Passage SDK v0.47 / upgrade 3.0.0 — rc.2

Passage SDK v0.47 upgrade — release candidate 2

Supersedes sdk-v0.47-rc.1 — do not use rc.1 (it was built with CometBFT v0.37.5, which is vulnerable to Tachyon / CSA-2026-001).

Built from feat/sdk-v0.47-from-v2.6.0 @ db014e0, rebased onto envadiv:release/v2.6.0-sdk-v047 (= v2.6.0 + the January CometBFT security patch).

What changed vs rc.1

• CometBFT v0.37.5 → v0.37.18 — the Tachyon-patched release for the v0.37 line, preserving the v2.6.0-patch security fix across the SDK upgrade
• cometbft-db v0.8.0 → v0.9.5, go directive → 1.22.7 (required by cometbft v0.37.18)
• Rebased onto release/v2.6.0-sdk-v047 so the PR merges clean

Unchanged

• cosmos-sdk v0.47.13, wasmd v0.45.0, wasmvm v1.5.7 (no contract-state format change), ibc-go v7.3.0
• On-chain upgrade name: 3.0.0 (handler app/upgrades/v3.0.0/) — the gov software-upgrade proposal must use 3.0.0

Validation

• go build / go mod tidy / go test ./... green
• Real-state fork test (exported passage-2 snapshot: 11,201 accounts / 79 contracts / 136 validators): gov prop → halt → swap → all module migrations → blocks past upgrade height; 33/33 wasm code hashes bit-identical post-upgrade, 79/79 contracts preserved

Binary

• passage-3.0.0-rc.2-linux-amd64, version 2.6.0-patch-4-gfa46bb6, statically reports cometbft v0.37.18 / wasmvm v1.5.7 / sdk v0.47.13 in version --long
• sha256: c1f649694784058617b22495036d9f4be84771bce4df344803c4c33aa32c364d

Validator build note

Building from source needs Go ≥ 1.22.7 (or Go ≥ 1.21 with GOTOOLCHAIN=auto). CometBFT 0.37 renames fast_sync → block_sync in config.toml.