Repository navigation
Conversation
Signed-off-by: Diana Borbe <diana@cosmoslabs.io>
Vulnerable dependencies2 advisories across 2 libraries need attention, 2 accepted. 🚨 Needs attention
|
| Advisory | CVE | Fixed in | Summary |
|---|---|---|---|
| GO-2025-3684 | — | no fix yet | Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm |
Go standard library
In use: go1.26.9 — reached from cli, e2e, gen/go/solidity-abi
| Advisory | CVE | Fixed in | Summary |
|---|---|---|---|
| GO-2026-6809 | CVE-2026-111943 | go1.26.10 |
Distrust compromised intermediate certificates in crypto/x509 |
Run make vulncheck for the call paths. Either upgrade the library, or add the
advisory to .govulncheck-ignore with a reason if no fix exists yet.
Accepted
Listed in .govulncheck-ignore with a reason.
github.com/pion/dtls/v2
In use: v2.2.12 — reached from cli
| Advisory | CVE | Fixed in | Summary |
|---|---|---|---|
| GO-2026-4479 | CVE-2026-26014 | no fix yet | Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls |
golang.org/x/crypto
In use: v0.57.0 — reached from cli, e2e
| Advisory | CVE | Fixed in | Summary |
|---|---|---|---|
| GO-2026-5932 | — | no fix yet | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues |
From make vulncheck-json on this run: logs.
 [Medium impact] The PR appears safe to merge, with no blocking findings; several earlier documentation concerns remain. Findings
SummaryAdds project guidance for governance, contributions, releases, security, conduct, maintainers, and adopters.
Reviews (2) · Last reviewed commit: "After code review" · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
|
||
| ## Copyright and license | ||
|
|
||
| Code is contributed under Apache 2.0, specifications under the Community Specification License 1.0, and documentation under CC BY 4.0, regardless of where in the repository the file lives. The SPDX header on each file records which applies. |
There was a problem hiding this comment.
CONTRIBUTING.md says specifications use the Community Specification License and documentation uses CC BY 4.0, but existing files still say Apache 2.0. The specification template also tells contributors to use Apache 2.0, and .licenserc.yaml says the specification conversion is separate. Keep this guidance aligned with the current licenses until that conversion lands.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
|
|
||
| ## Changelog | ||
|
|
||
| The changelog is generated from Conventional Commit titles at release time, so a well-formed pull request title is what matters rather than a hand-written entry. CI checks the title format. |
There was a problem hiding this comment.
This tells contributors that a handwritten changelog entry is unnecessary, but CHANGELOG.md still requires entries under its unreleased section, and the pull request template still asks for them. The release workflows have no step that generates the changelog. Keep the existing instructions until generation is added, or update the release process and its instructions together. The same claim appears in RELEASES.md.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
|
|
||
| All participants in project spaces, including repositories, issues, pull requests, discussions, community calls, and chat, are expected to uphold it in all interactions. | ||
|
|
||
| To report a concern, contact the project's Code of Conduct responders listed in TSC_MEMBERS.md, or escalate to LFDT per the process in the linked Code of Conduct. |
There was a problem hiding this comment.
Neither reporting route is usable as written: TSC_MEMBERS.md lists the Code of Conduct responders as [TBD], and the supposedly linked LFDT Code of Conduct has no link. Add a real confidential contact and the LFDT policy URL so participants can report concerns.
|
|
||
| ## Full charter | ||
|
|
||
| See the IBC Project Technical Charter for the complete governance model, including the TSC's responsibilities, how Maintainers are chosen, and the amendment process. |
There was a problem hiding this comment.
The full charter is neither included nor linked. Other sections defer to it for rules such as maintainer inactivity and removal, so readers cannot look up those rules. Link the approved Technical Charter here.
| - GitHub pull requests for ADRs, code, docs, and specs. | ||
| - Community calls, open to all and recorded, with a public calendar, for synchronous design and roadmap. | ||
| - Community chat on the LFDT Discord for questions and coordination. | ||
| - The governance forum named in MAINTAINERS.md for formal and asynchronous governance decisions. |
There was a problem hiding this comment.
MAINTAINERS.md does not name a governance forum. Contributors following this reference cannot find the stated place for formal governance discussions. Add the actual forum name and link there, or replace this instruction with the venue contributors should use.
|
|
||
| | Release line | Status | Supported until | | ||
| | --- | --- | --- | | ||
| | [TBD] | Supported | [TBD] | |
There was a problem hiding this comment.
The supported-version table contains only [TBD], but SECURITY.md uses it to define which release lines receive security fixes. List the supported lines for each component, or explicitly state that none are supported yet, before publishing this policy.
|
|
||
| ## Technical Steering Committee | ||
|
|
||
| The TSC is the set of Maintainers listed above. Each is a voting member with one vote. The TSC elects a Chair. |
There was a problem hiding this comment.
Giovanni Vitali is listed as Chair but omitted from the maintainer table. This file defines the TSC as exactly the maintainers listed above, while TSC_MEMBERS.md explicitly lists him as a voting maintainer. Add him to the maintainer table so the documents agree on membership and vote counts.
Signed-off-by: Diana Borbe <diana@cosmoslabs.io>
Signed-off-by: Diana Borbe <diana@cosmoslabs.io>
|
@greptile review |
Description
closes: #XXXX
Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.
docs/) if anything is changed.godoccomments if relevant.Files changedin the GitHub PR explorer.