This release introduces bug fixes and improvements on the Cosmos SDK v0.44 series.
The main performance improvement concerns gRPC queries, which are now able to run concurrently on the node (#10045). To benefit from this performance boost, make sure to send your gRPC queries to the gRPC server directly (default port 9090) instead of using the Tendermint RPC abci_query endpoint (default port 26657).
Recently, the Cosmos-SDK team became aware of a high-severity security vulnerability that impacts Cosmos-SDK v0.43.x and v0.44.x and can result in a consensus halt. User funds are NOT at risk; however, the vulnerability can result in a chain halt. This vulnerability does not impact the current Cosmos Hub, though other Cosmos-SDK based blockchains using v0.43.x or v0.44.x may be affected and are advised to update to v0.44.2 immediately.
Nodes can update their software independently of each other (no coordinated chain restart necessary), but should do so as soon as they are able.
A full disclosure will be published a week after the release.
Cosmos SDK v0.44.1 Release Notes
This release introduces bug fixes and improvements on the Cosmos SDK v0.44 series.
The main bug fix concerns all users performing in-place store migrations from v0.42 to v0.44. A source of non-determinism in the upgrade process has been detected and fixed in this release, causing consensus errors. As such, v0.44.0 is not safe to use when performing v0.42->v0.44 in-place store upgrades, please use this release v0.44.1 instead. This does not impact genesis JSON dump upgrades nor fresh chains starting with v0.44.
Another bug fix concerns calling the ABCI Query method using client.Context. We modified ABCI queries to use abci.QueryRequest's Height field if it is non-zero, otherwise continue using client.Context's height. This is a minor client-breaking change for users of the client.Context.
Some CLI fixes are also included, such as:
using pre-configured data for the CLI add-genesis-account command (#9969),
ensuring the init command reads the --home flag value correctly (#10104),
fixing the error message when period or period-limit flag is not set on a feegrant grant transaction #10049.
v0.44.1 also includes performance improvements, namely:
IAVL update to v0.17.1 which includes performance improvements on a batch load #10040,
Speedup coins.AmountOf(), by removing many intermittent regex calls #10021,
Improve CacheKVStore datastructures / algorithms, to no longer take O(N^2) time when interleaving iterators and insertions #10026.
#10024store/cachekv performance improvement by reduced growth factor for iterator ranging by using binary searches to find dirty items when unsorted key count >= 1024.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps github.com/cosmos/cosmos-sdk from 0.39.3 to 0.44.3.
Release notes
Sourced from github.com/cosmos/cosmos-sdk's releases.
... (truncated)
Changelog
Sourced from github.com/cosmos/cosmos-sdk's changelog.
... (truncated)
Commits
b75c29f
chore: v0.44.3 release notes and changelog (#10416)0592ba6
build: Update gin-gonic/gin to v1.7.0 (backport #10401) (#10410)c55b241
fix: rosettagetHeight
function to use tmRPC.GenesisChunked() instead tmRPC...f537f99
chore: backport release-v0.44.2 (#10349)6079fe1
fix!: store/cachekv: reduce growth factor for iterator ranging using binary s...a1521fd
build(deps): bump github.com/tendermint/tendermint from 0.34.13 to 0.34.14 (b...5b79b76
perf: Only do memory allocation when zero coin is found (backport #10339) (#1...f11689b
fix: null guard for tx fee amounts (backport #10327) (#10342)64cc3a7
chore: [x/feegrant] remove unnecessary logging in simulation (backport #10262...7a03a18
fix!: remove grpc query routing through tendermint (backport #10045) (#10269)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)