash anchoring in `new_peak_wallet`);
`PeerRequestCache` overwrites height timestamps correctly; untrusted
`add_states_from_peer` returns **False** when any chunk’s
`add_coin_states` fails or raises; new **`nft_auto_add_limit`** (default
100) caps auto-created DID-scoped NFT wallets; Data Layer
**`make_update_offer`** rejects non-DL legs.
>
> **Utilities**: `PriorityMutex` waiters use `eq=False` so cancelling a
non-first waiter does not strand the queue.
>
> Also adds coverage exclusion for `pragma: no cover` and
renames/removes SEC ticket references in test docstrings.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
67ddbb8578. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
CHIA-3484 Handle items that spend an older ff version when newer lineage exists (#19865)
Handle items that spend an older ff version when newer lineage exists.
[CHIA-3388] Port `test_cat_endpoints` in `test_wallet_rpc.py` to `WalletTestFramework` and R-CATs (#19818)
* Port `test_cat_endpoints` to `WalletTestFramework`
* Use mint_cat from cat tests
* Add RCAT parametrization
* Delete now unnecessary `from_zero`
* Minor clarification.
---------
Co-authored-by: Matt Hauff <quexington@gmail.com>
* Switch curl requests to github-glue action
* Prettier situationally prefers double quotes so make the bot happy
* Add name lines back to start release job steps
* Use github format environment variable in sync test start steps
* Remove redundant github-jwt step since that is wrapped in the glue action
Bumps [dnspython](https://github.com/rthalley/dnspython) from 2.4.2 to
2.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rthalley/dnspython/releases">dnspython's
releases</a>.</em></p>
<blockquote>
<h2>dnspython 2.5.0</h2>
<p>See the <a
href="https://dnspython.readthedocs.io/en/stable/whatsnew.html">What's
New</a> page for a summary of this release.</p>
<p>Thanks to all the contributors, and, as usual, thanks to my
co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rthalley/dnspython/blob/master/doc/whatsnew.rst">dnspython's
changelog</a>.</em></p>
<blockquote>
<h2>2.5.0</h2>
<ul>
<li>
<p>Dnspython now uses hatchling for builds.</p>
</li>
<li>
<p>Asynchronous destinationless sockets now work on Windows.</p>
</li>
<li>
<p>Cython is no longer supported due to various typing issues.</p>
</li>
<li>
<p>Dnspython now explicitly canonicalizes IPv4 and IPv6 addresses.
Previously it was possible for non-canonical IPv6 forms to be stored
in a AAAA address, which would work correctly but possibly cause
problmes if the address were used as a key in a dictionary.</p>
</li>
<li>
<p>The number of messages in a section can be retrieved with
section_count().</p>
</li>
<li>
<p>Truncation preferences for messages can be specified.</p>
</li>
<li>
<p>The length of a message can be automatically prepended when
rendering.</p>
</li>
<li>
<p>dns.message.create_response() automatically adds padding when
required by RFC 8467.</p>
</li>
<li>
<p>The TLS verify parameter is now supported by dns.query.tls(),
and the DoH and DoT Nameserver subclasses.</p>
</li>
<li>
<p>The MutableMapping used to store content in a zone may now be
specified by a factory when subclassing. Factories may also be
provided for writable verisons and immutable versions.</p>
</li>
<li>
<p>dns.name.Name now has predecessor() and successor() methods
implementing RFC 4471.</p>
</li>
<li>
<p>QUIC has had a number of bug fixes and also now supports session
tickets for faster session resumption.</p>
</li>
<li>
<p>The NSEC3 class now has a next_name() method for retrieving the next
name as a dns.name.Name.</p>
</li>
<li>
<p>Windows WMI interface detection should be more robust.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rthalley/dnspython/commit/91e5027191bb6c7d892e2524e74832501e6743de"><code>91e5027</code></a>
2.5.0 versioning</li>
<li><a
href="https://github.com/rthalley/dnspython/commit/59b2655f1c75d314348f3e18d16d04409ea1485f"><code>59b2655</code></a>
Bump readthedocs-sphinx-search from 0.3.1 to 0.3.2 (<a
href="https://redirect.github.com/rthalley/dnspython/issues/1033">#1033</a>)</li>
<li><a
href="https://github.com/rthalley/dnspython/commit/5e9cd03be3a6fa58bd705aa7c610c6e8cede2f4d"><code>5e9cd03</code></a>
bump hatchling minimum version for official 3.12 support</li>
<li><a
href="https://github.com/rthalley/dnspython/commit/f01878969df9faab6882f17221f84a6dc671dade"><code>f018789</code></a>
update SECURITY.md supported status</li>
<li><a
href="https://github.com/rthalley/dnspython/commit/a5078588622bd6a6616d1bda5b987ebc45062f24"><code>a507858</code></a>
2.5.0rc1 versioning</li>
<li><a
href="https://github.com/rthalley/dnspython/commit/ace5a5113741a174fd6fb174233b678948be210e"><code>ace5a51</code></a>
GSS-TSIG doco updates</li>
<li><a
href="https://github.com/rthalley/dnspython/commit/d9787409b3596a358e5fbdfd4866aee5bad5fe4a"><code>d978740</code></a>
formatting lint</li>
<li><a
href="https://github.com/rthalley/dnspython/commit/c7eb39297d45b9c7f82b18a710024b4c3d84de82"><code>c7eb392</code></a>
lint</li>
<li><a
href="https://github.com/rthalley/dnspython/commit/62c953693db3dca694cfb8e80bc5cc3691a71941"><code>62c9536</code></a>
update whatsnew for 2.5.0</li>
<li><a
href="https://github.com/rthalley/dnspython/commit/609d6b2e7ba4d01e3541558e01e9f7357bc6d0c6"><code>609d6b2</code></a>
Uniform TLS verify argument support. (<a
href="https://redirect.github.com/rthalley/dnspython/issues/1027">#1027</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/rthalley/dnspython/compare/v2.4.2...v2.5.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
StarttoasterandGitHub
