* Swap to azure code signing
* Update electron builder to allow building when using OIDC credentials for azure
* Try direct signing to work around hanging
* Use prod credential chain to azure signing service
* Disable signing in electron-builder for windows, since its done manually
* Remove unused azure login step
* Fix lint
bump chia_rs to 0.45.1 (#21068)
* bump chia_rs to 0.45.1
* fix issue in test_spam_message_too_large
* allow a few more warnings that can be triggered because our tests leak aiohttp websocket clients
* fix flaky test: test_transaction_ack_duplicate_without_resend_ignored
Co-authored-by: Arvid Norberg <arvid@libtorrent.org>
Source hash: b192f50081
Remaining commits: 3
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> The provided diff contains no code changes, so there is no functional
or behavioral risk beyond the administrative merge/checkpoint itself.
>
> **Overview**
> This PR appears to be a **checkpoint/merge** from `release/2.7.1` into
`main`, but the provided diff shows **no actual file changes** (only a
`+++ /dev/null` marker).
>
> No code, configuration, or dependency updates are visible to review in
this snapshot.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
0354fbdef7. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
* Checkpoint Merge
Co-authored-by: Almog De Paz <almogdepaz@gmail.com>
Co-authored-by: Zachary Brown <z.brown@chia.net>
* Add a timeout during node shutdown
* Revert "Add a timeout during node shutdown"
This reverts commit ab57da71fb.
* Replace test_add_transaction_seen_before_validation with simpler version
The previous version of this test was the sole cause of a CI hang on the
2.7.1-checkpoint branch (confirmed by bisection). It used the heavyweight
wallet_nodes fixture, a real peer connection, and a backgrounded task driving
add_transaction, all of which left orphaned async work during fixture teardown
under pytest-xdist on CI runners.
The replacement keeps the same regression coverage for SEC-111 (tx must be
marked in-flight before pre_validate_spendbundle) but does so with:
- the lightweight one_node_one_block fixture
- pytest.MonkeyPatch.context() instead of manual attribute swap
- two asyncio.Events to deterministically gate validation
- asyncio.wait_for on both the gate and the final task to fail fast
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Almog De Paz <almogdepaz@gmail.com>
Co-authored-by: Zachary Brown <z.brown@chia.net>
Co-authored-by: Earle Lowe <e.lowe@chia.net>
Co-authored-by: Cursor <cursoragent@cursor.com>
Source hash: 204fe59bd8
Remaining commits: 0
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Documentation-only change updating `CHANGELOG.md` with 2.6.1 release
notes; no code or behavior changes are included in this PR.
>
> **Overview**
> Adds release notes for **Chia blockchain 2.6.1 (2026-3-18)** to
`CHANGELOG.md`, listing the key *Added/Changed/Fixed/Removed* items
(e.g., wallet/RPC updates, full node hardening, `chia_rs` bump, and
dropping macOS 13/14 support).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
bbd15021ae. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Source hash: c3364780d4
Remaining commits: 1
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Touches full node block-ingest and peer discovery paths plus wallet
RPC signing behavior, so mistakes could affect sync/connectivity or
transaction submission, though changes are mostly defensive and covered
by new regression tests.
>
> **Overview**
> Improves robustness and security hardening across node networking and
block processing. `FullNode.add_prevalidated_blocks()` now returns typed
`Err` values (and logs) when prevalidation fails or `required_iters` is
missing, instead of raising assertions; new regression tests cover these
cases.
>
> Hardens peer discovery against pathological peer host strings by
bounding host length and rejecting non-IP hosts in `_add_peers_common()`
and `add_peers_neighbour()`, with new tests for oversized/invalid/mixed
hosts.
>
> Fixes cache eviction for future infusion points by recording TTLs in
`FullNodeStore.add_to_future_ip()` and adds tests ensuring
`clear_old_cache_entries()` evicts stale entries. Also tightens keyring
passphrase cache semantics (empty/cleared treated as missing) with a new
test, ensures data-layer uploader HTTP sessions consistently use
`client_timeout`, fixes an S3 plugin missing `continue` on store-id
mismatch, and disables auto-signing specifically for the wallet RPC
`take_offer` action scope.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1351f71b36. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Source hash: 888de5db7b
Remaining commits: 2
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> No effective code changes are visible in the provided diff; this
appears to be a checkpoint/merge-only PR, so risk is low.
>
> **Overview**
> This PR contains no reviewable code changes in the provided diff (it
only indicates `/dev/null`), suggesting a checkpoint/merge-only update
from `release/2.6.1` into `main`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
07ae7b31c8. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Source hash: d69c5214bd
Remaining commits: 3
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Adjusts `PendingTxCache` eviction logic for height-indexed pending
transactions; mistakes here could change which pending txs are
retained/evicted under load. Covered by new unit tests for the
empty-bucket edge case and eviction ordering.
>
> **Overview**
> Fixes a `PendingTxCache` eviction edge case where encountering an
empty `_by_height` bucket could incorrectly attempt to remove a tx from
`_txs` using a height key; eviction now drops the empty bucket instead.
>
> Adds targeted tests to ensure empty height buckets are cleaned up
during eviction and that eviction continues to remove transactions from
the highest `assert_height` first.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
ad015423fd. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Source hash: 8a64bfc1e2
Remaining commits: 4
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Build/packaging scripts now mutate `packages/gui/package.json` during
CI to work around electron-builder v26 dependency collection, which
could affect packaging behavior if the build relies on runtime node
modules.
>
> **Overview**
> After `npm run build`, the Linux/macOS/Windows GUI packaging scripts
now **rewrite `packages/gui/package.json` to clear `dependencies`**,
preventing electron-builder v26’s node-module collector from failing
once workspace packages are removed for cache slimming.
>
> Comments were updated to reflect that removing
`packages/gui/node_modules/@chia-network` is for cache size (and Windows
adds an explicit failure check if the dependency-clearing step errors).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1ed4f051c0. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Source hash: 0638d558db
Remaining commits: 5
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> The provided diff contains no code changes, so functional risk is
minimal aside from potential merge/branch management issues.
>
> **Overview**
> This PR appears to be a **checkpoint/merge sync** from `release/2.6.1`
into `main`, but the provided `full_diff` shows **no actual file
changes** (empty diff).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
0c7af2c03b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Source hash: f9206836b5
Remaining commits: 1
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Changes how `SingletonFastForward` updates its internal
`fast_forward_spends` state, which can affect subsequent mempool
validation/fast-forward chaining for singleton spends. Risk is moderate
because it touches spend/lineage handling but is a small, localized
logic change.
>
> **Overview**
> Ensures `SingletonFastForward.process_fast_forward_spends()`
**accumulates fast-forward lineage updates in a local `ff_state_update`
map** while processing a mempool item, and only merges them into
`self.fast_forward_spends` at the end.
>
> This also fixes the *no-fast-forward* path: when a spend is already
the latest singleton version, the derived “next version” lineage is now
persisted (via `self.fast_forward_spends.update(...)`) instead of being
dropped on early return.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
fdd11aaf6a. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Close VDF client TCP connections properly (#20602)
* Close VDF client TCP connections properly
_handle_client() did not close the StreamWriter for non-whitelisted
TCP connections, and free_clients had no upper bound once all 3
chains were mapped.
Fix:
- Explicitly close and await writer for non-whitelisted IPs
- Cap free_clients at max_free_clients (10)
- Close remaining free_clients connections during shutdown
Add unit tests for all three _handle_client paths (reject, accept,
cap overflow).
* Remove unrelated test to match private repo PR
Remove test_invalid_vdf_proof_is_ignored_in_process_communication and its
helpers (_NullTransport, _make_null_writer) so the public PR matches the
private security fix exactly.
* Move writer close outside lock in _handle_client
Avoid holding self.lock during writer.close()/wait_closed() to
prevent blocking timelord operations on a slow TCP close handshake.
Co-authored-by: Zachary Brown <z.brown@chia.net>
Source hash: bff4929ee7
Remaining commits: 1
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Low risk because there are no code or configuration changes in the
provided diff.
>
> **Overview**
> This PR contains **no code changes** as provided (the diff is empty),
indicating a checkpoint/merge-only PR with no repository modifications
to review.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1ce5a64252. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Source hash: 22e18c1b7f
Remaining commits: 5
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> No functional changes are present; review risk is minimal aside from
potential missing/incorrect diff context.
>
> **Overview**
> No code changes are included in this PR (the provided diff is empty /
contains only `+++ /dev/null`).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
5f56c7a3c6. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Source hash: 4e36460622
Remaining commits: 1
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Touches consensus-critical validation inputs (pre-SP tx height /
generator flags), which can affect block acceptance around overflow
blocks and the HF2 transition window. Changes are localized and covered
by new tests, but correctness is important for fork safety.
>
> **Overview**
> Adjusts `pre_sp_tx_block(_height)` to use `finished_sub_slots` (and
overflow-aware slot-crossing logic) instead of a boolean, fixing
selection of the latest transaction block before a block’s signage
point.
>
> Adds `full_node/hard_fork_utils.get_flags()` to compute CLVM/generator
`flags` during the HF2 transition period by walking back to the
appropriate pre-SP transaction block, and updates full node API/RPC
paths to use this helper when deriving spends, coin solutions, and
additions/removals.
>
> Updates all call sites and tests accordingly, and adds new tests
validating `get_flags` behavior inside and outside the HF2 transition
window.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
301fa2c143. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
* When testing rpms on rocky, swap to using the main rocky repos hosted by fastly
* Remove rocky-builder, since we're already testing on both rocky8 and rocky9 (which the builder is based on)
* Update all installer builds to use the version of node specified in chia-blockchain-gui .nvmrc
* Update the workflows that didn't previously use the setup-node action to use it, to make future updates easier (this action now works with all the currently supported platforms we build on)
* Swap to self hosted mac intel runners for installer build
* Change the test to also run self-hosted
* Use self hosted mac intel runners, and limit some things to not always run on mac intel
* Split the new mac intel rule to its own step
Enable Keccak for 2.5.4 (#19563)
* Backport enabling Keccak by default for wallet
* Keep ENABLE_KECCAK when not using mempool_mode
Co-authored-by: Earle Lowe <30607889+emlowe@users.noreply.github.com>
* Add support for a static list of peers to always have available in the dns_server
* Add some tests
* Test the hostname to ip resolution for static dns server responses
* Sort imports
* Fix types/lint
* Fix test_db_processing flake
* remove unnecessary continue
* Ensure the parts that used to loop every 2 seconds when the DB is being populated for the first time still loop every 2s
* Update chia/seeder/dns_server.py
Co-authored-by: Arvid Norberg <arvid@libtorrent.org>
* Remove redundant check for crawl store
---------
Co-authored-by: Arvid Norberg <arvid@libtorrent.org>
* Change a bunch of info logs back to warning in crawler, since crawlers are typically run in warning mode, to avoid the info log connection spam
* Ensure that the crawler loop ONLY doesn't start when in tests
* Rename the crawler service to crawler_service_no_loop, so defaults can also be tested WITH a loop
* Test crawler loop modes
* Add message when we received state chaged callback
* Add log to indicate crawling has started and how many peers we're crawling
* Add prune old peers functionality for crawler to keep the database size and write times under control
* Add test
* Make starting the crawler loop optional for tests. Test the pruning of old peers
* Fix lint issues
* its also useful to have network info available from the daemon, vs having to ask whichever service(s) happen to be up
* Add test for get_network_info on daemon
* Fix precommit
* Add get_network_info endpoint to the base rpc_server class, remove dupe implementations from wallet/full_node
Enables also getting network info from other RPC servers (crawler, etc)
* Add get_network_info test to full_node
* Remove unused var
* Update tests/core/test_full_node_rpc.py
Co-authored-by: Kyle Altendorf <sda@fstab.net>
* Use context manager for client
* Add success: true to the assertion to be complete
* Remove the **
---------
Co-authored-by: Kyle Altendorf <sda@fstab.net>
* Add fork height to block event
* Add rolled_back_records to the state change data as well
* Update default values for fork_height and rolled_back_records to be None
Chris MarslenderandGitHub
