fix(cometbft) Prevent panic on non-nil proposal without vote extensions

[chillyvee]

Description

We saw that gaiad has adoped cometbft v0.38 "HEAD" but we are aware of a panic bug affecting validator nodes.

We first experienced daemon panics on seda chain due to cometbft v0.38.6 calling panic when a non-nil proposal vote has vote extensions disabled.

The panic is a mistake and cometbft v0.38.11 includes our fix.

This panic is likely to affect gaiad regardless of vote extensions being enabled or not since the bug is:

extSignature = len([]byte{}) > 0 = false
precommit = true
isNil = false

if extSignature == (!precommit || isNil) => if faise == (!true || false) => if false == (false || false) => if false == false {
 panic()
}

Link to cometbft PR and discussion:
cometbft/cometbft#3565

This fix can reduce gaiad panics on upcoming mainnet v19

---

Author Checklist

All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.

I have...

• Included the correct type prefix in the PR title
• Added ! to the type prefix if API, client, or state breaking change (i.e., requires minor or major version bump)
• Targeted the correct branch (see PR Targeting)
• Provided a link to the relevant issue or specification
• Followed the guidelines for building SDK modules
• Included the necessary unit and integration tests
• Added a changelog entry in .changelog (for details, see contributing guidelines)
• Included comments for documenting Go code
• Updated the relevant documentation or specification
• Reviewed "Files changed" and left comments if necessary
• Confirmed all CI checks have passed

Reviewers Checklist

All items are required. Please add a note if the item is not applicable and please add
your handle next to the items reviewed if you only reviewed selected items.

I have...

• confirmed the correct type prefix in the PR title
• confirmed ! in the type prefix if API or client breaking change
• confirmed all author checklist items have been addressed
• reviewed state machine logic
• reviewed API design and naming
• reviewed documentation is accurate
• reviewed tests and test coverage

[mpoke]

@chillyvee Thanks for opening the PR. See my comments below. Also, is this change state-breaking? If so, please add the changelog entry also to the .changelog/unreleased/state-breaking folder.

[mpoke]

Rename the file to 3270-bump-cometbft and move it to .changelog/unreleased/dependencies/.

[chillyvee]

Also, is this change state-breaking?

From what we know, this is not state breaking. We mixed this fix into seda without updating other nodes and remain in consensus without panics. The bug fix only removes an accidental panic preventing normal program flow.

Updated changelog as you suggest

[mpoke]

@chillyvee could you please rebase on main? I added the v19.x backport label so it will be automatically backported to release/v19.x

The PR needs to be rebased on main

[chillyvee]

@chillyvee could you please rebase on main? I added the v19.x backport label so it will be automatically backported to release/v19.x

PR rebased on main.

[sainoe]

LGTM. Thanks @chillyvee!