Skip to content
This repository has been archived by the owner on Oct 15, 2024. It is now read-only.

dep: update deps that were reported in OSV issues #179

Merged
merged 8 commits into from
Jan 28, 2023

Conversation

j75689
Copy link
Contributor

@j75689 j75689 commented Jan 12, 2023

Description

This pr updates some dependencies to newer versions.

Rationale

Some dependency was found in OSV-reported issues. update them for security.
refer: https://github.com/google/osv-scanner

╭───────────────────────────────────────────────────┬───────────┬─────────────────────────────────────┬───────────────────────────────────┬──────────────────────────╮ ≈
│ OSV URL (ID IN BOLD)                              │ ECOSYSTEM │ PACKAGE                             │ VERSION                           │ SOURCE                   │
├───────────────────────────────────────────────────┼───────────┼─────────────────────────────────────┼───────────────────────────────────┼──────────────────────────┤ ≈
│ https://osv.dev/vulnerability/GHSA-2chg-86hq-7w38 │ Go        │ github.com/btcsuite/btcd            │ 0.0.0-20190115013929-ed77733ec07d │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2022-1098        │           │                                     │                                   │                          │
│ https://osv.dev/vulnerability/GO-2022-0322        │ Go        │ github.com/prometheus/client_golang │ 0.9.1                             │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2021-0227        │ Go        │ golang.org/x/crypto                 │ 0.0.0-20200622213623-75b288015ac9 │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2022-0968        │ Go        │ golang.org/x/crypto                 │ 0.0.0-20200622213623-75b288015ac9 │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2021-0356        │ Go        │ golang.org/x/crypto                 │ 0.0.0-20200622213623-75b288015ac9 │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2022-0236        │ Go        │ golang.org/x/net                    │ 0.0.0-20201021035429-f5854403a974 │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2021-0238        │ Go        │ golang.org/x/net                    │ 0.0.0-20201021035429-f5854403a974 │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2022-0288        │ Go        │ golang.org/x/net                    │ 0.0.0-20201021035429-f5854403a974 │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2022-0969        │ Go        │ golang.org/x/net                    │ 0.0.0-20201021035429-f5854403a974 │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2022-1144        │ Go        │ golang.org/x/net                    │ 0.0.0-20201021035429-f5854403a974 │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2022-0493        │ Go        │ golang.org/x/sys                    │ 0.0.0-20200930185726-fdedc70b468f │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2021-0113        │ Go        │ golang.org/x/text                   │ 0.3.3                             │ ../bnc-tendermint/go.mod │
│ https://osv.dev/vulnerability/GO-2022-1059        │ Go        │ golang.org/x/text                   │ 0.3.3                             │ ../bnc-tendermint/go.mod │
╰───────────────────────────────────────────────────┴───────────┴─────────────────────────────────────┴───────────────────────────────────┴──────────────────────────╯

Example

The following commits are used to verify the compatibility:
original: https://github.com/j75689/bnc-tendermint/blob/cf1e338824f9409876b85527f38f1948effd505f/crypto/secp256k1/secp256k1_internal_test.go#L1019
new: https://github.com/j75689/bnc-tendermint/blob/34773fd8f16c06c6f4119b178bc5a8b23b2dc3f2/crypto/secp256k1/secp256k1_internal_test.go#L1019

Changes

Notable changes:

  • go.mod
  • crypto/secp256k1

// PrivKeySecp256k1 implements PrivKey.
type PrivKeySecp256k1 [32]byte
// PrivKey implements PrivKey.
type PrivKeySecp256k1 []byte
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is the motivation to change from array to slice? Is it possible to have more than 32 or less than 32 bytes now?

@@ -1,23 +0,0 @@
// +build libsecp256k1
Copy link

@brilliant-lx brilliant-lx Jan 16, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BSC use secp256k1_cgo.go, which is removed in this PR, is it reasonable?
And crypto/secp256k1/secp256k1.go uses btcd, which is nocgo.

@unclezoro unclezoro merged commit 1295ea7 into bnb-chain:develop Jan 28, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants