Update to Cadence v1.7.0-preview.1 #87
Conversation
WalkthroughUpdated go.mod to bump Go version/toolchain and refresh a wide set of dependencies. This includes major upgrades across Flow, Ethereum (go-ethereum), OpenTelemetry, Google/AWS/cloud clients, golang.org/x modules, IPFS/Boxo, proto/grpc tooling, and several targeted replaces and indirect additions. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
go.mod (5)
113-128: AWS SDK v2 submodule versions driftMain v1.37.0 with mixed submodule minors (config 1.30.0, sts 1.35.0, etc.). This generally works, but aligning to a consistent minor reduces churn and surprises.
Optionally normalize with:
go get github.com/aws/aws-sdk-go-v2@v1.37.0 go get github.com/aws/aws-sdk-go-v2/{config,credentials,feature/ec2/imds,internal/{configsources,endpoints/v2,ini},service/{sso,ssooidc,sts}}@latest go mod tidy
266-269: Clean up confusing dual-version commentsThese lines include a second historical version in the comment, which can confuse readers and automated tools.
Apply:
- github.com/onflow/flow-core-contracts/lib/go/contracts v1.7.3 // indirect; v1.2.4-0.20230703193002-53362441b57d // indirect - github.com/onflow/flow-core-contracts/lib/go/templates v1.7.1 // indirect; v1.2.3 // indirect + github.com/onflow/flow-core-contracts/lib/go/contracts v1.7.3 // indirect + github.com/onflow/flow-core-contracts/lib/go/templates v1.7.1 // indirect
87-87: STUN v0 only an indirect dependency
No direct imports ofgithub.com/pion/stun(v0) were found in the codebase. Thev0entry in go.mod is pulled in transitively and can be safely ignored.• File: go.mod (line 87) –
github.com/pion/stun v0.x.x // indirect
• Action (optional): rungo mod tidyto remove the unused v0 indirect dependency and slim down your module graph.
33-35: Ensure gRPC/protobuf/genproto and your code-gen plugins stay in syncFrom your module list and Makefile:
- go.mod pins
- google.golang.org/grpc v1.74.2
- google.golang.org/protobuf v1.36.6
- google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2
- Makefile (line 131) only invokes:
(noprotoc --proto_path=model --go_out=model \--go-grpc_outfor service stubs)If you generate gRPC code:
- Add a
--go-grpc_outinvocation alongside--go_outin your Makefile- Install/pin matching plugin binaries in your CI/tooling, for example:
(latestgo install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.6 go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3.0protoc-gen-go-grpcis in the v1.3.x line, which aligns with grpc v1.74.2)Optional cleanup: bump any hard-coded
protoc-gen-go-grpc@v1.2.0installs in your docs/CI to v1.3.x to prevent drift.
23-30: Align OpenTelemetry exporters to v1.36.0The module’s core and SDK dependencies are already at v1.36.0, but the OTLP exporters remain at older minor versions. This causes duplicate entries in the module graph and risks subtle API mismatches at runtime.
• File go.mod, update lines 23–26 (the three OTLP exporter requires)
• Change- go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.34.0 - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0 - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0to
+ go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.36.0 + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0This will ensure all OpenTelemetry modules align on v1.36.0.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod(8 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: test
🔇 Additional comments (5)
go.mod (5)
39-46: Telemetry mix: Compatibility between OTel v1.36.0, Contrib v0.61.0, and GCP exporter/detectors confirmedI’ve verified that:
- The GCP metric exporter (github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.50.0)
- The GCP resource detectors (github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0)
- OpenTelemetry Go core (go.opentelemetry.io/otel v1.36.0)
- OpenTelemetry Contrib modules (go.opentelemetry.io/contrib v0.61.0)
are mutually compatible with no known breaking changes. No changes are needed in go.mod; it’s safe to proceed with these versions.
Affected locations:
- go.mod lines 39–46
- go.mod lines 98–101
3-5: Ensure CI workflow sets and uses Go 1.24.2 correctlyYour CI workflow at .github/workflows/ci.yml invokes:
uses: actions/setup-go@v5 with: go-version: ${{ env.GO_VERSION }}but I don’t see a definition for GO_VERSION in that file. Please verify that your runners will install or already have Go 1.24.2 available:
- In .github/workflows/ci.yml, either
• Add at the top of the file:• Or switch to reading the toolchain directive automatically by using:env: GO_VERSION: 1.24.2(v5 will pick up your- uses: actions/setup-go@v5 with: go-version-file: go.modtoolchain go1.24.2line in go.mod)- Confirm your runners allow downloading the Go toolchain or preinstall Go 1.24.x in your images.
- If you later run module commands with
-mod=readonly, be sure to include that flag in yourrun:steps (none detected currently).
17-21: Verify Cadence/Flow Preview Bump Before MergingThe module graph shows exactly one
onflow/atree(v0.10.0) and oneonflow/cadence(v1.7.0-preview.1) dependency, as expected. A quick search didn’t reveal any directimport "github.com/onflow/cadence"or usages ofatree./cadence.in the code—so there’s no obvious divergence in import paths or duplicated versions.• go.mod lines 17–21 remain:
github.com/onflow/cadence v1.7.0-preview.1 github.com/onflow/crypto v0.25.3 github.com/onflow/flow-go v0.42.3-util-fix.0.20250819165158-ea886bab7c19 github.com/onflow/flow/protobuf/go/flow v0.4.11 github.com/rs/zerolog v1.29.0• Verification script output:
github.com/onflow/atree v0.10.0 github.com/onflow/cadence v1.7.0-preview.1 (no direct imports or symbol references found)Next steps
- Manually exercise any Cadence-related surfaces:
– atree type manipulations, storage tree encoding/decoding
– script and transaction compilation, runtime execution
– any custom utility fixes inflow-gopseudo-version- Confirm there are no unintended breaking changes.
- If everything passes, consider filing an issue to track switching to the stable v1.7.0 release once it publishes.
351-353: Boxo replace directive verified—please track upstream issue and plan removal
- go.mod (line 352): single
replace github.com/ipfs/boxo => github.com/onflow/boxo v0.0.0-20240201202436-f2477b92f483entry confirmed; no otherboxoreplaces present.- Replace version matches the intended fork commit.
Next steps:
- Verify that onflow/flow-go#5338 still reflects the blocking issue.
- Open a follow-up/tracking issue in our tracker to remove this
replaceonce the upstream fix lands.Happy to draft the tracking issue with context and acceptance criteria.
32-32: Fix build errors before running govulncheckThe vulnerability scan is blocked by compilation failures in the onflow/crypto and flow-go modules. Please take the following steps:
• Align your bumped dependencies so that all symbols (e.g.
blsInstance,initBLS12381,crypto.NewExpandMsgXOFKMAC128, etc.) are defined.
• Verify the code builds cleanly with the new x/crypto v0.39.0 (and corresponding x/net, x/sys, flow-go, flow-go-sdk) by running:go build ./...• Once the build succeeds, re-run the vulnerability check:
go run golang.org/x/vuln/cmd/govulncheck@latest ./...• Confirm the output reports either “no vulnerabilities found” or lists any issues for triage.
After resolving these build errors and re-running govulncheck, please share the results so we can ensure no security advisories were introduced.
|
Covered by #90 which updates to v1.7.0-preview.3 |
Description
Automatically update to:
Summary by CodeRabbit