Update to Cadence v1.10.3#97
Conversation
📝 WalkthroughWalkthroughGo toolchain and module dependencies are systematically updated: toolchain bumped to 1.25.1, primary Flow/Ethereum/OpenTelemetry/gRPC/protobuf packages upgraded, with widespread indirect dependency version changes across cloud infrastructure, contract libraries, and utility packages. ChangesDependency Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 10: Update the pinned dependency for the Ethereum client in go.mod from
github.com/ethereum/go-ethereum v1.16.8 to v1.16.9 (or any later patched
release) to address the reported p2p/ECIES vulnerabilities; after changing the
version string for module github.com/ethereum/go-ethereum, run the module update
commands (eg. go get github.com/ethereum/go-ethereum@v1.16.9 and go mod tidy)
and re-run CI/build to ensure transitive updates and compilation succeed.
- Line 20: Update the OpenTelemetry modules to a safe version by bumping the
go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk entries from v1.39.0
to v1.41.0 (or later) in go.mod to remediate GHSA-mh2q-q3fh-2475 and
GO-2026-4394; after editing the go.mod, run the module tooling (e.g., go get
go.opentelemetry.io/otel@v1.41.0 and go get
go.opentelemetry.io/otel/sdk@v1.41.0, then go mod tidy) to update dependencies
and verify builds/tests pass.
- Line 64: Update the indirect dependency github.com/go-jose/go-jose/v4 from
v4.1.3 to v4.1.4 in go.mod to patch CVE-2026-34986; after changing the version
entry for github.com/go-jose/go-jose/v4 to v4.1.4 run go mod tidy and go list -m
all to ensure the new version is resolved, and audit any code paths that parse
JWE (look for uses of go-jose types and functions) to confirm key-wrapping
algorithms and empty encrypted_key fields are not accepted from untrusted input
if the update cannot be applied.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 18499959-a5b2-45fc-82b7-167bf6d4c37e
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 | ||
| github.com/dgraph-io/badger/v3 v3.2103.2 | ||
| github.com/ethereum/go-ethereum v1.16.5 | ||
| github.com/ethereum/go-ethereum v1.16.8 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the first patched go-ethereum version for GO-2026-4507, GO-2026-4508, GO-2026-4511, GHSA-2gjw-fg97-vg3r, GHSA-689v-6xwf-5jf3, and GHSA-m6j8-rg6r-7mv8?
💡 Result:
The first patched go-ethereum version for the specified vulnerabilities is v1.16.9 [1][2]. These vulnerabilities were addressed in the security hot-fix release v1.16.9, published on February 17, 2026 [1][3]. The specific vulnerabilities covered by this release include: - GO-2026-4507 (GHSA-2gjw-fg97-vg3r / CVE-2026-26314): Denial of Service via malicious p2p message [4][5][6]. - GO-2026-4508 (GHSA-689v-6xwf-5jf3 / CVE-2026-26313): Denial of Service via malicious p2p message [7][8]. - GO-2026-4511 (GHSA-m6j8-rg6r-7mv8 / CVE-2026-26315): Improper validation of the ECIES public key in the RLPx handshake [9][10]. All three vulnerabilities were resolved in v1.16.9, and they are also included in the subsequent feature release, v1.17.0 [1][2]. Users are strongly recommended to upgrade to at least v1.16.9 to mitigate these issues [1][2].
Citations:
- 1: https://github.com/ethereum/go-ethereum/releases/tag/v1.16.9
- 2: https://github.com/ethereum/go-ethereum/releases/tag/v1.17.0
- 3: https://newreleases.io/project/github/ethereum/go-ethereum/release/v1.16.9
- 4: x/vulndb: potential Go vuln in github.com/ethereum/go-ethereum: GHSA-2gjw-fg97-vg3r golang/vulndb#4507
- 5: https://nvd.nist.gov/vuln/detail/CVE-2026-26314
- 6: https://pkg.go.dev/vuln/GO-2026-4507
- 7: https://pkg.go.dev/vuln/GO-2026-4508
- 8: GHSA-689v-6xwf-5jf3
- 9: https://pkg.go.dev/vuln/GO-2026-4511
- 10: https://osv.dev/vulnerability/GO-2026-4511
Upgrade go-ethereum to v1.16.9 or later before merge.
Line 10 pins github.com/ethereum/go-ethereum v1.16.8, which contains three HIGH severity vulnerabilities in the p2p protocol: GO-2026-4507, GO-2026-4508 (both DoS via malicious p2p messages), and GO-2026-4511 (improper ECIES public key validation in RLPx handshake). These are patched in v1.16.9 (released February 17, 2026) and must be fixed for network-facing components.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum
(GO-2026-4507)
[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum affected by DoS via malicious p2p message in github.com/ethereum/go-ethereum
(GO-2026-4508)
[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake in github.com/ethereum/go-ethereum
(GO-2026-4511)
[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum affected by DoS via malicious p2p message
[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum affected by DoS via malicious p2p message
[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 10, Update the pinned dependency for the Ethereum client in
go.mod from github.com/ethereum/go-ethereum v1.16.8 to v1.16.9 (or any later
patched release) to address the reported p2p/ECIES vulnerabilities; after
changing the version string for module github.com/ethereum/go-ethereum, run the
module update commands (eg. go get github.com/ethereum/go-ethereum@v1.16.9 and
go mod tidy) and re-run CI/build to ensure transitive updates and compilation
succeed.
| github.com/rs/zerolog v1.29.0 | ||
| github.com/stretchr/testify v1.11.1 | ||
| go.opentelemetry.io/otel v1.37.0 | ||
| go.opentelemetry.io/otel v1.39.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What are the first fixed versions for GHSA-mh2q-q3fh-2475 and GO-2026-4394 (including GHSA-9h8m-3fm2-qjrq / GHSA-hfvc-g4fc-pqhx) in go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk?
💡 Result:
The first fixed versions for the specified vulnerabilities in the OpenTelemetry Go SDK are as follows: For GHSA-mh2q-q3fh-2475 (also tracked as CVE-2026-29181), which concerns excessive allocations during multi-value baggage header extraction, the first fixed version is v1.41.0 [1]. For GO-2026-4394 (also tracked as GHSA-9h8m-3fm2-qjrq and CVE-2026-24051), which concerns arbitrary code execution via PATH hijacking on macOS/Darwin, the first fixed version is v1.40.0 [2][3][4]. These vulnerabilities affect the go.opentelemetry.io/otel/sdk module [1][2][3]. GHSA-mh2q-q3fh-2475 also affects the go.opentelemetry.io/otel/propagation module [1].
Citations:
- 1: GHSA-mh2q-q3fh-2475
- 2: https://pkg.go.dev/vuln/GO-2026-4394
- 3: GHSA-9h8m-3fm2-qjrq
- 4: https://osv.dev/vulnerability/GHSA-9h8m-3fm2-qjrq
Upgrade otel and otel/sdk to v1.41.0 or later to address critical vulnerabilities.
Both modules at v1.39.0 are vulnerable to GHSA-mh2q-q3fh-2475 (excessive allocations during baggage header extraction) and GO-2026-4394 (PATH-hijacking RCE on macOS/Darwin). Upgrade to at least v1.41.0 to fix both issues.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 20-20: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 20, Update the OpenTelemetry modules to a safe version by
bumping the go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk entries
from v1.39.0 to v1.41.0 (or later) in go.mod to remediate GHSA-mh2q-q3fh-2475
and GO-2026-4394; after editing the go.mod, run the module tooling (e.g., go get
go.opentelemetry.io/otel@v1.41.0 and go get
go.opentelemetry.io/otel/sdk@v1.41.0, then go mod tidy) to update dependencies
and verify builds/tests pass.
| github.com/filecoin-project/go-clock v0.1.0 // indirect | ||
| github.com/fxamacker/golang-lru/v2 v2.0.0-20250716153046-22c8d17dc4ee // indirect | ||
| github.com/go-jose/go-jose/v4 v4.1.1 // indirect | ||
| github.com/go-jose/go-jose/v4 v4.1.3 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Find direct imports/usages in repository =="
rg -n --type=go -C2 'go-jose|jose\.'
echo
echo "== Show dependency pin in go.mod =="
rg -n 'github.com/go-jose/go-jose/v4' go.modRepository: onflow/rosetta
Length of output: 105
🏁 Script executed:
cat -n go.mod | head -100Repository: onflow/rosetta
Length of output: 5744
🏁 Script executed:
wc -l go.modRepository: onflow/rosetta
Length of output: 69
🏁 Script executed:
rg -i 'go-jose|jose' --type=go --type=modRepository: onflow/rosetta
Length of output: 86
🏁 Script executed:
# Check go.mod to see which dependencies are direct
rg -n 'require \(' go.mod -A 30
# Search more broadly for any JWE/JWT operations
rg -n --type=go 'jwe|jwt|jose' -iRepository: onflow/rosetta
Length of output: 5323
🌐 Web query:
go-jose v4.1.3 JWE decrypt panic security advisory CVE
💡 Result:
The security vulnerability affecting go-jose v4.1.3 is tracked as CVE-2026-34986 (also identified by GHSA-78h2-9frx-2jm8) [1][2][3]. This vulnerability involves a panic during the decryption of a JSON Web Encryption (JWE) object, which can lead to a denial-of-service (DoS) condition [1][4][5]. The panic is triggered when the JWE 'alg' field specifies a key wrapping algorithm (specifically those ending in 'KW', excluding 'A128GCMKW', 'A192GCMKW', and 'A256GCMKW') and the 'encrypted_key' field is empty [1][2][3]. The issue occurs because the 'cipher.KeyUnwrap' function attempts to allocate a slice with a zero or negative length based on the empty 'encrypted_key' [1][5][6]. The vulnerability is fixed in go-jose version 4.1.4 (and v3.0.5 for the v3 branch) [1][2][7]. Applications are unaffected if they do not include key wrapping algorithms in the list of accepted key algorithms passed to 'ParseEncrypted', 'ParseEncryptedJSON', or 'ParseEncryptedCompact' [1][8][3]. As a mitigation, developers can pre-validate JWE objects to ensure the 'encrypted_key' field is non-empty before attempting decryption [1].
Citations:
- 1: GHSA-78h2-9frx-2jm8
- 2: https://cvefeed.io/vuln/detail/CVE-2026-34986
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-34986
- 4: https://advisories.gitlab.com/golang/github.com/go-jose/go-jose/v4/CVE-2026-34986/
- 5: https://vulert.com/vuln-db/CVE-2026-34986
- 6: https://cve.imfht.com/detail/CVE-2026-34986
- 7: https://github.com/go-jose/go-jose/releases
- 8: [Security] Multiple CVEs in Temporal Docker Images - Base Image Dependencies temporalio/temporal#9682
Bump go-jose/v4 to v4.1.4 to resolve JWE decryption panic (CVE-2026-34986).
go-jose/v4 v4.1.3 contains a critical DoS vulnerability (CVE-2026-34986) triggered by malformed JWE objects with key wrapping algorithms and empty encrypted_key fields. Upgrade to v4.1.4, or confirm that your dependency chain does not accept key-wrapping algorithms in JWE operations. This is an indirect dependency—verify it's only reachable through safe codepaths that reject untrusted payloads.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 64-64: github.com/go-jose/go-jose/v4 4.1.3: Go JOSE Panics in JWE decryption
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 64, Update the indirect dependency
github.com/go-jose/go-jose/v4 from v4.1.3 to v4.1.4 in go.mod to patch
CVE-2026-34986; after changing the version entry for
github.com/go-jose/go-jose/v4 to v4.1.4 run go mod tidy and go list -m all to
ensure the new version is resolved, and audit any code paths that parse JWE
(look for uses of go-jose types and functions) to confirm key-wrapping
algorithms and empty encrypted_key fields are not accepted from untrusted input
if the update cannot be applied.
2 participants
Description
Automatically update to:
Summary by CodeRabbit