[tqin7]

Moves the cometbft fork pin from ab0baf2bacac (2026-10-14) to the current dydx-fork-v0.38.5 head 00f56e561ffd, picking up:

• types: reject light client attack evidence without a signed header cometbft#65 — types: reject light client attack evidence whose conflicting block has no signed header.
• blocksync: validate block response sender and signature count (upstream #5863) cometbft#66 — blocksync: validate the sender and signature count of block responses (upstream fix(blocksync): validate blocksync response sender and signature count (backport #5860) cometbft/cometbft#5863).
• blocksync: verify extended commits before storing them and stay in sync without a servable peer cometbft#67 — blocksync: verify a peer's extended commit against the validator set before persisting it, and stay in block sync while no peer can serve the next height.

All three are node-local (block sync, evidence validation, p2p message handling) with no state-machine or proposal changes, so the bump is safe for a rolling patch. Only go.mod / go.sum change here.

Summary by CodeRabbit

• Chores
  • No user-facing changes are included in this update. Existing functionality, controls, workflows, and content remain unchanged, and no new actions or settings are available.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2acb4657-0ad2-44ee-93a5-b7ececa507e2

Commits

Reviewing files that changed from the base of the PR and between e42927c and d59b461.

Files ignored due to path filters: 1

• protocol/go.sum is excluded by !**/*.sum

Files selected for processing: 1

• protocol/go.mod

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The CometBFT replacement in protocol/go.mod now points to dYdX fork revision v0.38.6-0.20261029164742-00f56e561ffd.

Changes: CometBFT Revision Update

Layer / File(s)	Summary
Update CometBFT revision protocol/go.mod	The CometBFT replacement now uses revision v0.38.6-0.20261029164742-00f56e561ffd instead of v0.38.6-0.20261014020802-ab0baf2bacac.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Suggested reviewers: kefancao

Merge Risk: Minimal · up to d59b4

No merge-blocking issue is established for this dependency update. It is mergeable subject to normal build and test checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description clearly explains the dependency bump and the included upstream changes, but it does not follow the required template. It omits the Changelist and Test Plan headings and the Author/Revi…	Rewrite the description using the required template. Add a Changelist section, a Test Plan section with the executed build and test commands, and the complete Author/Reviewer Checklist with applicable labels addressed or marked.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: updating the CometBFT fork dependency to commit 00f56e561ffd.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Description check

Explanation

The description clearly explains the dependency bump and the included upstream changes, but it does not follow the required template. It omits the Changelist and Test Plan headings and the Author/Reviewer Checklist.

Resolution

Rewrite the description using the required template. Add a Changelist section, a Test Plan section with the executed build and test commands, and the complete Author/Reviewer Checklist with applicable labels addressed or marked.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

[tqin7]

@Mergifyio backport release/protocol/v9.x

[mergify]

backport release/protocol/v9.x

✅ Backports have been created

Details

• #3462 deps: bump the cometbft fork to 00f56e561ffd (backport #3461) has been created for branch release/protocol/v9.x but encountered conflicts

Cherry-pick of 7b8822a has failed:

On branch mergify/bp/release/protocol/v9.x/pr-3461
Your branch is up to date with 'origin/release/protocol/v9.x'.

You are currently cherry-picking commit 7b8822a.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   protocol/go.sum

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   protocol/go.mod

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally