build: bump versions (l2geth-v5.10.11, Go 1.26.10, Ubuntu 24.04) by Thegaram · Pull Request #1826 · scroll-tech/scroll

Thegaram · 2026-10-22T15:55:31Z

Purpose or design rationale of this PR

Upgrades the toolchain and dependencies, and fixes known vulnerabilities.

go-ethereum scroll-v5.10.11 and Go 1.26.10 in all modules, go.work, CI and docs. Go 1.26.10 distrusts the compromised eMudhra intermediate CAs. golang.org/x/net v0.60.0 and x/crypto v0.57.0.
Rust: rustls-webpki 0.103.16 and webpki-roots 1.0.10 (eMudhra distrust for libzkp).
Lint: golangci-lint v1.57.2 → v2.14.0 (config migrated; forbidigo rule kept). Fixes found by the new linters: an ignored error in minimal_recovery.go, and the wrong errors.Is argument order in bridge_batch_deposit.go.
Runtime images: ubuntu:20.04 → ubuntu:24.04, with a --version/--help smoke test at build time. coordinator-api stays on 20.04: libzkp.so links libssl.so.1.1 from the 20.04 builder.
Builder workflow: new Go/Rust/cargo-chef options and a UBUNTU_VERSION input. The Ubuntu version is now part of the go-rust-builder tag.

Vulnerabilities (govulncheck): Go standard library 73 → 0, third-party 83 → 49.

PR title

Your PR title must follow conventional commits (as we are doing squash merge for each PR), so it must start with one of the following types:

build: Changes that affect the build system or external dependencies (example scopes: yarn, eslint, typescript)

Deployment tag versioning

Has tag in common/version.go been updated or have you added bump-version label to this PR?

No, this PR doesn't involve a new deployment, git tag, docker image tag
Yes

Breaking change label

Does this PR have the breaking-change label?

No, this PR is not a breaking change
Yes

Summary by CodeRabbit

Bug Fixes
- Improved recovery handling so rollup event-fetch errors are reported instead of being overlooked.
- Corrected handling of missing database records when retrieving synced heights.
Maintenance
- Updated the runtime environment for several services to Ubuntu 24.04.
- Updated Go tooling and project build requirements.
- Improved build-time checks for service binaries, helping catch startup or command-line issues before images are built.
Other
- Updated the application version to v4.8.6.

…04 images

coderabbitai · 2026-10-22T15:56:13Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

go.work.sum is excluded by !**/*.sum

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 346a4cdd-5be7-4d96-a6e9-eb82ba5d7892

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: c31fedfc-e86c-48b3-983a-8f6cd128a575

📥 Commits

Reviewing files that changed from the base of the PR and between 3046bbd and 9b147f5.

⛔ Files ignored due to path filters: 9

Cargo.lock is excluded by !**/*.lock
bridge-history-api/go.sum is excluded by !**/*.sum
common/go.sum is excluded by !**/*.sum
coordinator/go.sum is excluded by !**/*.sum
database/go.sum is excluded by !**/*.sum
go.work is excluded by !**/*.work
go.work.sum is excluded by !**/*.sum
rollup/go.sum is excluded by !**/*.sum
tests/integration-test/go.sum is excluded by !**/*.sum

📒 Files selected for processing: 38

.github/workflows/bridge_history_api.yml
.github/workflows/common.yml
.github/workflows/coordinator.yml
.github/workflows/database.yml
.github/workflows/integration.yml
.github/workflows/intermediate-docker.yml
.github/workflows/rollup.yml
README.md
bridge-history-api/go.mod
bridge-history-api/internal/orm/bridge_batch_deposit.go
build/.golangci.yml
build/dockerfiles/blob_uploader.Dockerfile
build/dockerfiles/bridgehistoryapi-api.Dockerfile
build/dockerfiles/bridgehistoryapi-db-cli.Dockerfile
build/dockerfiles/bridgehistoryapi-fetcher.Dockerfile
build/dockerfiles/coordinator-api.Dockerfile
build/dockerfiles/coordinator-cron.Dockerfile
build/dockerfiles/coordinator-proxy.Dockerfile
build/dockerfiles/db_cli.Dockerfile
build/dockerfiles/gas_oracle.Dockerfile
build/dockerfiles/intermediate/Makefile
build/dockerfiles/intermediate/go-rust-builder.Dockerfile
build/dockerfiles/recovery_permissionless_batches.Dockerfile
build/dockerfiles/rollup_relayer.Dockerfile
build/lint.go
common/cmd/cmd.go
common/go.mod
common/utils/utils.go
common/version/version.go
coordinator/go.mod
coordinator/internal/controller/api/get_task.go
coordinator/internal/controller/proxy/get_task.go
database/go.mod
rollup/cmd/mock_app.go
rollup/go.mod
rollup/internal/controller/permissionless_batches/minimal_recovery.go
tests/integration-test/contracts_test.go
tests/integration-test/go.mod

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Walkthrough

The PR updates Go modules and CI to Go 1.26.10, migrates the lint configuration to golangci-lint v2, and changes intermediate and runtime Docker builds. It also updates selected error checks, reflection checks, test assertions, and logging calls.

Changes: Go Toolchain and Build Updates

Layer / File(s)	Summary
Go toolchain and module updates `.github/workflows/*.yml`, `README.md`, `bridge-history-api/go.mod`, `common/go.mod`, `coordinator/go.mod`, `database/go.mod`, `rollup/go.mod`, `tests/integration-test/go.mod`	CI workflows and module toolchains now use Go 1.26.10, and the README lists Go 1.26. Dependencies are updated and several indirect requirements are removed across the modules.
Intermediate and runtime container builds `.github/workflows/intermediate-docker.yml`, `build/dockerfiles/intermediate/`, `build/dockerfiles/.Dockerfile`	The intermediate builder configuration adds Ubuntu version selection and updates its Go, Rust, and Cargo Chef defaults. The listed runtime images move to Ubuntu 24.04 and add build-time binary checks. The coordinator API Dockerfile documents its existing Ubuntu 20.04 constraint.
golangci-lint v2 migration `build/.golangci.yml`, `build/lint.go`, `common/cmd/cmd.go`, `coordinator/internal/controller/{api,proxy}/get_task.go`	The lint installation and configuration use golangci-lint v2. Linter settings, exclusions, and formatter configuration are updated. Three calls receive gosec suppression comments; their runtime behavior is unchanged.
Targeted code and test updates `bridge-history-api/internal/orm/bridge_batch_deposit.go`, `common/utils/utils.go`, `common/version/version.go`, `rollup/cmd/mock_app.go`, `rollup/internal/controller/permissionless_batches/minimal_recovery.go`, `tests/integration-test/contracts_test.go`	The database not-found checks and reflection pointer checks are updated. Minimal recovery now returns an error when fetching rollup events fails. Test logging, an integration-test assertion, and the common version tag are also updated.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 9b147

This change upgrades Go, go-ethereum, golangci-lint, and the runtime base images, and includes small error-handling fixes. The service images are still built with older Go builder images, which must download Go 1.26.10 during the build. The new build-time smoke tests would catch any binary that fails to start on Ubuntu 24.04. No concrete merge-blocking problem was found.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 10 files. (28 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main build changes: dependency, Go, and Ubuntu version upgrades. It uses the required conventional commit type.
Description check		The description includes the required purpose, title convention, deployment tag versioning, and breaking-change sections. It explains the rationale and implementation details.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 10 files. (28 skipped: 28 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov-commenter · 2026-10-22T15:59:10Z

Codecov Report

❌ Patch coverage is 8.33333% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 30.71%. Comparing base (3046bbd) to head (260b716).

Files with missing lines	Patch %	Lines
...troller/permissionless_batches/minimal_recovery.go	0.00%	3 Missing ⚠️
...e-history-api/internal/orm/bridge_batch_deposit.go	0.00%	2 Missing ⚠️
common/utils/utils.go	0.00%	2 Missing ⚠️
rollup/cmd/mock_app.go	0.00%	2 Missing ⚠️
coordinator/internal/controller/api/get_task.go	0.00%	1 Missing ⚠️
coordinator/internal/controller/proxy/get_task.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #1826      +/-   ##
===========================================
- Coverage    35.55%   30.71%   -4.85%     
===========================================
  Files          263      263              
  Lines        22824    22827       +3     
===========================================
- Hits          8116     7011    -1105     
- Misses       13856    15127    +1271     
+ Partials       852      689     -163

Flag	Coverage Δ
bridge-history-api	`8.49% <0.00%> (ø)`
common	`31.43% <33.33%> (+0.07%)`	⬆️
coordinator	`7.29% <0.00%> (-21.27%)`	⬇️
database	`36.24% <ø> (ø)`
rollup	`34.84% <0.00%> (-0.79%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

build: bump go-ethereum to scroll-v5.10.11, Go 1.26.10 and Ubuntu 24.…

9b147f5

…04 images

build: add missing go.work.sum entry for goimports

260b716

Thegaram merged commit d460f14 into develop Oct 22, 2026
18 checks passed

Thegaram deleted the chore/go1.26-geth-ubuntu-24.04 branch October 22, 2026 16:24

Thegaram mentioned this pull request Oct 22, 2026

build: use Ubuntu 24.04 go-rust-builder and coordinator-api #1827

Merged

3 of 5 tasks

Navigation Menu

Repository navigation

build: bump versions (l2geth-v5.10.11, Go 1.26.10, Ubuntu 24.04) - #1826

build: bump versions (l2geth-v5.10.11, Go 1.26.10, Ubuntu 24.04)#1826
Thegaram merged 2 commits into
developfrom
chore/go1.26-geth-ubuntu-24.04

Thegaram commented Oct 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 22, 2026 •

edited

Loading

Review skipped

Uh oh!

codecov-commenter commented Oct 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Thegaram commented Oct 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose or design rationale of this PR

PR title

Deployment tag versioning

Breaking change label

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

codecov-commenter commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Thegaram commented Oct 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 22, 2026 •

edited

Loading

codecov-commenter commented Oct 22, 2026 •

edited

Loading