Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: pull cometbft v0.34.35 #1495

Draft
wants to merge 174 commits into
base: v0.34.x-celestia
Choose a base branch
from
Draft

chore: pull cometbft v0.34.35 #1495

wants to merge 174 commits into from

Conversation

rootulp
Copy link
Collaborator

@rootulp rootulp commented Sep 20, 2024 •
edited
Loading

Closes #1468 by pulling upstream v0.34.35 with these notable merge conflicts:

  • Our repo upgraded Go past what upstream has so I choose to retain the more recent Go version

Things we can do to make pulls easier to review in the future:

  • Delete docs/
  • Delete changelog/
  • Delete CHANGELOG.md, UPGRADING.md, SECURITY.md, code of conduct,
  • Update all Go versions in workflow files to use 'go.mod' instead of a version number

Testing

I used go mod replace and verified that celestia-app can use this version of celestia-core.

  • single-node.sh
  • mocha.sh

mergify bot and others added 30 commits May 1, 2023 21:08
@mergify @sergio-mena
Fix TestStateOversizedBlock (backport celestiaorg#755) (celestiaorg…
9c1e23c 
…#766)

* Fix `TestStateOversizedBlock` (celestiaorg#755)

* Fix TestStateOversizedBlock

* Moved `findBlockSizeLimit` together with other aux functions

(cherry picked from commit c58597d656d5c816334aff9ea8e600bdbc534817)

# Conflicts:
#	consensus/state_test.go

* Revert "Fix `TestStateOversizedBlock` (celestiaorg#755)"

This reverts commit e7d2a127a26d4d833bae3aef0917bb6bca2cda5b.

* Fix `TestStateOversizedBlock` (celestiaorg#755)

* Fix TestStateOversizedBlock

* Moved `findBlockSizeLimit` together with other aux functions

---------

Co-authored-by: Sergio Mena <sergio@informal.systems>
@mergify @sergio-mena
Struct Client exposes sensitive data (celestiaorg#784) (celestiaorg…
49cf700 
…#788)

(cherry picked from commit ecd5ee112533cda28900cbd75afb349f67da3fa5)

Co-authored-by: Sergio Mena <sergio@informal.systems>
@mergify @sergio-mena
Unsafe int cast in kill command (backport celestiaorg#783) (celesti…
c5455d2 
…aorg#794)

* Unsafe int cast in `kill` command (celestiaorg#783)

* Unsafe int cast in `kill` command

* Revert "Unsafe int cast in `kill` command"

This reverts commit bbd649bd372ca90f83dea7b424d67dafbd9eb541.

* Changed strategy

(cherry picked from commit 03c5e7727a03983b54623e731d5d3d8dd4ac75ec)

# Conflicts:
#	cmd/cometbft/commands/debug/kill.go

* Revert "Unsafe int cast in `kill` command (celestiaorg#783)"

This reverts commit b7ab279a6df1f062bec60bcf95947d2a87f4ccec.

* Unsafe int cast in `kill` command (celestiaorg#783)

* Unsafe int cast in `kill` command

* Revert "Unsafe int cast in `kill` command"

This reverts commit bbd649bd372ca90f83dea7b424d67dafbd9eb541.

* Changed strategy

---------

Co-authored-by: Sergio Mena <sergio@informal.systems>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.17.0 to 1.18.0 (ce…
82c6c08 
…lestiaorg#805)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.17.0 to 1.18.0.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.17.0...v1.18.0)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@jmalicevic @lasarojc
@sergio-mena @thanethomson
Backport of PR celestiaorg#771 to 0.34 : big int parsing (celestiaorg…
30af8c2 
…#798)

Replaced int64 with big.int

Co-authored-by: Lasaro <lasaro@informal.systems>
Co-authored-by: Sergio Mena <sergio@informal.systems>
Co-authored-by: Thane Thomson <connect@thanethomson.com>
@mergify
rpc: Remove response data from response failure logs (backport celest…
557ddea 
…iaorg#829) (celestiaorg#838)
@dependabot
build(deps): Bump slackapi/slack-github-action from 1.23.0 to 1.24.0 (c…
7c58f28 
…elestiaorg#870)

Bumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) from 1.23.0 to 1.24.0.
- [Release notes](https://github.com/slackapi/slack-github-action/releases)
- [Commits](slackapi/slack-github-action@v1.23.0...v1.24.0)

---
updated-dependencies:
- dependency-name: slackapi/slack-github-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.18.0 to 1.19.0 (ce…
8220d97 
…lestiaorg#871)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.18.0 to 1.19.0.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.18.0...v1.19.0)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.19.0 to 1.20.0 (ce…
1a37e72 
…lestiaorg#909)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.19.0 to 1.20.0.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.19.0...v1.20.0)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify
v0.34.x: Prevent a transaction to appear twice in the mempool (backport
ea902b6 
celestiaorg#890) (celestiaorg#927)

* add a test to trigger the issue
* add a fix (in particular, we track the sender when receiving a tx twice)
* add a changelog
* update fix and test wrt. v0.34.x

---------
Co-authored-by: Daniel <daniel.cason@informal.systems>
Co-authored-by: Pierre Sutra <0track@gmail.com>
@mergify @mmsqe @sergio-mena
fix: avoid recursive call after rename to (*PeerState).MarshalJSON (b…
2a526ca 
…ackport celestiaorg#865) (celestiaorg#970)

* fix: avoid recursive call after rename to (*PeerState).MarshalJSON (celestiaorg#865)

* avoid recursive call after rename to (*PeerState).MarshalJSON

* add test

* add change doc

* explain for nolint

* fix lint

* fix golangci-lint to v1.52.2

* fix golangci-lint to v1.52.2

* Revert "fix golangci-lint to v1.52.2"

This reverts commit 598a9ef4c86fc29cf038251676c33a222217826c.

* Revert "fix golangci-lint to v1.52.2"

This reverts commit a8aad121e27382813e95b1911b1b560c62e1c7c3.

* Reintroduced `cmtjson`

* Avoid copying Mutex

* Avoid copying Mutex -- 2nd try, more succint

* Update .changelog/unreleased/bug-fixes/865-fix-peerstate-marshaljson.md

* Update consensus/reactor_test.go

---------

Co-authored-by: Sergio Mena <sergio@informal.systems>
(cherry picked from commit f6ea09171a2bf9f695f59b65f5c51e4a8c168015)

# Conflicts:
#	consensus/reactor_test.go

* Revert "fix: avoid recursive call after rename to (*PeerState).MarshalJSON (celestiaorg#865)"

* fix: avoid recursive call after rename to (*PeerState).MarshalJSON (celestiaorg#865)

* avoid recursive call after rename to (*PeerState).MarshalJSON

* add test

* add change doc

* explain for nolint

* fix lint

* fix golangci-lint to v1.52.2

* fix golangci-lint to v1.52.2

* Revert "fix golangci-lint to v1.52.2"

This reverts commit 598a9ef4c86fc29cf038251676c33a222217826c.

* Revert "fix golangci-lint to v1.52.2"

This reverts commit a8aad121e27382813e95b1911b1b560c62e1c7c3.

* Reintroduced `cmtjson`

* Avoid copying Mutex

* Avoid copying Mutex -- 2nd try, more succint

* Update .changelog/unreleased/bug-fixes/865-fix-peerstate-marshaljson.md

* Update consensus/reactor_test.go

---------

Co-authored-by: Sergio Mena <sergio@informal.systems>

---------

Co-authored-by: mmsqe <mavis@crypto.com>
Co-authored-by: Sergio Mena <sergio@informal.systems>
@thanethomson
Release v0.34.29 (celestiaorg#973)
fe4894f 
* changelog: Clean up and reorder

Signed-off-by: Thane Thomson <connect@thanethomson.com>

* changelog: Add missing entries

Signed-off-by: Thane Thomson <connect@thanethomson.com>

* changelog: Release v0.34.29

Signed-off-by: Thane Thomson <connect@thanethomson.com>

* Rebuild changelog

Signed-off-by: Thane Thomson <connect@thanethomson.com>

* version: Bump to v0.34.29

Signed-off-by: Thane Thomson <connect@thanethomson.com>

* test/e2e: Use Debian Bullseye as base image

Golang recently started offering Debian Bookworm as the default distro
for `golang:1.19`, which provides a newer version of RocksDB than what
we support in cometbft-db.

For now this pins the image to Bullseye, which is the base image we have
been using for some time now.

Signed-off-by: Thane Thomson <connect@thanethomson.com>

---------

Signed-off-by: Thane Thomson <connect@thanethomson.com>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.20.0 to 1.21.0 (ce…
91627c0 
…lestiaorg#940)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.20.0 to 1.21.0.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.20.0...v1.21.0)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): Bump docker/build-push-action from 4.0.0 to 4.1.1 (celes…
c6615d3 
…tiaorg#977)
@dependabot
build(deps): Bump docker/setup-buildx-action from 2.5.0 to 2.7.0 (cel…
90107ec 
…estiaorg#976)
@dependabot
build(deps): Bump docker/login-action from 2.1.0 to 2.2.0 (celestiaor…
fecacbc 
…g#942)

Bumps [docker/login-action](https://github.com/docker/login-action) from 2.1.0 to 2.2.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@v2.1.0...v2.2.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @sergio-mena
Add CMT_HOME (or remove it?) (backport celestiaorg#983) (celestiaor…
ffc580f 
…g#1000)

* Add `CMT_HOME` (or remove it?) (celestiaorg#983)

Closes celestiaorg#982

Added `CMT_HOME` everywhere `CMTHOME` is used.

### Notes to reviewers

This could be fixed the opposite way, by removing the only reference to `CMT_HOME` in the code, and also the reference in `UPGRADING.md` (two lines of code).

However, the reference in `UPGRADING.md`, which is part of our documentation, is already present in `v0.34.x` (not in `v0.37.x` though!). That's why this PR introduces `CMT_HOME` to work in equal conditions as `CMTHOME`.

If reviewers lean toward removing `CMT_HOME` from the doc in `v0.34.x` (and unreleased `v0.38.x` and `main`), I can do it easily.

---

#### PR checklist

- [x] Tests written/updated
- [ ] Changelog entry added in `.changelog` (we use [unclog](https://github.com/informalsystems/unclog) to manage our changelog)
- [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments

(cherry picked from commit b7be568f4a59edf41942ec7e0e25edd72df604d8)

# Conflicts:
#	cmd/cometbft/commands/root_test.go

* Revert "Add `CMT_HOME` (or remove it?) (celestiaorg#983)"

* Add `CMT_HOME` (or remove it?) (celestiaorg#983)

Closes celestiaorg#982

Added `CMT_HOME` everywhere `CMTHOME` is used.

This could be fixed the opposite way, by removing the only reference to `CMT_HOME` in the code, and also the reference in `UPGRADING.md` (two lines of code).

However, the reference in `UPGRADING.md`, which is part of our documentation, is already present in `v0.34.x` (not in `v0.37.x` though!). That's why this PR introduces `CMT_HOME` to work in equal conditions as `CMTHOME`.

If reviewers lean toward removing `CMT_HOME` from the doc in `v0.34.x` (and unreleased `v0.38.x` and `main`), I can do it easily.

---

- [x] Tests written/updated
- [ ] Changelog entry added in `.changelog` (we use [unclog](https://github.com/informalsystems/unclog) to manage our changelog)
- [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments

---------

Co-authored-by: Sergio Mena <sergio@informal.systems>
@yihuang
feat: make handshake cancelable (backport celestiaorg#857) (celestiao…
60e431e 
…rg#1012)

it'll make the handshake work with graceful shutdown(see: cosmos/cosmos-sdk#16202)

handshake could be a long running process if there are many local blocks to replay, for example we use it to do profiling.

Hope we can backport this to 0.34.x.

---

- [ ] Tests written/updated
- [ ] Changelog entry added in `.changelog` (we use [unclog](https://github.com/informalsystems/unclog) to manage our changelog)
- [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.21.0 to 1.22.0 (ce…
3452373 
…lestiaorg#1025)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.21.0 to 1.22.0.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.21.0...v1.22.0)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @stevenferrer
docs: Added double quotes to /abci_query path param (celestiaorg#1015) (
dde9946 
celestiaorg#1047)

Closes celestiaorg#666

This PR adds double quotes to `path` param of `/abci_query` endpoint.

---

#### PR checklist

- [ ] Tests written/updated
- [ ] Changelog entry added in `.changelog` (we use [unclog](https://github.com/informalsystems/unclog) to manage our changelog)
- [ ] Updated relevant documentation (`docs/` or `spec/`) and code comments

(cherry picked from commit f6f13b1f67a54549d9f212a859ca4924d6ad9127)

Co-authored-by: Steven Ferrer <steven.r.ferrer@gmail.com>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.22.0 to 1.23.1 (ce…
74bed03 
…lestiaorg#1070)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.22.0 to 1.23.1.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.22.0...v1.23.1)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): Bump docker/setup-buildx-action from 2.7.0 to 2.8.0 (cel…
61f6a41 
…estiaorg#1069)

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.7.0 to 2.8.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@v2.7.0...v2.8.0)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): Bump docker/setup-buildx-action from 2.8.0 to 2.9.0 (cel…
075f4b7 
…estiaorg#1099)

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.8.0 to 2.9.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@v2.8.0...v2.9.0)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): Bump docker/setup-buildx-action from 2.9.0 to 2.9.1 (cel…
0f35438 
…estiaorg#1127)

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.9.0 to 2.9.1.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@v2.9.0...v2.9.1)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.23.1 to 1.24.0 (ce…
197ed09 
…lestiaorg#1128)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.23.1 to 1.24.0.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.23.1...v1.24.0)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.24.0 to 1.25.0 (ce…
a389900 
…lestiaorg#1162)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.24.0 to 1.25.0.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.24.0...v1.25.0)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @chillyvee
Close evidence.db OnStop (celestiaorg#1210) (celestiaorg#1226)
8732989 
* CV OnStop close evidenceStore

* CV OnStop print db close

* CV add changelog

* CV update changelog with attribution

(cherry picked from commit 48335a06f01524b036fde4dc1bab569bfc4ab9c7)

Co-authored-by: Chill Validation <92176880+chillyvee@users.noreply.github.com>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.25.0 to 1.25.1 (ce…
4af4267 
…lestiaorg#1214)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.25.0 to 1.25.1.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.25.0...v1.25.1)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mergify @sergio-mena
Log proposer's address when correctly accepting a proposal (backport c…
30895df 
…elestiaorg#1079) (celestiaorg#1222)

* Log proposer's address when correctly accepting a proposal (celestiaorg#1079)

* Log proposer when logging received proposal

* Addressed review comments

* Promote updates to validator to Info level

(cherry picked from commit cf230821c899f1f0cd3ef9cbbcc678ca01008d46)

# Conflicts:
#	consensus/state.go
#	state/execution.go

* Revert "Log proposer's address when correctly accepting a proposal (celestiaorg#1079)"

This reverts commit 8ccdb00e9023da91ae324c86956ffe5a5851d1a3.

* Log proposer's address when correctly accepting a proposal (celestiaorg#1079)

* Log proposer when logging received proposal

* Addressed review comments

* Promote updates to validator to Info level

---------

Co-authored-by: Sergio Mena <sergio@informal.systems>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.25.1 to 1.26.0 (ce…
5188d4c 
…lestiaorg#1238)

Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.25.1 to 1.26.0.
- [Release notes](https://github.com/bufbuild/buf-setup-action/releases)
- [Commits](bufbuild/buf-setup-action@v1.25.1...v1.26.0)

---
updated-dependencies:
- dependency-name: bufbuild/buf-setup-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
dependabot bot and others added 17 commits September 4, 2024 07:03
@dependabot @mergify
build(deps): Bump bufbuild/buf-setup-action from 1.38.0 to 1.39.0 (#3…
fae1816 
…946)

Bumps
[bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action)
from 1.38.0 to 1.39.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bufbuild/buf-setup-action/releases">bufbuild/buf-setup-action's
releases</a>.</em></p>
<blockquote>
<h2>v1.39.0</h2>
<p>Release v1.39.0</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bufbuild/buf-setup-action/commit/54abbed4fe8d8d45173eca4798b0c39a53a7b658"><code>54abbed</code></a>
Release v1.39.0 (<a
href="https://github.com/bufbuild/buf-setup-action/issues/221">#221</a>)</li>
<li>See full diff in <a
href="https://github.com/bufbuild/buf-setup-action/compare/v1.38.0...v1.39.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=bufbuild/buf-setup-action&package-manager=github_actions&previous-version=1.38.0&new-version=1.39.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
@dependabot @mergify
build(deps): Bump github.com/Masterminds/semver/v3 from 3.2.1 to 3.3.…
f125d93 
…0 (#3915)

Bumps
[github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver)
from 3.2.1 to 3.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Masterminds/semver/releases">github.com/Masterminds/semver/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix: bad package in README by <a
href="https://github.com/sdelicata"><code>@​sdelicata</code></a> in <a
href="https://github.com/Masterminds/semver/pull/226">Masterminds/semver#226</a></li>
<li>Updating the GitHub Actions and versions of Go used by <a
href="https://github.com/mattfarina"><code>@​mattfarina</code></a> in <a
href="https://github.com/Masterminds/semver/pull/229">Masterminds/semver#229</a></li>
<li>Fix spelling in README by <a
href="https://github.com/robinschneider"><code>@​robinschneider</code></a>
in <a
href="https://github.com/Masterminds/semver/pull/222">Masterminds/semver#222</a></li>
<li>Adding go build cache to fuzz output by <a
href="https://github.com/mattfarina"><code>@​mattfarina</code></a> in <a
href="https://github.com/Masterminds/semver/pull/232">Masterminds/semver#232</a></li>
<li>Add caching to fuzz testing by <a
href="https://github.com/mattfarina"><code>@​mattfarina</code></a> in <a
href="https://github.com/Masterminds/semver/pull/234">Masterminds/semver#234</a></li>
<li>updating github actions by <a
href="https://github.com/mattfarina"><code>@​mattfarina</code></a> in <a
href="https://github.com/Masterminds/semver/pull/235">Masterminds/semver#235</a></li>
<li>feat: nil version equality by <a
href="https://github.com/KnutZuidema"><code>@​KnutZuidema</code></a> in
<a
href="https://github.com/Masterminds/semver/pull/213">Masterminds/semver#213</a></li>
<li>add &gt;= and &lt;= by <a
href="https://github.com/grosser"><code>@​grosser</code></a> in <a
href="https://github.com/Masterminds/semver/pull/238">Masterminds/semver#238</a></li>
<li>doc: hyphen range constraint without whitespace by <a
href="https://github.com/johnnychen94"><code>@​johnnychen94</code></a>
in <a
href="https://github.com/Masterminds/semver/pull/216">Masterminds/semver#216</a></li>
<li>Removing reference to vert by <a
href="https://github.com/mattfarina"><code>@​mattfarina</code></a> in <a
href="https://github.com/Masterminds/semver/pull/245">Masterminds/semver#245</a></li>
<li>simplify StrictNewVersion by <a
href="https://github.com/grosser"><code>@​grosser</code></a> in <a
href="https://github.com/Masterminds/semver/pull/241">Masterminds/semver#241</a></li>
<li>Updating the testing version of Go used by <a
href="https://github.com/mattfarina"><code>@​mattfarina</code></a> in <a
href="https://github.com/Masterminds/semver/pull/246">Masterminds/semver#246</a></li>
<li>bumping min version in go.mod based on what's tested by <a
href="https://github.com/mattfarina"><code>@​mattfarina</code></a> in <a
href="https://github.com/Masterminds/semver/pull/248">Masterminds/semver#248</a></li>
<li>Updating changelog for 3.3.0 by <a
href="https://github.com/mattfarina"><code>@​mattfarina</code></a> in <a
href="https://github.com/Masterminds/semver/pull/249">Masterminds/semver#249</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/sdelicata"><code>@​sdelicata</code></a>
made their first contribution in <a
href="https://github.com/Masterminds/semver/pull/226">Masterminds/semver#226</a></li>
<li><a
href="https://github.com/robinschneider"><code>@​robinschneider</code></a>
made their first contribution in <a
href="https://github.com/Masterminds/semver/pull/222">Masterminds/semver#222</a></li>
<li><a
href="https://github.com/KnutZuidema"><code>@​KnutZuidema</code></a>
made their first contribution in <a
href="https://github.com/Masterminds/semver/pull/213">Masterminds/semver#213</a></li>
<li><a href="https://github.com/grosser"><code>@​grosser</code></a> made
their first contribution in <a
href="https://github.com/Masterminds/semver/pull/238">Masterminds/semver#238</a></li>
<li><a
href="https://github.com/johnnychen94"><code>@​johnnychen94</code></a>
made their first contribution in <a
href="https://github.com/Masterminds/semver/pull/216">Masterminds/semver#216</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Masterminds/semver/compare/v3.2.1...v3.3.0">https://github.com/Masterminds/semver/compare/v3.2.1...v3.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Masterminds/semver/blob/master/CHANGELOG.md">github.com/Masterminds/semver/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.3.0 (2024-08-27)</h2>
<h3>Added</h3>
<ul>
<li><a
href="https://github.com/Masterminds/semver/issues/238">#238</a>:
Add LessThanEqual and GreaterThanEqual functions (thanks <a
href="https://github.com/grosser"><code>@​grosser</code></a>)</li>
<li><a
href="https://github.com/Masterminds/semver/issues/213">#213</a>:
nil version equality checking (thanks <a
href="https://github.com/KnutZuidema"><code>@​KnutZuidema</code></a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li><a
href="https://github.com/Masterminds/semver/issues/241">#241</a>:
Simplify StrictNewVersion parsing (thanks <a
href="https://github.com/grosser"><code>@​grosser</code></a>)</li>
<li>Testing support up through Go 1.23</li>
<li>Minimum version set to 1.21 as this is what's tested now</li>
<li>Fuzz testing now supports caching</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Masterminds/semver/commit/e6e3d4d3cb1073f0ab8fb3d4be0869d1687b75f9"><code>e6e3d4d</code></a>
Merge pull request <a
href="https://github.com/Masterminds/semver/issues/249">#249</a>
from mattfarina/update-changelog-3.3.0</li>
<li><a
href="https://github.com/Masterminds/semver/commit/e80c4ea7233523c64c380d944a3ed57c1666ac67"><code>e80c4ea</code></a>
Updating changelog for 3.3.0</li>
<li><a
href="https://github.com/Masterminds/semver/commit/80427ad56e4fca2ef72e4050f01f1c9c347a0cd3"><code>80427ad</code></a>
Merge pull request <a
href="https://github.com/Masterminds/semver/issues/248">#248</a>
from mattfarina/bump-min-version</li>
<li><a
href="https://github.com/Masterminds/semver/commit/b6108372278f95198bb85fd22464b3cdc894a3a2"><code>b610837</code></a>
bumping min version in go.mod based on what's tested</li>
<li><a
href="https://github.com/Masterminds/semver/commit/a4cccd8ea5e6a94c09921a2dd4136e337ef069d1"><code>a4cccd8</code></a>
Merge pull request <a
href="https://github.com/Masterminds/semver/issues/246">#246</a>
from mattfarina/bump-go-1.23</li>
<li><a
href="https://github.com/Masterminds/semver/commit/7c178cf0c64cb23c5fcf0a291a2c9fb968806819"><code>7c178cf</code></a>
Updating the testing version of Go used</li>
<li><a
href="https://github.com/Masterminds/semver/commit/29f94c1119d901b8b4daf94be98df54ef044d3d9"><code>29f94c1</code></a>
Merge pull request <a
href="https://github.com/Masterminds/semver/issues/241">#241</a>
from grosser/grosser/validate</li>
<li><a
href="https://github.com/Masterminds/semver/commit/2cf1b16b95d71b6f8ccd5fc0fe43e1896a3049cd"><code>2cf1b16</code></a>
Merge pull request <a
href="https://github.com/Masterminds/semver/issues/245">#245</a>
from mattfarina/remove-vert</li>
<li><a
href="https://github.com/Masterminds/semver/commit/b55476af0ebb4f52e3f5fb5aca65960354bdc309"><code>b55476a</code></a>
Removing reference to vert</li>
<li><a
href="https://github.com/Masterminds/semver/commit/d07450b7cfece0885549dce1ad5b798aa7844d95"><code>d07450b</code></a>
simplify StrictNewVersion</li>
<li>Additional commits viewable in <a
href="https://github.com/Masterminds/semver/compare/v3.2.1...v3.3.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/Masterminds/semver/v3&package-manager=go_modules&previous-version=3.2.1&new-version=3.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.39.0 to 1.40.1 (#4…
40c4aef 
…030)

Bumps
[bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action)
from 1.39.0 to 1.40.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bufbuild/buf-setup-action/releases">bufbuild/buf-setup-action's
releases</a>.</em></p>
<blockquote>
<h2>v1.40.1</h2>
<p>Release v1.40.1</p>
<h2>v1.40.0</h2>
<p>Release v1.40.0</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bufbuild/buf-setup-action/commit/2dbfb63c8b0cc4f1707ba5dd23017e998a25b2f0"><code>2dbfb63</code></a>
Release v1.40.1 (<a
href="https://github.com/bufbuild/buf-setup-action/issues/223">#223</a>)</li>
<li><a
href="https://github.com/bufbuild/buf-setup-action/commit/51c53201f0da34af376e0b998c889ebb2813d479"><code>51c5320</code></a>
Release v1.40.0 (<a
href="https://github.com/bufbuild/buf-setup-action/issues/222">#222</a>)</li>
<li>See full diff in <a
href="https://github.com/bufbuild/buf-setup-action/compare/v1.39.0...v1.40.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=bufbuild/buf-setup-action&package-manager=github_actions&previous-version=1.39.0&new-version=1.40.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@alesforz
build(deps): update python module requests to v2.32.3 (#4053)
afd00e9 
### Context
The project has a dependency on an old version of the python module
[requests](https://pypi.org/project/requests/2.32.3/), which is
vulnerable to
[CVE-2023-32681](https://nvd.nist.gov/vuln/detail/CVE-2023-32681) and
[CVE-2024-35195](https://nvd.nist.gov/vuln/detail/CVE-2024-35195).

### This Change
This PR updates the version of the python module `requests` to the
latest unaffected by vulnerabilities.

---

#### PR checklist

~- [ ] Tests written/updated~
- [ ] Changelog entry added in `.changelog` (we use
[unclog](https://github.com/informalsystems/unclog) to manage our
changelog)
~- [ ] Updated relevant documentation (`docs/` or `spec/`) and code
comments~
@alesforz
build(deps): Update cometbft-db to v0.9.5 (#4059)
0f713de
@dependabot @mergify
build(deps): Bump github.com/go-git/go-git/v5 from 5.11.0 to 5.12.0 (…
60e85f7 
…#3918)

Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git)
from 5.11.0 to 5.12.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.12.0</h2>
<h2>What's Changed</h2>
<ul>
<li>git: Worktree.AddWithOptions: add skipStatus option when providing a
specific path by <a
href="https://github.com/moranCohen26"><code>@​moranCohen26</code></a>
in <a
href="https://github.com/go-git/go-git/pull/994">go-git/go-git#994</a></li>
<li>git: Signer: fix usage of crypto.Signer interface by <a
href="https://github.com/wlynch"><code>@​wlynch</code></a> in <a
href="https://github.com/go-git/go-git/pull/1029">go-git/go-git#1029</a></li>
<li>git: Remote, fetch, adds the prune option. by <a
href="https://github.com/juliens"><code>@​juliens</code></a> in <a
href="https://github.com/go-git/go-git/pull/366">go-git/go-git#366</a></li>
<li>git: Add crypto.Signer option to CommitOptions. by <a
href="https://github.com/wlynch"><code>@​wlynch</code></a> in <a
href="https://github.com/go-git/go-git/pull/996">go-git/go-git#996</a></li>
<li>git: Worktree checkout tag hash id (<a
href="https://github.com/go-git/go-git/issues/959">#959</a>) by
<a
href="https://github.com/aymanbagabas"><code>@​aymanbagabas</code></a>
in <a
href="https://github.com/go-git/go-git/pull/966">go-git/go-git#966</a></li>
<li>git: Worktree, Don't panic on empty or root path when checking if it
is valid by <a
href="https://github.com/tim775"><code>@​tim775</code></a> in <a
href="https://github.com/go-git/go-git/pull/1042">go-git/go-git#1042</a></li>
<li>git: Add commit validation for Reset by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://github.com/go-git/go-git/pull/1048">go-git/go-git#1048</a></li>
<li>git: worktree_commit, Fix amend commit to apply changes. Fixes <a
href="https://github.com/go-git/go-git/issues/1024">#1024</a>
by <a href="https://github.com/onee-only"><code>@​onee-only</code></a>
in <a
href="https://github.com/go-git/go-git/pull/1045">go-git/go-git#1045</a></li>
<li>git: Implement Merge function with initial
<code>FastForwardMerge</code> support by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://github.com/go-git/go-git/pull/1044">go-git/go-git#1044</a></li>
<li>plumbing: object, Make first commit visible on logs filtered with
filename. Fixes <a
href="https://github.com/go-git/go-git/issues/191">#191</a> by
<a href="https://github.com/onee-only"><code>@​onee-only</code></a> in
<a
href="https://github.com/go-git/go-git/pull/1036">go-git/go-git#1036</a></li>
<li>plumbing: no panic in printStats function. Fixes <a
href="https://github.com/go-git/go-git/issues/177">#177</a> by
<a href="https://github.com/nodivbyzero"><code>@​nodivbyzero</code></a>
in <a
href="https://github.com/go-git/go-git/pull/971">go-git/go-git#971</a></li>
<li>plumbing: object, Optimize logging with file. by <a
href="https://github.com/onee-only"><code>@​onee-only</code></a> in <a
href="https://github.com/go-git/go-git/pull/1046">go-git/go-git#1046</a></li>
<li>plumbing: object, check legitimacy in (*Tree).Encode by <a
href="https://github.com/niukuo"><code>@​niukuo</code></a> in <a
href="https://github.com/go-git/go-git/pull/967">go-git/go-git#967</a></li>
<li>plumbing: format/gitattributes, close file in ReadAttributesFile by
<a href="https://github.com/prskr"><code>@​prskr</code></a> in <a
href="https://github.com/go-git/go-git/pull/1018">go-git/go-git#1018</a></li>
<li>plumbing: check setAuth error. Fixes <a
href="https://github.com/go-git/go-git/issues/185">#185</a> by
<a href="https://github.com/nodivbyzero"><code>@​nodivbyzero</code></a>
in <a
href="https://github.com/go-git/go-git/pull/969">go-git/go-git#969</a></li>
<li>plumbing: object, fix variable defaultUtf8CommitMessageEncoding name
spell error by <a
href="https://github.com/Jerry-yz"><code>@​Jerry-yz</code></a> in <a
href="https://github.com/go-git/go-git/pull/987">go-git/go-git#987</a></li>
<li>utils: merkletrie, calculate filesystem node's hash lazily. by <a
href="https://github.com/candid82"><code>@​candid82</code></a> in <a
href="https://github.com/go-git/go-git/pull/825">go-git/go-git#825</a></li>
<li>utils: update comment in node.go's Hash() by <a
href="https://github.com/codablock"><code>@​codablock</code></a> in <a
href="https://github.com/go-git/go-git/pull/992">go-git/go-git#992</a></li>
<li>_example: fix 404 link and added ssh-agent clone link by <a
href="https://github.com/grinish21"><code>@​grinish21</code></a> in <a
href="https://github.com/go-git/go-git/pull/1022">go-git/go-git#1022</a></li>
<li>_example: checkout-branch example by <a
href="https://github.com/dlambda"><code>@​dlambda</code></a> in <a
href="https://github.com/go-git/go-git/pull/446">go-git/go-git#446</a></li>
<li>_example: example for git clone using ssh-agent by <a
href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a
href="https://github.com/go-git/go-git/pull/998">go-git/go-git#998</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/candid82"><code>@​candid82</code></a>
made their first contribution in <a
href="https://github.com/go-git/go-git/pull/825">go-git/go-git#825</a></li>
<li><a href="https://github.com/codablock"><code>@​codablock</code></a>
made their first contribution in <a
href="https://github.com/go-git/go-git/pull/992">go-git/go-git#992</a></li>
<li><a href="https://github.com/Jerry-yz"><code>@​Jerry-yz</code></a>
made their first contribution in <a
href="https://github.com/go-git/go-git/pull/987">go-git/go-git#987</a></li>
<li><a href="https://github.com/wlynch"><code>@​wlynch</code></a> made
their first contribution in <a
href="https://github.com/go-git/go-git/pull/996">go-git/go-git#996</a></li>
<li><a
href="https://github.com/moranCohen26"><code>@​moranCohen26</code></a>
made their first contribution in <a
href="https://github.com/go-git/go-git/pull/994">go-git/go-git#994</a></li>
<li><a href="https://github.com/grinish21"><code>@​grinish21</code></a>
made their first contribution in <a
href="https://github.com/go-git/go-git/pull/1022">go-git/go-git#1022</a></li>
<li><a href="https://github.com/prskr"><code>@​prskr</code></a> made
their first contribution in <a
href="https://github.com/go-git/go-git/pull/1018">go-git/go-git#1018</a></li>
<li><a href="https://github.com/dlambda"><code>@​dlambda</code></a> made
their first contribution in <a
href="https://github.com/go-git/go-git/pull/446">go-git/go-git#446</a></li>
<li><a href="https://github.com/juliens"><code>@​juliens</code></a> made
their first contribution in <a
href="https://github.com/go-git/go-git/pull/366">go-git/go-git#366</a></li>
<li><a href="https://github.com/onee-only"><code>@​onee-only</code></a>
made their first contribution in <a
href="https://github.com/go-git/go-git/pull/1036">go-git/go-git#1036</a></li>
<li><a href="https://github.com/tim775"><code>@​tim775</code></a> made
their first contribution in <a
href="https://github.com/go-git/go-git/pull/1042">go-git/go-git#1042</a></li>
<li><a href="https://github.com/niukuo"><code>@​niukuo</code></a> made
their first contribution in <a
href="https://github.com/go-git/go-git/pull/967">go-git/go-git#967</a></li>
<li><a
href="https://github.com/avoidalone"><code>@​avoidalone</code></a> made
their first contribution in <a
href="https://github.com/go-git/go-git/pull/1047">go-git/go-git#1047</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-git/go-git/compare/v5.11.0...v5.12.0">https://github.com/go-git/go-git/compare/v5.11.0...v5.12.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-git/go-git/commit/302dddeda962e4bb3477a8e4080bc6f5a253e2bb"><code>302ddde</code></a>
Merge pull request <a
href="https://github.com/go-git/go-git/issues/1060">#1060</a>
from go-git/dependabot/go_modules/github.com/gliderl...</li>
<li><a
href="https://github.com/go-git/go-git/commit/6bba34deab858ad5d74733686f0a8b4c2940f388"><code>6bba34d</code></a>
build: bump github.com/gliderlabs/ssh from 0.3.6 to 0.3.7</li>
<li><a
href="https://github.com/go-git/go-git/commit/feaeb36df2438dd5f861be2c1041f4e07c126233"><code>feaeb36</code></a>
Merge pull request <a
href="https://github.com/go-git/go-git/issues/937">#937</a>
from matejrisek/feature/rename-short-fields</li>
<li><a
href="https://github.com/go-git/go-git/commit/7959a42552a99b2e2df21a6aacafc97b2b5c7457"><code>7959a42</code></a>
Merge pull request <a
href="https://github.com/go-git/go-git/issues/1052">#1052</a>
from go-git/dependabot/go_modules/github.com/skeema/...</li>
<li><a
href="https://github.com/go-git/go-git/commit/4c17ce7c6a7936a61cea17bee56daf5d9c2b21e4"><code>4c17ce7</code></a>
build: bump github.com/skeema/knownhosts from 1.2.1 to 1.2.2</li>
<li><a
href="https://github.com/go-git/go-git/commit/3f77e6f0292bdabb6368a42ef0f5fa925ed42f60"><code>3f77e6f</code></a>
Merge pull request <a
href="https://github.com/go-git/go-git/issues/1048">#1048</a>
from pjbgf/fix-reset-validation</li>
<li><a
href="https://github.com/go-git/go-git/commit/6af38e000608a795320cd17c99491853f0b8ad3a"><code>6af38e0</code></a>
Merge pull request <a
href="https://github.com/go-git/go-git/issues/1047">#1047</a>
from avoidalone/master</li>
<li><a
href="https://github.com/go-git/go-git/commit/e6c3e58198d176c497bb2dba1a2adb9302597676"><code>e6c3e58</code></a>
Merge pull request <a
href="https://github.com/go-git/go-git/issues/1044">#1044</a>
from pjbgf/ff-merge</li>
<li><a
href="https://github.com/go-git/go-git/commit/04f7b23cbb85040a276ab2b7d6879223779451fd"><code>04f7b23</code></a>
*: fix some comments</li>
<li><a
href="https://github.com/go-git/go-git/commit/f4f1a876e622c45ed51d05df1298d421a6868fcc"><code>f4f1a87</code></a>
Merge pull request <a
href="https://github.com/go-git/go-git/issues/971">#971</a>
from nodivbyzero/fix-177-diff-print-file-stats</li>
<li>Additional commits viewable in <a
href="https://github.com/go-git/go-git/compare/v5.11.0...v5.12.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.11.0&new-version=5.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
@alesforz
build(deps): updated pkg gonum.org/v1/gonum to v0.15.1: (#4045)
61a6c3f 
### Context
The project has a transitive dependency on an old version of
[golang.org/x/image](https://pkg.go.dev/golang.org/x/image), which is
vulnerable to
[CVE-2024-24792](https://nvd.nist.gov/vuln/detail/CVE-2024-24792),
[CVE-2023-29407](https://nvd.nist.gov/vuln/detail/CVE-2023-29407),
[CVE-2023-29408](https://nvd.nist.gov/vuln/detail/CVE-2023-29408), and
[CVE-2022-41727](https://nvd.nist.gov/vuln/detail/CVE-2022-41727).

### This Change
This PR updates the version of a direct CometBFT dependency
(`gonum.org/v1/gonum`) that depends on `golang.org/x/image`, thus
causing the transitive dependency.
This forces an update of `golang.org/x/image` to a newer version
unaffected by vulnerabilities.

---

#### PR checklist

~- [ ] Tests written/updated~
- [ ] Changelog entry added in `.changelog` (we use
[unclog](https://github.com/informalsystems/unclog) to manage our
changelog)
~- [ ] Updated relevant documentation (`docs/` or `spec/`) and code
comments~
@dependabot @mergify
build(deps): Bump github.com/ChainSafe/go-schnorrkel from 1.0.0 to 1.…
415d93d 
…1.0 (#3920)

Bumps
[github.com/ChainSafe/go-schnorrkel](https://github.com/ChainSafe/go-schnorrkel)
from 1.0.0 to 1.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ChainSafe/go-schnorrkel/releases">github.com/ChainSafe/go-schnorrkel's
releases</a>.</em></p>
<blockquote>
<h2>v1.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: update documentation by <a
href="https://github.com/jimjbrettj"><code>@​jimjbrettj</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/42">ChainSafe/go-schnorrkel#42</a></li>
<li>Enhancement: cache compressed public key by <a
href="https://github.com/jimjbrettj"><code>@​jimjbrettj</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/47">ChainSafe/go-schnorrkel#47</a></li>
<li>Use VarTimeMultiScalarMult for batch verification by <a
href="https://github.com/jimjbrettj"><code>@​jimjbrettj</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/49">ChainSafe/go-schnorrkel#49</a></li>
<li>Update pubkey verify by <a
href="https://github.com/jimjbrettj"><code>@​jimjbrettj</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/50">ChainSafe/go-schnorrkel#50</a></li>
<li>add audit report by <a
href="https://github.com/noot"><code>@​noot</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/52">ChainSafe/go-schnorrkel#52</a></li>
<li>Func for generating mini secret for mnemonic by <a
href="https://github.com/StringNick"><code>@​StringNick</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/53">ChainSafe/go-schnorrkel#53</a></li>
<li>Add a keypair type by <a
href="https://github.com/jimjbrettj"><code>@​jimjbrettj</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/51">ChainSafe/go-schnorrkel#51</a></li>
<li>Bump golang.org/x/crypto from 0.0.0-20191206172530-e9b2fee46413 to
0.1.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/57">ChainSafe/go-schnorrkel#57</a></li>
<li>add syntax highlighting to readme by <a
href="https://github.com/noot"><code>@​noot</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/58">ChainSafe/go-schnorrkel#58</a></li>
<li>Add NewSecretKeyFromEd25519Bytes by <a
href="https://github.com/oldgreen"><code>@​oldgreen</code></a> in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/59">ChainSafe/go-schnorrkel#59</a></li>
<li>feat: upgrade go version to 1.21 by <a
href="https://github.com/EclesioMeloJunior"><code>@​EclesioMeloJunior</code></a>
in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/61">ChainSafe/go-schnorrkel#61</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/jimjbrettj"><code>@​jimjbrettj</code></a> made
their first contribution in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/42">ChainSafe/go-schnorrkel#42</a></li>
<li><a
href="https://github.com/StringNick"><code>@​StringNick</code></a> made
their first contribution in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/53">ChainSafe/go-schnorrkel#53</a></li>
<li><a
href="https://github.com/dependabot"><code>@​dependabot</code></a> made
their first contribution in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/57">ChainSafe/go-schnorrkel#57</a></li>
<li><a href="https://github.com/oldgreen"><code>@​oldgreen</code></a>
made their first contribution in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/59">ChainSafe/go-schnorrkel#59</a></li>
<li><a
href="https://github.com/EclesioMeloJunior"><code>@​EclesioMeloJunior</code></a>
made their first contribution in <a
href="https://github.com/ChainSafe/go-schnorrkel/pull/61">ChainSafe/go-schnorrkel#61</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/ChainSafe/go-schnorrkel/compare/v1.0.0...v1.1.0">https://github.com/ChainSafe/go-schnorrkel/compare/v1.0.0...v1.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/ae404e2b9368b48506302e7aed3da219eff9e1e7"><code>ae404e2</code></a>
feat: upgrade go version to 1.21 (<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/61">#61</a>)</li>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/97bcebeca41639f38b3624814338281dc29fa6fe"><code>97bcebe</code></a>
Add NewSecretKeyFromEd25519Bytes (<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/59">#59</a>)</li>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/6f903a725bf83374e5bc00e78c34344211bd5b04"><code>6f903a7</code></a>
add syntax highlighting to readme (<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/58">#58</a>)</li>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/b1d618c1ab67869e024cbf6ecdca776969e8c46c"><code>b1d618c</code></a>
Bump golang.org/x/crypto from 0.0.0-20191206172530-e9b2fee46413 to 0.1.0
(<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/57">#57</a>)</li>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/027d287d27bf145aa74d969e52bef54a7190f4c7"><code>027d287</code></a>
implement keypair type (<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/51">#51</a>)</li>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/021b2b6b15332695a0d69d13204dd2d2e66363ac"><code>021b2b6</code></a>
add <code>GenerateMnemonic</code> (<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/53">#53</a>)</li>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/1e46fb590c48476d42109cf09da729ea8aa7f011"><code>1e46fb5</code></a>
add audit report (<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/52">#52</a>)</li>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/3214b1579aca3913d40ba08dbd81c1822204b36d"><code>3214b15</code></a>
Update pubkey.Verify to use VarTimeDoubleScalarBaseMult (<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/50">#50</a>)</li>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/455507cab28bc2f023254151f6c36cbea5cb8651"><code>455507c</code></a>
use VarTimeMultiScalarMult for batch verification (<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/49">#49</a>)</li>
<li><a
href="https://github.com/ChainSafe/go-schnorrkel/commit/5fe5a0f4e161f7b9ea9e51231918a7057911ed6a"><code>5fe5a0f</code></a>
enhancement: cache compressed public key (<a
href="https://github.com/ChainSafe/go-schnorrkel/issues/47">#47</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ChainSafe/go-schnorrkel/compare/v1.0.0...v1.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/ChainSafe/go-schnorrkel&package-manager=go_modules&previous-version=1.0.0&new-version=1.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
@dependabot @mergify
build(deps): Bump github.com/rs/cors from 1.11.0 to 1.11.1 (#3921)
044f605 
Bumps [github.com/rs/cors](https://github.com/rs/cors) from 1.11.0 to
1.11.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rs/cors/commit/a814d7990a5449fcc211a536119d271469cc4157"><code>a814d79</code></a>
Re-add support for multiple Access-Control-Request-Headers field (fixes
<a
href="https://github.com/rs/cors/issues/184">#184</a>)...</li>
<li><a
href="https://github.com/rs/cors/commit/1562b1715b353146f279ff7d445b7412e0f1a842"><code>1562b17</code></a>
Removed redundant log nil checks (<a
href="https://github.com/rs/cors/issues/178">#178</a>)</li>
<li><a
href="https://github.com/rs/cors/commit/3d336ea9b505046d343dfb14f09f19fad17673b4"><code>3d336ea</code></a>
Update all dependencies to latest in examples (<a
href="https://github.com/rs/cors/issues/175">#175</a>)</li>
<li><a
href="https://github.com/rs/cors/commit/85fc0cac7b03634b6bcf9686f0283858b427d484"><code>85fc0ca</code></a>
Make Gin wrapper's status configurable and use 204 as default (fixes <a
href="https://github.com/rs/cors/issues/145">#145</a>)
(#...</li>
<li>See full diff in <a
href="https://github.com/rs/cors/compare/v1.11.0...v1.11.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/rs/cors&package-manager=go_modules&previous-version=1.11.0&new-version=1.11.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
@melekes
build(deps): update adlio schema (#4050)
0aa6b32 
updating `adlio/schema` removes dependency on `docker/docker`

CVE-2024-41110

---

#### PR checklist

- [ ] Tests written/updated
- [ ] Changelog entry added in `.changelog` (we use
[unclog](https://github.com/informalsystems/unclog) to manage our
changelog)
- [ ] Updated relevant documentation (`docs/` or `spec/`) and code
comments
@melekes @mergify
ci: update Go to 1.22 (#4060)
09e4b25 
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
@melekes
build(deps): update go-kit (#4056)
3c1db27 
<!--

Please add a reference to the issue that this PR addresses and indicate
which
files are most critical to review. If it fully addresses a particular
issue,
please include "Closes #XXX" (where "XXX" is the issue number).

If this PR is non-trivial/large/complex, please ensure that you have
either
created an issue that the team's had a chance to respond to, or had some
discussion with the team prior to submitting substantial pull requests.
The team
can be reached via GitHub Discussions or the Cosmos Network Discord
server in
the #cometbft channel. GitHub Discussions is preferred over Discord as
it
allows us to keep track of conversations topically.
https://github.com/cometbft/cometbft/discussions

If the work in this PR is not aligned with the team's current
priorities, please
be advised that it may take some time before it is merged - especially
if it has
not yet been discussed with the team.

See the project board for the team's current priorities:
https://github.com/orgs/cometbft/projects/1

-->

---

#### PR checklist

- [ ] Tests written/updated
- [ ] Changelog entry added in `.changelog` (we use
[unclog](https://github.com/informalsystems/unclog) to manage our
changelog)
- [ ] Updated relevant documentation (`docs/` or `spec/`) and code
comments
@dependabot @melekes
build(deps): Bump github.com/btcsuite/btcd/btcec/v2 from 2.2.2 to 2.3…
1ea9db5 
….4 (#3919)

Bumps
[github.com/btcsuite/btcd/btcec/v2](https://github.com/btcsuite/btcd)
from 2.2.2 to 2.3.4.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/btcsuite/btcd/commit/ff2e03e11233fa25c01cf4acbf76501fc008b31f"><code>ff2e03e</code></a>
chore: fix some comments for struct field (<a
href="https://github.com/btcsuite/btcd/issues/2214">#2214</a>)</li>
<li><a
href="https://github.com/btcsuite/btcd/commit/2134387ba8ff6d33d90afba285c5f0d52f3a0f6b"><code>2134387</code></a>
Merge pull request <a
href="https://github.com/btcsuite/btcd/issues/2208">#2208</a>
from kcalvinalvin/2024-07-01-close-blockfiles</li>
<li><a
href="https://github.com/btcsuite/btcd/commit/e5d15fddb9c486dfe382bc95dc38d2fd247813bf"><code>e5d15fd</code></a>
btcec/ecdsa: remove error return value for SignCompact (<a
href="https://github.com/btcsuite/btcd/issues/2211">#2211</a>)</li>
<li><a
href="https://github.com/btcsuite/btcd/commit/c9fae1ac7cca6e6d55baec913286e483e28923a9"><code>c9fae1a</code></a>
ffldb: close block files before deleting them</li>
<li><a
href="https://github.com/btcsuite/btcd/commit/8ed8ef134067e8af529996c4d027913b5945bf13"><code>8ed8ef1</code></a>
ffldb: refactor out file close code into its own method</li>
<li><a
href="https://github.com/btcsuite/btcd/commit/8b5f2aa6f2cbd6c73d51d3f6c7251c7f48288175"><code>8b5f2aa</code></a>
ffldb: add check for deleting files that are open</li>
<li><a
href="https://github.com/btcsuite/btcd/commit/4712e20049ebc24c4902049c47aadac27ffdc549"><code>4712e20</code></a>
ffldb: throw error when attempting to delete an open file</li>
<li><a
href="https://github.com/btcsuite/btcd/commit/d881c686e61db35e332fb0309178152dac589b03"><code>d881c68</code></a>
Fix the btcctl uptime command</li>
<li><a
href="https://github.com/btcsuite/btcd/commit/139669066ca7631559d45efe25ab5518bb692554"><code>1396690</code></a>
Sending RPC requests through unix sockets (<a
href="https://github.com/btcsuite/btcd/issues/2168">#2168</a>)</li>
<li><a
href="https://github.com/btcsuite/btcd/commit/b2eec96beac53b2d4ffbb4e42de7eba381d28c23"><code>b2eec96</code></a>
Merge pull request <a
href="https://github.com/btcsuite/btcd/issues/2206">#2206</a>
from guggero/psbt-serialization-fix</li>
<li>Additional commits viewable in <a
href="https://github.com/btcsuite/btcd/compare/btcec/v2.2.2...btcec/v2.3.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/btcsuite/btcd/btcec/v2&package-manager=go_modules&previous-version=2.2.2&new-version=2.3.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Anton Kaliaev <anton.kalyaev@gmail.com>
@alesforz
build(deps): Update gonum dependency to latest commit (#4090)
907925d
@dependabot
build(deps): Bump bufbuild/buf-setup-action from 1.40.1 to 1.41.0 (#4…
d9fca7f 
…095)

Bumps
[bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action)
from 1.40.1 to 1.41.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bufbuild/buf-setup-action/releases">bufbuild/buf-setup-action's
releases</a>.</em></p>
<blockquote>
<h2>v1.41.0</h2>
<p>Release v1.41.0</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bufbuild/buf-setup-action/commit/2881ede27923557cb71f4ddc8954905c2639d1fb"><code>2881ede</code></a>
Release v1.41.0 (<a
href="https://github.com/bufbuild/buf-setup-action/issues/224">#224</a>)</li>
<li>See full diff in <a
href="https://github.com/bufbuild/buf-setup-action/compare/v1.40.1...v1.41.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=bufbuild/buf-setup-action&package-manager=github_actions&previous-version=1.40.1&new-version=1.41.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@melekes
v0.34.35 (#4105)
46db8f4
@rootulp
Merge branch 'rp/cometbft-v0.34.35' into rp/v0.34.35
0587ad1
@rootulp rootulp self-assigned this Sep 20, 2024
@rootulp rootulp mentioned this pull request Sep 20, 2024
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@rootulp rootulp

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

State syncing validator from malicious node may lead to a chain split
10 participants
@rootulp @jmalicevic @thanethomson @yihuang @cason @lasarojc @hvanz @sergio-mena @melekes @alesforz