bump math v1.3.0 -> v1.4.0 #1750
Conversation
WalkthroughThe changes in this pull request involve updates to the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (1)
go.mod (1)
362-362: Maintain security-related replace directivesThe existing replace directives contain important security fixes (e.g., GHSA-h395-qcrw-5vmq for gin-gonic/gin). These should be maintained until upstream vulnerabilities are resolved.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
⛔ Files ignored due to path filters (2)
go.sumis excluded by!**/*.sumgo.work.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod(2 hunks)
🔇 Additional comments (2)
go.mod (2)
362-362: LGTM! Format change maintains the same functionality
The retract directive has been reformatted from multi-line to single-line while preserving the same functionality and reason for retraction.
7-7: Verify the latest secure version of cosmossdk.io/math
Let's ensure v1.4.0 is the latest stable version and check for any security advisories.
✅ Verification successful
Upgrade to v1.4.0 is correct and addresses the security vulnerability
The upgrade to cosmossdk.io/math v1.4.0 is the correct version as it's the first patched version that fixes the HIGH severity security vulnerability (ASA-2024-010) affecting versions <= 1.3.0. The vulnerability is related to mismatched bit-length validation that could lead to panics.
Note: The proxy.golang.org response seems outdated, but the GitHub security advisory confirms v1.4.0 as the patched version.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check for the latest version and security advisories for cosmossdk.io/math
# Check for security advisories
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "cosmossdk.io/math") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
# Check the latest version from proxy.golang.org
curl -s https://proxy.golang.org/cosmossdk.io/math/@v/list | tail -n 1
Length of output: 702
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1750 +/- ##
=======================================
Coverage 61.57% 61.57%
=======================================
Files 196 196
Lines 17026 17026
=======================================
Hits 10483 10483
Misses 5696 5696
Partials 847 847
Flags with carried forward coverage won't be shown. Click here to find out more.
|
1. Summary
Bump math to v1.4.0 in response to security advisory
Summary by CodeRabbit
cosmossdk.io/mathto enhance stability and performance.