build(deps): Bump github.com/celestiaorg/nmt from 0.10.0 to 0.11.0 #871
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [github.com/celestiaorg/nmt](https://github.com/celestiaorg/nmt) from 0.10.0 to 0.11.0. - [Release notes](https://github.com/celestiaorg/nmt/releases) - [Commits](celestiaorg/nmt@v0.10.0...v0.11.0) --- updated-dependencies: - dependency-name: github.com/celestiaorg/nmt dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
requested review from
evan-forbes and
Wondertan
as code owners
dependabot
bot
added
the
T:dependencies
rootulp
deleted the
dependabot/go_modules/github.com/celestiaorg/nmt-0.11.0
branch
| @@ -9,8 +9,7 @@ require ( | |||
| github.com/adlio/schema v1.1.13 | |||
| github.com/btcsuite/btcd v0.21.0-beta | |||
| github.com/btcsuite/btcutil v1.0.2 | |||
| github.com/celestiaorg/nmt v0.10.0 | |||
| github.com/celestiaorg/rsmt2d v0.6.0 | |||
There was a problem hiding this comment.
on re-review, it's not immediately clear why this dependency was removed in this PR. This repo doesn't depend on rsmt2d (see search) but nmt never depended on it so upgrading from v0.10.0 -> v0.11.0 didn't remove a transitive dependency.
I suspect, dependabot runs go mod tidy after updating a dependency. But I'm still curious as to how a previous commit that removed usage of rsmt2d didn't remove this line. I'll inspect commits that moved code from celestia-core to celestia-app b/c I expect one of them to have also included this removal
There was a problem hiding this comment.
From commit prior to this PR 79548a4
$ go mod why -m github.com/celestiaorg/rsmt2d
# github.com/celestiaorg/rsmt2d
(main module does not need module github.com/celestiaorg/rsmt2d)
From last PR that upgraded rsmt2d fcf4583
$ go mod why -m github.com/celestiaorg/rsmt2d
# github.com/celestiaorg/rsmt2d
github.com/tendermint/tendermint/pkg/consts
github.com/celestiaorg/rsmt2d
There was a problem hiding this comment.
Note that I ran go mod tidy locally on a version before this PR here and it also removed rsmt2d.
There was a problem hiding this comment.
go mod tidy hasn't been run since 97c3cce which deleted the last usage of rsmtd from this repo
There was a problem hiding this comment.
we should have a CI check in this repo that fails if go mod tidy introduces any git diff: #873
Bumps [bufbuild/buf-setup-action](https://github.com/bufbuild/buf-setup-action) from 1.18.0 to 1.19.0. - [Release notes](https://github.com/bufbuild/buf-setup-action/releases) - [Commits](bufbuild/buf-setup-action@v1.18.0...v1.19.0) --- updated-dependencies: - dependency-name: bufbuild/buf-setup-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps github.com/celestiaorg/nmt from 0.10.0 to 0.11.0.
Release notes
Sourced from github.com/celestiaorg/nmt's releases.
Commits
230d27fRemove dependency on nebulous in proof generation (#68)6274243Fix import usage (#69)f1abf11Remove dependency on nebulous in verification (#67)793b868Merge pull request #65 from rahulghangas/chore/update-READMEf2e5ff2Merge pull request #64 from rootulp/rp/licensed5d0780chore: update example in README41cb2b4Update to Go 1.18 (#62)91e1662Add Apache License 2.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)