renovate[bot]
commented
3 months ago ⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
- any of the package files in this branch needs updating, or
- the branch becomes conflicted, or
- you click the rebase/retry checkbox if found above, or
- you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: go.sum
Command failed: go get -d -t ./...
go: downloading github.com/localtunnel/go-localtunnel v0.0.0-20170326223115-8a804488f275
go: downloading github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2
go: downloading github.com/pkg/browser v0.0.0-20210621091255-c198bc921a84
go: downloading github.com/urfave/cli/v2 v2.3.0
go: downloading golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
go: downloading github.com/stretchr/testify v1.7.0
go: downloading github.com/xplorfin/netutils v0.45.0
go: downloading golang.org/x/net v0.0.0-20210614182718-04defd469f4e
go: downloading github.com/btcsuite/btcd v0.24.0
go: downloading github.com/fiatjaf/go-lnurl v1.3.1
go: downloading github.com/brianvoe/gofakeit/v5 v5.11.2
go: downloading github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
go: downloading golang.org/x/sys v0.0.0-20210514084401-e8d321eab015
go: downloading github.com/davecgh/go-spew v1.1.1
go: downloading github.com/pmezard/go-difflib v1.0.0
go: downloading gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c
go: downloading github.com/fasthttp/router v1.4.0
go: downloading github.com/integralist/go-findroot v0.0.0-20160518114804-ac90681525dc
go: downloading github.com/jarcoal/httpmock v1.0.8
go: downloading github.com/valyala/fasthttp v1.28.0
go: downloading github.com/xplorfin/filet v0.3.0
go: downloading github.com/yudai/gojsondiff v1.0.0
go: downloading github.com/cpuguy83/go-md2man/v2 v2.0.0
go: downloading github.com/tidwall/gjson v1.6.0
go: downloading github.com/savsgio/gotils v0.0.0-20210617111740-97865ed5a873
go: downloading github.com/valyala/bytebufferpool v1.0.0
go: downloading github.com/andybalholm/brotli v1.0.2
go: downloading github.com/klauspost/compress v1.12.2
go: downloading github.com/spf13/afero v1.6.0
go: downloading github.com/jpillora/backoff v1.0.0
go: downloading github.com/EDDYCJY/fake-useragent v0.2.0
go: downloading github.com/sergi/go-diff v1.1.0
go: downloading github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82
go: downloading github.com/russross/blackfriday/v2 v2.0.1
go: downloading github.com/tidwall/match v1.0.1
go: downloading github.com/tidwall/pretty v1.0.0
go: downloading golang.org/x/text v0.3.6
go: downloading github.com/shurcooL/sanitized_anchor_name v1.0.0
go: downloading github.com/PuerkitoBio/goquery v1.6.1
go: downloading github.com/andybalholm/cascadia v1.1.0
go: downloading github.com/btcsuite/btcd v0.24.2
go: github.com/xplorfin/lnurlauth/integration imports
github.com/btcsuite/btcd/btcec: cannot find module providing package github.com/btcsuite/btcd/btcec
This PR contains the following updates:
v0.21.0-beta->v0.24.0GitHub Vulnerability Alerts
CVE-2022-44797
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
Specific Go Packages Affected
github.com/btcsuite/btcd/wire
CVE-2024-34478
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
Release Notes
btcsuite/btcd (github.com/btcsuite/btcd)
### [`v0.24.0`](https://togithub.com/btcsuite/btcd/releases/tag/v0.24.0): btcd v0.24.0 [Compare Source](https://togithub.com/btcsuite/btcd/compare/v0.23.4...v0.24.0) This release is a major release that includes several general bug fixes, **security bug fixes** (please update!), and also a series of performance improvements that dramatically reduce the time for initial block download from ~45 hours+ to around 6 hours! With this release,`btcd` now also supports BIP 155 and has gained support for pruning (`--prune=MiB`). ### Verifying the Release In order to verify the release, you'll need to have `gpg` or `gpg2` installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already: curl https://raw.githubusercontent.com/lightningnetwork/lnd/master/scripts/keys/roasbeef.asc | gpg --import Once you have the required PGP keys, you can verify the release (assuming `manifest-roasbeef-v0.24.0.sig` and `manifest-v0.24.0.txt` are in the current directory) with: gpg --verify manifest-roasbeef-v0.24.0.sig manifest-v0.24.0.txt You should see the following if the verification was successful: gpg: Signature made Sat Dec 30 17:11:22 2023 PST gpg: using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306 gpg: Good signature from "Olaoluwa OsuntokunConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.