Bump chia-blockchain from 2.7.1 to 2.7.2

[dependabot]

Bumps chia-blockchain from 2.7.1 to 2.7.2.

Release notes

Sourced from chia-blockchain's releases.

2.7.2

What's Changed

Added

• Add Python 3.14 support
• Add Weight Proof v2 (WPv2) with MMR-based block commitments and optimized sub-epoch challenge segment tracking
• Add PlotNFT v2 drivers for pool launch, join/leave, and reward claim
• Add /get_constants RPC to full node
• Add get_full_node_peer_count RPC to wallet

Changed

• Add offer_only option to create_offer_for_ids
• Change how offer_only works on create_offer_for_id
• Add get_fee_estimate wallet RPC that retrieves fee-per-cost estimates from a connected full node peer, allowing wallet clients to get fee guidance without calling the full node RPC directly
• Use a separate config for pooling information
• Use SQLITE_MAX_VARIABLE_NUMBER for chunking limit
• Simplify TransactionQueueEntry
• Speedup test_ban_for_mismatched_tx_cost_fee
• Improve state block handling in WalletNode's validate_received_state_from_peer
• Annotate timelord_api.py
• Annotate timelord_launcher.py
• Annotate test_transactions.py
• Support treating old consensus constant names as the new ones
• Improve collection of valid coin states in WalletNode's add_states_from_peer
• Make it clear that bytes100 is always exactly 100 bytes long
• Annotate server.py
• Avoid recomputing peak header block in WalletNode's wallet_short_sync_backtrack
• Improve fetch_coin_spend
• Annotate wallet_user_store.py
• Add explicit None check in full_node's short_sync_batch instead of naked assert
• Improve validate_additions
• Use bad_element in test_invalid_rc_sub_slot_vdf
• Do not require peer for some wallet node APIs
• Improve macOS Intel CI timeout headroom
• Add configuration option to advertise rate limits v3 support
• Annotate wallet_node_api.py

Fixed

• Pass unresolved name as server name in ws_connect
• Remove duplicate code from DID wallet
• Fix wallet sync wait after puzzle-hash derivation in test_self_revoke
• Handle stale peers during connection garbage collection
• Fix error handling in chia plots check
• Fix stale overflow
• Fix chia peer errors for invalid or missing services
• Isolate per-subscription failures in the DataLayer management loop
• Fix apparmor profile

... (truncated)

Changelog

Sourced from chia-blockchain's changelog.

2.7.2 Chia blockchain 2026-07-09

What's Changed

Added

• Add Python 3.14 support
• Add Weight Proof v2 (WPv2) with MMR-based block commitments and optimized sub-epoch challenge segment tracking
• Add PlotNFT v2 drivers for pool launch, join/leave, and reward claim
• Add /get_constants RPC to full node
• Add get_full_node_peer_count RPC to wallet

Changed

• Add offer_only option to create_offer_for_ids
• Change how offer_only works on create_offer_for_id
• Add get_fee_estimate wallet RPC that retrieves fee-per-cost estimates from a connected full node peer, allowing wallet clients to get fee guidance without calling the full node RPC directly
• Use a separate config for pooling information
• Use SQLITE_MAX_VARIABLE_NUMBER for chunking limit
• Simplify TransactionQueueEntry
• Speedup test_ban_for_mismatched_tx_cost_fee
• Improve state block handling in WalletNode's validate_received_state_from_peer
• Annotate timelord_api.py
• Annotate timelord_launcher.py
• Annotate test_transactions.py
• Support treating old consensus constant names as the new ones
• Improve collection of valid coin states in WalletNode's add_states_from_peer
• Make it clear that bytes100 is always exactly 100 bytes long
• Annotate server.py
• Avoid recomputing peak header block in WalletNode's wallet_short_sync_backtrack
• Improve fetch_coin_spend
• Annotate wallet_user_store.py
• Add explicit None check in full_node's short_sync_batch instead of naked assert
• Improve validate_additions
• Use bad_element in test_invalid_rc_sub_slot_vdf
• Do not require peer for some wallet node APIs
• Improve macOS Intel CI timeout headroom
• Add configuration option to advertise rate limits v3 support
• Annotate wallet_node_api.py

Fixed

• Pass unresolved name as server name in ws_connect
• Remove duplicate code from DID wallet
• Fix wallet sync wait after puzzle-hash derivation in test_self_revoke
• Handle stale peers during connection garbage collection
• Fix error handling in chia plots check
• Fix stale overflow
• Fix chia peer errors for invalid or missing services
• Isolate per-subscription failures in the DataLayer management loop

... (truncated)

Commits

• 4f46536 Add 2.7.2 changelog entry (#21104)
• 715953b Checkpoint Merge (#21106)
• 8878b56 bump chia_rs to 0.45.1 (#21068)
• 49c105b Update GUI pin to release/2.7.2@8572ccd4269f3c155baadcc65b8cda1c66201540 (#21...
• e7af25c Update Managed Files (#20905)
• a8570da add configuration option to advertize rate limits v3 support (#21025)
• ad16f15 CHIA-4273 Annotate wallet_node_api.py (#21030)
• 0d5a394 [LABS-469] Sanity check that PlotNFT memos match actual inner puzzle (#21029)
• 99d4993 CHIA-4253 Use bad_element in test_invalid_rc_sub_slot_vdf (#21004)
• 50fc910 build(deps): bump ruff from 0.15.13 to 0.15.16 (#21018)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Bumps a core blockchain dependency with wallet, consensus, and pooling changes; regressions would surface via tests/CI rather than in-repo code edits.

Overview
Updates the pinned chia-blockchain dependency in pyproject.toml from 2.7.1 to 2.7.2. No application source changes in this repo; runtime behavior for CAT admin tooling now follows whatever APIs and fixes ship in that upstream patch release (wallet sync, offers, pooling, consensus helpers, etc., per the upstream changelog).

^{Reviewed by Cursor Bugbot for commit de5f612. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​chia-blockchain@​2.7.1 ⏵ 2.7.2	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: pypi chia-blockchain is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pyproject.toml → pypi/chia-blockchain@2.7.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/chia-blockchain@2.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[dependabot]

Superseded by #175.