[dianab-cl]

Description

Adds two IBC CLI how-tos that start from the tutorial's finished state, and corrects the concept pages they build on.

• docs/6-ibc-cli/8-upgrade-the-router-contract.md: upgrades both routers to freshly deployed ICS26Router logic, built from the ibc-contracts commit the CLI pins. It confirms each proxy runs the new logic, that deploy status still passes, and that a transfer still lands.
• docs/6-ibc-cli/9-grant-change-and-revoke-a-role.md: grants RELAYER_ROLE to the relayer and to IBCMulticall, then restricts the four relaying functions and IBCMulticall's multicall to it. It verifies the change with getTargetFunctionRole, canCall, a simulated unauthorized batch, and a live transfer, then reopens relaying and revokes the role.
• Permissions page, router page, solidity overview, and two "how IBC works" pages:
  • add IBCMulticall as the third access-managed contract
  • state that addIBCApp(address) and the generated-identifier addClient are role-gated: admin-only on a CLI deployment, and opened to every address by DeployAccessManagerWithRoles
  • correct the storage-layout rule for appending fields
• Bumps Go to 1.26.10 across the CLI, e2e, and generated modules, and in the docs' prerequisites.

closes: FOU-1881

---

• Linked to GitHub issue with discussion and accepted design, OR link to spec that describes this work.
• Include changelog entry when appropriate (e.g. chores should be omitted from changelog). n/a: docs only
• Wrote unit and e2e tests if relevant. n/a: docs only; guides executed manually as above
• Updated documentation (docs/) if anything is changed.
• Added godoc comments if relevant. n/a
• Self-reviewed Files changed in the GitHub PR explorer.
• Provide a conventional commit message to follow the repository standards.

[linear-code]

FOU-1881

[github-actions]

Vulnerable dependencies

0 advisories across 0 libraries need attention, 3 accepted.

Accepted

Listed in .govulncheck-ignore with a reason.

github.com/cosmos/evm

In use: v0.7.3 — reached from e2e

Advisory	CVE	Fixed in	Summary
GO-2025-3684	—	no fix yet	Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm

github.com/pion/dtls/v2

In use: v2.2.12 — reached from cli

Advisory	CVE	Fixed in	Summary
GO-2026-4479	CVE-2026-26014	no fix yet	Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls

golang.org/x/crypto

In use: v0.57.0 — reached from cli, e2e

Advisory	CVE	Fixed in	Summary
GO-2026-5932	—	no fix yet	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

_{From make vulncheck-json on this run: logs.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable new issue was found.

Summary

Adds two guides for upgrading router logic and changing relayer permissions.

• Operators can switch both router proxies to new logic while keeping their state.
• Operators can check that upgraded routers still hold state and deliver packets.
• Operators can restrict packet relaying to a role on both chains.
• Operators can reopen relaying before removing the temporary role grants.
• IBC docs explain how router registration and relayer access depend on deployment choices.
• The project’s Go version references now use 1.26.10.

Diagram

sequenceDiagram
    participant Relayer
    participant Batch as IBCMulticall
    participant Router as ICS26Router
    participant Manager as AccessManager
    Relayer->>Batch: multicall
    Batch->>Manager: Check relayer's role
    Manager-->>Batch: Allow
    Batch->>Router: updateClient and packet calls
    Router->>Manager: Check IBCMulticall's role
    Manager-->>Router: Allow

Loading

_{Reviews (3) · Last reviewed commit: "Merge branch 'main' into diana/fou-1881-..." · Reviewed by Greptile}

[dianab-cl]

@greptile review

[evanorti]

Only 1 comment on guide 8. Please review the suggestion and fix if needed. The rest looks great!

Thank you!

[dianab-cl]

@greptile review