bump cometbft from v0.38.15 to v0.38.19 #2999
Conversation
WalkthroughUpdates go.mod: advances Go version to 1.22.11, adds toolchain go1.24.9, and bumps multiple dependencies (CometBFT, Cobra, gRPC, Protobuf, OpenTelemetry, Prometheus, golang.org/x/*, etc.). No code files changed; only module requirements/directives adjusted. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.5.0)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod(9 hunks)
🧰 Additional context used
🪛 OSV Scanner (2.2.3)
go.mod
[HIGH] 69-69: golang.org/x/crypto 0.33.0: Potential denial of service in golang.org/x/crypto
(GO-2025-3487)
[HIGH] 69-69: golang.org/x/crypto 0.33.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
[HIGH] 184-184: github.com/golang/glog 1.2.3: Vulnerability when creating log files in github.com/golang/glog
(GO-2025-3372)
[HIGH] 184-184: github.com/golang/glog 1.2.3: Insecure Temporary File usage in github.com/golang/glog
[HIGH] 258-258: golang.org/x/oauth2 0.24.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 258-258: golang.org/x/oauth2 0.24.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Run Unit Tests
| golang.org/x/crypto v0.33.0 | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20241202173237-19429a94021a | ||
| ) |
There was a problem hiding this comment.
Security regression: golang.org/x/crypto v0.33.0 ships a known DoS vulnerability.
OSV reports GO-2025-3487 / GHSA-hcg3-q754-cr77 flag this exact release for a slow/incomplete key exchange DoS. Please bump to the patched version (or roll back) before merging so we don’t ship a known vulnerability. Based on static analysis hints.
🧰 Tools
🪛 OSV Scanner (2.2.3)
[HIGH] 69-69: golang.org/x/crypto 0.33.0: Potential denial of service in golang.org/x/crypto
(GO-2025-3487)
[HIGH] 69-69: golang.org/x/crypto 0.33.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
🤖 Prompt for AI Agents
go.mod lines 69-71: the project pins golang.org/x/crypto to v0.33.0 which
contains a known DoS vuln; update the dependency to a patched release (e.g., at
least v0.34.0 or the latest stable patch) by running `go get
golang.org/x/[email protected]` (or `@latest`), then run `go mod tidy` to update
go.mod/go.sum and run tests/lint to verify; commit the updated go.mod and go.sum
files before merging.
| github.com/golang/glog v1.2.3 // indirect | ||
| github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect | ||
| github.com/golang/snappy v0.0.4 // indirect |
There was a problem hiding this comment.
Security regression: github.com/golang/glog v1.2.3 is flagged for insecure temp-file handling.
OSV ID GO-2025-3372 / GHSA-6wxm-mpqj-6jpf marks 1.2.3 as vulnerable when creating log files. Please move to the patched release that fixes this issue prior to release. Based on static analysis hints.
🧰 Tools
🪛 OSV Scanner (2.2.3)
[HIGH] 184-184: github.com/golang/glog 1.2.3: Vulnerability when creating log files in github.com/golang/glog
(GO-2025-3372)
[HIGH] 184-184: github.com/golang/glog 1.2.3: Insecure Temporary File usage in github.com/golang/glog
🤖 Prompt for AI Agents
In go.mod around lines 184 to 186, the dependency github.com/golang/glog is
pinned to v1.2.3 which is flagged for insecure temp-file handling; update the
glog requirement to a patched non-vulnerable release (bump the version to the
patched v1.x tag), then run go get github.com/golang/glog@<patched-version> and
go mod tidy to update go.sum, rebuild/run tests to verify no breakages, and
commit the updated go.mod and go.sum.
| golang.org/x/oauth2 v0.24.0 // indirect | ||
| golang.org/x/sync v0.11.0 // indirect | ||
| golang.org/x/sys v0.30.0 // indirect |
There was a problem hiding this comment.
Security regression: golang.org/x/oauth2 v0.24.0 carries high-severity parsing flaws.
Per GO-2025-3488 / GHSA-6v2p-p543-phr9 this version can consume excessive memory when parsing tokens due to lax validation. Upgrade to the patched version (or revert) to avoid introducing the issue. Based on static analysis hints.
🧰 Tools
🪛 OSV Scanner (2.2.3)
[HIGH] 258-258: golang.org/x/oauth2 0.24.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 258-258: golang.org/x/oauth2 0.24.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
🤖 Prompt for AI Agents
In go.mod around lines 258-260, golang.org/x/oauth2 is pinned at v0.24.0 which
has a high-severity parsing vulnerability; update the module to a patched
release (e.g., v0.25.0 or later) by changing the version requirement, run go get
golang.org/x/[email protected] (or newer), then run go mod tidy and rebuild/test to
ensure the dependency graph and indirect references are updated and no
regressions occur.
1 participant
bump cometbft from v0.38.15 to v0.38.19
Summary by CodeRabbit