chore(release): update changelog and bump version to 1.6.0-dev.2

[lklimek]

Issue being fixed or feature implemented

Release new Tenderdash version

What was done?

• Updated changelog
• Bumped packages version

How Has This Been Tested?

None

Breaking Changes

None

Checklist:

• I have performed a self-review of the generated changelog
• I have checked that P2PProtocol in version/version.go is bumped if needed
• I have checked that BlockProtocol in version/version.go is bumped if needed
• I have checked that ABCISemVer in version/version.go is bumped if needed

For repository code-owners and collaborators only

• I have assigned this pull request to a milestone

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8d357774-f4a9-4669-a3bc-613478068741

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release_1.6.0-dev.2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[thepastaclaw]

✅ Review complete (commit 20589c5)

[thepastaclaw]

Code Review

Release-chore PR correctly bumps the version constant but the CHANGELOG edit is structurally broken: the existing 1.6.0-dev.1 header was renamed in place to 1.6.0-dev.2 (instead of inserting a new section above it), so the already-tagged dev.1 release history is no longer addressable and a user-visible WS Origin behavior-change note from #1343 was silently dropped. Both findings independently verified against the diff, the v1.6.0-dev.1 tag, and the project's prior release pattern (e.g. 1.5.0-dev.2 over 1.5.0-dev.1). Codex returned no findings and CodeRabbit was empty.

🔴 2 blocking

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `CHANGELOG.md`:
- [BLOCKING] CHANGELOG.md:1: 1.6.0-dev.1 section overwritten instead of preserved
  The diff renames `## [1.6.0-dev.1] - 2026-06-12` to `## [1.6.0-dev.2] - 2026-06-19` and merges new bullets into the same section, even though `v1.6.0-dev.1` already exists as a tag (visible in `git tag`). Every prior release in this CHANGELOG (e.g. 1.5.0-dev.2 over 1.5.0-dev.1) was added as a NEW header above the prior one with only its own bullets. As written, the dev.1 release notes are no longer addressable and bullets that belong exclusively to dev.1 (#1245, #1329, #1331, #1314, #1334, #1252, #1248, #1249, #1250, #1258, #1263, #1336, #1333, and the entire dev.1 dependabot block) are now attributed to dev.2. The clearest symptom is that the dev.1 release chore itself — `Update changelog and version to 1.6.0-dev.1 (#1337)` — is now listed under dev.2's Miscellaneous Tasks, which is logically impossible. Fix: restore the dev.1 section verbatim and insert a new `## [1.6.0-dev.2] - 2026-06-19` section above it containing only the items merged since #1337.
- [BLOCKING] CHANGELOG.md:15: Dropped the WS Origin / cross-origin behavior-change note from #1343
  The diff removes the existing line `Restrict websocket upgrades to same-host and Origin-less requests by default; browser WS clients on cross-origin hosts must now be listed in cors-allowed-origins (#1343)` and replaces it with only the generic `Add input validation and request bounds (#1343)`. The removed line documents a real default-policy change shipped in #1343 and is the only in-changelog warning operators get that browser WS clients on other origins will start being rejected after upgrade. Restore it (in the dev.1 section per the previous finding) so the behavior change is not silently lost.