Uh oh!
There was an error while loading. Please reload this page.
build(deps): Bump the go_modules group across 2 directories with 3 updates - #2846
Merged
julienrbrt merged 2 commits intoNov 17, 2025
Merged
Conversation
…dates Bumps the go_modules group with 1 update in the /apps/evm/single directory: [github.com/consensys/gnark-crypto](https://github.com/consensys/gnark-crypto). Bumps the go_modules group with 3 updates in the /execution/evm/test directory: [github.com/consensys/gnark-crypto](https://github.com/consensys/gnark-crypto), [github.com/cometbft/cometbft](https://github.com/cometbft/cometbft) and [github.com/dvsekhvalnov/jose2go](https://github.com/dvsekhvalnov/jose2go). Updates `github.com/consensys/gnark-crypto` from 0.18.0 to 0.18.1 - [Release notes](https://github.com/consensys/gnark-crypto/releases) - [Changelog](https://github.com/Consensys/gnark-crypto/blob/master/CHANGELOG.md) - [Commits](Consensys/gnark-crypto@v0.18.0...v0.18.1) Updates `github.com/consensys/gnark-crypto` from 0.18.0 to 0.18.1 - [Release notes](https://github.com/consensys/gnark-crypto/releases) - [Changelog](https://github.com/Consensys/gnark-crypto/blob/master/CHANGELOG.md) - [Commits](Consensys/gnark-crypto@v0.18.0...v0.18.1) Updates `github.com/cometbft/cometbft` from 0.38.17 to 0.38.19 - [Release notes](https://github.com/cometbft/cometbft/releases) - [Changelog](https://github.com/cometbft/cometbft/blob/v0.38.19/CHANGELOG.md) - [Commits](cometbft/cometbft@v0.38.17...v0.38.19) Updates `github.com/dvsekhvalnov/jose2go` from 1.6.0 to 1.7.0 - [Commits](dvsekhvalnov/jose2go@v1.6.0...v1.7.0) --- updated-dependencies: - dependency-name: github.com/consensys/gnark-crypto dependency-version: 0.18.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/consensys/gnark-crypto dependency-version: 0.18.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/cometbft/cometbft dependency-version: 0.38.19 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/dvsekhvalnov/jose2go dependency-version: 1.7.0 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Claude finished @dependabot[bot]'s task —— View job Code Review CompleteI've reviewed this Dependabot PR that updates Go module dependencies across 2 directories with 3 package updates. Here's my comprehensive analysis: Tasks
SummaryThis PR updates three dependencies with patch/minor version bumps:
Recommendation: ✅ Approve after CI passes Detailed Review1. Code Quality & Architecture ✅Verdict: No issues
2. Security Analysis 🔒Verdict: Important security fixes included Critical Security Fix in CometBFT v0.38.19The CometBFT update includes ASA-2025-003 (GHSA-hrhf-2vcr-ghch):
This is a security-critical update and should be merged promptly. dvsekhvalnov/jose2go v1.7.0From the commits, this version adds:
This is also a security-related improvement. consensys/gnark-crypto v0.18.1
3. Breaking Changes Analysis ✅Verdict: No breaking changes detected All updates are patch or minor version bumps:
The changes are performance and security fixes without API modifications. 4. Dependency Compatibility ✅Verdict: Compatible All three dependencies are indirect dependencies (marked with
Affected Modules:
5. Testing & Reliability ⏳Verdict: Waiting for CI
Recommendation: Wait for CI to complete before merging, particularly:
6. Resource Efficiency & Performance ✅Verdict: Performance improvements included All three updates include performance/resource efficiency improvements:
Specific ObservationsFile: |
| Risk Area | Level | Notes |
|---|---|---|
| Breaking Changes | 🟢 Low | All semantic versioning compatible |
| Security Impact | 🔴 High (positive) | Critical security fixes included |
| Performance Impact | 🟢 Low (positive) | Memory and storage improvements |
| Integration Risk | 🟡 Medium | CometBFT consensus changes require validation |
| Rollback Complexity | 🟢 Low | Simple dependency revert if needed |
Overall Risk: Low - The benefits significantly outweigh the risks.
Conclusion
This is a well-structured, security-focused dependency update that:
- ✅ Fixes critical security vulnerabilities (CometBFT ASA-2025-003)
- ✅ Improves resource efficiency and performance
- ✅ Maintains backward compatibility
- ✅ Follows semantic versioning principles
- ✅ Includes no breaking changes
Final Recommendation: Approve and merge after CI passes 🎯
The security fixes in CometBFT (ASA-2025-003) and jose2go make this update important for production security posture.
Contributor
The latest Buf updates on your PR. Results from workflow CI / buf-check (pull_request).
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@## main #2846 +/- ##
==========================================
+ Coverage 64.66% 64.76% +0.09%
==========================================
Files 81 81 Lines 7169 7169 ==========================================
+ Hits 4636 4643 +7 + Misses 1993 1986 -7
Partials 540 540
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
julienrbrt
approved these changes
Nov 17, 2025
Uh oh!
There was an error while loading. Please reload this page.
julienrbrt
deleted the
dependabot/go_modules/apps/evm/single/go_modules-482f3545f5
branch
November 17, 2025 12:34
alpe added a commit
that referenced
this pull request
Nov 17, 2025
* main: build(deps): Bump the go_modules group across 2 directories with 3 updates (#2846) build(deps): Bump github.com/dvsekhvalnov/jose2go from 1.7.0 to 1.8.0 in /test/e2e (#2851) build(deps): Bump github.com/consensys/gnark-crypto from 0.18.0 to 0.18.1 in /test/e2e (#2844) build(deps): Bump github.com/cometbft/cometbft from 0.38.17 to 0.38.19 in /test/e2e (#2843) build(deps): Bump github.com/dvsekhvalnov/jose2go from 1.6.0 to 1.7.0 in /test/e2e (#2845)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go_modules group with 1 update in the /apps/evm/single directory: github.com/consensys/gnark-crypto.
Bumps the go_modules group with 3 updates in the /execution/evm/test directory: github.com/consensys/gnark-crypto, github.com/cometbft/cometbft and github.com/dvsekhvalnov/jose2go.
Updates
github.com/consensys/gnark-cryptofrom 0.18.0 to 0.18.1Release notes
Sourced from github.com/consensys/gnark-crypto's releases.
Changelog
Sourced from github.com/consensys/gnark-crypto's changelog.
Commits
fb04e95docs: add CHANGELOG for 0.18.10a4d04aperf: limit memory allocation during Vector deserialization (#759)Updates
github.com/consensys/gnark-cryptofrom 0.18.0 to 0.18.1Release notes
Sourced from github.com/consensys/gnark-crypto's releases.
Changelog
Sourced from github.com/consensys/gnark-crypto's changelog.
Commits
fb04e95docs: add CHANGELOG for 0.18.10a4d04aperf: limit memory allocation during Vector deserialization (#759)Updates
github.com/cometbft/cometbftfrom 0.38.17 to 0.38.19Release notes
Sourced from github.com/cometbft/cometbft's releases.
Changelog
Sourced from github.com/cometbft/cometbft's changelog.
Commits
be5677cMerge commit from fork2cd5d91fix(consensus/reactor): reject oversized proposals (backport #5324) (#5407)bb538f0fix: remove exposed dockertest port to unblock postgres test (#5325)61b60f6chore: clean up the repo (#5315)9806733fix(store): Properly prune extended commits (backport #5276) (#5313)c789138chore: fix the linter (#5304)840e709chore: update and fix mockery tooling on v0.38 (#5301)020c7cfchore: refactor changelogs (#5303)91348c6chore: fix test docker image (#5299)5344a6echore: prep release for v0.38.18 (#5253)Updates
github.com/dvsekhvalnov/jose2gofrom 1.6.0 to 1.7.0Commits
0a0673dMerge pull request #34 from dvsekhvalnov/issue-33-deflate-limitc3fff7cdocse51b47fdocsc7dde52fixing workflowa194baaadded go versions and OSs to matrixf31cfc6fixing yaml1a4ba55added matrix to workflowd2baff2go workflowb14c81aadded limitation for deflate decompression streamDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.