feat: chain upgrade v1.14 #28
Conversation
WalkthroughThis pull request updates both the Dockerfile and go.mod. The Dockerfile now uses a more specific Golang base image version and includes newer versions of the libwasmvm_muslc libraries for both x86_64 and aarch64, along with added SHA256 checksum verifications. The go.mod file reflects an updated Go version and numerous dependency upgrades to ensure compatibility with the latest releases. The core build processes and configuration steps remain unchanged. Changes
Suggested reviewers
Poem
Warning There were issues while running some tools. Please review the errors and either fix the tool’s configuration or disable the tool if it’s a critical failure. 🔧 golangci-lint (1.62.2)level=warning msg="[runner] Can't run linter goanalysis_metalinter: buildir: failed to load package ethsecp256k1: could not load export data: no export data for "github.com/InjectiveLabs/sdk-go/chain/crypto/ethsecp256k1"" Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (2)
Dockerfile(1 hunks)go.mod(4 hunks)
🔇 Additional comments (4)
Dockerfile (1)
5-8: LGTM! Security improvement with SHA256 verification.The addition of SHA256 checksum verification for libwasmvm libraries enhances security by ensuring the integrity of downloaded artifacts.
go.mod (3)
223-236: LGTM! Consistent dependency overridesThe replace directives maintain consistency by using InjectiveLabs forks of core dependencies, which is the expected pattern for chain-specific customizations.
46-46:✅ Verification successful
Verify compatibility between wasmvm and bbolt updates
Critical dependencies updated:
- CosmWasm/wasmvm/v2: v2.1.2
- go.etcd.io/bbolt: v1.4.0-alpha
These are core components. Please ensure thorough testing of state management and WASM contract execution.
Also applies to: 193-193
🌐 Web query:
Are there any known compatibility issues between CosmWasm/wasmvm v2.1.2 and bbolt v1.4.0-alpha?💡 Result:
Based on the provided search results, there are no documented compatibility issues specifically between CosmWasm/wasmvm v2.1.2 and bbolt v1.4.0-alpha. However, here’s a breakdown of relevant findings:
Key Observations:
Known Issues with
bbolt(v1.x):
- A data corruption issue exists on Linux systems with ext4’s "fast commit" feature enabled (kernel versions <5.17)[5]. This affects writes/truncates but isn’t directly tied to CosmWasm.
- Zero-length value writes always return empty
[]byte{}[5].CosmWasm/wasmvm Updates:
- Provenance blockchain updated
github.com/CosmWasm/wasmvm/v2to v2.1.3 and later v2.1.4 in its dependencies[6], suggesting incremental stability fixes but no explicit mention ofbbolt-related changes.- A separate vulnerability (GO-2025-3449) affecting performance in older
wasmvmversions (pre-2.0.6/2.1.x)[3] exists but does not involvebbolt.Conclusion:
No direct incompatibility between wasmvm v2.1.x and bbolt v1.x is documented in the provided sources[3][5][6]. For safety:
- Ensure your Linux kernel is ≥5.17 if using ext4[5].
- Consider updating to newer
wasmvmversions (e.g., ≥v2.1.5) for security fixes[3].Citations:
- 1: https://github.com/CosmWasm/cosmwasm/blob/main/CHANGELOG.md
- 2: https://cert-manager.io/docs/releases/release-notes/release-notes-1.14/
- 3: https://vulert.com/vuln-db/go-github-com-cosmwasm-wasmvm-182494
- 4: https://cosmwasm.com/about
- 5: https://pkg.go.dev/go.etcd.io/bbolt
- 6: https://github.com/provenance-io/provenance/blob/main/CHANGELOG.md
- 7: https://github.com/CosmWasm/cosmwasm/issues
- 8: https://docs.influxdata.com/influxdb/v2/reference/release-notes/influxdb/
- 9: Incompatible format of compiled wasm modules between wasmvm 1.2.1 and 1.2.2 CosmWasm/wasmvm#426
- 10: https://cosmwasm.com
Compatibility Check Verified: No Documented Issues
The dependency updates in go.mod—CosmWasm/wasmvm v2.1.2 and go.etcd.io/bbolt v1.4.0-alpha—do not exhibit any documented compatibility issues based on the latest available information. That said, please note the following considerations:
- Linux File Systems: For systems using ext4, ensure the kernel is ≥5.17 if "fast commit" is enabled to avoid known bbolt issues.
- Testing: Continue to thoroughly test state management and WASM contract execution in your environment.
- Additional References: The same considerations apply to the similar dependency update noted at lines 193-193.
10-10:❓ Verification inconclusive
Caution: Using release candidate version
github.com/InjectiveLabs/sdk-go v1.56.0-rc3is a release candidate version. Consider waiting for the stable release before upgrading in production.
🌐 Web query:
Is there a stable release of InjectiveLabs/sdk-go newer than v1.56.0-rc3?💡 Result:
Based on the search results, there is no indication of a stable release for InjectiveLabs/sdk-go newer than v1.56.0-rc3. The latest confirmed stable versions referenced in the search results are:
- v1.55.1 (listed as the latest release on GitHub as of two weeks before February 2025) [5].
- v1.49 (mentioned in Go SDK updates from January 2024) [3].
The search results include pre-release versions like v1.54.2-0 (December 2024) and v1.56 candidates (e.g.,
rc3), but no stable releases beyond these versions are documented in the provided sources[4][8].For real-time updates, check the official GitHub repository or package registries like npm for TypeScript SDK releases[9][10].
Citations:
- 1: https://github.com/InjectiveLabs/injective-chain-releases/releases
- 2: https://pkg.go.dev/github.com/InjectiveLabs/sdk-go/chain/types
- 3: https://api.injective.exchange
- 4: https://deps.dev/go/github.com%2FInjectiveLabs%2Fsdk-go/v1.43.3-0.20221121030154-e906910746a0/versions
- 5: https://github.com/InjectiveLabs/sdk-go
- 6: https://github.com/InjectiveLabs/sdk-go/blob/master/NOTICE.md
- 7: https://pkg.go.dev/github.com/InjectiveLabs/sdk-go
- 8: https://deps.dev/go/github.com%2FInjectiveLabs%2Fsdk-go/v1.43.3-0.20221121030154-e906910746a0
- 9: https://www.npmjs.com/package/@injectivelabs/sdk-ts?activeTab=dependents
- 10: https://www.npmjs.com/package/@injectivelabs/sdk-ts/v/1.0.92?activeTab=versions
Caution: Release Candidate Usage in Production
The dependency in
go.mod:github.com/InjectiveLabs/sdk-go v1.56.0-rc3is using a release candidate version. Our investigation confirms that no stable release newer than this candidate exists – the latest stable version is v1.55.1. If this upgrade is intended for production, please ensure that:
- Extensive testing has been performed to validate the release candidate’s stability.
- Any compatibility or security implications with the critical updates have been thoroughly verified.
- You consider downgrading to the stable v1.55.1 if production reliability is paramount.
| @@ -1,9 +1,11 @@ | |||
| #install packages for build layer | |||
| FROM golang:1.22-alpine AS builder | |||
| FROM golang:1.22.5-alpine AS builder | |||
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Version mismatch between Dockerfile and go.mod
The Dockerfile uses Go 1.22.5 while go.mod specifies Go 1.22.2. This could lead to inconsistencies between development and build environments.
🌐 Web query:
What is the latest stable version of Go 1.22.x?
💡 Result:
The latest stable version of Go 1.22.x is Go 1.22.12, released on February 4, 2025[5][7]. This minor revision includes security fixes to the crypto/elliptic package and bug fixes to the compiler and go command[5].
Key details about Go 1.22's maintenance status:
- Officially supported until two subsequent major releases (Go 1.24) arrive[7]
- Follows a regular release cadence with security/bug fix updates every ~6 weeks
- Latest patch versions address vulnerabilities while maintaining backward compatibility[5]
For production environments, using Go 1.22.12 ensures you receive critical security updates while maintaining compatibility with existing codebases targeting Go 1.22[7].
Citations:
- 1: https://tip.golang.org/doc/go1.22
- 2: https://www.ompluscator.com/article/golang/standard-lib-version/
- 3: https://github.com/golang/tools/releases
- 4: https://blog.stackademic.com/unveiling-go-1-22-enhancements-performance-boosts-and-library-additions-62ff283476fb
- 5: https://go.dev/doc/devel/release
- 6: https://groups.google.com/g/golang-dev/c/4RA8zxQG8uk
- 7: https://endoflife.date/go
- 8: https://go.dev/dl/
- 9: https://dev.golang.org/release
Align Go versions in Dockerfile and go.mod for consistency
The Dockerfile currently specifies the base image as:
FROM golang:1.22.5-alpine AS builderwhile the go.mod file sets Go to 1.22.2. Since the latest stable release in the Go 1.22 series is now 1.22.12 (which includes important security and bug fixes), it’s advisable to update both the Dockerfile and go.mod to reference Go 1.22.12. This alignment will help prevent any discrepancies between your build and development environments.
- Dockerfile (line 2): Change to
FROM golang:1.22.12-alpine AS builder - go.mod: Update the Go version specification to
1.22.12
Summary by CodeRabbit