Conversation
📝 WalkthroughWalkthroughThis pull request updates four Go module dependencies in Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Tip 🧪 Unit Test Generation v2 is now available!We have significantly improved our unit test generation capabilities. To enable: Add this to your reviews:
finishing_touches:
unit_tests:
enabled: trueTry it out by using the Have feedback? Share your thoughts on our Discord thread! Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@go.mod`:
- Line 14: Update the CometBFT dependency from v0.37.18 to v0.38.17 in go.mod
and adjust your chain consensus evidence settings: locate where consensus
parameters are initialized (e.g., ConsensusParams or EvidenceParams) and set
EvidenceParams.MaxAgeDuration to a value greater than your chain's unbonding
period and EvidenceParams.MaxAgeNumBlocks to a value greater than the number of
blocks expected during unbonding; ensure imports and any API changes between
cometbft v0.37.x and v0.38.x are addressed after the upgrade.
| github.com/CosmWasm/wasmd v0.45.0 | ||
| github.com/CosmWasm/wasmvm v1.5.9 | ||
| github.com/cometbft/cometbft v0.37.13 | ||
| github.com/cometbft/cometbft v0.37.18 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
GHSA-r3r4-g7hq-pq4f CometBFT security advisory fixed version
💡 Result:
GHSA-r3r4-g7hq-pq4f (CometBFT) is fixed in:
- v0.38.17 (for the 0.38.x line) [1][2]
- v1.0.1 (for the 1.0.x line; affected from v1.0.0-alpha.1 up to but not including v1.0.1) [1][2]
Sources: [1] Go vulnerability report (GO-2025-3443) / pkg.go.dev, [2] GitLab Advisory Database.
🌐 Web query:
GHSA-22qq-3xwm-r5x4 CometBFT security advisory fixed version
💡 Result:
GHSA-22qq-3xwm-r5x4 (CometBFT) is fixed in:
- CometBFT v0.38.x: upgrade to v0.38.17 or later. [1]
- CometBFT v1.0.x (internal/blocksync module line): upgrade to v1.0.1 or later. [1][2]
🌐 Web query:
GHSA-555p-m4v6-cqxv CometBFT security advisory fixed version
💡 Result:
GHSA-555p-m4v6-cqxv (CometBFT) has no fixed/patched release version — “Patched versions: None.” Affected versions are CometBFT <= 0.38.5. Mitigation is to adjust the chain’s consensus parameters (EvidenceParams.MaxAgeNumBlocks / EvidenceParams.MaxAgeDuration) rather than upgrading to a specific CometBFT release. [1], [2]
Sources: [1] GitHub Advisory Database (GHSA-555p-m4v6-cqxv) [2] GitLab Advisory Database (GHSA-555p-m4v6-cqxv)
🌐 Web query:
CometBFT v0.37.18 security advisories ASA-2024-004
💡 Result:
ASA-2024-004 (GHSA-555p-m4v6-cqxv) for CometBFT is a low-criticality “insecure default” advisory: CometBFT’s default evidence parameters may be too small for many chains, so evidence can expire before the chain’s full unbonding period, which in turn can prevent slashing in certain cases (i.e., Byzantine behavior might go unpunished if evidence is discovered after the evidence window). [1][2]
Does it affect CometBFT v0.37.18? Yes—this advisory is marked as affecting all versions (and at least through 0.38.5 in the advisory databases), which includes v0.37.18. [1][2]
Mitigation / what to do
- Set consensus parameters to cover (exceed) your chain’s unbonding window:
EvidenceParams.MaxAgeDuration>Staking.UnbondingTimeEvidenceParams.MaxAgeNumBlocks> expected number of blocks produced during the unbonding period [1][2]
Notes
- This is not described as a code patch / CVE-style remote exploit; it’s primarily about chain configuration needing to be set appropriately. [1][2]
Sources: [1] OSV entry for GHSA-555p-m4v6-cqxv (ASA-2024-004) [2] GitLab Advisory Database entry for GHSA-555p-m4v6-cqxv
Upgrade CometBFT to v0.38.17 and configure evidence parameters.
Dependency Review is failing with three CometBFT advisories that v0.37.18 does not resolve. Two (GHSA-r3r4-g7hq-pq4f and GHSA-22qq-3xwm-r5x4) are fixed in v0.38.17+. The third (GHSA-555p-m4v6-cqxv / ASA-2024-004) has no code patch and instead requires adjusting consensus parameters: set EvidenceParams.MaxAgeDuration to exceed your chain's unbonding time and EvidenceParams.MaxAgeNumBlocks to exceed the expected block count during unbonding. Upgrade to v0.38.17 and apply these configuration changes so CI passes.
🤖 Prompt for AI Agents
In `@go.mod` at line 14, Update the CometBFT dependency from v0.37.18 to v0.38.17
in go.mod and adjust your chain consensus evidence settings: locate where
consensus parameters are initialized (e.g., ConsensusParams or EvidenceParams)
and set EvidenceParams.MaxAgeDuration to a value greater than your chain's
unbonding period and EvidenceParams.MaxAgeNumBlocks to a value greater than the
number of blocks expected during unbonding; ensure imports and any API changes
between cometbft v0.37.x and v0.38.x are addressed after the upgrade.
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (62.47%) is below the target coverage (65.50%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #2776 +/- ##
===========================================
- Coverage 75.38% 62.47% -12.92%
===========================================
Files 100 275 +175
Lines 8025 16069 +8044
===========================================
+ Hits 6050 10039 +3989
- Misses 1589 5252 +3663
- Partials 386 778 +392 🚀 New features to boost your workflow:
|
|
This PR has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
1 participant
Description
update cometbft to v0.37.18
Author Checklist
All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.
I have...
!to the type prefix if API or client breaking changeCHANGELOG.mdReviewers Checklist
All items are required. Please add a note if the item is not applicable and please add
your handle next to the items reviewed if you only reviewed selected items.
I have...
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.