Hot-patch deploys without timelock (last 30 days)

Evidence summary #

v4.2.7 (Apr 14, 2026) bumped CometBFT to v0.38.22 — minor node-level update; v4.2.5 (Feb 4, 2026) addressed CometBFT security fix (GHSA-h598-3g3g-c67c). Minor CometBFT bumps in Cosmos SDK chains are typically deployed by validators independently without requiring governance upgrade proposals (no state change). No confirmed timelock-bypass or hot-patch-without-governance-approval identified in the last 30 days. Governance upgrade proposals are on-chain with voting periods.

Sources #

Methodology #

Count upgrades executed in the last 30 days without going through the declared timelock path.

See the full factor methodology and distribution across all protocols →