core: Merge v1.17.2

.github/CODEOWNERS

@@ -10,6 +10,7 @@ beacon/merkle/                  @zsfelfoldi
 beacon/types/                   @zsfelfoldi @fjl
 beacon/params/                  @zsfelfoldi @fjl
 cmd/evm/                        @MariusVanDerWijden @lightclient
+cmd/keeper/                     @gballet
 core/state/                     @rjl493456442
 crypto/                         @gballet @jwasinger @fjl
 core/                           @rjl493456442

.github/workflows/go.yml

@@ -70,8 +70,8 @@ jobs:
 
       - name: Install cross toolchain
         run: |
-          apt-get update
-          apt-get -yq --no-install-suggests --no-install-recommends install gcc-multilib
+          sudo apt-get update
+          sudo apt-get -yq --no-install-suggests --no-install-recommends install gcc-multilib
 
       - name: Build
         run: go run build/ci.go test -arch 386 -short -p 8

.github/workflows/validate_pr.yml

@@ -10,17 +10,77 @@ jobs:
   validate-pr:
     runs-on: ubuntu-latest
     steps:
+      - name: Check for Spam PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prTitle = context.payload.pull_request.title;
+            const spamRegex = /^(feat|chore|fix)(\(.*\))?\s*:/i;
+
+            if (spamRegex.test(prTitle)) {
+              // Leave a comment explaining why
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                body: `## PR Closed as Spam
+
+            This PR was automatically closed because the title format \`feat:\`, \`fix:\`, or \`chore:\` is commonly associated with spam contributions.
+
+            If this is a legitimate contribution, please:
+            1. Review our contribution guidelines
+            2. Use the correct PR title format: \`directory, ...: description\`
+            3. Open a new PR with the proper title format
+
+            Thank you for your understanding.`
+              });
+
+              // Close the PR
+              await github.rest.pulls.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.payload.pull_request.number,
+                state: 'closed'
+              });
+
+              core.setFailed('PR closed as spam due to suspicious title format');
+              return;
+            }
+
+            console.log('✅ PR passed spam check');
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
       - name: Check PR Title Format
         uses: actions/github-script@v7
         with:
           script: |
+            const fs = require('fs');
+            const path = require('path');
             const prTitle = context.payload.pull_request.title;
             const titleRegex = /^([\w\s,{}/.]+): .+/;
 
             if (!titleRegex.test(prTitle)) {
               core.setFailed(`PR title "${prTitle}" does not match required format: directory, ...: description`);
               return;
             }
+
+            const match = prTitle.match(titleRegex);
+            const dirPart = match[1];
+            const directories = dirPart.split(',').map(d => d.trim());
+            const missingDirs = [];
+            for (const dir of directories) {
+              const fullPath = path.join(process.env.GITHUB_WORKSPACE, dir);
+              if (!fs.existsSync(fullPath)) {
+                missingDirs.push(dir);
+              }
+            }
+
+            if (missingDirs.length > 0) {
+              core.setFailed(`The following directories in the PR title do not exist: ${missingDirs.join(', ')}`);
+              return;
+            }
 
             console.log('✅ PR title format is valid');
 

AGENTS.md

@@ -0,0 +1,102 @@
+# AGENTS
+
+## Guidelines
+
+- **Keep changes minimal and focused.** Only modify code directly related to the task at hand. Do not refactor unrelated code, rename existing variables or functions for style, or bundle unrelated fixes into the same commit or PR.
+- **Do not add, remove, or update dependencies** unless the task explicitly requires it.
+
+## Pre-Commit Checklist
+
+Before every commit, run **all** of the following checks and ensure they pass:
+
+### 1. Formatting
+
+Before committing, always run `gofmt` and `goimports` on all modified files:
+
+```sh
+gofmt -w <modified files>
+goimports -w <modified files>
+```
+
+### 2. Build All Commands
+
+Verify that all tools compile successfully:
+
+```sh
+make all
+```
+
+This builds all executables under `cmd/`, including `keeper` which has special build requirements.
+
+### 3. Tests
+
+While iterating during development, use `-short` for faster feedback:
+
+```sh
+go run ./build/ci.go test -short
+```
+
+Before committing, run the full test suite **without** `-short` to ensure all tests pass, including the Ethereum execution-spec tests and all state/block test permutations:
+
+```sh
+go run ./build/ci.go test
+```
+
+### 4. Linting
+
+```sh
+go run ./build/ci.go lint
+```
+
+This runs additional style checks. Fix any issues before committing.
+
+### 5. Generated Code
+
+```sh
+go run ./build/ci.go check_generate
+```
+
+Ensures that all generated files (e.g., `gen_*.go`) are up to date. If this fails, first install the required code generators by running `make devtools`, then run the appropriate `go generate` commands and include the updated files in your commit.
+
+### 6. Dependency Hygiene
+
+```sh
+go run ./build/ci.go check_baddeps
+```
+
+Verifies that no forbidden dependencies have been introduced.
+
+## What to include in commits
+
+Do not commit binaries, whether they are produced by the main build or byproducts of investigations.
+
+## Commit Message Format
+
+Commit messages must be prefixed with the package(s) they modify, followed by a short lowercase description:
+
+```
+<package(s)>: description
+```
+
+Examples:
+- `core/vm: fix stack overflow in PUSH instruction`
+- `eth, rpc: make trace configs optional`
+- `cmd/geth: add new flag for sync mode`
+
+Use comma-separated package names when multiple areas are affected. Keep the description concise.
+
+## Pull Request Title Format
+
+PR titles follow the same convention as commit messages:
+
+```
+<list of modified paths>: description
+```
+
+Examples:
+- `core/vm: fix stack overflow in PUSH instruction`
+- `core, eth: add arena allocator support`
+- `cmd/geth, internal/ethapi: refactor transaction args`
+- `trie/archiver: streaming subtree archival to fix OOM`
+
+Use the top-level package paths, comma-separated if multiple areas are affected. Only mention the directories with functional changes, interface changes that trickle all over the codebase should not generate an exhaustive list. The description should be a short, lowercase summary of the change.

Dockerfile

@@ -4,7 +4,7 @@ ARG VERSION=""
 ARG BUILDNUM=""
 
 # Build Geth in a stock Go builder container
-FROM golang:1.24-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 RUN apk add --no-cache gcc musl-dev linux-headers git
 

Dockerfile.alltools

@@ -4,7 +4,7 @@ ARG VERSION=""
 ARG BUILDNUM=""
 
 # Build Geth in a stock Go builder container
-FROM golang:1.24-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 RUN apk add --no-cache gcc musl-dev linux-headers git
 

SECURITY.md

@@ -21,7 +21,6 @@ Audit reports are published in the `docs` folder: https://github.com/ethereum/go
 
 To find out how to disclose a vulnerability in Ethereum visit [https://bounty.ethereum.org](https://bounty.ethereum.org) or email bounty@ethereum.org. Please read the [disclosure page](https://github.com/ethereum/go-ethereum/security/advisories?state=published) for more information about publicly disclosed security vulnerabilities.
 
-Use the built-in `geth version-check` feature to check whether the software is affected by any known vulnerability. This command will fetch the latest [`vulnerabilities.json`](https://geth.ethereum.org/docs/vulnerabilities/vulnerabilities.json) file which contains known security vulnerabilities concerning `geth`, and cross-check the data against its own version number.
 
 The following key may be used to communicate sensitive information to developers.
 

accounts/abi/bind/v2/dep_tree_test.go

@@ -158,10 +158,10 @@ func testLinkCase(tcInput linkTestCaseInput) error {
 		overrideAddrs  = make(map[rune]common.Address)
 	)
 	// generate deterministic addresses for the override set.
-	rand.Seed(42)
+	rng := rand.New(rand.NewSource(42))
 	for contract := range tcInput.overrides {
 		var addr common.Address
-		rand.Read(addr[:])
+		rng.Read(addr[:])
 		overrideAddrs[contract] = addr
 		overridesAddrs[addr] = struct{}{}
 	}

accounts/keystore/keystore.go

@@ -418,6 +418,7 @@ func (ks *KeyStore) Export(a accounts.Account, passphrase, newPassphrase string)
 	if err != nil {
 		return nil, err
 	}
+	defer zeroKey(key.PrivateKey)
 	var N, P int
 	if store, ok := ks.storage.(*keyStorePassphrase); ok {
 		N, P = store.scryptN, store.scryptP
@@ -477,6 +478,7 @@ func (ks *KeyStore) Update(a accounts.Account, passphrase, newPassphrase string)
 	if err != nil {
 		return err
 	}
+	defer zeroKey(key.PrivateKey)
 	return ks.storage.StoreKey(a.URL.Path, key, newPassphrase)
 }
 

accounts/keystore/presale.go

@@ -81,6 +81,9 @@ func decryptPreSaleKey(fileContent []byte, password string) (key *Key, err error
 	*/
 	passBytes := []byte(password)
 	derivedKey := pbkdf2.Key(passBytes, passBytes, 2000, 16, sha256.New)
+	if len(cipherText)%aes.BlockSize != 0 {
+		return nil, errors.New("ciphertext must be a multiple of block size")
+	}
 	plainText, err := aesCBCDecrypt(derivedKey, cipherText, iv)
 	if err != nil {
 		return nil, err

accounts/scwallet/securechannel.go

@@ -300,6 +300,10 @@ func (s *SecureChannelSession) decryptAPDU(data []byte) ([]byte, error) {
 		return nil, err
 	}
 
+	if len(data) == 0 || len(data)%aes.BlockSize != 0 {
+		return nil, fmt.Errorf("invalid ciphertext length: %d", len(data))
+	}
+
 	ret := make([]byte, len(data))
 
 	crypter := cipher.NewCBCDecrypter(a, s.iv)

accounts/usbwallet/hub.go

@@ -43,6 +43,14 @@ const refreshCycle = time.Second
 // trashing.
 const refreshThrottling = 500 * time.Millisecond
 
+const (
+	// deviceUsagePage identifies Ledger devices by HID usage page (0xffa0) on Windows and macOS.
+	// See: https://github.com/LedgerHQ/ledger-live/blob/05a2980e838955a11a1418da638ef8ac3df4fb74/libs/ledgerjs/packages/hw-transport-node-hid-noevents/src/TransportNodeHid.ts
+	deviceUsagePage = 0xffa0
+	// deviceInterface identifies Ledger devices by USB interface number (0) on Linux.
+	deviceInterface = 0
+)
+
 // Hub is a accounts.Backend that can find and handle generic USB hardware wallets.
 type Hub struct {
 	scheme     string                  // Protocol scheme prefixing account and wallet URLs.
@@ -82,14 +90,16 @@ func NewLedgerHub() (*Hub, error) {
 		0x0005, /* Ledger Nano S Plus */
 		0x0006, /* Ledger Nano FTS */
 		0x0007, /* Ledger Flex */
+		0x0008, /* Ledger Nano Gen5 */
 
 		0x0000, /* WebUSB Ledger Blue */
 		0x1000, /* WebUSB Ledger Nano S */
 		0x4000, /* WebUSB Ledger Nano X */
 		0x5000, /* WebUSB Ledger Nano S Plus */
 		0x6000, /* WebUSB Ledger Nano FTS */
 		0x7000, /* WebUSB Ledger Flex */
-	}, 0xffa0, 0, newLedgerDriver)
+		0x8000, /* WebUSB Ledger Nano Gen5 */
+	}, deviceUsagePage, deviceInterface, newLedgerDriver)
 }
 
 // NewTrezorHubWithHID creates a new hardware wallet manager for Trezor devices.

accounts/usbwallet/ledger.go

@@ -184,7 +184,7 @@
 		return nil, accounts.ErrWalletClosed
 	}
 	// Ensure the wallet is capable of signing the given transaction
-	if w.version[0] < 1 && w.version[1] < 5 {
+	if w.version[0] < 1 || (w.version[0] == 1 && w.version[1] < 5) {
 		//lint:ignore ST1005 brand name displayed on the console
 		return nil, fmt.Errorf("Ledger version >= 1.5.0 required for EIP-712 signing (found version v%d.%d.%d)", w.version[0], w.version[1], w.version[2])
 	}
@@ -509,7 +509,7 @@
 //	Optional APDU data       | arbitrary
 func (w *ledgerDriver) ledgerExchange(opcode ledgerOpcode, p1 ledgerParam1, p2 ledgerParam2, data []byte) ([]byte, error) {
 	// Construct the message payload, possibly split into multiple chunks
 	apdu := make([]byte, 2, 7+len(data))
 
 	binary.BigEndian.PutUint16(apdu, uint16(5+len(data)))
 	apdu = append(apdu, []byte{0xe0, byte(opcode), byte(p1), byte(p2), byte(len(data))}...)

accounts/usbwallet/wallet.go

@@ -632,7 +632,7 @@ func (w *wallet) SignTx(account accounts.Account, tx *types.Transaction, chainID
 // data is not supported for Ledger wallets, so this method will always return
 // an error.
 func (w *wallet) SignTextWithPassphrase(account accounts.Account, passphrase string, text []byte) ([]byte, error) {
-	return w.SignText(account, accounts.TextHash(text))
+	return w.SignText(account, text)
 }
 
 // SignTxWithPassphrase implements accounts.Wallet, attempting to sign the given

arbcrypto/keccak.go

@@ -5,9 +5,9 @@ package arbcrypto
 import (
 	"hash"
 
-	"golang.org/x/crypto/sha3"
+	"github.com/ethereum/go-ethereum/crypto/keccak"
 )
 
 func NewLegacyKeccak256() hash.Hash {
-	return sha3.NewLegacyKeccak256()
+	return keccak.NewLegacyKeccak256()
 }

arbitrum/apibackend.go

@@ -587,7 +587,7 @@ func StateAndHeaderFromHeader(ctx context.Context, chainDb ethdb.Database, bc *c
 			return statedb, NoopStateRelease, nil
 		}
 	}
-	liveState, liveStateRelease, err := stateFor(bc.StateCache(), bc.Snapshots())(header)
+	liveState, liveStateRelease, err := stateFor(state.NewDatabase(bc.TrieDB(), bc.CodeDB()), bc.Snapshots())(header)
 	if err == nil {
 		liveStatesReferencedCounter.Inc(1)
 		liveState.SetArbFinalizer(func(*state.ArbitrumExtraData) {

arbitrum/recreatestate.go

@@ -80,7 +80,7 @@ func AdvanceStateByBlock(ctx context.Context, bc *core.BlockChain, state *state.
 	if logFunc != nil {
 		logFunc(block.Header(), true)
 	}
-	result, err := bc.Processor().Process(block, state, vmConfig)
+	result, err := bc.Processor().Process(ctx, block, state, vmConfig)
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("failed recreating state for block %d : %w", blockToRecreate, err)
 	}

arbitrum/retryables/scheduled_txes.go

@@ -39,7 +39,7 @@ func RunScheduledTxes(ctx context.Context, b core.NodeInterfaceBackendAPI, state
 			evm.Cancel()
 		}()
 
-		scheduledTxResult, err := core.ApplyMessage(evm, msg, new(core.GasPool).AddGas(math.MaxUint64))
+		scheduledTxResult, err := core.ApplyMessage(evm, msg, core.NewGasPool(math.MaxUint64))
 		if err != nil {
 			return nil, err
 		}