build(deps): bump github.com/ethereum/go-ethereum from 1.17.5 to 1.17.6 in the dependencies group

[dependabot]

Bumps the dependencies group with 1 update: github.com/ethereum/go-ethereum.

Updates github.com/ethereum/go-ethereum from 1.17.5 to 1.17.6

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Inorganic Lubricant (v1.17.6)

This is a maintenance release with a number of performance improvements to block processing and initial sync, and is recommended for all users.

A few things worth highlighting:

• The Amsterdam hardfork is scheduled on the Sepolia testnet at timestamp 1791294816 (Oct 6, 2026, 13:53:36 UTC). Sepolia node operators must upgrade before that time.
• The Holesky testnet has been removed, as the network reached end-of-life.
• Go 1.24 is no longer supported. Release binaries and Docker images are now built with Go 1.27.

Fork Implementation

• Schedule the Amsterdam fork on Sepolia (#35734)
• Remove the EIP-7610 implementation (#35581)
• Update EIP-2780 and EIP-8038 gas parameters (#35454, #35497)
• Update EIP-7997 deterministic factory contract (#35458)
• Update EIP-8037, repaying the outstanding gas debt first after absorbing a child frame (#35633)
• Implement parallel block execution driven by the block-level access list (#35264, #35441, #35443, #35459, #35461, #35465, #35575, #35693)
• Rename "regular gas" to "execution gas" to match EIP-8037 (#35457, #35486)

Core

• Remove the Holesky testnet (#35591)
• Optimize JSON decoding of large requests such as engine_newPayload (#35518)
• Process the receipts for bloom construction and root calculation alongside execution (#35738)
• Introduce a precompile result cache shared between prefetcher, block processing and miner (#35388, #35473, #35526, #35578, #35753)
• Parallelize chain data and state writes in the post-execution commit (#35595)
• Do not seal a block if a database error occurred (#35427)
• Fix a panic in the log indexer when a reorg shortens the chain onto the rendered block (#35619)
• Honor ExecuteConfig.EnableTracer for the EVM-level tracing hooks (#35512)
• Add a metered LRU cache variant (#33719)
• Retain block-level access lists alongside bad blocks (#35423)
• Unset the block-level access list at the end of each transaction (#35498)
• Fix the blob cache initialization (#35509)
• Fix head truncation below a diverged tail group (#35551)
• Improve the blob fetcher with a few defensive operations (#35572)
• Fix deadlock when re-requesting partial receipts in eth/70 (#35537)
• Reject empty partial receipt responses in eth/70 (#35593)
• Cap the total size of blocked blob transactions in the sparse blobpool (#35367)
• Fix the Cells/GetCells RLP encoding in eth/72 (#35428)
• Cache recovered blobs in the blobpool to speed up serving pre-eth/72 peers (#35543)
• Add fork validation for transaction types in the state transition (#35588)
• Avoid announcing sparse blob txs to legacy peers (#35589)
• Add eth/71 (EIP-8159) tests (#35389)
• Fix gas tracer hooks and gas measurement (#35646)
• The eth/72 blob buffer is capped at 128 MiB total and 16 MiB per peer (#35766)

Sync

... (truncated)

Commits

• 3d84c6b version: release 1.17.6 (#35770)
• bb81e22 cmd/geth, core, eth: add flag to disable precompile cache (#35753)
• c6e3a0d core/txpool/blobpool: bound what the blob buffer holds (#35766)
• 5b5c9d0 core, core/types: hash the receipts alongside execution (#35738)
• 2aaf1a1 ethdb/memorydb: don't treat batch delete of the empty key as a range delete (...
• c1c2f8d go.mod: update otel to 1.46.0 (#35754)
• 23408c2 core/state: fix EIP number in selfdestruct comment (#35759)
• 89def4a core, params: schedule amsterdam fork on sepolia (#35734)
• a5b90d2 core, eth, miner, cmd/evm: ensure the parallel state processor records otel s...
• 19bdbb0 eth/protocols/snap: port optimizations into snap v2 (#35705)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[redpandabot]

Summary

Dependabot bump of go-ethereum 1.17.5 → 1.17.6 plus the transitive dependency updates it implies, with the yaegi plugin symbols regenerated (three new symbols verified against v1.17.6 source). The geth bump itself is clean, but the implied golang.org/x/mod bump lands on v0.39.0, which carries two open OSV advisories fixed only in v0.40.0 — a trivial override fixes it.

Issues

• 🔴 go.mod:92 — golang.org/x/mod v0.39.0 has open OSV advisories — see the thread on that line

---

_{Reviewed @ 33bdc244
"Bad pennies always come back." — Hungarian variant}

[redpandabot]

🔴 golang.org/x/mod v0.39.0 has open OSV advisories

OSV reports GO-2026-6179 (tlog tile verification bypass, CVE-2026-56865) and GO-2026-6180 (unauthenticated hashes in sumdb Lookup, CVE-2026-56864) against x/mod < 0.40.0. The vulnerable symbols live in golang.org/x/mod/sumdb, which nothing in this repo imports (x/mod is indirect, no direct imports found), so runtime exposure is likely nil — but v0.40.0 fixes both and MVS will accept an explicit require golang.org/x/mod v0.40.0 even with geth 1.17.6 requiring v0.39.0.