Provides several minor bug fixes, as well as fixes for several low-severity
security issues.
BUG FIXES
[state/kvindex] Querying event attributes that are bigger than int64 is now
enabled. We are not supporting reading floats from the db into the indexer
nor parsing them into BigFloats to not introduce breaking changes in minor
releases. (#771)
[pubsub] Pubsub queries are now able to parse big integers (larger than
int64). Very big floats are also properly parsed into very big integers
instead of being truncated to int64.
(#771)
IMPROVEMENTS
[rpc] Remove response data from response failure logs in order
to prevent large quantities of log data from being produced
(#654)
SECURITY FIXES
[rpc/jsonrpc/client]Low severity - Prevent RPC
client credentials from being inadvertently dumped to logs
(#787)
[cmd/cometbft/commands/debug/kill]Low severity - Fix unsafe int cast in
debug kill command (#793)
[consensus]Low severity - Avoid recursive call after rename to
(*PeerState).MarshalJSON
(#863)
[mempool/clist_mempool]Low severity - Prevent a transaction from
appearing twice in the mempool
(#890: @otrack)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps github.com/cometbft/cometbft from 0.37.1 to 0.37.2.
Release notes
Sourced from github.com/cometbft/cometbft's releases.
Changelog
Sourced from github.com/cometbft/cometbft's changelog.
Commits
fe45483
Release v0.37.2 (#972)9a453da
fix: avoid recursive call after rename to (*PeerState).MarshalJSON (#865) (#969)4f04b67
Add requirement forCheckTx
in ABCI spec (backport #928) (#965)3e6b456
build(deps): Bump docker/build-push-action from 4.0.0 to 4.1.1 (#959)79f182b
build(deps): Bump docker/setup-buildx-action from 2.5.0 to 2.7.0 (#958)3f62405
build(deps): Bump docker/login-action from 2.1.0 to 2.2.0 (#937)e45db5d
build(deps): Bump bufbuild/buf-setup-action from 1.20.0 to 1.21.0 (#936)9cbdef8
e2e: Generate prometheus.yaml on setup (#954) (#957)587522f
v0.37.x: Prevent a transaction to appear twice in the mempool (backport #890)...6c94617
build(deps): Bump bufbuild/buf-setup-action from 1.19.0 to 1.20.0 (#911)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)