chore(deps): update dependency filecoin-project/lotus to v1.36.3

[renovate]

This PR contains the following updates:

Package	Update	Change
filecoin-project/lotus	patch	v1.36.2 → v1.36.3

---

Release Notes

filecoin-project/lotus (filecoin-project/lotus)

v1.36.3

Compare Source

Lotus Node v1.36.3 is a recommended patch release focused on Ethereum RPC correctness (event-index completeness for eth_getLogs/eth_getTransactionReceipt, RLP validation), a WebTransport memory-exhaustion fix (CVE-2026-57497), gateway event-query bounding, sector-reporting UX, and operator tooling.

☢️ Upgrade Warnings ☢️

• lotus state active-sectors has been removed and merged into lotus state sectors, which now defaults to active sectors only (previously it returned every committed sector). Use lotus state sectors --all for the previous full-sector-set behavior. (filecoin-project/lotus#13743)

⭐ New Features

• feat(cli): lotus state sectors now prints Activation, Expiration, InitialPledge, and DailyFee for each sector by default, and gained a --human flag to render epochs as local calendar time and attoFIL amounts as FIL instead of raw numbers. (filecoin-project/lotus#13743)
• feat(shed): add lotus-shed eth storage-dump / eth storage-decode to enumerate and decode an EVM contract's on-chain storage KAMT at a given tipset. Dumps slot-sorted NDJSON plus KAMT shape stats (optional CARv1 and eth_getStorageAt verification); decodes against a forge storage layout with ERC-1967/7201 support (filecoin-project/lotus#13730)
• feat(blockstore): LOTUS_BLOCKSTORE_VERIFY_READS=1 enables a verify-after-read mode for the blockstore, which incurs a hash cost on every block load but can be used to help heal a damaged blockstore by re-importing blocks and overwriting damaged ones. (filecoin-project/lotus#13752)
• feat(shed): lotus-shed import-car can now read and import modern FRC-0108 v2 snapshot CARs into the Lotus blockstore, similar to lotus daemon --import-snapshot. (filecoin-project/lotus#13752)

🐛 Bug Fixes

• fix(docker): update Debian from bullseye to trixie for lotus-builder and lotus-base stages; also fetch prebuilt filecoin-ffi libraries instead of compiling them. (filecoin-project/lotus#13785)
• fix(eth): prevent eth_getLogs from returning successful empty or partial results when historical event-index coverage is incomplete. Block-hash queries now require a completed block event index, and range queries verify every canonical non-null tipset before returning logs. (filecoin-project/lotus#13749)
• fix(eth): prevent eth_getTransactionReceipt from returning a successful receipt with an empty logs array while that transaction's events are still being indexed. The call now fails until event indexing is complete, while transactions that completed with no events still return an empty array. (filecoin-project/lotus#13758)
• fix(network): prevent remote memory exhaustion through Lotus's default WebTransport listener by updating go-libp2p and webtransport-go (CVE-2026-57497). (filecoin-project/lotus#13734)
• fix(events): GetActorEventsRaw and SubscribeActorEventsRaw now reject a filter whose toHeight is negative. (filecoin-project/lotus#13751)
• fix(eth): eth_sendRawTransaction now rejects a transaction whose RLP integer fields are not minimally encoded, matching go-ethereum. (filecoin-project/lotus#13744)

👌 Improvements

• build: bump Go version to 1.25.14 from1.25.7; build Lotus with Go 1.25.14 or newer. (filecoin-project/lotus#13786)
• feat(gateway): limit event queries and historical filter preloads to 360 epochs (three hours) by default across EthGetLogs, EthNewFilter, GetActorEventsRaw, and SubscribeActorEventsRaw. Gateway operators can change the limit with --event-filter-max-height-range, or set it to zero to disable the gateway limit. (filecoin-project/lotus#13776)

📝 Changelog

For the full set of changes since the last stable release:

• Node: filecoin-project/lotus@release/v1.36.2...release/v1.36.3

👨‍👩‍👧‍👦 Contributors

Contributor	Commits	Lines ±	Files Changed
dependabot[bot]	11	+137/-141	4
Rod Vagg	6	+2949/-80	31
Steve Loeppky	4	+242/-15	7
Phi-rjan	3	+234/-90	19
Kaif	2	+102/-55	9
Sash	2	+20/-9	2
LexLuthr	1	+1044/-217	10
beck	1	+59/-80	4
fmterrors	1	+29/-5	2
zjuzhongwen	1	+3/-3	1
zloglevel	1	+2/-2	2

Release Log

• github.com/filecoin-project/lotus:
  • docs(release): finalize v1.36.3 release notes in CHANGELOG
  • build: release Lotus Node v1.36.3
  • build: backport Go 1.25.14 and Docker trixie fix for v1.36.3 (#​13791)
  • feat(gateway): limit event filter height ranges (#​13776)
  • chore(ci): make installs more resillient, assign blame where due (#​13777)
  • chore(docs): add basic agent context docs (#​13775)
  • build(deps): bump github.com/elastic/gosigar from 0.14.3 to 0.14.4 (#​13769)
  • build(deps): bump github.com/mattn/go-sqlite3 from 1.14.49 to 1.14.50 in the data-storage group (#​13765)
  • build(deps): bump github.com/ipfs/boxo from 0.42.1 to 0.42.2 in the ipfs-ecosystem group (#​13763)
  • build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0 (#​13767)
  • fix(httpreader): preserve Content-Length parse errors (#​13773)
  • fix(chain): reject incomplete event query results from eth event indexing (#​13762)
  • ci(pr-title-check): make title check resilient to out-of-order runs (#​13772)
  • chore: update nv29 codename (#​13748)
  • docs(release): mention create-release-issue workflow (#​13759)
  • perf(openrpc): decode openrpc docs only once per process lifetime (#​13754)
  • fix(wallet): render signing bytes for unrecognized message types in interactive mode (#​13746)
  • feat(blockstore): opt-in verify-on-read mode to check for bad blocks (#​13752)
  • feat(shed): add lotus-shed eth storage-{dump,decode} (#​13730)
  • chore: fix some comments to improve readability (#​13750)
  • refactor(chain): use slices.SortFunc for peer ordering (#​13753)
  • fix(eth): reject non-minimal RLP integers in transaction parsing (#​13744)
  • fix(events): reject negative toHeight in parseHeightRange (#​13751)
  • ci: bind create-release-issue inputs via env before shell (#​13745)
  • build(deps): bump the ipfs-ecosystem group across 1 directory with 2 updates (#​13734)
  • feat(cli): merge state active-sectors into state sectors (#​13743)
  • build(deps): bump github.com/cheggaaa/pb/v3 from 3.1.7 to 3.2.0 (#​13741)
  • build(deps): bump github.com/mattn/go-sqlite3 from 1.14.48 to 1.14.49 in the data-storage group across 1 directory (#​13737)
  • build(deps): bump github.com/xorcare/golden from 0.8.3 to 0.8.4 (#​13742)
  • build(deps): bump github.com/multiformats/go-multiaddr-dns from 0.5.0 to 0.6.0 in the multiformats group (#​13736)
  • build(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.24 (#​13739)
  • build(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 (#​13740)
  • chore: set CODEOWNERS (#​13733)
  • fix(release): render the release issue template with text/template (#​13732)
  • docs(release): support no-RC release flow (#​13697)
  • chore(release): cherry-pick v1.36.2 changelog back to master (#​13729)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 4am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.