bump cometbft from v0.38.15 to v0.38.19#2999
Conversation
📝 WalkthroughWalkthroughUpdates only to Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.5.0)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod(9 hunks)
🧰 Additional context used
🪛 OSV Scanner (2.2.3)
go.mod
[HIGH] 69-69: golang.org/x/crypto 0.33.0: Potential denial of service in golang.org/x/crypto
(GO-2025-3487)
[HIGH] 69-69: golang.org/x/crypto 0.33.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
[HIGH] 184-184: github.com/golang/glog 1.2.3: Vulnerability when creating log files in github.com/golang/glog
(GO-2025-3372)
[HIGH] 184-184: github.com/golang/glog 1.2.3: Insecure Temporary File usage in github.com/golang/glog
[HIGH] 258-258: golang.org/x/oauth2 0.24.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 258-258: golang.org/x/oauth2 0.24.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Run Unit Tests
| golang.org/x/crypto v0.33.0 | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20241202173237-19429a94021a | ||
| ) |
There was a problem hiding this comment.
Security regression: golang.org/x/crypto v0.33.0 ships a known DoS vulnerability.
OSV reports GO-2025-3487 / GHSA-hcg3-q754-cr77 flag this exact release for a slow/incomplete key exchange DoS. Please bump to the patched version (or roll back) before merging so we don’t ship a known vulnerability. Based on static analysis hints.
🧰 Tools
🪛 OSV Scanner (2.2.3)
[HIGH] 69-69: golang.org/x/crypto 0.33.0: Potential denial of service in golang.org/x/crypto
(GO-2025-3487)
[HIGH] 69-69: golang.org/x/crypto 0.33.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
🤖 Prompt for AI Agents
go.mod lines 69-71: the project pins golang.org/x/crypto to v0.33.0 which
contains a known DoS vuln; update the dependency to a patched release (e.g., at
least v0.34.0 or the latest stable patch) by running `go get
golang.org/x/crypto@v0.34.0` (or `@latest`), then run `go mod tidy` to update
go.mod/go.sum and run tests/lint to verify; commit the updated go.mod and go.sum
files before merging.
| github.com/golang/glog v1.2.3 // indirect | ||
| github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect | ||
| github.com/golang/snappy v0.0.4 // indirect |
There was a problem hiding this comment.
Security regression: github.com/golang/glog v1.2.3 is flagged for insecure temp-file handling.
OSV ID GO-2025-3372 / GHSA-6wxm-mpqj-6jpf marks 1.2.3 as vulnerable when creating log files. Please move to the patched release that fixes this issue prior to release. Based on static analysis hints.
🧰 Tools
🪛 OSV Scanner (2.2.3)
[HIGH] 184-184: github.com/golang/glog 1.2.3: Vulnerability when creating log files in github.com/golang/glog
(GO-2025-3372)
[HIGH] 184-184: github.com/golang/glog 1.2.3: Insecure Temporary File usage in github.com/golang/glog
🤖 Prompt for AI Agents
In go.mod around lines 184 to 186, the dependency github.com/golang/glog is
pinned to v1.2.3 which is flagged for insecure temp-file handling; update the
glog requirement to a patched non-vulnerable release (bump the version to the
patched v1.x tag), then run go get github.com/golang/glog@<patched-version> and
go mod tidy to update go.sum, rebuild/run tests to verify no breakages, and
commit the updated go.mod and go.sum.
| golang.org/x/oauth2 v0.24.0 // indirect | ||
| golang.org/x/sync v0.11.0 // indirect | ||
| golang.org/x/sys v0.30.0 // indirect |
There was a problem hiding this comment.
Security regression: golang.org/x/oauth2 v0.24.0 carries high-severity parsing flaws.
Per GO-2025-3488 / GHSA-6v2p-p543-phr9 this version can consume excessive memory when parsing tokens due to lax validation. Upgrade to the patched version (or revert) to avoid introducing the issue. Based on static analysis hints.
🧰 Tools
🪛 OSV Scanner (2.2.3)
[HIGH] 258-258: golang.org/x/oauth2 0.24.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 258-258: golang.org/x/oauth2 0.24.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
🤖 Prompt for AI Agents
In go.mod around lines 258-260, golang.org/x/oauth2 is pinned at v0.24.0 which
has a high-severity parsing vulnerability; update the module to a patched
release (e.g., v0.25.0 or later) by changing the version requirement, run go get
golang.org/x/oauth2@v0.25.0 (or newer), then run go mod tidy and rebuild/test to
ensure the dependency graph and indirect references are updated and no
regressions occur.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@go.mod`:
- Line 10: Update build and CI to require Go 1.22.11+ and validate the new
CometBFT dependency "github.com/cometbft/cometbft v0.38.21" works: set the Go
toolchain version used by local builds and CI to >=1.22.11, run full integration
tests exercising state sync and consensus (including BitArray/voting power
scenarios) to catch stricter validation rejections, and add test cases or CI
checks for the new additive config option "max-snapshot-chunks" if you intend to
use state sync with chunking.
🧹 Nitpick comments (1)
go.mod (1)
229-231: Consider verifying Prometheus client compatibility.The Prometheus client libraries received minor version bumps. While these are indirect dependencies and the changes are likely non-breaking, you may want to verify compatibility if your application uses custom Prometheus metrics.
| github.com/bianjieai/nft-transfer v1.1.3-ibc-v8.6.1 | ||
| github.com/bianjieai/tibc-go v0.6.0 | ||
| github.com/cometbft/cometbft v0.38.15 | ||
| github.com/cometbft/cometbft v0.38.21 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
CometBFT v0.38.21 release notes changelog
💡 Result:
CometBFT v0.38.21 (released Jan 23, 2026) includes two changes: [1]
- State sync: Adds a new config option
max-snapshot-chunksto let operators cap the maximum snapshot size they’ll accept (in chunks), and rejects peers that exceed the configured limit. [2] - Tests: Adds comprehensive unit tests for
TotalVotingPowerSafe(including boundary/overflow cases) to improve coverage and safety checks. [3]
Full changelog (compare): v0.38.20...v0.38.21. [1]
Sources: [1] [2] [3]
🌐 Web query:
CometBFT v0.38.21 cosmos-sdk v0.50 compatibility
💡 Result:
Yes—CometBFT v0.38.21 is compatible with Cosmos SDK v0.50.x, because Cosmos SDK 0.50 chains are built against the CometBFT 0.38 line (ABCI 2.0 / “Comet38”). [1]
In practice, many SDK v0.50.x-based projects pin some v0.38.* patch (e.g., IBC release notes show SDK v0.50.13 using CometBFT v0.38.15), and moving within the same minor series (0.38.* → 0.38.*) is intended to be patch-compatible. [2] [3]
Rule of thumb: keep major+minor aligned (0.38 for SDK 0.50); choosing a newer patch like 0.38.21 is generally fine. [1] [3]
Sources:
[1] https://medium.com/cosmwasm/cosmjs-0-32-supports-sdk-0-50-8b87920defec
[2] https://docs.cosmos.network/ibc/v10.1.x/changelog/release-notes
[3] https://socket.dev/go/package/github.com/cometbft/cometbft
🌐 Web query:
CometBFT v0.38 breaking changes between v0.38.15 and v0.38.21
💡 Result:
Between CometBFT v0.38.15 and v0.38.21, there are no documented “BREAKING CHANGES” (in the sense of intentional API/protocol breaks) in the release notes for the intervening patch releases; changes are primarily bugfixes, security hardening, and small additions. [1][2]
Notable items that can still be practically breaking for some deployments:
- Build/toolchain requirement change: v0.38.17 bumps the minimum Go version to 1.22.11, which will break builds using older Go toolchains. [1]
- Security hardening (stricter validation):
- v0.38.15 patches a high-severity issue where vote extensions could trigger a panic when handling invalid precommit data. [3]
- v0.38.19 is a security patch release fixing invalid BitArray handling that could lead to a network halt; stricter message validation can change how nodes react to malformed peer messages (drop/reject instead of processing). [2][4]
- Behavior/validation tightening: v0.38.20 adds voting power validation, which may cause nodes to reject/flag invalid data that previously slipped through. [2]
- Config surface area change (additive): v0.38.21 adds a state-sync setting for maximum snapshot chunks (new config option; typically non-breaking unless you rely on strict config schemas/tools). [2]
Sources: Cosmos CometBFT v0.38 release notes (up through v0.38.18) [1], CometBFT GitHub releases (v0.38.19–v0.38.21) [2], security advisory for v0.38.15 [3], security advisory for v0.38.19 [4].
Validate Go 1.22.11 requirement and test security-hardened changes.
CometBFT v0.38.21 is compatible with cosmos-sdk v0.50.11-lsm. The upgrade from v0.38.15 includes no formal breaking changes but introduces practical implications:
- Go 1.22.11+ is now required (enforced in v0.38.17); ensure your build environment meets this.
- Security hardening in v0.38.19–v0.38.20 tightens validation (BitArray handling, voting power checks); test that these stricter checks don't cause unexpected peer rejections or validation failures in your deployment.
- v0.38.21 adds an additive config option (
max-snapshot-chunksfor state sync); no action needed unless you plan to use it.
Confirm Go version compatibility and perform integration testing with the stricter validation rules.
🤖 Prompt for AI Agents
In `@go.mod` at line 10, Update build and CI to require Go 1.22.11+ and validate
the new CometBFT dependency "github.com/cometbft/cometbft v0.38.21" works: set
the Go toolchain version used by local builds and CI to >=1.22.11, run full
integration tests exercising state sync and consensus (including BitArray/voting
power scenarios) to catch stricter validation rejections, and add test cases or
CI checks for the new additive config option "max-snapshot-chunks" if you intend
to use state sync with chunking.
bump cometbft from v0.38.15 to v0.38.19
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.