From 483853c56c5906bba08807f33ef5eae940e32613 Mon Sep 17 00:00:00 2001
From: mchain0 <maciej.wisniewski@smartcontract.com>
Date: Thu, 22 Oct 2026 13:39:17 +0200
Subject: [PATCH] cre-7120: decode core defaults per call to avoid shared
 mutable state

---
 core/config/docs/defaults.go                  | 10 +----
 core/config/docs/defaults_test.go             | 12 ++++++
 .../services/chainlink/config_general_test.go | 37 +++++++++++++++++++
 3 files changed, 51 insertions(+), 8 deletions(-)

diff --git a/core/config/docs/defaults.go b/core/config/docs/defaults.go
index f6bb93b05a4..c8670b8c326 100644
--- a/core/config/docs/defaults.go
+++ b/core/config/docs/defaults.go
@@ -10,16 +10,10 @@ import (
 	"github.com/smartcontractkit/chainlink/v2/core/config/toml"
 )
 
-var defaults toml.Core
-
-func init() {
-	if err := configdoc.DefaultsOnly(strings.NewReader(coreTOML), &defaults, commonconfig.DecodeTOML); err != nil {
+func CoreDefaults() (c toml.Core) {
+	if err := configdoc.DefaultsOnly(strings.NewReader(coreTOML), &c, commonconfig.DecodeTOML); err != nil {
 		log.Fatalf("Failed to initialize defaults from docs: %v", err)
 	}
-}
-
-func CoreDefaults() (c toml.Core) {
-	c.SetFrom(&defaults)
 	c.Database.DriverName = pgcommon.DriverPostgres // not user visible - overridden for tests only
 	c.Tracing.Attributes = make(map[string]string)
 	return c
diff --git a/core/config/docs/defaults_test.go b/core/config/docs/defaults_test.go
index 1f56bf9386d..82522b887a8 100644
--- a/core/config/docs/defaults_test.go
+++ b/core/config/docs/defaults_test.go
@@ -3,9 +3,21 @@ package docs
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/smartcontractkit/chainlink-common/pkg/config/configtest"
 )
 
 func TestCoreDefaults_notNil(t *testing.T) {
 	configtest.AssertFieldsNotNil(t, CoreDefaults())
 }
+
+func TestCoreDefaults_distinctInstances(t *testing.T) {
+	t.Parallel()
+	a := CoreDefaults()
+	b := CoreDefaults()
+	*a.Insecure.DevWebServer = true
+	*a.AuditLogger.Enabled = true
+	assert.False(t, *b.Insecure.DevWebServer)
+	assert.False(t, *b.AuditLogger.Enabled)
+}
diff --git a/core/services/chainlink/config_general_test.go b/core/services/chainlink/config_general_test.go
index 4b389b0a7d7..6a7c70852cb 100644
--- a/core/services/chainlink/config_general_test.go
+++ b/core/services/chainlink/config_general_test.go
@@ -8,6 +8,7 @@ import (
 	"maps"
 	"net/url"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -83,6 +84,42 @@ func TestTOMLGeneralConfig_InsecureConfig(t *testing.T) {
 	})
 }
 
+func TestGeneralConfigOpts_ConcurrentOverrideAndNew(t *testing.T) {
+	t.Parallel()
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+		for range 100 {
+			_, err := GeneralConfigOpts{
+				OverrideFn: func(c *Config, s *Secrets) {
+					*c.Insecure.DevWebServer = true
+					*c.AuditLogger.Enabled = true
+				},
+			}.New()
+			if err != nil {
+				t.Error(err)
+				return
+			}
+		}
+	}()
+
+	go func() {
+		defer wg.Done()
+		for range 100 {
+			opts := GeneralConfigOpts{}
+			if _, err := opts.New(); err != nil {
+				t.Error(err)
+				return
+			}
+		}
+	}()
+
+	wg.Wait()
+}
+
 func TestValidateDB(t *testing.T) {
 	t.Setenv(string(env.Config), "")