fix(security): bump evm to GHSA Aug-2026 patched commit (testnet/v37)

[skosito]

Testnet (node release/zetacore/v37) node-side. One line: bumps cosmos/evm to the patched v37 commit.

github.com/cosmos/evm => github.com/zeta-chain/evm v0.0.0-20260903155126-a69d910e9214

a69d910e is the current tip of zeta-chain/evm's release/v37 — the fork line testnet's v37 pins — after zeta-chain/evm#37 merged. Same guard set as mainnet.

Validate on testnet first, then promote mainnet.

Note on the pin

Pinned to the merged release/v37 tip, not a PR-branch commit: #37 was squash-merged, so the pre-merge commits are unreachable and such a pin would break once the branch is deleted.

The v0.0.0- prefix matches the existing convention in this replace block; go mod tidy would canonicalise it to v1.0.0-rc2.0.20260903155126-a69d910e9214. Both name the same commit but hash differently in go.sum.

Verification

go build ./cmd/zetacored is green and produces a working binary. No GOPRIVATE needed — the evm dependency is public.

---

Note

Medium Risk
Upgrades the forked EVM stack used for ante, VM, and feemarket paths; security-critical but scoped to a known patched commit with no local logic changes.

Overview
Updates the github.com/cosmos/evm → github.com/zeta-chain/evm replace pin in go.mod from commit 515bbca4d348 to a69d910e9214 (current release/v37 tip after the security backport), with matching go.sum entries.

This is a dependency-only change for the testnet release/zetacore/v37 line: node code is unchanged, but builds now pull the GHSA Aug-2026–patched EVM fork instead of the previous pin.

^{Reviewed by Cursor Bugbot for commit 6eefd38. Configure here.}

Greptile Summary

This PR updates the testnet v37 github.com/cosmos/evm replacement to the patched zeta-chain/evm release commit.

• Updates the EVM fork pseudo-version in go.mod.
• Adds the corresponding module and module-metadata checksums to go.sum.

Confidence Score: 5/5

The PR appears safe to merge, with the replacement version and integrity hashes updated consistently and no actionable defect identified.

The change is limited to an EVM fork revision and its matching checksums; available repository evidence does not establish a build, runtime, dependency-resolution, or newly introduced security failure.

Important Files Changed

Filename	Overview
go.mod	Updates the Cosmos EVM replacement to the patched release/v37 fork commit; no concrete compatibility or dependency-graph defect was identified.
go.sum	Adds checksums corresponding to the new EVM fork revision while retaining harmless historical checksum entries.

_{Reviews (1): Last reviewed commit: "fix(security): bump cosmos/evm to GHSA A..." | Re-trigger Greptile}