release v0.41.2 (#8615)

CHANGELOG.md

@@ -34,6 +34,12 @@ Ref: https://keepachangelog.com/en/1.0.0/
 
 # Changelog
 
+## [v0.41.2](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.41.2) - 2021-02-18
+
+### Improvements
+
+* Bump tendermint dependency to v0.34.7.
+
 ## [v0.41.1](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.41.1) - 2021-02-17
 
 ### Bug Fixes

RELEASE_NOTES.md

@@ -1,39 +1,10 @@
-# Cosmos SDK v0.41.1 "Stargate" Release Notes
+# Cosmos SDK v0.41.2 "Stargate" Release Notes
 
-This release includes two security patches, and does not introduce any breaking changes. It is **highly recommended** that all applications using v0.41.0 upgrade to v0.41.1 as soon as possible.
+This release upgrades Tendermint to v0.34.7, and does not introduce any breaking changes. It is **highly recommended** that all applications using v0.41.1 upgrade to v0.41.2 as soon as possible.
 
-See the [Cosmos SDK v0.41.1 milestone](https://github.com/cosmos/cosmos-sdk/milestone/38?closed=1) on our issue tracker for details.
+### Tendermint v0.34.7
 
-### Security Patch #1: All gRPC requests are now routed through ABCI
+Operators running nodes that manage their keys through the Tendermint's `FilePV` implementation were
+susceptible to leaking private keys material in the logs. The issue is now fixed in Tendermint v0.34.5 and later versions.
 
-When Tendermint commits a new block, the `versions` map in IAVL MutableTree is updated. If, at the same time, a concurrent gRPC request is performed, it will read the same `versions` map, causing the node to crash.
-
-The patch consists of routing all gRPC requests through ABCI. The Go implementation of ABCI uses global lock on all requests, making them linearizable (received one at a time) which in turn prevents concurrent map reads and writes.
-
-We are exploring on ways of introducing concurrent gRPC queries in [#8591](https://github.com/cosmos/cosmos-sdk/issues/8591).
-
-This bug has been reported via HackerOne.
-
-### Security Patch #2: Remove `GetValidator` cache map
-
-The `x/staking` keeper holds an internal `validatorCache` cache map of validators. When multipile gRPC queries are performed simulataneously, concurrent reads and writes of this map can happen, causing the node to crash.
-
-The patch removes the `validatorCache` altogether. Benchmarks show that the removal of the cache map even increases performance.
-
-Is is important to note that the Security Patch #1 should also fix this bug, as it forces synchronous gRPC queries and therefore synchronous map reads/writes. However, it was deemed useful to include this bugfix too in this release.
-
-### Bug Fixes & Improvements
-
-Several bug fixes and non-breaking improvements are included in this release.
-
-Tendermint has been bumped to v0.34.4 to address a memory leak.
-
-Environment variables are now correctly populated to CLI flags. When using the Tendermint subcommands `tendermint show-*` from the CLI, the SDK doesn't create new files anymore.
-
-Keyring imports from older versions are fixed.
-
-Additional validation for client denom metadata has been added.
-
-On the IBC side, a `packet_connection` attribute has been added to IBC events to enable relayer filtering.
-
-For the full change log, please see the [CHANGELOG](https://github.com/cosmos/cosmos-sdk/blob/v0.41.0/CHANGELOG.md).
+For more information regarding the patch, please refer to [Tendermint's changelog](https://github.com/tendermint/tendermint/blob/v0.34.7/CHANGELOG.md#v0345).

go.mod

@@ -46,7 +46,7 @@ require (
 	github.com/tendermint/btcd v0.1.1
 	github.com/tendermint/crypto v0.0.0-20191022145703-50d29ede1e15
 	github.com/tendermint/go-amino v0.16.0
-	github.com/tendermint/tendermint v0.34.4
+	github.com/tendermint/tendermint v0.34.7
 	github.com/tendermint/tm-db v0.6.4
 	golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad
 	google.golang.org/genproto v0.0.0-20210114201628-6edceaf6022f

go.sum

@@ -557,8 +557,8 @@ github.com/tendermint/go-amino v0.16.0/go.mod h1:TQU0M1i/ImAo+tYpZi73AU3V/dKeCoM
 github.com/tendermint/tendermint v0.34.0-rc4/go.mod h1:yotsojf2C1QBOw4dZrTcxbyxmPUrT4hNuOQWX9XUwB4=
 github.com/tendermint/tendermint v0.34.0-rc6/go.mod h1:ugzyZO5foutZImv0Iyx/gOFCX6mjJTgbLHTwi17VDVg=
 github.com/tendermint/tendermint v0.34.0/go.mod h1:Aj3PIipBFSNO21r+Lq3TtzQ+uKESxkbA3yo/INM4QwQ=
-github.com/tendermint/tendermint v0.34.4 h1:E7qkvFGx27d8ugVLiAY2iWP6DL5cep3l/mpTaWKHyBA=
-github.com/tendermint/tendermint v0.34.4/go.mod h1:JVuu3V1ZexOaZG8VJMRl8lnfrGw6hEB2TVnoUwKRbss=
+github.com/tendermint/tendermint v0.34.7 h1:lvBJFNqpDuEzKfLZKtUXOL5dMOpqHonHlO6LCujyl6E=
+github.com/tendermint/tendermint v0.34.7/go.mod h1:JVuu3V1ZexOaZG8VJMRl8lnfrGw6hEB2TVnoUwKRbss=
 github.com/tendermint/tm-db v0.6.2/go.mod h1:GYtQ67SUvATOcoY8/+x6ylk8Qo02BQyLrAs+yAcLvGI=
 github.com/tendermint/tm-db v0.6.3 h1:ZkhQcKnB8/2jr5EaZwGndN4owkPsGezW2fSisS9zGbg=
 github.com/tendermint/tm-db v0.6.3/go.mod h1:lfA1dL9/Y/Y8wwyPp2NMLyn5P5Ptr/gvDFNWtrCWSf8=