deps: Nethermind 1.37.1 + Autofac 9.1.0 + Int256 1.5.0 (Wave 2 atomic bundle)

[leinss]

Summary

• Bumps Nethermind.ReferenceAssemblies 1.36.2 → 1.37.1
• Bumps Nethermind.Numerics.Int256 1.3.6 → 1.5.0
• Bumps Autofac 9.0.0 → 9.1.0 (required: Nethermind 1.37.1's Nethermind.Api references Autofac 9.1.0; mismatch produces CS1705 at link time)
• Bumps nethermind/nethermind Docker base image 1.36.2 → 1.37.1 (docker/Index.Dockerfile)

Atomic bundle — all four bumps must land together. Supersedes #251, #351, #352.

Audit

Plugin's surface into Nethermind APIs (IBlockTree.Head, NewHeadBlock event, SyncModeSelector.Current, IBlockTree.FindBlock, IReceiptFinder.Get) was reviewed against 1.37.1's worldstate refactor. All call sites compile against 1.37.1 and tests pass with no regression.

No Vault, NDM, eth/66, eth/67, EngineApiVersion, IsMining, or StoreReceipts references — plugin is event-indexer only, unaffected by 1.37.1's protocol/Engine API changes.

Local results:

• dotnet build -c Release — 0 errors, 143 warnings (all pre-existing categories: internal Settings.DisableConsentedFlow deprecation warnings introduced in fix(pathfinder): unconditional consented sender->Group rejection #345/fix(pathfinder): close consented-source -> non-Group leak + enforce audit safety net #346/fix(pathfinder): post-merge review followups (validator + historical + tests) #358, plus the documented Newtonsoft.Json CVE and NU1510 pruning notes)
• ./scripts/test.sh — 1219 passed, 0 failed, 390 skipped (staging-/Anvil-dependent)

Test plan

• CI green: build-and-test, CodeQL, snapshot-tests, regression-tests, formatting
• Rolling deploy node 1: indexer healthy, tip catches up
• RPC smoke node 1: ./scripts/test-rpc.sh against staging URL — all circles_* 200 OK
• Rolling deploy node 2: indexer healthy, tip catches up
• RPC smoke node 2
• EL ↔ CL: nethermind logs show no EngineApiVersion mismatch with the consensus client

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9065c34c-d6cf-4231-bed7-0f1b326ac7f3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/wave2-nethermind

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nuget/​nethermind.referenceassemblies@​1.36.2 ⏵ 1.37.1
	nuget/​autofac@​9.0.0 ⏵ 9.1.0	+2
	nuget/​nethermind.numerics.int256@​1.3.6 ⏵ 1.5.0	+1

View full report