build: bump kwil-db to pick up the p2p and statesync fixes

[MicBun]

The node has pinned kwil-db at c7425a52 since 19-Jun. Nine commits have landed on kwil-db main since then, including every peer-to-peer and statesync fix from the last two weeks, and none of them is in a node binary. This moves the pin to cf061288.

What it carries

• fix: bootstrap a node when the trusted provider is unreachable kwil-db#1720 — a node bootstraps when the trusted snapshot provider is unreachable, instead of retrying forever
• fix: keep unroutable addresses out of the peer address book kwil-db#1723 — addresses that cannot work from the connection they arrived over stay out of the address book
• fix: advertise only the ports a node can be reached on kwil-db#1724 — a node advertises only the ports it can actually be reached on
• fix: reject malformed entries in a peer's snapshot catalog kwil-db#1726 — a malformed snapshot catalog from a peer is rejected rather than crashing a bootstrapping node
• fix: see every live connection in admin peers kwil-db#1728 — admin peers lists a connected peer that has no dialable address
• fix: tell a peer with PEX off apart from a failing one kwil-db#1729 — a peer with peer exchange off reads as configured, not as failing
• perf: keep top-holder queries fast at scale kwil-db#1715 — top-holder queries stay fast as the balances table grows
• refactor: use CutSuffix when appending window ordering kwil-db#1716 — window ordering generation, refactor only

Two things worth knowing before the release

The erc20 meta-schema gains an index, and it is built at startup. #1715 adds idx_balances_reward_balance and bumps the meta-schema version from 2 to 3, which is what makes OnStart re-run the idempotent createSchema on an existing node. Without that version bump the index would never reach a database that already exists. The index is built with a plain CREATE INDEX IF NOT EXISTS during startup, so the first start on the new version pays for it once, in proportion to the size of balances.

The postgres change is not in this bump. #1714 raises work_mem, and it edits contrib/docker/postgres.dockerfile rather than any Go file. It reaches an operator through a new postgres image, not through this dependency. Worth saying out loud so nobody reads the commit list and assumes otherwise.

Consensus

Nothing here changes execution. The one commit that touches SQL generation, #1716, replaces HasSuffix plus TrimSuffix with CutSuffix on both branches and produces the same string, so generated SQL is byte-identical. The rest is peer-to-peer, statesync, an admin RPC listing, and an index.

Verification

• go build ./... and go vet -tags kwiltest ./... are clean.
• Three schema suites run the node's own actions through kwil-db's engine against the new pin, and all pass: tests/streams/auth (185s), tests/streams/aggregation (147s) and tests/streams/query (467s). That is the part a dependency bump most needs to prove, since it is the engine underneath every action.
• The go.mod diff is the two kwil-db lines and nothing else; go mod tidy pulled in no transitive changes.

There is no Problem issue behind this. It is the delivery step for work already merged in kwil-db, so it carries no closing keyword.

Summary by CodeRabbit

• Chores
  • Updated underlying database components to newer pre-release builds.
  • No user-facing features or behavior changes were introduced.

[holdex]

Time Submission Status

Member	#	Time	Running Total	Status	Last Update
MicBun			2h	✅ Submitted	Sep 17, 2026, 3:09 AM

---

Submit or update total time with:

@holdex pr submit-time 2h

Add time on top of previous submission with:

@holdex pr add-time 1h30m

See available commands to help comply with our Guidelines.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d8dabb07-e851-4cc0-9dc2-9f45ce0776f9

📥 Commits

Reviewing files that changed from the base of the PR and between 5bf031b and 9a83eb2.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR updates the pinned github.com/trufnetwork/kwil-db and github.com/trufnetwork/kwil-db/core dependencies to newer pre-release builds.

Changes

Kwil DB Dependency Update

Layer / File(s)	Summary
Update Kwil DB module versions go.mod	The manifest updates both Kwil DB dependencies from the 20260619090422 builds to the 20260917021347 builds.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 9a83e

This dependency-only update has no identified unresolved risk and is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: updating the kwil-db dependency to include peer-to-peer and statesync fixes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump-kwil-db-with-the-p2p-and-statesync-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[MicBun]

@holdex pr submit-time 2h