build(deps): Bump github.com/cometbft/cometbft from 0.38.23 to 0.38.26

[dependabot]

Bumps github.com/cometbft/cometbft from 0.38.23 to 0.38.26.

Release notes

Sourced from github.com/cometbft/cometbft's releases.

v0.38.26

What's Changed

• feat: Backport mldsa verification by @​Eric-Warehime in cometbft/cometbft#6028

Full Changelog: cometbft/cometbft@v0.38.25...v0.38.26

v0.38.25

What's Changed

• fix(mempool): fix setRecheckFull/setDone race causing spurious ErrRecheckFull (backport #5837) by @​mergify[bot] in cometbft/cometbft#5845
• test(consensus): fix cs.GetRoundState deadlock after ensureNewProposal (backport #5815) by @​mergify[bot] in cometbft/cometbft#5843
• fix(blocksync): validate blocksync response sender and signature count (backport #5860) by @​mergify[bot] in cometbft/cometbft#5863
• feat(consensus): additional validation for vote ext signatures (backport #5873) by @​mergify[bot] in cometbft/cometbft#5877
• feat(config): add EventBusBufferCapacity setting (backport #5849) by @​mergify[bot] in cometbft/cometbft#5914
• fix(mempool): Implement MsgBytesFilter in Reactor to prevent heap amplification (backport #5946) by @​mergify[bot] in cometbft/cometbft#5951
• fix(mempool): truncate proto field number to int32 in filter's ReadTag (backport #5948) by @​mergify[bot] in cometbft/cometbft#6005
• fix(consensus): correct loop condition in checkDoubleSigningRisk for height=1 (backport #5668) by @​mergify[bot] in cometbft/cometbft#6001
• fix(consensus): release cs.mtx before sending to statsMsgQueue (backport #5813) by @​mergify[bot] in cometbft/cometbft#5998
• fix(blocksync): tolerate late BlockResponse from honest peers after switching to consensus (backport #5959) by @​mergify[bot] in cometbft/cometbft#6003
• chore: update changelog by @​swift1337 in cometbft/cometbft#6006

Full Changelog: cometbft/cometbft@v0.38.23...v0.38.25

Note: v0.38.24 is skipped.

Changelog

Sourced from github.com/cometbft/cometbft's changelog.

v0.38.26

August 12, 2026

FEATURES

• [crypto] Add ML-DSA-65 public key decoding and signature verification.

v0.38.24

July 27, 2026

BUG FIXES

• [blocksync] tolerate late BlockResponse from honest peers after switching to consensus (#5959)
• [consensus] Fix double_sign_check_height = 1 performing no double-sign checks due to off-by-one error in loop condition (i < N should be i <= N). The value 1 now correctly checks the previous block as intended. (#5668)
• [mempool] fix setRecheckFull/setDone race causing spurious ErrRecheckFull. (#5837)
• [consensus] release cs.mtx before sending to statsMsgQueue (#5813)
• [mempool] truncate proto field number to int32 in filter's ReadTag (#5948)

IMPROVEMENTS

• [blocksync] validate blocksync response sender and signature count (#5860)
• [mempool] Implement MsgBytesFilter in Reactor to prevent heap amplification attack (#5946)

FEATURES

• [config] Add EventBusBufferCapacity setting. (#5849)

Commits

• 94d77f9 chore: Bump version (#6029)
• 5e80022 Bump version
• 12be560 feat: Backport mldsa verification (#6028)
• 20561a7 Fix lint, test
• 774d261 Remove unnecessary changelog lines
• 25c6d57 Backport mldsa verification
• 330d3bb chore: update changelog (#6006)
• e9ffcb9 fix(blocksync): tolerate late BlockResponse from honest peers after switching...
• 7cd4427 fix(consensus): release cs.mtx before sending to statsMsgQueue (backport #581...
• 5adf46c fix(consensus): correct loop condition in checkDoubleSigningRisk for height=1...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[greptile-apps]

PR author is not in the allowed authors list.

[srdtrk]

🤖 Gnut (automated assistant posting on behalf of srdtrk)

Reviewed this one properly because the red CI is misleading: none of the 9 failing checks are caused by cometbft 0.38.26. The content of the bump is worth taking; the failures are a stale-sibling-module artifact, and the thing that actually needs fixing is update-all. Two behavioural notes below are worth a conscious sign-off before this lands on a release branch.

1. Why CI is red

Check go mod tidy names exactly three modules: simapp, tests, tests/systemtests. Those are precisely the three that replace github.com/cosmos/cosmos-sdk => ../.. Dependabot bumped only the root go.mod, so these three now resolve cometbft v0.38.26 through the local replace while their own go.mod still records v0.38.23, which gives:

go: updates to go.mod needed, disabled by -mod=readonly
make: *** [Makefile:132: build] Error 1

That single inconsistency explains build (amd64), build (arm64), test-integration, test-e2e, test-sim-nondeterminism, test-system and test-system-legacy. The other 11 cometbft-consuming modules (store, client/v2, x/{upgrade,evidence,feegrant,circuit,nft}, tools/*, systemtests) have no local SDK replace, resolve cometbft independently, and their test jobs are all green — consistent with this diagnosis.

Verified locally on the PR head with Go 1.23.12:

• before: go build ./... in simapp/ fails with the error above;
• after go mod tidy in simapp/: go build ./... is clean;
• go mod tidy -diff in each of the three modules is exactly cometbft v0.38.23 → v0.38.26 plus github.com/cloudflare/circl v1.6.3 // indirect, and nothing else.

So there is no incompatibility here, only unpropagated go.mod/go.sum.

2. update-all never ran — this is the actual bug

The repo has automation for exactly this case, but it died in 37s before reaching any go get. The Generate Token step fails:

Failed to create token for "cosmos-sdk" (attempt 1..4): Not Found
GET https://api.github.com/repos/cosmos/cosmos-sdk/installation → 404

The same log records Secret source: Dependabot. Since dependabot-update-all.yml triggers on: pull_request and gates on github.actor == 'dependabot[bot]', the run is served from the Dependabot secret store, not the Actions one — so secrets.APP_ID / secrets.APP_PRIVATE_KEY must exist under Settings → Secrets and variables → Dependabot, and the GitHub App must be installed on cosmos/cosmos-sdk. Until that is fixed, every root-module dependabot PR on this branch will fail in exactly this shape, and closing/reopening won't help — no newer cometbft version can fix an unpropagated go.mod.

To unblock this PR, either fix the token so update-all can do its job, or commit the propagation directly:

./scripts/go-update-dep-all.sh github.com/cometbft/cometbft@v0.38.26
./scripts/go-mod-tidy-all.sh

Note that go-update-dep-all.sh uses go get -u, so it will also churn transitive deps across all 15 modules. The minimal equivalent is go get github.com/cometbft/cometbft@v0.38.26 && go mod tidy in simapp, tests and tests/systemtests only — which reproduces the diff quoted above and nothing more.

3. What is in the bump

The intermediate release is v0.38.25 — v0.38.24 was tagged but skipped (no release was published for it), while the in-repo CHANGELOG.md still files that work under a ## v0.38.24 heading, which is confusing when reading the diff. It contains: blocksync tolerating late BlockResponse after switching to consensus (#5959); off-by-one making double_sign_check_height = 1 perform no check at all (#5668); setRecheckFull/setDone race causing spurious ErrRecheckFull (#5837); releasing cs.mtx before the stats queue send (#5813); blocksync sender and signature-count validation (#5860); MsgBytesFilter in the mempool reactor against heap amplification (#5946, #5948); additional validation for vote-extension signatures (#5873, adding ValidatorSet.VerifyCommitExtended); and the new event_bus_buffer_capacity config setting (#5849).

v0.38.26: ML-DSA-65 public-key decoding and signature verification (#6028). v0.38.26 is the newest v0.38.x tag.

That is a good set for a release branch — the double_sign_check_height and mempool fixes in particular.

The new config key needs nothing on the SDK side: server/util.go goes through cmtcfg.DefaultConfig() / cmtcfg.WriteConfigFile, so generated config.toml picks it up, and existing files fall back to 0 (unbuffered), i.e. previous behaviour.

4. Two things worth a conscious sign-off

(a) types.MaxCommitSigBytes grew ~30× and is not in the changelog. ML-DSA-65 signatures are 3309 bytes, so types.MaxSignatureSize becomes max(ed25519 64, mldsa65 3309) = 3309, and MaxCommitSigBytes changes from const int64 = 109 to var … = 3355. MaxCommitBytes(n) therefore goes from 94 + 111n to 94 + 3358n:

validators	before	after
100	11,194 B	335,894 B
150	16,744 B	503,794 B

That reserve is subtracted in two live paths: state.MaxDataBytes (proposal building → the MaxTxBytes the SDK receives in PrepareProposal) and state.TxPreCheck (the mempool's per-tx size ceiling). At the default block.max_bytes = 22020096 this is ~2% at 150 validators — fine. But a chain with a small explicit block.max_bytes will now panic in MaxDataBytesNoEvidence ("Negative MaxDataBytes") where it previously worked; the threshold is ≈336 KB at 100 validators and ≈504 KB at 150. block.max_bytes = -1 is handled (mapped to MaxBlockSizeBytes), so only explicit small values are exposed.

No consensus divergence: block validation checks total block size, not MaxDataBytes, so a mixed 0.38.23/0.38.26 validator set will not fault — only proposal sizing and mempool admission differ between versions. Worth an upgrade note nonetheless, since it arrives in a patch bump. The const → var change is also technically API-breaking for downstream code using it in a constant expression; the SDK itself never references MaxCommitSigBytes, MaxCommitBytes, MaxDataBytes or MaxSignatureSize (checked across the tree).

(b) New PublicKey oneof variant. cometbft now registers PublicKey_Mldsa65 and accepts ml_dsa_65 in consensus_params.validator.pub_key_types. crypto/codec/cmt.go only maps Ed25519/Secp256k1 and its default: arm returns ErrInvalidType, so the SDK errors cleanly rather than panicking — but the two sides now disagree about what counts as a valid validator key type. Nothing to do in this PR; just worth knowing it is now reachable via consensus params. Relatedly, circl moves from an indirect v1.3.7 to a direct v1.6.3 in cometbft and appears as a new indirect entry in the SDK modules; dependency-review is green on it.

---

Recommendation: don't close this one — the bump is worth taking and the failure is mechanical. Propagate the version to simapp, tests and tests/systemtests (ideally by fixing the update-all app token, which will keep fixing every future bump), and add an upgrade note about the commit-size reserve for operators running a small block.max_bytes.

Review notes only — not an approval, and I have not pushed anything to this branch.

_{Edited to fix section 3: the intermediate release is v0.38.25, not v0.38.24 (that tag exists but was skipped, and the in-repo changelog heading still says v0.38.24), and the vote-extension signature validation was missing from the list.}

[srdtrk]

🤖 Gnut (automated assistant posting on behalf of srdtrk)

Pushed 1b2223cc to this branch — the multi-module go.mod fix the red checks were asking for.

What it does. simapp, tests and tests/systemtests each replace github.com/cosmos/cosmos-sdk => ../., so MVS resolved cometbft to 0.38.26 through the replaced SDK while their own require lines still said 0.38.23. That inconsistency is what produced go: updates to go.mod needed, disabled by -mod=readonly and took down 9 checks. The commit brings those three modules in line: cometbft 0.38.23 → 0.38.26 plus the new indirect github.com/cloudflare/circl v1.6.3. Six files, no other version movement.

Method — tidy only. I ran ./scripts/go-mod-tidy-all.sh (the exact command pr-go-mod-tidy-mocks.yml checks) and nothing else. I deliberately did not run scripts/go-update-dep-all.sh, which dependabot-update-all.yml runs first: it uses go get -u, which would drag all 15 cometbft-referencing modules forward along with transitive upgrades across the board — a much larger diff on a release branch, and none of the other 12 are failing (they pin cometbft independently at 0.38.17/19/20 and don't see the replace).

Verified locally on Go 1.23.12: tidy is idempotent, go build -mod=readonly ./... clean in simapp and tests, go vet -tags system_test clean in tests/systemtests, go mod verify passes in all three, and the go.sum hashes match the root module's.

Two things this commit does not address, both from my earlier review, both still needing a human:

1. update-all is broken at the token step, not the Go step. actions/create-github-app-token gets 404 on GET /repos/cosmos/cosmos-sdk/installation and the job dies in ~37s, before any go get. Secret source is Dependabot, so APP_ID/APP_PRIVATE_KEY need to exist in that store and the app must be installed on the repo. Expect the check to now go quiet rather than green: the job is gated on github.actor == 'dependabot[bot]', so after a push from a human account it should skip. The underlying breakage is untouched and will hit every future root-module bump on this branch — and main has no such workflow at all, which is why build(deps): Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.69.0 to 0.70.0 #26746 fails identically with nothing to repair it.

2. types.MaxCommitSigBytes grows from const int64 = 109 to var … = 3355 in this bump, because MaxSignatureSize becomes max(ed25519 64, mldsa65 3309). Per-validator commit reservation goes 111 → 3358 bytes, so MaxCommitBytes(100) is ~336 KB instead of ~11 KB. It is subtracted in state.MaxDataBytes (the MaxTxBytes the SDK sees in PrepareProposal) and in state.TxPreCheck (the mempool per-tx ceiling). Harmless at the 22 MB default; a chain with a small explicit block.max_bytes will now panic where it previously did not. No consensus divergence — block validation checks total size, not MaxDataBytes — so mixed-version validator sets won't fault. It is not in the changelog, and it arrives via a patch bump onto a release branch. Whether that is acceptable for v0.53 is a maintainer call; green CI won't answer it.

One consequence worth knowing: pushing by hand takes this PR out of dependabot's hands. It won't rebase without an explicit @dependabot rebase, and if anyone issues that, this commit gets force-pushed away.