v0.54.4

This release contains important security fixes. We recommend all chains upgrade to this patch release as soon as possible using a coordinated upgrade.

This release is state breaking.

What's Changed

• fix: Change otel env var (backport #26390) by @mergify[bot] in #26391
• chore: bump Go baseline to 1.26.3 and relax goconst linting (backport #26407) by @mergify[bot] in #26412
• build(deps): Bump actions/dependency-review-action from 4 to 5 (backport #26402) by @mergify[bot] in #26411
• fix(distribution): add strict + fallback behavior when withdrawing delegator rewards (backport #26406) by @mergify[bot] in #26409
• build(deps): Bump actions/add-to-project from 1.0.2 to 2.0.0 (backport #26384) by @mergify[bot] in #26393
• chore(deps): bump x/net, x/sys, x/text (backport #26442) by @mergify[bot] in #26445
• fix: resolve pre-existing lint and test failures (backport #26457) by @mergify[bot] in #26459
• ci: bump go to 1.26.4 and source CI Go version from go.mod (backport #26486) by @mergify[bot] in #26496
• fix(x/staking): handle redelegation when unbonded source is removed (backport #26408) by @mergify[bot] in #26416
• test(x/gov): expand genesis InitGenesis/ExportGenesis coverage (backport #26354) by @mergify[bot] in #26446
• feat: add Block-STM configuration support (backport #26208) by @mergify[bot] in #26495
• ci: bump remaining Dockerfile/scripts go to 1.26.4 (backport #26494) by @mergify[bot] in #26500
• chore(x/auth): human-readable error (backport #26567) by @mergify[bot] in #26577
• fix: Guard against bstm estimate failure (backport #26627) by @mergify[bot] in #26636
• build(deps): consolidated deps bump on release/v0.54.x by @swift1337 in #26671
• fix(x/auth/tx): avoid nil pointer panic in GetSigningTxData (backport #26527) by @mergify[bot] in #26660
• fix: bound multisig signature and pubkey indexing by slice lengths (backport #26515) by @mergify[bot] in #26650
• fix(x/auth/tx): avoid nil pointer panic in GetSigningTxData for multisig ModeInfo with a nil Multi or nil Bitarray (backport #26571) by @mergify[bot] in #26657
• build(deps): bump google.golang.org/grpc to v1.82.1 on release/v0.54.x by @swift1337 in #26676
• fix: bound compact bit array index by elems length (backport #26509) by @mergify[bot] in #26656
• fix: reject tx with mismatched signer info and signature counts (backport #26517) by @mergify[bot] in #26652
• fix(x/auth/ante): reject tx with extra SignerInfos in SetPubKeyDecorator (backport #26573) by @mergify[bot] in #26658
• fix(x/distribution): return errors for missing historical rewards internally (backport #26518) by @mergify[bot] in #26654
• fix(blockstm): normalize non-positive worker count in STMRunner.Run (backport #26591) by @mergify[bot] in #26659
• fix(blockstm): count validation tasks before advancing validationIdx to prevent lost updates (backport #26583) by @mergify[bot] in #26667
• fix(crypto): validate secp256k1 pubkey SEC1 tag byte (backport #26529) by @mergify[bot] in #26666
• feat: update comet and changelog by @swift1337 in #26690

Full Changelog: v0.54.3...v0.54.4