Repository navigation
fix: bump jwt/v4, pgx/v5, klauspost/compress and gorilla/websocket - #1828
Conversation
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Dependency and version updates common/go.mod, database/go.mod, bridge-history-api/go.mod, coordinator/go.mod, rollup/go.mod, tests/integration-test/go.mod, common/version/version.go |
Multiple modules update dependency requirements. The common version tag changes to v4.8.8. |
Watcher test setup rollup/internal/controller/watcher/l2_watcher_test.go |
Both NewL2WatcherClient calls in the tests now receive an empty params.ChainConfig instead of nil. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Merge Risk: 
3812a
-
The dependency updates and watcher test setup have no established merge-blocking issue; the PR is ready for normal checks.
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi… Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Description check The description explains the dependency updates, security rationale, test fix, validation results, title convention, deployment version update, and breaking-change status. It matches the required temp… Title check The title is concise, uses the required conventional commit format, and clearly identifies the primary dependency updates in the pull request. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Description check
-
Explanation
The description explains the dependency updates, security rationale, test fix, validation results, title convention, deployment version update, and breaking-change status. It matches the required template.
-
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 2 files. (6 skipped: 6 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
-
Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #1828 +/- ##
===========================================
+ Coverage 30.71% 30.84% +0.13%
===========================================
Files 263 263
Lines 22827 22827
===========================================
+ Hits 7011 7041 +30
+ Misses 15127 15091 -36
- Partials 689 695 +6
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Purpose or design rationale of this PR
Dependency bumps for known vulnerabilities:
golang-jwt/jwt/v4v4.5.0 → v4.5.2 (GO-2025-3553, GO-2024-3250). The coordinator's JWT middleware parses tokens before authentication, so an unauthenticated client could cause excessive memory allocation.jackc/pgx/v5v5.5.4 → v5.9.2 (GO-2026-4771, GO-2026-4772, GO-2026-5004). The SQL injection requires the simple query protocol, which we do not enable.klauspost/compressv1.17.9 → v1.18.7 (GO-2026-5841) andgorilla/websocket→ v1.5.3 (GO-2026-6278). Neither vulnerable path is reachable in our binaries; these bumps clear GitHub alerts.Also fixes the flaky
TestFetchRunningMissingBlocks: it passed a nil chain config, which panics when the test L2 node has produced a block.govulncheck on the deployed binaries: reachable findings 34 → 30, none new.
PR title
Your PR title must follow conventional commits (as we are doing squash merge for each PR), so it must start with one of the following types:
Deployment tag versioning
Has
tagincommon/version.gobeen updated or have you addedbump-versionlabel to this PR?Breaking change label
Does this PR have the
breaking-changelabel?Summary by CodeRabbit