Backport audit: fix PRs on main missing from v0.39.x-celestia

[rootulp]

Summary

Audit of main vs v0.39.x-celestia found 24 fix: PRs merged to main that have not been backported. This issue tracks the backport effort.

Security / correctness (high priority)

• fix(types): validate nil SignedHeader in LightClientAttackEvidence #2923 — validate nil SignedHeader in LightClientAttackEvidence
• fix(mempool): cap SeenTxSet size to prevent OOM from SeenTx flooding #2887 — cap SeenTxSet size to prevent OOM from SeenTx flooding
• fix: prevent uint32 overflow in RowProof.Validate() #2886 — prevent uint32 overflow in RowProof.Validate()
• fix: validate PartSetHeader.Total upper bound in ValidateBasic #2885 — validate PartSetHeader.Total upper bound in ValidateBasic
• fix: cross-validate ExtendedCommit against LastCommit in blocksync #2884 — cross-validate ExtendedCommit against LastCommit in blocksync
• fix: guard nil syncer dereference in statesync Reactor.Receive #2883 — guard nil syncer dereference in statesync Reactor.Receive
• fix: enforce maxRequestsPerPeer on direct SeenTx path in CAT mempool #2880 — enforce maxRequestsPerPeer on direct SeenTx path in CAT mempool
• fix: enforce PubKey-Address binding in LCA evidence validation #2848 — enforce PubKey-Address binding in LCA evidence validation
• fix: prevent CompactBlock.Proofs() cache poisoning on validation failure #2847 — prevent CompactBlock.Proofs() cache poisoning on validation failure
• fix: strip BlobTx wrappers in ExecCommitBlock during crash replay #2846 — strip BlobTx wrappers in ExecCommitBlock during crash replay
• fix: release P2P channel receive buffer after large message EOF #2815 — release P2P channel receive buffer after large message EOF
• fix: disconnect peers that send invalid chunks during state sync #2814 — disconnect peers that send invalid chunks during state sync
• fix: add default case to handleHaves select to prevent reactor halt #2813 — add default case to handleHaves select to prevent reactor halt
• fix: add missing QuerySequence case to socket client resMatchesReq #2844 — add missing QuerySequence case to socket client resMatchesReq

Dependency / toolchain bumps

• fix: bump Go version from 1.26.1 to 1.26.2 #2917 — bump Go 1.26.1 → 1.26.2
• fix: bump Go to 1.25.8 to resolve stdlib vulnerabilities #2845 — bump Go to 1.25.8 (stdlib vulnerabilities)
• fix: bump github.com/cloudflare/circl to v1.6.3 #2840 — bump github.com/cloudflare/circl to v1.6.3

Test / CI (lower priority, likely skip)

• fix: correct .PHONY target for test_deadlock #2882 — correct .PHONY target for test_deadlock
• fix: use dynamic ports in node tests to prevent port conflicts #2851 — use dynamic ports in node tests
• fix: increase TestByzantinePrevoteEquivocation timeout to reduce flakes #2850 — increase TestByzantinePrevoteEquivocation timeout
• fix: increase base ensureTimeout from 200ms to 400ms #2849 — increase base ensureTimeout from 200ms to 400ms
• fix: increase ensureVote timeout to fix flaky TestStateOversizedBlock #2842 — increase ensureVote timeout for TestStateOversizedBlock
• fix: use assert.Eventually in TestReactorRecordsVotesAndBlockParts #2841 — use assert.Eventually in TestReactorRecordsVotesAndBlockParts
• fix: reduce flakiness in three consensus tests #2810 — reduce flakiness in three consensus tests

Backport mechanism

Backports are triggered by adding the backport-to-v0.39.x label to the original PR (.github/mergify.yml). Mergify opens a backport PR automatically.