Skip to content

Update to Cadence v1.8.3 #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update to Cadence v1.8.3 #94

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 35 additions & 33 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,14 @@ require (
github.com/coinbase/rosetta-sdk-go/types v1.0.0
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0
github.com/dgraph-io/badger/v3 v3.2103.2
github.com/ethereum/go-ethereum v1.16.3
github.com/ethereum/go-ethereum v1.16.5
github.com/golang/protobuf v1.5.4
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
github.com/libp2p/go-libp2p v0.38.2
github.com/onflow/cadence v1.7.0
github.com/onflow/cadence v1.8.3
github.com/onflow/crypto v0.25.3
github.com/onflow/flow-go v0.43.0
github.com/onflow/flow/protobuf/go/flow v0.4.15
github.com/onflow/flow-go v0.43.3-0.20251029192457-d4f875155987
github.com/onflow/flow/protobuf/go/flow v0.4.16
github.com/rs/zerolog v1.29.0
github.com/stretchr/testify v1.11.1
go.opentelemetry.io/otel v1.37.0
Expand All @@ -27,8 +27,8 @@ require (
go.opentelemetry.io/otel/trace v1.37.0
go.uber.org/zap v1.27.0
golang.org/x/crypto v0.41.0
google.golang.org/grpc v1.75.0
google.golang.org/protobuf v1.36.7
google.golang.org/grpc v1.75.1
google.golang.org/protobuf v1.36.9
lukechampine.com/blake3 v1.4.1
)

Expand All @@ -46,17 +46,19 @@ require (
github.com/cockroachdb/fifo v0.0.0-20240606204812-0bbfbd93a7ce // indirect
github.com/cockroachdb/pebble/v2 v2.0.6 // indirect
github.com/cockroachdb/swiss v0.0.0-20250624142022-d6e517c1d961 // indirect
github.com/crate-crypto/go-eth-kzg v1.3.0 // indirect
github.com/crate-crypto/go-eth-kzg v1.4.0 // indirect
github.com/crate-crypto/go-ipa v0.0.0-20240724233137-53bbb0ceb27a // indirect
github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
github.com/emicklei/dot v1.6.2 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
github.com/ethereum/c-kzg-4844/v2 v2.1.0 // indirect
github.com/ethereum/c-kzg-4844/v2 v2.1.3 // indirect
github.com/ethereum/go-bigmodexpfix v0.0.0-20250911101455-f9e208c548ab // indirect
github.com/ethereum/go-verkle v0.2.2 // indirect
github.com/fatih/color v1.16.0 // indirect
github.com/ferranbt/fastssz v0.1.4 // indirect
github.com/filecoin-project/go-clock v0.1.0 // indirect
github.com/fxamacker/golang-lru/v2 v2.0.0-20250716153046-22c8d17dc4ee // indirect
Copy link

@coderabbitai coderabbitai bot Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Confirm intentionality of pseudo-versions for golang-lru and blst.

Lines 61 and 310 use pseudo-version timestamps rather than released versions:

  • fxamacker/golang-lru/v2 v2.0.0-20250716153046-22c8d17dc4ee
  • supranational/blst v0.3.16-0.20250831170142-f48500c1fdbe

These appear to be development/patched versions rather than official releases. Verify that this is intentional and necessary for Flow's requirements, particularly since these are cryptographic libraries.

Also applies to: 310-310

🌐 Web query:

What is the latest released version of supranational/blst and fxamacker/golang-lru/v2?

💡 Result:

  • supranational/blst — v0.3.16 (released 19 Sep 2025). [1]
  • golang-lru (v2) — v2.0.7 (released 29 Sep 2025). [2]

Sources:
[1] supranational/blst releases.
[2] hashicorp/golang-lru releases.

Update cryptographic dependencies to stable releases instead of pseudo-versions.

The latest official release of supranational/blst is v0.3.16 (released 19 Sep 2025), but go.mod pins a pseudo-version from 31 Aug 2025. The latest official release of fxamacker/golang-lru/v2 is v2.0.7 (released 29 Sep 2025), but go.mod pins a pseudo-version from 16 Jul 2025.

Using pseudo-versions for cryptographic libraries introduces maintenance and security risks. Update both dependencies to their stable releases:

  • Line 61: Change to v2.0.7
  • Line 310: Change to v0.3.16

If pseudo-versions are intentional due to incompatibilities with stable releases, document the reason.

🤖 Prompt for AI Agents 
In go.mod around lines 61 and 310, the file pins pseudo-versions for
fxamacker/golang-lru/v2 and supranational/blst; update the entries to the stable
releases: change the fxamacker line (around 61) to v2.0.7 and the
supranational/blst line (around 310) to v0.3.16, then run the Go toolchain (eg.
go get github.com/fxamacker/golang-lru/v2@v2.0.7 && go get
github.com/supranational/blst@v0.3.16 or go mod tidy) to update go.sum, run
tests/build, and if the pseudo-versions were intentional add a short comment in
go.mod or project docs explaining why the pseudo-version is required and linking
any issue/compatibility notes.

github.com/go-jose/go-jose/v4 v4.1.1 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/huandu/go-clone v1.6.0 // indirect
Expand All @@ -71,6 +73,7 @@ require (
github.com/onflow/flow-ft/lib/go/templates v1.0.1 // indirect
github.com/onflow/flow-nft/lib/go/templates v1.3.0 // indirect
github.com/onflow/nft-storefront/lib/go/contracts v1.0.0 // indirect
github.com/pierrec/lz4/v4 v4.1.22 // indirect
github.com/pion/datachannel v1.5.10 // indirect
github.com/pion/dtls/v2 v2.2.12 // indirect
github.com/pion/ice/v2 v2.3.37 // indirect
Expand Down Expand Up @@ -109,23 +112,23 @@ require (
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/SaveTheRbtz/mph v0.1.1-0.20240117162131-4166ec7869bc // indirect
github.com/StackExchange/wmi v1.2.1 // indirect
github.com/VictoriaMetrics/fastcache v1.12.2 // indirect
github.com/aws/aws-sdk-go-v2 v1.38.1 // indirect
github.com/aws/aws-sdk-go-v2/config v1.31.2 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.18.6 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 // indirect
github.com/VictoriaMetrics/fastcache v1.13.0 // indirect
github.com/aws/aws-sdk-go-v2 v1.39.3 // indirect
github.com/aws/aws-sdk-go-v2/config v1.31.13 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.18.17 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.10 // indirect
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.5.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.10 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.10 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.10 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.7.0 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.15.0 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 // indirect
github.com/aws/smithy-go v1.22.5 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.29.7 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.2 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.38.7 // indirect
github.com/aws/smithy-go v1.23.1 // indirect
github.com/benbjohnson/clock v1.3.5 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bits-and-blooms/bitset v1.24.0 // indirect
Expand Down Expand Up @@ -176,10 +179,10 @@ require (
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/glog v1.2.5 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/snappy v0.0.5-0.20231225225746-43d5d4cd4e0e // indirect
github.com/golang/snappy v1.0.0 // indirect
github.com/google/flatbuffers v2.0.8+incompatible // indirect
github.com/google/gopacket v1.1.19 // indirect
github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
github.com/google/pprof v0.0.0-20250630185457-6e76a2b096b5 // indirect
github.com/google/s2a-go v0.1.9 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
Expand Down Expand Up @@ -261,11 +264,11 @@ require (
github.com/multiformats/go-multistream v0.6.0 // indirect
github.com/multiformats/go-varint v0.0.7 // indirect
github.com/olekukonko/tablewriter v0.0.5 // indirect
github.com/onflow/atree v0.10.1 // indirect
github.com/onflow/flow-core-contracts/lib/go/contracts v1.8.1 // indirect; v1.2.4-0.20230703193002-53362441b57d // indirect
github.com/onflow/flow-core-contracts/lib/go/templates v1.8.1 // indirect; v1.2.3 // indirect
github.com/onflow/atree v0.11.0 // indirect
github.com/onflow/flow-core-contracts/lib/go/contracts v1.9.1 // indirect; v1.2.4-0.20230703193002-53362441b57d // indirect
github.com/onflow/flow-core-contracts/lib/go/templates v1.9.1 // indirect; v1.2.3 // indirect
github.com/onflow/flow-ft/lib/go/contracts v1.0.1 // indirect
github.com/onflow/flow-go-sdk v1.8.1 // indirect
github.com/onflow/flow-go-sdk v1.9.2 // indirect
github.com/onflow/flow-nft/lib/go/contracts v1.3.0 // indirect
github.com/onflow/go-ethereum v1.16.2 // indirect
github.com/onflow/sdks v0.6.0-preview.1 // indirect
Expand All @@ -275,7 +278,6 @@ require (
github.com/opentracing/opentracing-go v1.2.0 // indirect
github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
github.com/pelletier/go-toml/v2 v2.2.1 // indirect
github.com/pierrec/lz4 v2.6.1+incompatible // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/polydawn/refmt v0.89.0 // indirect
Expand Down Expand Up @@ -305,7 +307,7 @@ require (
github.com/spf13/viper v1.15.0 // indirect
github.com/stretchr/objx v0.5.2 // indirect
github.com/subosito/gotenv v1.4.2 // indirect
github.com/supranational/blst v0.3.14 // indirect
github.com/supranational/blst v0.3.16-0.20250831170142-f48500c1fdbe // indirect
github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
github.com/texttheater/golang-levenshtein/levenshtein v0.0.0-20200805054039-cae8b0eaed6c // indirect
github.com/tklauser/go-sysconf v0.3.12 // indirect
Expand All @@ -331,7 +333,7 @@ require (
golang.org/x/net v0.43.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sync v0.16.0 // indirect
golang.org/x/sys v0.35.0 // indirect
golang.org/x/sys v0.36.0 // indirect
golang.org/x/term v0.34.0 // indirect
golang.org/x/text v0.28.0 // indirect
golang.org/x/time v0.12.0 // indirect
Expand All @@ -340,8 +342,8 @@ require (
gonum.org/v1/gonum v0.16.0 // indirect
google.golang.org/api v0.247.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
Expand Down
Loading
Loading