chore(test/interchain): upgrade cosmos-sdk and celestia-core versions #4107
Conversation
tskoyo
requested review from
rootulp and
rach-id
and removed request for
a team
|
Warning There were issues while running some tools. Please review the errors and either fix the tool’s configuration or disable the tool if it’s a critical failure. 🔧 golangci-lint (1.62.2)level=error msg="Running error: context loading failed: no go files to analyze: running 📝 Walkthrough📝 WalkthroughWalkthroughThe Changes
Possibly related PRs
Suggested labels
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
📝 WalkthroughWalkthroughThe Changes
Possibly related PRs
Suggested labels
Suggested reviewers
📜 Recent review detailsConfiguration used: .coderabbit.yaml ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🔇 Additional comments (4)test/interchain/go.mod (4)Line range hint The module configuration and direct dependencies are well-structured and aligned with the testing requirements.
The updates to cosmos-sdk and tendermint versions match the PR objectives: - github.com/cosmos/cosmos-sdk => github.com/celestiaorg/cosmos-sdk v1.24.0-sdk-v0.46.16
+ github.com/cosmos/cosmos-sdk => github.com/celestiaorg/cosmos-sdk v1.25.0-sdk-v0.46.16
- github.com/tendermint/tendermint => github.com/celestiaorg/celestia-core v0.34.29
+ github.com/tendermint/tendermint => github.com/celestiaorg/celestia-core v1.44.0-tm-v0.34.35Line range hint The replacement of - github.com/strangelove-ventures/interchaintest/v6 => github.com/rootulp/interchaintest/v6 v6.1.0This is noted as temporary until PR #1051 is merged. Line range hint Several dependencies have significant version updates. While these updates are generally good for security and features, please ensure compatibility, particularly for:
✅ Verification successfulDependency updates appear safe to proceed The version updates are minor and patch releases that maintain backward compatibility:
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Check for breaking changes in major version updates
# Check if the updated versions have any known compatibility issues
echo "Checking prometheus/client_golang compatibility..."
gh api repos/prometheus/client_golang/releases/tags/v1.20.3 | jq -r '.body' | grep -i "breaking"
echo "Checking opentelemetry-go compatibility..."
gh api repos/open-telemetry/opentelemetry-go/releases/tags/v1.30.0 | jq -r '.body' | grep -i "breaking"
Length of output: 402 Script: #!/bin/bash
# Let's try a different approach to check for potential breaking changes
# by examining the go.mod changes and dependency usage
# Find all Go files that might use these dependencies
echo "Files using prometheus/client_golang:"
rg --type go "github.com/prometheus/client_golang" -l
echo -e "\nFiles using opentelemetry:"
rg --type go "go.opentelemetry.io/otel" -l
echo -e "\nChecking go.mod history for these dependencies:"
git diff HEAD~1 test/interchain/go.mod | grep -E "github.com/prometheus/|opentelemetry"
# Check if there are any replace directives for these packages
echo -e "\nChecking replace directives:"
grep -A 5 "^replace" test/interchain/go.mod
Length of output: 2463 Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
| cloud.google.com/go/iam v1.1.6 // indirect | ||
| cloud.google.com/go/storage v1.37.0 // indirect | ||
| cosmossdk.io/errors v1.0.1 // indirect | ||
| filippo.io/edwards25519 v1.0.0-rc.1 // indirect | ||
| github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect | ||
| github.com/99designs/keyring v1.2.2 // indirect | ||
| github.com/BurntSushi/toml v1.3.2 // indirect | ||
| github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c // indirect |
There was a problem hiding this comment.
this version number looks suspect so I looked into why
$ go mod why github.com/BurntSushi/toml
go: downloading github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5
go: downloading github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b
# github.com/BurntSushi/toml
github.com/celestiaorg/celestia-app/test/interchain/chainspec
github.com/strangelove-ventures/interchaintest/v6/testutil
github.com/BurntSushi/toml
and then I tried the bumping the versions used in the replace directive and ran go mod tidy and got the same result so seems fine
rootulp
changed the title
…est-interchain-version-conflicts
Head branch was pushed to by a user without write access
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
test/interchain/go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
test/interchain/go.mod(10 hunks)
🔇 Additional comments (1)
test/interchain/go.mod (1)
227-227: Version updates align with PR objectives
The replace directives have been updated to use:
github.com/celestiaorg/cosmos-sdk v1.25.0-sdk-v0.46.16github.com/celestiaorg/celestia-core v1.44.0-tm-v0.34.35
These updates align with the PR's objective to resolve build conflicts from differing replacement directives.
Let's verify these are the latest compatible versions:
Also applies to: 232-232
✅ Verification successful
Versions are up-to-date with the latest compatible releases
The replace directives in the PR are using the most recent compatible versions:
v1.25.0-sdk-v0.46.16is the latest release of celestiaorg/cosmos-sdk for the v0.46.x seriesv1.44.0-tm-v0.34.35is the latest release of celestiaorg/celestia-core for the v0.34.x series
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Verify the latest compatible versions
# Check latest cosmos-sdk releases from celestiaorg fork
gh api repos/celestiaorg/cosmos-sdk/releases --jq '.[].tag_name | select(contains("sdk-v0.46"))' | head -n 5
# Check latest celestia-core releases
gh api repos/celestiaorg/celestia-core/releases --jq '.[].tag_name | select(contains("tm-v0.34"))' | head -n 5
Length of output: 432
| github.com/prometheus/client_golang v1.20.3 // indirect | ||
| github.com/prometheus/client_model v0.6.1 // indirect | ||
| github.com/prometheus/common v0.55.0 // indirect | ||
| github.com/prometheus/procfs v0.15.1 // indirect |
There was a problem hiding this comment.
💡 Codebase verification
Update monitoring dependencies to latest stable versions
The current versions in the go.mod file are behind the latest stable releases:
- prometheus/client_golang: v1.20.3 (latest: v1.20.5)
- opentelemetry-go: v1.30.0 (latest: v1.33.0)
Consider updating these dependencies to their latest stable versions for improved monitoring capabilities and security fixes.
🔗 Analysis chain
Monitoring tools have been significantly updated
The Prometheus and OpenTelemetry dependencies have been updated to their latest versions. These updates typically include performance improvements and bug fixes for monitoring capabilities.
Let's verify if these versions are the latest stable releases:
Also applies to: 177-179
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Verify the latest stable versions of monitoring tools
# Check latest Prometheus client releases
gh api repos/prometheus/client_golang/releases/latest --jq .tag_name
# Check latest OpenTelemetry releases
gh api repos/open-telemetry/opentelemetry-go/releases/latest --jq .tag_name
Length of output: 164
| @@ -32,11 +31,11 @@ | |||
| github.com/beorn7/perks v1.0.1 // indirect | |||
| github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect | |||
| github.com/bgentry/speakeasy v0.1.0 // indirect | |||
| github.com/btcsuite/btcd/btcec/v2 v2.3.2 // indirect | |||
| github.com/celestiaorg/nmt v0.22.0 // indirect | |||
| github.com/btcsuite/btcd/btcec/v2 v2.3.4 // indirect | |||
There was a problem hiding this comment.
💡 Codebase verification
Security vulnerabilities found in dependencies - Action Required
Critical security issues detected in current dependency versions:
-
Docker v24.0.1 is vulnerable to "Authz zero length regression" (Critical severity, published July 2024)
- Affects versions >= 24.0.0, < 25.0.6
- Update to at least version 25.0.6 recommended
-
btcd/btcec v2.3.4 appears to be safe from the latest known vulnerabilities, as the reported issues affect earlier versions
Actions needed:
- Update docker dependency to a version >= 25.0.6 to address the critical vulnerability
- Review the docker version override in the replace directive
🔗 Analysis chain
Verify security implications of dependency updates
Several security-sensitive packages have been updated:
- Crypto packages (btcd/btcec)
- Docker-related packages
- Core dependencies (cosmos-sdk, tendermint)
Please ensure these versions have been properly vetted for security vulnerabilities.
Let's check for known vulnerabilities:
Also applies to: 229-229, 230-230
Let me check the specific version being used in the go.mod file to compare against these vulnerabilities.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check for known vulnerabilities in updated dependencies
# Check for security advisories for btcd
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "github.com/btcsuite/btcd") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
}
}
}'
# Check for security advisories for docker
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "github.com/docker/docker") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
}
}
}'
Length of output: 1929
Script:
#!/bin/bash
# Get the exact version of btcd/btcec being used
cat test/interchain/go.mod | grep "btcd/btcec"
# Check if there are any other docker-related dependencies
cat test/interchain/go.mod | grep "docker"
Length of output: 441
There was a problem hiding this comment.
Is this something to be concerned about?
There was a problem hiding this comment.
hmm I think we can upgrade the docker version in a separate PR so it shouldn't block this PR.
done! |
|
Congrats, your important contribution to this open-source project has earned you a GitPOAP! GitPOAP: 2024 Celestia Contributor: Head to gitpoap.io & connect your GitHub account to mint! Learn more about GitPOAPs here. |
Updated the dependency versions in the
test/interchainmodule. This resolves build conflicts caused by differing replacement directives for:github.com/cosmos/cosmos-sdkgithub.com/tendermint/tendermintChanges:
github.com/cosmos/cosmos-sdktogithub.com/celestiaorg/cosmos-sdk v1.25.0-sdk-v0.46.16.github.com/tendermint/tenderminttogithub.com/tendermint/tendermint => github.com/celestiaorg/celestia-core v1.44.0-tm-v0.34.35.Tested with
make buildandmake testto ensure compatibility.