bump: cometbft to v0.38.19 #446

beer-1 · 2025-10-15T05:46:47Z

Description

Bump cometbft to latest to patch security update

Author Checklist

All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.

I have...

included the correct type prefix in the PR title, you can find examples of the prefixes below:
confirmed ! in the type prefix if API or client breaking change
targeted the correct branch
provided a link to the relevant issue or specification
reviewed "Files changed" and left comments if necessary
included the necessary unit and integration tests
updated the relevant documentation or specification, including comments for documenting Go code
confirmed all CI checks have passed

Reviewers Checklist

All items are required. Please add a note if the item is not applicable and please add
your handle next to the items reviewed if you only reviewed selected items.

I have...

confirmed the correct type prefix in the PR title
confirmed all author checklist items have been addressed
reviewed state machine logic, API design and naming, documentation is accurate, tests and test coverage

coderabbitai · 2025-10-15T05:46:58Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

.github/workflows/dependency-review.yml is excluded by !**/*.yml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

📝 Walkthrough

Walkthrough

Removed the ReIndexEventCmd CLI subcommand from initiad by deleting its import and the line adding it to rootCmd. No other exported/public declarations changed.

Changes

Cohort / File(s)	Summary
CLI subcommand cleanup `cmd/initiad/root.go`	Removed import of `github.com/cometbft/cometbft/cmd/cometbft/commands` and the addition of `ReIndexEventCmd` to `rootCmd`, effectively dropping that subcommand.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    actor U as User
    participant C as initiad CLI (rootCmd)
    participant S as Subcommands

    U->>C: initiad <subcommand> [args]
    C->>S: Dispatch to registered subcommand
    Note over S: ReIndexEventCmd REMOVED<br/>(no longer registered)
    S-->>C: Execute (if subcommand exists)
    C-->>U: Output / exit code

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

I nibbled a flag from the clover of code,
A tiny subcommand hops off the road.
No more reindex burrows to seek,
The garden’s neater, lean and sleek.
Thump-thump—release the clean,
A rabbit proud of paths unseen. 🥕

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title Check	✅ Passed	The title succinctly indicates the primary change of the pull request, which is bumping the cometbft dependency to version v0.38.19.
Description Check	✅ Passed	The description directly states that the pull request upgrades cometbft to patch a security issue and includes related context, making it clearly relevant to the changeset.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2025-10-15T05:47:00Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 8 package(s) with unknown licenses.

See the Details below.

License Issues

go.mod

Package	Version	License	Issue Type
golang.org/x/crypto	0.36.0	Null	Unknown License
golang.org/x/net	0.38.0	Null	Unknown License
golang.org/x/sync	0.12.0	Null	Unknown License
golang.org/x/sys	0.31.0	Null	Unknown License
golang.org/x/term	0.30.0	Null	Unknown License
golang.org/x/text	0.23.0	Null	Unknown License
golang.org/x/time	0.9.0	Null	Unknown License
google.golang.org/protobuf	1.36.5	Null	Unknown License

Allowed Licenses:
Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense, CC0-1.0, Zlib, MIT-0, PostgreSQL, BSL-1.0, MPL-2.0, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

gomod/github.com/bits-and-blooms/bitset

1.20.0

🟢 7.3

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 5	Found 8/14 approved changesets -- score normalized to 5
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Packaging	⚠️ -1	packaging workflow not detected
Dependency-Update-Tool	🟢 10	update tool detected
Maintained	🟢 8	9 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 8
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
License	🟢 10	license file detected
CI-Tests	🟢 10	10 out of 10 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 17 contributing companies or organizations

gomod/github.com/cockroachdb/pebble

1.1.5

🟢 5.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Code-Review	🟢 10	all changesets reviewed
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

gomod/github.com/consensys/gnark-crypto

0.18.0

Unknown

gomod/github.com/crate-crypto/go-eth-kzg

1.3.0

Unknown

gomod/github.com/crate-crypto/go-ipa

0.0.0-20240724233137-53bbb0ceb27a

🟢 5.5

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

gomod/github.com/decred/dcrd/dcrec/secp256k1/v4

4.4.0

🟢 7.5

Details

Check	Score	Reason
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	🟢 5	5 existing vulnerabilities detected

gomod/github.com/ethereum/c-kzg-4844/v2

2.1.0

🟢 6.4

Details

Check	Score	Reason
Code-Review	🟢 6	Found 11/17 approved changesets -- score normalized to 6
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 9	binaries present in source code
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	🟢 7	3 existing vulnerabilities detected

gomod/github.com/ethereum/go-ethereum

1.16.0

🟢 7

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 9	Found 28/30 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 9	binaries present in source code
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

gomod/github.com/ethereum/go-verkle

0.2.2

🟢 4.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 24/30 approved changesets -- score normalized to 8
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	🟢 7	SAST tool detected but not run on all commits

gomod/github.com/holiman/uint256

1.3.2

🟢 4.7

Details

Check	Score	Reason
Code-Review	🟢 7	Found 23/30 approved changesets -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ -1	No tokens found
Maintained	⚠️ 2	3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	⚠️ -1	no workflows found
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

gomod/github.com/initia-labs/cometbft

0.0.0-20251015032510-ebe92607f9c2

Unknown

gomod/github.com/prometheus/client_golang

1.21.0

🟢 8

Details

Check	Score	Reason
Dependency-Update-Tool	🟢 10	update tool detected
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 9	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 10	license file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	🟢 9	SAST tool detected but not run on all commits
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
CI-Tests	🟢 10	24 out of 24 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 37 contributing companies or organizations

gomod/github.com/spf13/cobra

1.9.1

🟢 7.1

Details

Check	Score	Reason
Maintained	🟢 7	4 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 7
Code-Review	🟢 8	Found 21/25 approved changesets -- score normalized to 8
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

gomod/github.com/spf13/pflag

1.0.6

🟢 5.7

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 7	Found 11/14 approved changesets -- score normalized to 7
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

gomod/github.com/supranational/blst

0.3.14

🟢 6.2

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 9	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	19 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
SAST	🟢 10	SAST tool detected: CodeQL
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Vulnerabilities	🟢 10	0 existing vulnerabilities detected

gomod/golang.org/x/crypto

0.36.0

Unknown

gomod/golang.org/x/net

0.38.0

Unknown

gomod/golang.org/x/sync

0.12.0

Unknown

gomod/golang.org/x/sys

0.31.0

Unknown

gomod/golang.org/x/term

0.30.0

Unknown

gomod/golang.org/x/text

0.23.0

Unknown

gomod/golang.org/x/time

0.9.0

Unknown

gomod/google.golang.org/protobuf

1.36.5

Unknown

Scanned Files

go.mod

codecov · 2025-10-15T06:03:14Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.47%. Comparing base (1dbff7e) to head (2004834).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #446      +/-   ##
==========================================
- Coverage   41.69%   40.47%   -1.23%     
==========================================
  Files         320      307      -13     
  Lines       29347    28458     -889     
==========================================
- Hits        12236    11518     -718     
+ Misses      15290    15157     -133     
+ Partials     1821     1783      -38

see 24 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

bump cometbft to v0.38.19

0988d53

beer-1 self-assigned this Oct 15, 2025

beer-1 requested a review from a team as a code owner October 15, 2025 05:46

beer-1 added 3 commits October 16, 2025 17:30

update to use allow-licenses

c8f5c6e

split with comma

d48c510

fix name of license

2004834

beer-1 merged commit d43f6b5 into main Oct 22, 2025
10 of 11 checks passed

beer-1 deleted the bump/cometbft branch October 22, 2025 02:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

bump: cometbft to v0.38.19 #446

bump: cometbft to v0.38.19 #446

Uh oh!

beer-1 commented Oct 15, 2025

Uh oh!

coderabbitai bot commented Oct 15, 2025 •

edited

Loading

Review skipped

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Poem

Uh oh!

github-actions bot commented Oct 15, 2025 •

edited

Loading

Uh oh!

codecov bot commented Oct 15, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bump: cometbft to v0.38.19 #446

bump: cometbft to v0.38.19 #446

Uh oh!

Conversation

beer-1 commented Oct 15, 2025

Description

Author Checklist

Reviewers Checklist

Uh oh!

coderabbitai bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Poem

Pre-merge checks and finishing touches

Uh oh!

github-actions bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

License Issues

go.mod

OpenSSF Scorecard

Scanned Files

Uh oh!

codecov bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai bot commented Oct 15, 2025 •

edited

Loading

github-actions bot commented Oct 15, 2025 •

edited

Loading

codecov bot commented Oct 15, 2025 •

edited

Loading