fix: dedupe persistent-merkle-tree to recover hashtree hasher

.github/workflows/test.yml

@@ -52,6 +52,9 @@ jobs:
       - name: Assert pnpm prints no warnings
         run: scripts/assert_no_pnpm_warnings.sh
 
+      - name: Assert @chainsafe/persistent-merkle-tree is not duplicated
+        run: scripts/assert_persistent_merkle_tree_dedup.sh
+
       - name: Lint Code
         run: pnpm lint
 

packages/api/package.json

@@ -74,7 +74,7 @@
     "check-readme": "pnpm exec ts-node ../../scripts/check_readme.ts"
   },
   "dependencies": {
-    "@chainsafe/persistent-merkle-tree": "^1.2.1",
+    "@chainsafe/persistent-merkle-tree": "^1.2.5",
     "@chainsafe/ssz": "^1.4.0",
     "@lodestar/config": "workspace:^",
     "@lodestar/params": "workspace:^",

packages/beacon-node/package.json

@@ -114,7 +114,7 @@
     "@chainsafe/enr": "^6.0.1",
     "@chainsafe/libp2p-noise": "^17.0.0",
     "@chainsafe/libp2p-quic": "^2.0.1",
-    "@chainsafe/persistent-merkle-tree": "^1.2.1",
+    "@chainsafe/persistent-merkle-tree": "^1.2.5",
     "@chainsafe/prometheus-gc-stats": "^1.0.0",
     "@chainsafe/pubkey-index-map": "^3.0.0",
     "@chainsafe/snappy-wasm": "^0.5.0",

packages/cli/package.json

@@ -62,7 +62,7 @@
     "@chainsafe/blst": "^2.2.0",
     "@chainsafe/discv5": "^12.0.1",
     "@chainsafe/enr": "^6.0.1",
-    "@chainsafe/persistent-merkle-tree": "^1.2.1",
+    "@chainsafe/persistent-merkle-tree": "^1.2.5",
     "@chainsafe/pubkey-index-map": "^3.0.0",
     "@chainsafe/ssz": "^1.4.0",
     "@chainsafe/threads": "^1.11.3",

packages/light-client/package.json

@@ -65,7 +65,7 @@
   "dependencies": {
     "@chainsafe/bls": "8.2.0",
     "@chainsafe/blst": "^2.2.0",
-    "@chainsafe/persistent-merkle-tree": "^1.2.1",
+    "@chainsafe/persistent-merkle-tree": "^1.2.5",
     "@chainsafe/ssz": "^1.4.0",
     "@lodestar/api": "workspace:^",
     "@lodestar/config": "workspace:^",

packages/prover/package.json

@@ -51,7 +51,7 @@
     "generate-fixtures": "node --loader ts-node/esm scripts/generate_fixtures.ts"
   },
   "dependencies": {
-    "@chainsafe/persistent-merkle-tree": "^1.2.1",
+    "@chainsafe/persistent-merkle-tree": "^1.2.5",
     "@ethereumjs/block": "^4.2.2",
     "@ethereumjs/blockchain": "^6.2.2",
     "@ethereumjs/common": "^3.1.2",

packages/state-transition/package.json

@@ -62,7 +62,7 @@
   "dependencies": {
     "@chainsafe/as-sha256": "^1.2.0",
     "@chainsafe/blst": "^2.2.0",
-    "@chainsafe/persistent-merkle-tree": "^1.2.1",
+    "@chainsafe/persistent-merkle-tree": "^1.2.5",
     "@chainsafe/persistent-ts": "^1.0.0",
     "@chainsafe/pubkey-index-map": "^3.0.0",
     "@chainsafe/ssz": "^1.4.0",

scripts/assert_persistent_merkle_tree_dedup.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+#
+# Assert @chainsafe/persistent-merkle-tree resolves to a single instance in pnpm-lock.yaml.
+#
+# persistent-merkle-tree carries a module-scoped `hasher` binding configured by Lodestar at
+# startup via setHasher(hashtree). If a second copy is loaded transitively (e.g. under
+# @chainsafe/ssz when its package.json declares an empty version constraint), Lodestar's
+# setHasher call configures only one copy while ssz internals digest through the other —
+# silently falling back to the slow JS noble hasher and producing a significant GC regression
+# on mainnet (see PR #9211).
+
+set -euo pipefail
+
+LOCKFILE="${1:-pnpm-lock.yaml}"
+PACKAGE="@chainsafe/persistent-merkle-tree"
+
+# Versions known to come from non-runtime legacy paths and excluded from the dedup check.
+# @ethereumjs/util pulls in @chainsafe/ssz@0.11.1 which depends on persistent-merkle-tree@0.6.1.
+# That predates the setHasher API and can't share a singleton with the modern 1.x line.
+EXEMPT_VERSIONS=("0.6.1")
+
+# Extract every resolved version of PACKAGE that appears as a lockfile key.
+# pnpm-lock.yaml keys are of the form '<name>@<version>'[(<peer-dep-suffix>)]':' — version may
+# include pre-release tags (e.g. 1.2.5-alpha.0) and a parenthesized peer-dep suffix.
+# - grep captures everything between '<name>@' and the next ' or :
+# - sed strips any '(...)' peer-dep suffix to normalize on the bare version
+exempt_filter=$(printf '%s\n' "${EXEMPT_VERSIONS[@]}")
+versions=$(
+  grep -oE "'${PACKAGE}@[^':]+" "$LOCKFILE" \
+    | sed "s|'${PACKAGE}@||" \
+    | sed -E 's|\(.+$||' \
+    | grep -vxF "$exempt_filter" \
+    | sort -u
+)
+count=$(echo -n "$versions" | grep -c '^' || true)
+
+if [ "$count" -eq 0 ]; then
+  echo "ERROR: ${PACKAGE} not found in ${LOCKFILE}."
+  echo "The lockfile layout may have changed or the dependency is gone. Update this script"
+  echo "to match, or delete it if ${PACKAGE} is no longer used."
+  exit 1
+fi
+
+if [ "$count" -gt 1 ]; then
+  echo "ERROR: found multiple versions of ${PACKAGE} in ${LOCKFILE}:"
+  echo "$versions" | sed 's/^/  /'
+  echo
+  echo "Multiple instances split the module-scoped hasher singleton — Lodestar's"
+  echo "setHasher(hashtree) call configures only one copy, while @chainsafe/ssz internals"
+  echo "digest via the other (silently falling back to the slow JS noble hasher). Result:"
+  echo "significant GC regression on mainnet."
+  echo
+  echo "Fix: align every workspace package.json pin for ${PACKAGE} with the highest version"
+  echo "present, then run 'pnpm install' to dedupe."
+  exit 1
+fi
+
+echo "OK: single copy of ${PACKAGE}@${versions} in ${LOCKFILE}"