chore(deps): bump the dependencies group with 5 updates

[dependabot]

Bumps the dependencies group with 5 updates:

Package	From	To
github.com/ethereum/go-ethereum	1.17.6	1.17.8
github.com/herumi/bls-eth-go-binary	1.37.0	1.38.0
github.com/pk910/dynamic-ssz	1.3.3-0.20260921152246-990798fa9718	1.4.0
github.com/urfave/cli/v3	3.13.0	3.14.0
golang.org/x/sync	0.23.0	0.24.0

Updates github.com/ethereum/go-ethereum from 1.17.6 to 1.17.8

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Protein Sludge Pack (v1.17.8)

This is a security-focused release, fixing several DoS risk issues ❤️‍🩹 . Note most of the the fixes related to bugs which only become possible after the activation of the Amsterdam fork. There are also some general correctness improvements.

This release is recommended for all users.

All Changes

Security

• In the eth and snap p2p protocol handler, DoS resistance has been improved for multiple packet handlers (#35862, #35883, #35859, #35857, #35904, #35856)
• JUMPDEST analysis caching has been hardened for attack cases after Amsterdam fork (#35881)
• The IP address predictor now requires IP verification before accepting statements (#35861)
• A post-Amsterdam DoS vector related to BAL accounts is resolved (#35865)
• A rogue STUN server could crash the node with an invalid response (#35863)

RPC

• eth_createAccessList now works when the sender account has no balance (#35397)
• eth_simulateV1 has been fixed to correctly report ETH transfer logs post-Amsterdam (#35617)
• eth_simulateV1 virtual blocks are now aligned with the Amsterdam spec (#35668)
• eth_capabilities reports the availability of receipts bounded by the transaction hash index (#35878)
• For eth_call and related operations, the transaction gas limit is no longer applied (after Amsterdam fork) (#35845)
• A post-Amsterdam crash in journaled live tracers core/tracing: handle creator nonce change without an open frame (#35896)
• An edge case in processing beacon chain head updates after unclean shutdown is resolved (#35804)
• abigen will now use sequential nonces when deploying library dependencies of a contract (#35888)

Core Library

• The hard-coded Hoodi testnet beacon chain genesis time was incorrect (#35876)
• blsync could get stuck if the server was unresponsive or overloaded (#35872)

P2P

• A correctness issue in the EIP-8070 Sparse Blobpool (Amsterdam fork) implementation is fixed (#35860)
• The dial scheduler now handles IPv4 <> IPv6 transitions for DNS-resolved static nodes (#35880)

Build

• The PPA now publishes for Ubuntu 26.04 "Resolute Raccoon" (#35854)

---

For a full rundown of the changes please consult the Geth 1.17.8 release milestone.

As with all our previous releases, you can find the:

• Pre-built binaries for all platforms on our downloads page.
• Docker images published under ethereum/client-go (use "stable" tag).
• Ubuntu packages in our Launchpad PPA repository.
• macOS packages in our Homebrew Tap repository.

... (truncated)

Commits

• a579077 version: go-ethereum v1.17.8 stable
• b10c4ec eth/protocols/eth: add size checks for receipts (#35904)
• acdb0c6 eth/catalyst: don't treat a forward canonical update as a reorg (#35804)
• 21f1eb2 node: fix flaky jwt too new auth test (#35889)
• 0ef7a39 accounts/abi/abigen: chain nonces when deploying library dependencies (#35888)
• eedeb03 core/tracing: handle creator nonce change without an open frame (#35896)
• 0b468a8 eth/protocols/eth: verify block shape before hashing (#35862)
• fd37587 eth/protocols/eth: limit getCells lookup (#35883)
• 4f9ca6d eth: fix cells response to use index major (#35860)
• defbdf7 internal/ethapi, core: align eth_simulateV1 blocks with the Amsterdam spec (#...
• Additional commits viewable in compare view

Updates github.com/herumi/bls-eth-go-binary from 1.37.0 to 1.38.0

Commits

• e8755af fix(release): added libs for windows
• e957467 fix(release): added libs for ios/ios simulator
• 94dab60 fix(release): added libs for darwin
• eb49bb3 Merge remote-tracking branch 'origin/master' into release
• 5c2a38e ci: update actions and macOS runners
• 6e2d4c0 fix(release): added libs for android
• 28a7cfe fix(release): added libs for linux(amd64/arm64)
• a5a34af Merge remote-tracking branch 'origin/master' into release
• 574c8cc bump bls
• 9997046 fix(release): added libs for android
• Additional commits viewable in compare view

Updates github.com/pk910/dynamic-ssz from 1.3.3-0.20260921152246-990798fa9718 to 1.4.0

Release notes

Sourced from github.com/pk910/dynamic-ssz's releases.

v1.4.0 - hardening & async hashing

This is a hardening release. The reflection engine, the code generator, the hasher and treeproof went through many rounds of differential fuzzing, external audits and conformance testing. Both engines now produce the same bytes, roots, trees and errors for the same schema, bad input returns an error instead of panicking or allocating without bound, and the code generator is no longer in beta.

Breaking Changes

• CompatibleUnion selectors now follow EIP-8016. Selectors are 1-based (1..127), so the first untagged variant is written as 0x01 instead of 0x00. Schemas and values that use 0-based selectors need to be migrated.
• The hash tree root of ssz-type:"optional" fields changed (extended types only). Presence is now mixed in as a length, so an absent value and a present zero value no longer have the same root. The root is now the same as for optional-list. Serialization is unchanged. Generated code keeps the old root until it is regenerated.
• Validation is stricter. Some malformed input and schemas that older versions accepted are now rejected with an error. This includes list counts that do not fit the region, non-zero padding bits in bitvectors, trailing or missing bytes, hash tree roots of lists without a limit, conflicting size or type tags, zero-field containers with their own SSZ methods (use ssz-type:"custom" for these) and spec-only bounds in code generated without dynamic expressions.

Added

• Classic SSZ Union[T] with 0-based selectors and dynssz.None, next to the EIP-8016 CompatibleUnion[T].
• Async hashing. Optional background hashing of large subtrees, enabled with WithAsyncHashing(workers) or hasher.EnableAsyncHashing.
• Recursive types, as long as every cycle goes through a variable-length field. Nesting depth is limited (default 1024) and can be set with WithMaxNestingDepth, codegen.WithRecursionDepth or dynssz-gen -recursion-depth.
• Batched tree finalization. GetTree now builds a finalized read-only tree through the hashtree backend. New Node.Finalize, treeproof.WithHashFn and treeproof.NewWrapperWithHashFn.
• Unknown-size stream decoding. UnmarshalSSZReader with a negative size reads until EOF and only allocates for bytes that actually arrived. Generated code needs to be regenerated for this.
• Limits for untrusted input: WithMaxStreamSize, the per-call WithStreamSizeLimit and WithMaxNestingDepth.
• ssz-type:"-" to skip a struct field, and WithNoDelegation to ignore the generated methods of a type.
• dynssz-gen options: custom header templates, per-type skip-* settings in the config file, -recursion-depth and -remove.
• New error values (ErrStreamTooLarge, ErrSszSizeExceeded, ErrMaxDepthExceeded and more), HashErr() on Hasher and treeproof.Wrapper, and Reset on all encoders and decoders.
• Big-endian (s390x) and 32-bit support, tested in CI. New examples (chain-specs, streaming, merkle-proofs, fork-views, htr-caching) and a docs page about method delegation.

Changed

• Performance: generated code resolves the spec expressions of a type once per DynSsz instance instead of on every call (regenerate to get this). Encoders and decoders are pooled per instance. The reflection engine sizes byte lists by their length, decodes byte slices without boxing and handles uint64 and byte-array elements as one block.
• All size, offset and limit math is done in unsigned 64-bit with explicit range checks, so both engines are safe on 32-bit targets.
• Spec expressions are evaluated as exact rationals and rounded up once. The govaluate dependency is gone. A name:N fallback syntax was added.
• Both engines use the same rules for when the fastssz, *Dyn or view methods of a type are called. Promoted methods from embedded fields are no longer used, and fastssz is only used when no resolved spec value differs from the static tags. sszutils.Annotate now works across packages and on views, type wrappers and union variants.
• Conformance tests: the consensus-spec vectors (including Gloas) also run as a 32-bit build, and a new test runs every vector of the official ethereum/ssz-specs suite on both engines. The differential fuzzer got an independent reference SSZ implementation and extra checks for trees, proofs, native hashing, sizes and streaming.
• The code generator is now considered production ready. hashtree-bindings bumped to 0.2.6.

Fixed

• Panics and unbounded allocations on bad input (oversized declared lists, huge bitsize values, stream over-reads, offset overflows, recursive payloads).
• Cases where reflection and generated code framed, sized or hashed the same schema differently: views of view-serving types, custom types with spec-driven widths, overridden type hints, cross-package Annotate, packed large uints, union variants with spec-only widths and code generated without dynamic expressions.
• Hash tree roots of packed scopes with delegated elements, Index-opened scopes, progressive lists under async hashing, partial chunks, short uint128 and uint256 values, optionals and lists of type wrappers. HashTreeRoot and GetTree now agree and return backend errors.
• Streaming: the streaming encoder of a static build wrote correct data behind wrong offsets for children with spec values. Unions, optionals, custom types and views are now framed the same way on buffer and reader paths.
• treeproof: empty leaves from ProveMulti, caller memory being aliased, zero-padding gindices that could not be proven, 32-bit leaf overflow and an unbounded multiproof cache.
• Zero-padding no longer writes into caller memory, float32 NaN bits are kept as is, NewDynSsz copies its spec map and RemoveType removes both the value and the pointer form of a type.

Full changelog

• 36555b0 fix: remove both value and pointer forms in RemoveType (#259)
• 3d377da perf: handle uint64 and byte-array elements as one block in reflection (#258)
• 90de3df perf: decode reflection byte slices without boxing them (#257)
• f2782e3 Check the size against the platform int before SizeSSZ converts it (#256)
• 1697d38 Pre-release performance refinement: cheaper per-call lookups, byte-list sizing, pooled encoders and decoders (#255)
• 0af489a Run the official SSZ vectors from upstream main on generated types (#254)
• f48642c Size a spec-carrying child inline in a static build's streaming encoder (#253)
• c97b5f8 Add official SSZ conformance gate and independent fuzz oracles (#224)
• 6aadf51 Walk a generated type's static surface by reflection under WithNoDelegation (#251)
• 8da8c6c fix: bound the multiproof required-indices cache (#252)

... (truncated)

Changelog

Sourced from github.com/pk910/dynamic-ssz's changelog.

[v1.4.0] 2026-10-08 hardening & async hashing

This is a hardening release. The reflection engine, the code generator, the hasher and treeproof went through many rounds of differential fuzzing, external audits and conformance testing. Both engines now produce the same bytes, roots, trees and errors for the same schema, bad input returns an error instead of panicking or allocating without bound, and the code generator is no longer in beta.

Breaking Changes

• CompatibleUnion selectors now follow EIP-8016. Selectors are 1-based (1..127), so the first untagged variant is written as 0x01 instead of 0x00. Schemas and values that use 0-based selectors need to be migrated.
• The hash tree root of ssz-type:"optional" fields changed (extended types only). Presence is now mixed in as a length, so an absent value and a present zero value no longer have the same root. The root is now the same as for optional-list. Serialization is unchanged. Generated code keeps the old root until it is regenerated.
• Validation is stricter. Some malformed input and schemas that older versions accepted are now rejected with an error. This includes list counts that do not fit the region, non-zero padding bits in bitvectors, trailing or missing bytes, hash tree roots of lists without a limit, conflicting size or type tags, zero-field containers with their own SSZ methods (use ssz-type:"custom" for these) and spec-only bounds in code generated without dynamic expressions.

Added

• Classic SSZ Union[T] with 0-based selectors and dynssz.None, next to the EIP-8016 CompatibleUnion[T].
• Async hashing. Optional background hashing of large subtrees, enabled with WithAsyncHashing(workers) or hasher.EnableAsyncHashing.
• Recursive types, as long as every cycle goes through a variable-length field. Nesting depth is limited (default 1024) and can be set with WithMaxNestingDepth, codegen.WithRecursionDepth or dynssz-gen -recursion-depth.
• Batched tree finalization. GetTree now builds a finalized read-only tree through the hashtree backend. New Node.Finalize, treeproof.WithHashFn and treeproof.NewWrapperWithHashFn.
• Unknown-size stream decoding. UnmarshalSSZReader with a negative size reads until EOF and only allocates for bytes that actually arrived. Generated code needs to be regenerated for this.
• Limits for untrusted input: WithMaxStreamSize, the per-call WithStreamSizeLimit and WithMaxNestingDepth.
• ssz-type:"-" to skip a struct field, and WithNoDelegation to ignore the generated methods of a type.
• dynssz-gen options: custom header templates, per-type skip-* settings in the config file, -recursion-depth and -remove.
• New error values (ErrStreamTooLarge, ErrSszSizeExceeded, ErrMaxDepthExceeded and more), HashErr() on Hasher and treeproof.Wrapper, and Reset on all encoders and decoders.
• Big-endian (s390x) and 32-bit support, tested in CI. New examples (chain-specs, streaming, merkle-proofs, fork-views, htr-caching) and a docs page about method delegation.

Changed

• Performance: generated code resolves the spec expressions of a type once per DynSsz instance instead of on every call (regenerate to get this). Encoders and decoders are pooled per instance. The reflection engine sizes byte lists by their length, decodes byte slices without boxing and handles uint64 and byte-array elements as one block.
• All size, offset and limit math is done in unsigned 64-bit with explicit range checks, so both engines are safe on 32-bit targets.
• Spec expressions are evaluated as exact rationals and rounded up once. The govaluate dependency is gone. A name:N fallback syntax was added.
• Both engines use the same rules for when the fastssz, *Dyn or view methods of a type are called. Promoted methods from embedded fields are no longer used, and fastssz is only used when no resolved spec value differs from the static tags. sszutils.Annotate now works across packages and on views, type wrappers and union variants.
• Conformance tests: the consensus-spec vectors (including Gloas) also run as a 32-bit build, and a new test runs every vector of the official ethereum/ssz-specs suite on both engines. The differential fuzzer got an independent reference SSZ implementation and extra checks for trees, proofs, native hashing, sizes and streaming.
• The code generator is now considered production ready. hashtree-bindings bumped to 0.2.6.

Fixed

• Panics and unbounded allocations on bad input (oversized declared lists, huge bitsize values, stream over-reads, offset overflows, recursive payloads).
• Cases where reflection and generated code framed, sized or hashed the same schema differently: views of view-serving types, custom types with spec-driven widths, overridden type hints, cross-package Annotate, packed large uints, union variants with spec-only widths and code generated without dynamic expressions.
• Hash tree roots of packed scopes with delegated elements, Index-opened scopes, progressive lists under async hashing, partial chunks, short uint128 and uint256 values, optionals and lists of type wrappers. HashTreeRoot and GetTree now agree and return backend errors.
• Streaming: the streaming encoder of a static build wrote correct data behind wrong offsets for children with spec values. Unions, optionals, custom types and views are now framed the same way on buffer and reader paths.
• treeproof: empty leaves from ProveMulti, caller memory being aliased, zero-padding gindices that could not be proven, 32-bit leaf overflow and an unbounded multiproof cache.
• Zero-padding no longer writes into caller memory, float32 NaN bits are kept as is, NewDynSsz copies its spec map and RemoveType removes both the value and the pointer form of a type.

---

[v1.3.3] 2026-08-26

Fixed

• Fix treeproof.Wrapper building a non-canonical Merkle tree for containers that interleave buffered Append* fields with directly added Put*/AddNode fields - pending bytes are now flushed to leaf nodes before a node is added or a scope checkpoint is captured, so the leaf order matches hasher.Hasher
• Fix GetTree(x).Hash() diverging from HashTreeRoot(x), and proofs derived from the tree failing to verify, for Deneb and later BeaconState, BeaconBlock, SignedBeaconBlock, ExecutionPayload and ExecutionPayloadHeader; this affects every release since GetTree was introduced in v1.1.1, while HashTreeRoot, MarshalSSZ and UnmarshalSSZ are unaffected

---

[v1.3.2] 2026-06-21

Added

... (truncated)

Commits

• See full diff in compare view

Updates github.com/urfave/cli/v3 from 3.13.0 to 3.14.0

Release notes

Sourced from github.com/urfave/cli/v3's releases.

v3.14.0

What's Changed

• chore(deps): bump mkdocs-git-revision-date-localized-plugin from 1.5.4 to 1.6.0 in the python-packages group by @​dependabot[bot] in urfave/cli#2436
• fix: set BoolWithInverseFlag in a short option group by @​lazerg in urfave/cli#2440
• Keep arguments after a bare dash by @​official-burak in urfave/cli#2419
• fix: handle a multi-byte flag at the end of a short option group by @​SulimanAbdulrazzaq in urfave/cli#2438
• fix: complete persistent flags in shell completion by @​sb123sb123 in urfave/cli#2437
• fix: restore Unwrap on the error returned by Exit by @​fadiroot in urfave/cli#2444
• fix: reject a parent's Local flag inside a short option group by @​fadiroot in urfave/cli#2445
• fix: report a flag that needs an argument but is not last in a short group by @​yu2971512385-ui in urfave/cli#2443
• Use prefixFor so flag suggestions agree with help on rune count by @​januththedev in urfave/cli#2448
• fix: reject duplicate flag names by @​deepakganesh78 in urfave/cli#2396
• fix: date a time-only timestamp today when Timezone is not UTC by @​breken-ai in urfave/cli#2450
• fix: let a subcommand's command-line value replace a persistent flag's env/file value by @​breken-ai in urfave/cli#2449
• Add urfave_cli_no_template build tag by @​kolyshkin in urfave/cli#2441
• fix: skip empty source values for flags that cannot parse them by @​abo3losh1 in urfave/cli#2451

New Contributors

• @​lazerg made their first contribution in urfave/cli#2440
• @​official-burak made their first contribution in urfave/cli#2419
• @​SulimanAbdulrazzaq made their first contribution in urfave/cli#2438
• @​sb123sb123 made their first contribution in urfave/cli#2437
• @​fadiroot made their first contribution in urfave/cli#2444
• @​yu2971512385-ui made their first contribution in urfave/cli#2443
• @​januththedev made their first contribution in urfave/cli#2448
• @​deepakganesh78 made their first contribution in urfave/cli#2396
• @​breken-ai made their first contribution in urfave/cli#2450
• @​abo3losh1 made their first contribution in urfave/cli#2451

Full Changelog: urfave/cli@v3.13.0...v3.14.0

Commits

• 2f64589 Merge pull request #2451 from abo3losh1/fix/empty-env-source-not-set
• 72a6466 docs: describe empty values for any source, not only environment variables
• c40d7b3 test: cover an empty file source in TestFlagFromEmptyFileSource
• ea94516 Merge remote-tracking branch 'origin/main' into fix/empty-env-source-not-set
• f6f38ed Merge pull request #2441 from kolyshkin/no-template-tag
• 925b1e3 Merge pull request #2449 from breken-ai/fix/persistent-flag-source-override
• 4dac5a8 test: cover slice separator and cmd.Set after a source value
• 4d537c9 docs: say how an empty environment variable is treated
• 41ce75f test: cover empty source values in TestFlagsFromEmptyEnv
• 72f4bbb fix: skip empty source values for flags that cannot parse them
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.23.0 to 0.24.0

Commits

• 36f2d70 errgroup: modernize the usage of closures in goroutines
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions