Security Patch Release

This security patch release includes upgrades to Cosmos SDK v0.45.9 (including the Dragonberry patch) in order to harden the node against potential security threats. This binary may be used as a stand-in replacement of v1.12.0 as it does not contain state-breaking updates. Note that this upgrade includes multiple Cosmos SDK updates (v0.45.4 -> v0.45.9) and has been tested thoroughly for regressions.

v1.12.1 - 2022-10-14

Improvements

• Bump Cosmos-SDK to v0.45.9-pio-1 (from v0.45.5-pio-1) PR 1159.

Bug Fixes

• Bump ics23/go to Cosmos-SDK's v0.8.0 (from confio's v0.7.0) PR 1159.

Cosmos v0.45.4 -> v0.45.9

ATTENTION:

This is a security release for the
Dragonberry security advisory.

All users should upgrade immediately.

Features

• #13435 Extend error context when a simulation fails.
• (upgrade) #12603 feat: Move AppModule.BeginBlock and AppModule.EndBlock to extension interfaces
• (query) #12253 Add GenericFilteredPaginate to the query package to improve UX.

Improvements

• #13369 Improve UX for keyring.List by returning all retrieved keys.
• #13323 Ensure withdraw_rewards rewards are emitted from all actions that result in rewards being withdrawn.
• #13321 Add flag to disable fast node migration and usage.
• (store) #13326 Implementation of ADR-038 file StreamingService, backport #8664.
• (store) #13540 Default fastnode migration to false to prevent suprises. Operators must enable it, unless they have it enabled already.
• #12981 Return proper error when parsing telemetry configuration.
• #12885 Amortize cost of processing cache KV store.
• #12970 Bump Tendermint to v0.34.21 and IAVL to v0.19.1.
• #12693 Make sure the order of each node is consistent when emitting proto events.
• (simapp) #13107 Call SetIAVLCacheSize with the configured value in simapp.
• (cli) #12742 Add the prune CLI cmd to manually prune app store history versions based on the pruning options.
• (events) #12850 Add a new fee_payer attribute to the tx event that is emitted from the DeductFeeDecorator AnteHandler decorator.
• (x/params) #12724 Add GetParamSetIfExists function to params Subspace to prevent panics on breaking changes.
• #12668 Add authz_msg_index event attribute to message events emitted when executing via MsgExec through x/authz.
• #12697 Upgrade IAVL to v0.19.0 with fast index and error propagation. NOTE: first start will take a while to propagate into new model.
  • Note: after upgrading to this version it may take up to 15 minutes to migrate from 0.17 to 0.19. This time is used to create the fast cache introduced into IAVL for performance
• #12784 Upgrade Tendermint to 0.34.20.
• (x/bank) #12674 Add convenience function CreatePrefixedAccountStoreKey() to construct key to access account's balance for a given denom.
• (simapp) #12314 Increase DefaultGenTxGas from 1000000 to 10000000
• #12371 Update min required Golang version to 1.18.
• (x/feegrant) #11813 Fix pagination total count in AllowancesByGranter query.
• (errors) #12002 Removed 'redacted' error message from defaultErrEncoder.
• (ante) #12017 Index ante events for failed tx (backport #12013).
• #12153 Add a new NewSimulationManagerFromAppModules constructor, to simplify simulation wiring.
• #11886 Improve error messages

API Breaking Changes

• (cli) #13089 Fix rollback command don't actually delete multistore versions, added method RollbackToVersion to interface CommitMultiStore and added method CommitMultiStore to Application interface.

Bug Fixes

• #... Implement dragonberry security patch.
  • For applying the patch please refer to the RELEASE NOTES
• (store) #13459 Don't let state listener observe the uncommitted writes.
• #13046 Fix missing return statement in BaseApp.Query.
• (x/mint) #12384 Ensure GoalBonded must be positive when performing x/mint parameter validation.
• #12317 Rename edit-validator command's --moniker flag to --new-moniker
• (x/upgrade) #12264 Fix GetLastCompleteUpgrade to properly return the latest upgrade.
• (x/crisis) #12208 Fix progress index of crisis invariant assertion logs.
• #11796 Handle EOF error case in readLineFromBuf, which allows successful reading of passphrases from STDIN.
• #11772 Limit types.Dec length to avoid overflow.
• #10947 Add AllowancesByGranter query to the feegrant module
• #9639 Check store keys length before accessing them by making sure that key is of length m+1 (for key[n:m])
• #11983 (x/feegrant, x/authz) rename grants query commands to grants-by-grantee, grants-by-granter cmds.