0.26.0-alpha

go-flokicoin v0.26.0-alpha Release Notes

go-flokicoin v0.26.0-alpha ports a batch of security hardening, protocol correctness, and RPC improvements from upstream btcd.

Security & Robustness

• BIP30 enforcement hardening: ported upstream's stricter BIP30 (duplicate coinbase) enforcement logic.
• Panic recovery: peer message-handling goroutines now recover from panics instead of taking down the process.
• Wire protocol hardening: ReadMessage now enforces full payload consumption; witness item reads are bounded to the remaining decode slab, closing a class of malformed-message issues.
• Address validation: addrv2 now rejects/reclassifies IPv4-mapped IPv6 addresses; RFC7343 ORCHIDv2 and zero-prefix IPv6 addresses are rejected as unroutable.

RPC Client

• Fixed a shutdown double-resolve race and added httpURL caching.
• In-flight HTTP requests can now be canceled; several batch-request bugs fixed.
• Added GetTxOutProof, a dial-timeout fix, and faster JSON string parsing.

Networking & Sync

• netsync now allows syncing with non-localhost peers on regtest/simnet.
• Fixed a peer add/done race between peerHandler and syncManager.

Fixes

• Corrected a Debugf call in chain-tip reconsideration that was missing its argument (would have printed a blank tip count instead of the actual number of inactive tips being examined).

Dependency Security

• Bumped golang.org/x/crypto from v0.45.0 to v0.52.0, closing 7 upstream advisories in the ssh/ssh/agent subpackage (GHSA-rm3j-f69w-wqmq, GHSA-vgwf-h737-ff37, GHSA-f5wc-c3c7-36mc, GHSA-jppx-rxg9-jmrx, GHSA-89gr-r52h-f8rx, GHSA-5cgq-3rg8-m6cv, GHSA-x527-x647-q7gg). None of these code paths are reachable in go-flokicoin (only pbkdf2/scrypt/ripemd160/sha3/nacl/secretbox are used, never ssh), but the fix is a clean, zero-risk version bump.

---

Commit range: 0.25.13-alpha..0.26.0-alpha (13 commits).