Merge branch 'develop' into feature/BCI-3842-configure-rpc-timeout

# Conflicts:
#	core/chains/evm/client/evm_client.go
#	core/chains/evm/client/helpers_test.go
#	core/chains/evm/client/rpc_client.go
#	core/chains/evm/client/rpc_client_test.go

.changeset/bright-readers-dress.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+#internal address security vulnerabilities around updating nodes and node operators on capabilities registry

.changeset/fresh-badgers-pull.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+#internal change chain reader to use nil blocknumber when reading latest value

.changeset/kind-garlics-smash.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+Updated Functions ToS contract wrappers #internal

.changeset/lucky-cameras-punch.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+#internal end to end test for streams capabilities

.changeset/shiny-ligers-compete.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+#internal logging of non determinism in target server

.changeset/twenty-rings-kneel.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+#bugfix Set LatestFinalizedBlock for finalized blocks saved by logpoller

.changeset/unlucky-lemons-learn.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+Use the new log buffer in automation #changed

.changeset/wet-wasps-hide.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+Fix TestIntegration_KeeperPluginLogUpkeep_ErrHandler flaky test #internal

.changeset/wild-seals-look.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+Added new health check that ensures RPC provides new finalized heads at least every `NoNewFinalizedHeadsThreshold` #added

.github/actions/build-sign-publish-chainlink/action.yml

@@ -68,6 +68,13 @@ inputs:
     description: When set to the string boolean value of "true", the resulting build image signature will be verified
     default: "false"
     required: false
+outputs:
+  docker-image-tag:
+    description: The docker image tag that was built and pushed
+    value: ${{ steps.save-non-root-image-name-env.outputs.image-tag }}
+  docker-image-digest:
+    description: The docker image digest that was built and pushed
+    value: ${{ steps.save-non-root-image-name-env.outputs.image-digest }}
 
 runs:
   using: composite
@@ -208,10 +215,13 @@ runs:
         IMAGES_NAME_RAW=${{ fromJSON(steps.buildpush-nonroot.outputs.metadata)['image.name'] }}
         IMAGE_DIGEST=${{ fromJSON(steps.buildpush-nonroot.outputs.metadata)['containerimage.digest'] }}
         IMAGE_NAME=$(echo "$IMAGES_NAME_RAW" | cut -d"," -f1)
+        IMAGE_TAG=$(echo "$IMAGES_NAME_RAW" | cut -d":" -f2)
         echo "nonroot_image_name=${IMAGE_NAME}" >> $GITHUB_ENV
         echo '### Docker Image' >> $GITHUB_STEP_SUMMARY
         echo "Image Name: ${IMAGE_NAME}"  >> $GITHUB_STEP_SUMMARY
         echo "Image Digest: ${IMAGE_DIGEST}"  >> $GITHUB_STEP_SUMMARY
+        echo "image-tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
+        echo "image-digest=${IMAGE_DIGEST}" >> $GITHUB_OUTPUT
 
     - name: Check if non-root image runs as root
       id: check-nonroot-runs-root

.github/actions/detect-solidity-file-changes/action.yml

@@ -1,5 +1,5 @@
-name: 'Detect Changes Composite Action'
-description: 'Detects changes in solidity files and fails if read-only files are modified.'
+name: 'Detect Solidity File Changes Composite Action'
+description: 'Detects changes in solidity files and outputs the result.'
 outputs:
   changes:
     description: 'Whether or not changes were detected'
@@ -19,18 +19,3 @@ runs:
             - '.github/workflows/solidity.yml'
             - '.github/workflows/solidity-foundry.yml'
             - '.github/workflows/solidity-wrappers.yml'
-          read_only_sol:
-            - 'contracts/src/v0.8/interfaces/**/*'
-            - 'contracts/src/v0.8/automation/v1_2/**/*'
-            - 'contracts/src/v0.8/automation/v1_3/**/*'
-            - 'contracts/src/v0.8/automation/v2_0/**/*'
-
-    - name: Fail if read-only files have changed
-      if: ${{ steps.changed_files.outputs.read_only_sol == 'true' }}
-      shell: bash
-      run: |
-        echo "One or more read-only Solidity file(s) has changed."
-        for file in ${{ steps.changed_files.outputs.read_only_sol_files }}; do
-          echo "$file was changed"
-        done
-        exit 1

.github/actions/detect-solidity-readonly-file-changes/action.yml

@@ -0,0 +1,31 @@
+name: 'Detect Solidity Readonly Files Changes Composite Action'
+description: 'Detects changes in readonly solidity files and fails if they are modified.'
+outputs:
+  changes:
+    description: 'Whether or not changes were detected'
+    value: ${{ steps.changed_files.outputs.src }}
+runs:
+  using: 'composite'
+  steps:
+
+    - name: Filter paths
+      uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      id: changed_files
+      with:
+        list-files: 'csv'
+        filters: |
+          read_only_sol:
+            - 'contracts/src/v0.8/interfaces/**/*'
+            - 'contracts/src/v0.8/automation/v1_2/**/*'
+            - 'contracts/src/v0.8/automation/v1_3/**/*'
+            - 'contracts/src/v0.8/automation/v2_0/**/*'
+
+    - name: Fail if read-only files have changed
+      if: ${{ steps.changed_files.outputs.read_only_sol == 'true' }}
+      shell: bash
+      run: |
+        echo "One or more read-only Solidity file(s) has changed."
+        for file in ${{ steps.changed_files.outputs.read_only_sol_files }}; do
+          echo "$file was changed"
+        done
+        exit 1

.github/actions/setup-merge-base64-config/action.yml

@@ -24,22 +24,20 @@ runs:
         echo "BASE64_CONFIG_OVERRIDE=$BASE64_CONFIG_OVERRIDE" >> $GITHUB_ENV
 
         decoded_toml=$(echo $BASE64_CONFIG_OVERRIDE | base64 -d)
-        CHAINLINK_IMAGE=$(echo "$decoded_toml" | dasel -r toml 'ChainlinkImage.image')
+        CHAINLINK_IMAGE=$(echo "$decoded_toml" | { dasel -r toml 'ChainlinkImage.image' 2>/dev/null || echo ''; })
         echo ::add-mask::$CHAINLINK_IMAGE
-        CHAINLINK_VERSION=$(echo "$decoded_toml" | dasel -r toml 'ChainlinkImage.version')
+        CHAINLINK_VERSION=$(echo "$decoded_toml" | { dasel -r toml 'ChainlinkImage.version' 2>/dev/null || echo ''; })
         NETWORKS=$(echo "$decoded_toml" | awk -F'=' '/^[[:space:]]*selected_networks[[:space:]]*=/ {gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2}' 2>/dev/null)
 
         if [ -n "$CHAINLINK_IMAGE" ]; then
           echo "CHAINLINK_IMAGE=$CHAINLINK_IMAGE" >> $GITHUB_ENV
         else
-          echo "No Chainlink Image found in base64-ed config. Exiting"
-          exit 1
+          echo "No Chainlink Image found in base64-ed config"
         fi
         if [ -n "$CHAINLINK_VERSION" ]; then
           echo "CHAINLINK_VERSION=$CHAINLINK_VERSION" >> $GITHUB_ENV
         else
-          echo "No Chainlink Version found in base64-ed config. Exiting"
-          exit 1
+          echo "No Chainlink Version found in base64-ed config"
         fi
         if [ -n "$NETWORKS" ]; then
           echo "NETWORKS=$NETWORKS" >> $GITHUB_ENV

.github/actions/setup-parse-base64-config/action.yml

@@ -20,23 +20,21 @@ runs:
       shell: bash
       run: |
         decoded_toml=$(echo $BASE64_CONFIG_OVERRIDE | base64 -d)
-        CHAINLINK_IMAGE=$(echo "$decoded_toml" | dasel -r toml 'ChainlinkImage.image')
+        CHAINLINK_IMAGE=$(echo "$decoded_toml" | { dasel -r toml 'ChainlinkImage.image' 2>/dev/null || echo ''; })
         echo ::add-mask::$CHAINLINK_IMAGE
-        CHAINLINK_VERSION=$(echo "$decoded_toml" | dasel -r toml 'ChainlinkImage.version')
+        CHAINLINK_VERSION=$(echo "$decoded_toml" | { dasel -r toml 'ChainlinkImage.version' 2>/dev/null || echo ''; })
         NETWORKS=$(echo "$decoded_toml" | awk -F'=' '/^[[:space:]]*selected_networks[[:space:]]*=/ {gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2}' 2>/dev/null)
         ETH2_EL_CLIENT=$(echo "$decoded_toml" | awk -F'=' '/^[[:space:]]*execution_layer[[:space:]]*=/ {gsub(/^[[:space:]]+|[[:space:]]+$/, "", $2); print $2}' 2>/dev/null)
 
         if [ -n "$CHAINLINK_IMAGE" ]; then
           echo "CHAINLINK_IMAGE=$CHAINLINK_IMAGE" >> $GITHUB_ENV
         else
-          echo "No Chainlink Image found in base64-ed config. Exiting"
-          exit 1
+          echo "No Chainlink Image found in base64-ed config"
         fi
         if [ -n "$CHAINLINK_VERSION" ]; then
           echo "CHAINLINK_VERSION=$CHAINLINK_VERSION" >> $GITHUB_ENV
         else
           echo "No Chainlink Version found in base64-ed config. Exiting"
-          exit 1
         fi
         if [ -n "$NETWORKS" ]; then
           echo "NETWORKS=$NETWORKS" >> $GITHUB_ENV

.github/dependabot.yml

@@ -1,7 +1,7 @@
 version: 2
 updates:
   - package-ecosystem: gomod
-    directory: '/'
+    directory: "/"
     schedule:
       interval: monthly
     open-pull-requests-limit: 10
@@ -11,7 +11,7 @@ updates:
       - dependency-name: github.com/libp2p/go-libp2p-peerstore
       - dependency-name: github.com/multiformats/go-multiaddr
   - package-ecosystem: npm
-    directory: '/'
+    directory: "/"
     schedule:
       interval: monthly
     open-pull-requests-limit: 0
@@ -24,7 +24,7 @@ updates:
         versions:
           - 4.17.21
   - package-ecosystem: github-actions
-    directory: '/'
+    directory: "/"
     schedule:
-      interval: daily
-    open-pull-requests-limit: 10
+      interval: monthly
+    open-pull-requests-limit: 0