From 34e6308b6b9cf95e9ddf8f77f49faa4f595996a0 Mon Sep 17 00:00:00 2001 From: Julien Robert Date: Wed, 7 Jun 2023 19:08:11 +0200 Subject: [PATCH 1/5] chore: prepare v0.46.13 (2/2) --- CHANGELOG.md | 12 ++++++------ RELEASE_NOTES.md | 12 +++++++----- go.mod | 4 +++- x/gov/keeper/proposal.go | 6 +++++- 4 files changed, 21 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 64b9862ff596..ec02cf3ad0b8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -37,7 +37,7 @@ Ref: https://keepachangelog.com/en/1.0.0/ ## [Unreleased] -## [v0.46.13](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13) - 2022-06-05 +## [v0.46.13](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13) - 2023-06-08 ## Features @@ -57,11 +57,11 @@ Ref: https://keepachangelog.com/en/1.0.0/ ### Bug Fixes +* Fix [burberry](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825) security vulnerability. * (cli) [#16312](https://github.com/cosmos/cosmos-sdk/pull/16312) Allow any addresses in `client.ValidatePromptAddress`. * (store/iavl) [#15717](https://github.com/cosmos/cosmos-sdk/pull/15717) Upstream error on empty version (this change was present on all version but v0.46). -* (x/gov) [#16331](https://github.com/cosmos/cosmos-sdk/pull/16331) Revert a change that breaks result hash. -## [v0.46.12](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.12) - 2022-04-04 +## [v0.46.12](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.12) - 2023-04-04 ### Features @@ -78,7 +78,7 @@ Ref: https://keepachangelog.com/en/1.0.0/ * (x/auth/vesting) [#15383](https://github.com/cosmos/cosmos-sdk/pull/15383) Add extra checks when creating a periodic vesting account. * (x/gov) [#13051](https://github.com/cosmos/cosmos-sdk/pull/13051) In SubmitPropsal, when a legacy msg fails it's handler call, wrap the error as ErrInvalidProposalContent (instead of ErrNoProposalHandlerExists). -## [v0.46.11](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.11) - 2022-03-03 +## [v0.46.11](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.11) - 2023-03-03 ### Improvements @@ -90,13 +90,13 @@ Ref: https://keepachangelog.com/en/1.0.0/ * [#15243](https://github.com/cosmos/cosmos-sdk/pull/15243) `LatestBlockResponse` & `BlockByHeightResponse` types' field `sdk_block` was incorrectly cast `proposer_address` bytes to validator operator address, now to consensus address. -## [v0.46.10](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.10) - 2022-02-16 +## [v0.46.10](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.10) - 2023-02-16 ### Improvements * (cli) [#14953](https://github.com/cosmos/cosmos-sdk/pull/14953) Enable profiling block replay during abci handshake with `--cpu-profile`. -## [v0.46.9](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.9) - 2022-02-07 +## [v0.46.9](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.9) - 2023-02-07 ### Improvements diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index c258c002d686..33ff49b6e07f 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,9 +1,11 @@ # Cosmos SDK v0.46.13 Release Notes -This release includes a few improvements and bug fixes. -Notably, a bump to [CometBFT v0.34.28](https://github.com/cometbft/cometbft/blob/v0.34.28/CHANGELOG.md#v03428). -Additionally, it includes new commands for snapshots management and bootstrapping from a local snapshot. -Add `snapshot.Cmd(appCreator)` to your chain root command for using it. +This release includes few improvements and bug fixes. +Notably, the [burberry security fix](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825). All chains using Cosmos SDK `<= v0.46.12` should upgrade to `v0.46.13` **immediately**. + +When upgrading from `<= v0.46.12` to `v0.46.13`, a **coordinated upgrade** is required. A chain is safe as soon as **33%+1** of the voting power has upgraded. + +Additionally, it includes new commands for snapshots management and bootstrapping from a local snapshot (add `snapshot.Cmd(appCreator)` to the chain root command for using it). Did you know Cosmos SDK Twilight (a.k.a v0.47) has been released? Upgrade easily by reading the [upgrading guide](https://github.com/cosmos/cosmos-sdk/blob/release/v0.47.x/UPGRADING.md#v047x). @@ -18,4 +20,4 @@ replace github.com/syndtr/goleveldb => github.com/syndtr/goleveldb v1.0.1-0.2021 Please see the [CHANGELOG](https://github.com/cosmos/cosmos-sdk/blob/release/v0.46.x/CHANGELOG.md) for an exhaustive list of changes. -**Full Commit History**: https://github.com/cosmos/cosmos-sdk/compare/v0.46.12...v0.46.13 \ No newline at end of file +**Full Commit History**: https://github.com/cosmos/cosmos-sdk/compare/v0.46.12...v0.46.13 diff --git a/go.mod b/go.mod index 3aaf3c199e8a..e7e7cd495599 100644 --- a/go.mod +++ b/go.mod @@ -178,7 +178,9 @@ replace ( ) retract ( - // revert fix https://github.com/cosmos/cosmos-sdk/pull/16331 + // migrating from v0.46.x -> v0.46.12 breaks LastResultsHash + // this is not an issue for new chains started on v0.46.12 or chains that + // need to upgrade to v0.46.13 due to barberry v0.46.12 // subject to a bug in the group module and gov module migration [v0.46.5, v0.46.6] diff --git a/x/gov/keeper/proposal.go b/x/gov/keeper/proposal.go index 64088859c684..b49cd8335042 100644 --- a/x/gov/keeper/proposal.go +++ b/x/gov/keeper/proposal.go @@ -1,6 +1,7 @@ package keeper import ( + "errors" "fmt" "github.com/cosmos/cosmos-sdk/client" @@ -54,7 +55,10 @@ func (keeper Keeper) SubmitProposal(ctx sdk.Context, messages []sdk.Msg, metadat if msg, ok := msg.(*v1.MsgExecLegacyContent); ok { cacheCtx, _ := ctx.CacheContext() if _, err := handler(cacheCtx, msg); err != nil { - return v1.Proposal{}, sdkerrors.Wrap(types.ErrNoProposalHandlerExists, err.Error()) + if errors.Is(types.ErrNoProposalHandlerExists, err) { + return v1.Proposal{}, err + } + return v1.Proposal{}, sdkerrors.Wrap(types.ErrInvalidProposalContent, err.Error()) } } From 5c9ef06f64f13756aeb3ed28912aa59554674c31 Mon Sep 17 00:00:00 2001 From: Julien Robert Date: Wed, 7 Jun 2023 21:32:59 +0200 Subject: [PATCH 2/5] barberry --- CHANGELOG.md | 2 +- RELEASE_NOTES.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ec02cf3ad0b8..946863844363 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -57,7 +57,7 @@ Ref: https://keepachangelog.com/en/1.0.0/ ### Bug Fixes -* Fix [burberry](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825) security vulnerability. +* Fix [barberry](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825) security vulnerability. * (cli) [#16312](https://github.com/cosmos/cosmos-sdk/pull/16312) Allow any addresses in `client.ValidatePromptAddress`. * (store/iavl) [#15717](https://github.com/cosmos/cosmos-sdk/pull/15717) Upstream error on empty version (this change was present on all version but v0.46). diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 33ff49b6e07f..4b560d8a965f 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,7 +1,7 @@ # Cosmos SDK v0.46.13 Release Notes This release includes few improvements and bug fixes. -Notably, the [burberry security fix](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825). All chains using Cosmos SDK `<= v0.46.12` should upgrade to `v0.46.13` **immediately**. +Notably, the [barberry security fix](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825). All chains using Cosmos SDK `<= v0.46.12` should upgrade to `v0.46.13` **immediately**. When upgrading from `<= v0.46.12` to `v0.46.13`, a **coordinated upgrade** is required. A chain is safe as soon as **33%+1** of the voting power has upgraded. From 14460d51fa511945f3ec17ce73ad25243d93bc9b Mon Sep 17 00:00:00 2001 From: Julien Robert Date: Thu, 8 Jun 2023 11:12:40 +0200 Subject: [PATCH 3/5] revert revert of reversion --- x/gov/keeper/proposal.go | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/x/gov/keeper/proposal.go b/x/gov/keeper/proposal.go index b49cd8335042..64088859c684 100644 --- a/x/gov/keeper/proposal.go +++ b/x/gov/keeper/proposal.go @@ -1,7 +1,6 @@ package keeper import ( - "errors" "fmt" "github.com/cosmos/cosmos-sdk/client" @@ -55,10 +54,7 @@ func (keeper Keeper) SubmitProposal(ctx sdk.Context, messages []sdk.Msg, metadat if msg, ok := msg.(*v1.MsgExecLegacyContent); ok { cacheCtx, _ := ctx.CacheContext() if _, err := handler(cacheCtx, msg); err != nil { - if errors.Is(types.ErrNoProposalHandlerExists, err) { - return v1.Proposal{}, err - } - return v1.Proposal{}, sdkerrors.Wrap(types.ErrInvalidProposalContent, err.Error()) + return v1.Proposal{}, sdkerrors.Wrap(types.ErrNoProposalHandlerExists, err.Error()) } } From 1e09cc91ac19197edc72525fc19d264f94f544ab Mon Sep 17 00:00:00 2001 From: Julien Robert Date: Thu, 8 Jun 2023 11:15:22 +0200 Subject: [PATCH 4/5] updates --- go.mod | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e7e7cd495599..3aaf3c199e8a 100644 --- a/go.mod +++ b/go.mod @@ -178,9 +178,7 @@ replace ( ) retract ( - // migrating from v0.46.x -> v0.46.12 breaks LastResultsHash - // this is not an issue for new chains started on v0.46.12 or chains that - // need to upgrade to v0.46.13 due to barberry + // revert fix https://github.com/cosmos/cosmos-sdk/pull/16331 v0.46.12 // subject to a bug in the group module and gov module migration [v0.46.5, v0.46.6] From 197ae12331bb1758c9ea69522823eede5147fe55 Mon Sep 17 00:00:00 2001 From: Julien Robert Date: Thu, 8 Jun 2023 11:20:50 +0200 Subject: [PATCH 5/5] wording --- RELEASE_NOTES.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 4b560d8a965f..f9afd69295b3 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,9 +1,7 @@ # Cosmos SDK v0.46.13 Release Notes This release includes few improvements and bug fixes. -Notably, the [barberry security fix](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825). All chains using Cosmos SDK `<= v0.46.12` should upgrade to `v0.46.13` **immediately**. - -When upgrading from `<= v0.46.12` to `v0.46.13`, a **coordinated upgrade** is required. A chain is safe as soon as **33%+1** of the voting power has upgraded. +Notably, the [barberry security fix](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825). All chains using Cosmos SDK `<= v0.46.12` must upgrade to `v0.46.13` **immediately**. A chain is safe as soon as **33%+1** of the voting power has upgraded. Coordinate with your validators to upgrade as soon as possible. Additionally, it includes new commands for snapshots management and bootstrapping from a local snapshot (add `snapshot.Cmd(appCreator)` to the chain root command for using it).