chore(deps): bump Polkadot SDK to stable2606

[bkontur]

Moves every SDK crate in [workspace.dependencies] from the polkadot-stable2603 line to polkadot-stable2606 (umbrella polkadot-sdk 2606.0.0, node version 1.24.0) and pins POLKADOT_SDK_VERSION in .github/env so CI downloads the matching binaries.

API adaptations

Change in 2606	What this PR does
sp-core dropped its deprecated sp_crypto_hashing re-export	blake2_256 / blake2_128 / twox_128 now come from the sp-crypto-hashing crate directly (new workspace dependency, wired into 6 crates with std propagation)
pallet_revive::Config gained Deposit (PGAS-backed storage deposits, #11847) and AutoMap (#12135)	both runtimes keep today's behaviour: Deposit = () (native currency) and AutoMap = ConstBool<false> (the explicit map_account dispatchable stays enabled, which the PAPI SDK relies on)
EthExtra splits Extension into ExtensionV0 + ExtensionOtherVersions (Extrinsic Horizon)	ExtensionV0 = TxExtension, ExtensionOtherVersions = InvalidVersion — no other extrinsic versions are supported
cumulus_pallet_parachain_system::Config gained SchedulingSignatureVerifier	left as (); per the SDK docs, enabling V3 scheduling before collators and the relay chain support it stalls the parachain
RelayParentOffsetApi is now version 2, and SchedulingV3EnabledApi is new	max_claim_queue_offset() delegates to cumulus_pallet_parachain_system::Pallet, and scheduling_v3_enabled() reports the verifier's V3_SCHEDULING_ENABLED — same shape as asset-hub-westend at this tag

No usage of the APIs removed in this release (pallet-transaction-payment's CurrencyAdapter, parachains_common::AssetsToBlockAuthor).

Storage migrations

2606 bumps the in-code storage version of two pallets we use, so the Paseo runtime schedules the SDK migrations for both:

cumulus_pallet_parachain_system::migration::Migration<Runtime>,   // v2 -> v3 (kills PoVMessagesTracker)
cumulus_pallet_xcmp_queue::migration::v7::MigrateV6ToV7<Runtime>, // v6 -> v7

Without them try-runtime on-runtime-upgrade failed on a previewnet snapshot with a version mismatch for both pallets plus corrupted-state reads in the parachain-system prefix. Each migration is gated on the on-chain version, so both stay no-ops once applied and are safe to leave in the tuple. The local runtime is unaffected — it sets SingleBlockMigrations = () and has no live endpoint in scripts/runtimes-matrix.json.

Verification

Run locally (the usual remote build box was unreachable), all green:

• cargo check --workspace --all-targets
• cargo build -p storage-parachain-runtime -p storage-paseo-runtime — both runtimes build for wasm32v1-none, so the no_std path is covered
• cargo +nightly fmt --all, taplo format, zepter run, hawkeye format (both license configs)
• cargo clippy --all-targets --workspace -- -D warnings and cargo clippy --all-targets --all-features --workspace -- -D warnings
• cargo test --workspace — 750 passed, 0 failed, 8 ignored
• try-runtime on-runtime-upgrade --checks=all against a fresh wss://previewnet.substrate.dev/web3-storage snapshot — exit 0, no errors, ✅ Entire runtime state decodes without error, every pallet's try-state checks run

Note for local runs: --all-features pulls in pallet-revive-fixtures, whose build script needs solc on PATH (the CI image has it; SKIP_PALLET_REVIVE_FIXTURES=1 works around it locally).

Follow-up, not in this PR

The checked-in chain metadata — crates/storage-subxt/metadata/storage_paseo_runtime.scale and packages/papi/.papi/metadata/parachain.scale — was generated against a 2603 runtime. Metadata changes with this bump (new pallet_revive items, the extrinsic-version rework), so just subxt-codegen / papi generate should be re-run against a 2606 node before the demos and integration tests are trusted.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​pallet-xcm@​26.0.0 ⏵ 29.0.0
	cargo/​pallet-xcm-benchmarks@​26.0.0 ⏵ 29.0.0
	cargo/​polkadot-parachain-primitives@​21.0.0 ⏵ 23.0.0
	cargo/​polkadot-runtime-common@​25.0.0 ⏵ 29.0.0
	cargo/​sp-runtime@​46.0.0 ⏵ 48.0.0
	cargo/​frame-system@​46.0.0 ⏵ 48.0.0
	cargo/​frame-support@​46.0.0 ⏵ 48.0.0
	cargo/​sp-io@​45.0.0 ⏵ 48.0.0
	cargo/​pallet-revive@​0.13.0 ⏵ 0.19.0	+1
	cargo/​cumulus-pallet-aura-ext@​0.26.0 ⏵ 0.29.0
	cargo/​cumulus-pallet-parachain-system@​0.26.0 ⏵ 0.29.0
	cargo/​cumulus-pallet-session-benchmarking@​27.0.0 ⏵ 30.0.0
	cargo/​cumulus-pallet-weight-reclaim@​0.8.0 ⏵ 0.11.0
	cargo/​cumulus-pallet-xcm@​0.25.0 ⏵ 0.27.0
	cargo/​cumulus-pallet-xcmp-queue@​0.26.0 ⏵ 0.30.0
	cargo/​cumulus-primitives-aura@​0.22.0 ⏵ 0.24.0
	cargo/​cumulus-primitives-core@​0.24.0 ⏵ 0.26.0
	cargo/​cumulus-primitives-utility@​0.26.0 ⏵ 0.30.0
	cargo/​frame-benchmarking@​46.0.0 ⏵ 49.0.0
	cargo/​frame-executive@​46.0.0 ⏵ 48.0.0
	cargo/​frame-metadata-hash-extension@​0.14.0 ⏵ 0.16.0
	cargo/​frame-system-benchmarking@​46.0.0 ⏵ 49.0.0
	cargo/​frame-system-rpc-runtime-api@​41.0.0 ⏵ 43.0.0
	cargo/​frame-try-runtime@​0.52.0 ⏵ 0.54.0
	cargo/​pallet-aura@​45.0.0 ⏵ 48.0.0
	cargo/​pallet-authorship@​46.0.0 ⏵ 48.0.0
	cargo/​pallet-balances@​47.0.0 ⏵ 50.0.0
	cargo/​pallet-collator-selection@​27.0.0 ⏵ 30.0.0
	cargo/​pallet-message-queue@​49.0.0 ⏵ 52.0.0
	cargo/​pallet-session@​46.0.0 ⏵ 49.0.0
	cargo/​pallet-sudo@​46.0.0 ⏵ 49.0.0
	cargo/​pallet-timestamp@​45.0.0 ⏵ 48.0.0
See 20 more rows in the dashboard

View full report