chore: pull cometbft v0.34.35

.changelog/v0.34.30/build/1351-bump-go-120.md

@@ -0,0 +1,2 @@
+- Bump Go version used to v1.20 since v1.19 has reached EOL
+  ([\#1351](https://github.com/cometbft/cometbft/pull/1351))

.changelog/v0.34.30/features/1512-metric-mempool-size-bytes.md

@@ -0,0 +1,2 @@
+- `[metrics]` Add metric for mempool size in bytes `SizeBytes`.
+  ([\#1512](https://github.com/cometbft/cometbft/pull/1512))

.changelog/v0.34.30/improvements/1210-close-evidence-db.md

@@ -0,0 +1 @@
+- `[node]` Close evidence.db OnStop ([cometbft/cometbft\#1210](https://github.com/cometbft/cometbft/pull/1210): @chillyvee)

.changelog/v0.34.30/improvements/1558-experimental-gossip-limiting.md

@@ -0,0 +1,9 @@
+- `[mempool]` Add experimental feature to limit the number of persistent peers and non-persistent
+  peers to which the node gossip transactions (only for "v0" mempool).
+  ([\#1558](https://github.com/cometbft/cometbft/pull/1558),
+  ([\#1584](https://github.com/cometbft/cometbft/pull/1584))
+- `[config]` Add mempool parameters `experimental_max_gossip_connections_to_persistent_peers` and
+  `experimental_max_gossip_connections_to_non_persistent_peers` for limiting the number of peers to
+  which the node gossip transactions. 
+  ([\#1558](https://github.com/cometbft/cometbft/pull/1558))
+  ([\#1584](https://github.com/cometbft/cometbft/pull/1584))

.changelog/v0.34.30/improvements/857-make-handshake-cancelable.md

@@ -0,0 +1 @@
+- `[node]` Make handshake cancelable ([cometbft/cometbft\#857](https://github.com/cometbft/cometbft/pull/857))

.changelog/v0.34.30/summary.md

@@ -0,0 +1,5 @@
+*November 17, 2023*
+
+This release contains, among other things, an opt-in, experimental feature to
+help reduce the bandwidth consumption associated with the mempool's transaction
+gossip.

.changelog/v0.34.31/bug-fixes/1654-semaphore-wait.md

@@ -0,0 +1,3 @@
+- `[mempool]` Avoid infinite wait in transaction sending routine when
+  using experimental parameters to limiting transaction gossiping to peers
+  ([\#1654](https://github.com/cometbft/cometbft/pull/1654))

.changelog/v0.34.31/summary.md

@@ -0,0 +1,3 @@
+*November 27, 2023*
+
+Fixes a small bug in the mempool for an experimental feature.

.changelog/v0.34.32/bug-fixes/1749-light-client-attack-verify-all-sigs.md

@@ -0,0 +1,4 @@
+- `[evidence]` When `VerifyCommitLight` & `VerifyCommitLightTrusting` are called as part
+  of evidence verification, all signatures present in the evidence must be verified
+  ([\#1749](https://github.com/cometbft/cometbft/pull/1749))
+

.changelog/v0.34.32/improvements/1715-validate-validator-address.md

@@ -0,0 +1 @@
+- `[types]` Validate `Validator#Address` in `ValidateBasic` ([\#1715](https://github.com/cometbft/cometbft/pull/1715))

.changelog/v0.34.32/improvements/1730-increase-abci-socket-message-size-limit.md

@@ -0,0 +1 @@
+- `[abci]` Increase ABCI socket message size limit to 2GB ([\#1730](https://github.com/cometbft/cometbft/pull/1730): @troykessler)

.changelog/v0.34.32/improvements/2094-e2e-load-max-txs.md

@@ -0,0 +1,2 @@
+- `[e2e]` Add manifest option `load_max_txs` to limit the number of transactions generated by the
+  `load` command. ([\#2094](https://github.com/cometbft/cometbft/pull/2094))

.changelog/v0.34.32/improvements/2328-e2e-log-sent-txs.md

@@ -0,0 +1,2 @@
+- `[e2e]` Log the number of transactions that were sent successfully or failed.
+  ([\#2328](https://github.com/cometbft/cometbft/pull/2328))

.changelog/v0.34.32/summary.md

@@ -0,0 +1,3 @@
+*March 12, 2024*
+
+This release fixes a security bug in the light client.

.changelog/v0.34.33/bug-fixes/2774-bitarray-unmarshal-json.md

@@ -0,0 +1,2 @@
+- [`bits`] prevent `BitArray.UnmarshalJSON` from crashing on 0 bits
+  ([\#2774](https://github.com/cometbft/cometbft/pull/2774))

.changelog/v0.34.33/dependencies/2783-update-cometbft-db.md

@@ -0,0 +1,2 @@
+- Bump cometbft-db version to v0.9.1, which brings support for RocksDB v8.
+  ([\#2783](https://github.com/cometbft/cometbft/pull/2783))

.changelog/v0.34.33/dependencies/2784-update-go.md

@@ -0,0 +1,2 @@
+- Bump Go version used to v1.21 since v1.20 has reached EOL
+  ([\#2784](https://github.com/cometbft/cometbft/pull/2784))

.changelog/v0.34.33/summary.md

@@ -0,0 +1,3 @@
+*April 26, 2024*
+
+This release bumps Go version to 1.21.

.changelog/v0.34.34/bug-fixes/0016-abc-light-proposer-priorities.md

@@ -0,0 +1,2 @@
+- `[light]` Cross-check proposer priorities in retrieved validator sets
+  ([\#ASA-2024-009](https://github.com/cometbft/cometbft/security/advisories/GHSA-g5xx-c4hv-9ccc))

.changelog/v0.34.34/features/3760-remove-tools-package.md

@@ -0,0 +1,2 @@
+- `[tools]` Remove tools package
+  [\#3760](https://github.com/cometbft/cometbft/pull/3760)

.changelog/v0.34.34/improvements/0016-abc-types-validator-set.md

@@ -0,0 +1,2 @@
+- `[types]` Check that proposer is one of the validators in `ValidateBasic`
+  ([\#ASA-2024-009](https://github.com/cometbft/cometbft/security/advisories/GHSA-g5xx-c4hv-9ccc))

.changelog/v0.34.34/summary.md

@@ -0,0 +1,4 @@
+*September 3, 2024*
+
+This release includes a security fix for the light client and is recommended
+for all users.

.changelog/v0.34.35/dependencies/4045-update-image-pkg.md

@@ -0,0 +1,3 @@
+- updated pkg gonum.org/v1/gonum to latest version unaffected by CVE-
+  2024-24792, CVE-2023-29407, CVE-2023-29408, and CVE-2022-41727
+  ([\#4045](https://github.com/cometbft/cometbft/pull/4045))

.changelog/v0.34.35/dependencies/4053-update-python-requests-dep.md

@@ -0,0 +1,2 @@
+- updated python module "requests" to latest version unaffected by CVE-2023-32681
+  and CVE-2024-35195 ([\#4053](https://github.com/cometbft/cometbft/pull/4053))

.changelog/v0.34.35/dependencies/4059-update-cometbft-db.md

@@ -0,0 +1,2 @@
+- updated cometbft-db to v0.9.5
+  ([\#4059](https://github.com/cometbft/cometbft/pull/4059))

.changelog/v0.34.35/summary.md

@@ -0,0 +1,3 @@
+*September 16, 2024*
+
+This release bumps Go version to 1.22 and updates dependencies.

.github/workflows/check-generated.yml

@@ -41,7 +41,7 @@ jobs:
   check-proto:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: "1.23.1"
 

.github/workflows/coverage.yml

@@ -6,35 +6,6 @@ on:
       - v0.34.x-celestia
 
 jobs:
-  split-test-files:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
-        with:
-          go-version: "1.23.1"
-      - name: Create a file with all the pkgs
-        run: go list ./... > pkgs.txt
-      - name: Split pkgs into 4 files
-        run: split -d -n l/4 pkgs.txt pkgs.txt.part.
-      # cache multiple
-      - uses: actions/upload-artifact@v4
-        with:
-          name: "${{ github.sha }}-00"
-          path: ./pkgs.txt.part.00
-      - uses: actions/upload-artifact@v4
-        with:
-          name: "${{ github.sha }}-01"
-          path: ./pkgs.txt.part.01
-      - uses: actions/upload-artifact@v4
-        with:
-          name: "${{ github.sha }}-02"
-          path: ./pkgs.txt.part.02
-      - uses: actions/upload-artifact@v4
-        with:
-          name: "${{ github.sha }}-03"
-          path: ./pkgs.txt.part.03
-
   build-linux:
     name: Build
     runs-on: ubuntu-latest
@@ -46,7 +17,7 @@ jobs:
     env:
       GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
     steps:
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: "1.23.1"
       - uses: actions/checkout@v3
@@ -58,17 +29,14 @@ jobs:
             go.sum
       - name: install
         run: GOOS=linux GOARCH=${{ matrix.goarch }} make build
-        if: "env.GIT_DIFF != ''"
+        if: env.GIT_DIFF
 
   tests:
     runs-on: ubuntu-latest
-    needs: split-test-files
     strategy:
-      fail-fast: false
-      matrix:
-        part: ["00", "01", "02", "03"]
+      fail-fast: true
     steps:
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: "1.23.1"
       - uses: actions/checkout@v3
@@ -78,18 +46,13 @@ jobs:
             **/**.go
             go.mod
             go.sum
-      - uses: actions/[email protected]
-        with:
-          name: "${{ github.sha }}-${{ matrix.part }}"
-        if: env.GIT_DIFF
       - name: test & coverage report creation
-        run: |
-          cat pkgs.txt.part.${{ matrix.part }} | xargs go test -mod=readonly -timeout 8m -race -coverprofile=${{ matrix.part }}profile.out -covermode=atomic
+        run: go test ./... -mod=readonly -timeout 15m -race -coverprofile=profile.out -covermode=atomic
         if: env.GIT_DIFF
       - uses: actions/upload-artifact@v4
         with:
-          name: "${{ github.sha }}-${{ matrix.part }}-coverage"
-          path: ./${{ matrix.part }}profile.out
+          name: "${{ github.sha }}-coverage"
+          path: ./profile.out
 
   upload-coverage-report:
     runs-on: ubuntu-latest
@@ -104,24 +67,12 @@ jobs:
             go.sum
       - uses: actions/[email protected]
         with:
-          name: "${{ github.sha }}-00-coverage"
-        if: env.GIT_DIFF
-      - uses: actions/[email protected]
-        with:
-          name: "${{ github.sha }}-01-coverage"
-        if: env.GIT_DIFF
-      - uses: actions/[email protected]
-        with:
-          name: "${{ github.sha }}-02-coverage"
-        if: env.GIT_DIFF
-      - uses: actions/[email protected]
-        with:
-          name: "${{ github.sha }}-03-coverage"
+          name: "${{ github.sha }}-coverage"
         if: env.GIT_DIFF
       - run: |
-          cat ./*profile.out | grep -v "mode: atomic" >> coverage.txt
+          cat ./profile.out | grep -v "mode: atomic" >> coverage.txt
         if: env.GIT_DIFF
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v4
         with:
           file: ./coverage.txt
         if: env.GIT_DIFF

.github/workflows/e2e-manual.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.23.1'
 

.github/workflows/e2e-nightly-34x.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.23.1'
 

.github/workflows/e2e.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.23.1'
       - uses: actions/checkout@v3
@@ -27,12 +27,12 @@ jobs:
         working-directory: test/e2e
         # Run two make jobs in parallel, since we can't run steps in parallel.
         run: make -j2 docker runner
-        if: "env.GIT_DIFF != ''"
+        if: env.GIT_DIFF
 
       - name: Run CI testnet
         working-directory: test/e2e
         run: ./build/runner -f networks/ci.toml
-        if: "env.GIT_DIFF != ''"
+        if: env.GIT_DIFF
 
       - name: Emit logs on failure
         if: ${{ failure() }}

.github/workflows/fuzz-nightly.yml

@@ -9,7 +9,7 @@ jobs:
   fuzz-nightly-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.23.1'
 

.github/workflows/govulncheck.yml

@@ -27,4 +27,4 @@ jobs:
             Makefile
       - name: govulncheck
         run: make vulncheck
-        if: "env.GIT_DIFF != ''"
+        if: env.GIT_DIFF

.github/workflows/janitor.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: styfle/cancel-workflow-action@0.11.0
+      - uses: styfle/cancel-workflow-action@0.12.1
         with:
           workflow_id: 1041851,1401230,2837803
           access_token: ${{ github.token }}

.github/workflows/pre-release.yml

@@ -16,7 +16,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.23.1'
 

.github/workflows/release-version.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.23.1'
 

.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.23.1'
 

.github/workflows/stale.yml

@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@v9
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-pr-message: "This pull request has been automatically marked as stale because it has not had