Skip to content

Update to Cadence v1.10.3 #97

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
turbolent merged 1 commit into from
May 20, 2026
Merged

Update to Cadence v1.10.3 #97

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
161 changes: 82 additions & 79 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,47 +1,49 @@
module github.com/onflow/rosetta

go 1.25.0
go 1.25.1

require (
github.com/coinbase/rosetta-sdk-go v0.8.9
github.com/coinbase/rosetta-sdk-go/types v1.0.0
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0
github.com/dgraph-io/badger/v3 v3.2103.2
github.com/ethereum/go-ethereum v1.16.5
github.com/ethereum/go-ethereum v1.16.8
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

What is the first patched go-ethereum version for GO-2026-4507, GO-2026-4508, GO-2026-4511, GHSA-2gjw-fg97-vg3r, GHSA-689v-6xwf-5jf3, and GHSA-m6j8-rg6r-7mv8?

💡 Result:

The first patched go-ethereum version for the specified vulnerabilities is v1.16.9 [1][2]. These vulnerabilities were addressed in the security hot-fix release v1.16.9, published on February 17, 2026 [1][3]. The specific vulnerabilities covered by this release include: - GO-2026-4507 (GHSA-2gjw-fg97-vg3r / CVE-2026-26314): Denial of Service via malicious p2p message [4][5][6]. - GO-2026-4508 (GHSA-689v-6xwf-5jf3 / CVE-2026-26313): Denial of Service via malicious p2p message [7][8]. - GO-2026-4511 (GHSA-m6j8-rg6r-7mv8 / CVE-2026-26315): Improper validation of the ECIES public key in the RLPx handshake [9][10]. All three vulnerabilities were resolved in v1.16.9, and they are also included in the subsequent feature release, v1.17.0 [1][2]. Users are strongly recommended to upgrade to at least v1.16.9 to mitigate these issues [1][2].

Citations:

Upgrade go-ethereum to v1.16.9 or later before merge.

Line 10 pins github.com/ethereum/go-ethereum v1.16.8, which contains three HIGH severity vulnerabilities in the p2p protocol: GO-2026-4507, GO-2026-4508 (both DoS via malicious p2p messages), and GO-2026-4511 (improper ECIES public key validation in RLPx handshake). These are patched in v1.16.9 (released February 17, 2026) and must be fixed for network-facing components.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum affected by crash via malicious p2p message in github.com/ethereum/go-ethereum

(GO-2026-4507)

[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum affected by DoS via malicious p2p message in github.com/ethereum/go-ethereum

(GO-2026-4508)

[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake in github.com/ethereum/go-ethereum

(GO-2026-4511)

[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum affected by DoS via malicious p2p message

(GHSA-2gjw-fg97-vg3r)

[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum affected by DoS via malicious p2p message

(GHSA-689v-6xwf-5jf3)

[HIGH] 10-10: github.com/ethereum/go-ethereum 1.16.8: Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

(GHSA-m6j8-rg6r-7mv8)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 10, Update the pinned dependency for the Ethereum client in
go.mod from github.com/ethereum/go-ethereum v1.16.8 to v1.16.9 (or any later
patched release) to address the reported p2p/ECIES vulnerabilities; after
changing the version string for module github.com/ethereum/go-ethereum, run the
module update commands (eg. go get github.com/ethereum/go-ethereum@v1.16.9 and
go mod tidy) and re-run CI/build to ensure transitive updates and compilation
succeed.

github.com/golang/protobuf v1.5.4
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
github.com/libp2p/go-libp2p v0.38.2
github.com/onflow/cadence v1.8.3
github.com/onflow/crypto v0.25.3
github.com/onflow/flow-go v0.43.3-0.20251029192457-d4f875155987
github.com/onflow/flow/protobuf/go/flow v0.4.16
github.com/onflow/cadence v1.10.3
github.com/onflow/crypto v0.25.4
github.com/onflow/flow-go v0.48.1-evm-cache-block.0.20260518173711-5b9fa9c8352e
github.com/onflow/flow/protobuf/go/flow v0.4.20
github.com/rs/zerolog v1.29.0
github.com/stretchr/testify v1.11.1
go.opentelemetry.io/otel v1.37.0
go.opentelemetry.io/otel v1.39.0
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

What are the first fixed versions for GHSA-mh2q-q3fh-2475 and GO-2026-4394 (including GHSA-9h8m-3fm2-qjrq / GHSA-hfvc-g4fc-pqhx) in go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk?

💡 Result:

The first fixed versions for the specified vulnerabilities in the OpenTelemetry Go SDK are as follows: For GHSA-mh2q-q3fh-2475 (also tracked as CVE-2026-29181), which concerns excessive allocations during multi-value baggage header extraction, the first fixed version is v1.41.0 [1]. For GO-2026-4394 (also tracked as GHSA-9h8m-3fm2-qjrq and CVE-2026-24051), which concerns arbitrary code execution via PATH hijacking on macOS/Darwin, the first fixed version is v1.40.0 [2][3][4]. These vulnerabilities affect the go.opentelemetry.io/otel/sdk module [1][2][3]. GHSA-mh2q-q3fh-2475 also affects the go.opentelemetry.io/otel/propagation module [1].

Citations:

Upgrade otel and otel/sdk to v1.41.0 or later to address critical vulnerabilities.

Both modules at v1.39.0 are vulnerable to GHSA-mh2q-q3fh-2475 (excessive allocations during baggage header extraction) and GO-2026-4394 (PATH-hijacking RCE on macOS/Darwin). Upgrade to at least v1.41.0 to fix both issues.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 20-20: go.opentelemetry.io/otel 1.39.0: OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)

(GHSA-mh2q-q3fh-2475)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 20, Update the OpenTelemetry modules to a safe version by
bumping the go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk entries
from v1.39.0 to v1.41.0 (or later) in go.mod to remediate GHSA-mh2q-q3fh-2475
and GO-2026-4394; after editing the go.mod, run the module tooling (e.g., go get
go.opentelemetry.io/otel@v1.41.0 and go get
go.opentelemetry.io/otel/sdk@v1.41.0, then go mod tidy) to update dependencies
and verify builds/tests pass.

go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.34.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0
go.opentelemetry.io/otel/metric v1.37.0
go.opentelemetry.io/otel/sdk v1.37.0
go.opentelemetry.io/otel/sdk/metric v1.37.0
go.opentelemetry.io/otel/trace v1.37.0
go.opentelemetry.io/otel/metric v1.39.0
go.opentelemetry.io/otel/sdk v1.39.0
go.opentelemetry.io/otel/sdk/metric v1.39.0
go.opentelemetry.io/otel/trace v1.39.0
go.uber.org/zap v1.27.0
golang.org/x/crypto v0.41.0
google.golang.org/grpc v1.75.1
google.golang.org/protobuf v1.36.9
golang.org/x/crypto v0.47.0
google.golang.org/grpc v1.79.3
google.golang.org/protobuf v1.36.11
lukechampine.com/blake3 v1.4.1
)

require (
cel.dev/expr v0.24.0 // indirect
cloud.google.com/go/auth v0.16.4 // indirect
cel.dev/expr v0.25.1 // indirect
cloud.google.com/go/auth v0.18.1 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
cloud.google.com/go/monitoring v1.24.2 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.50.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.50.0 // indirect
cloud.google.com/go/monitoring v1.24.3 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
github.com/Jorropo/jsync v1.0.1 // indirect
github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
github.com/ProjectZKM/Ziren/crates/go-runtime/zkvm_runtime v0.0.0-20251001021608-1fe7b43fc4d6 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
github.com/cockroachdb/crlib v0.0.0-20241015224233-894974b3ad94 // indirect
github.com/cockroachdb/fifo v0.0.0-20240606204812-0bbfbd93a7ce // indirect
github.com/cockroachdb/pebble/v2 v2.0.6 // indirect
Expand All @@ -50,29 +52,29 @@ require (
github.com/crate-crypto/go-ipa v0.0.0-20240724233137-53bbb0ceb27a // indirect
github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
github.com/emicklei/dot v1.6.2 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
github.com/ethereum/c-kzg-4844/v2 v2.1.3 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
github.com/ethereum/c-kzg-4844/v2 v2.1.5 // indirect
github.com/ethereum/go-bigmodexpfix v0.0.0-20250911101455-f9e208c548ab // indirect
github.com/ethereum/go-verkle v0.2.2 // indirect
github.com/fatih/color v1.16.0 // indirect
github.com/ferranbt/fastssz v0.1.4 // indirect
github.com/filecoin-project/go-clock v0.1.0 // indirect
github.com/fxamacker/golang-lru/v2 v2.0.0-20250716153046-22c8d17dc4ee // indirect
github.com/go-jose/go-jose/v4 v4.1.1 // indirect
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Find direct imports/usages in repository =="
rg -n --type=go -C2 'go-jose|jose\.'

echo
echo "== Show dependency pin in go.mod =="
rg -n 'github.com/go-jose/go-jose/v4' go.mod

Repository: onflow/rosetta

Length of output: 105

🏁 Script executed:

cat -n go.mod | head -100

Repository: onflow/rosetta

Length of output: 5744

🏁 Script executed:

wc -l go.mod

Repository: onflow/rosetta

Length of output: 69

🏁 Script executed:

rg -i 'go-jose|jose' --type=go --type=mod

Repository: onflow/rosetta

Length of output: 86

🏁 Script executed:

# Check go.mod to see which dependencies are direct
rg -n 'require \(' go.mod -A 30

# Search more broadly for any JWE/JWT operations
rg -n --type=go 'jwe|jwt|jose' -i

Repository: onflow/rosetta

Length of output: 5323

🌐 Web query:

go-jose v4.1.3 JWE decrypt panic security advisory CVE

💡 Result:

The security vulnerability affecting go-jose v4.1.3 is tracked as CVE-2026-34986 (also identified by GHSA-78h2-9frx-2jm8) [1][2][3]. This vulnerability involves a panic during the decryption of a JSON Web Encryption (JWE) object, which can lead to a denial-of-service (DoS) condition [1][4][5]. The panic is triggered when the JWE 'alg' field specifies a key wrapping algorithm (specifically those ending in 'KW', excluding 'A128GCMKW', 'A192GCMKW', and 'A256GCMKW') and the 'encrypted_key' field is empty [1][2][3]. The issue occurs because the 'cipher.KeyUnwrap' function attempts to allocate a slice with a zero or negative length based on the empty 'encrypted_key' [1][5][6]. The vulnerability is fixed in go-jose version 4.1.4 (and v3.0.5 for the v3 branch) [1][2][7]. Applications are unaffected if they do not include key wrapping algorithms in the list of accepted key algorithms passed to 'ParseEncrypted', 'ParseEncryptedJSON', or 'ParseEncryptedCompact' [1][8][3]. As a mitigation, developers can pre-validate JWE objects to ensure the 'encrypted_key' field is non-empty before attempting decryption [1].

Citations:

Bump go-jose/v4 to v4.1.4 to resolve JWE decryption panic (CVE-2026-34986).

go-jose/v4 v4.1.3 contains a critical DoS vulnerability (CVE-2026-34986) triggered by malformed JWE objects with key wrapping algorithms and empty encrypted_key fields. Upgrade to v4.1.4, or confirm that your dependency chain does not accept key-wrapping algorithms in JWE operations. This is an indirect dependency—verify it's only reachable through safe codepaths that reject untrusted payloads.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 64-64: github.com/go-jose/go-jose/v4 4.1.3: Go JOSE Panics in JWE decryption

(GHSA-78h2-9frx-2jm8)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 64, Update the indirect dependency
github.com/go-jose/go-jose/v4 from v4.1.3 to v4.1.4 in go.mod to patch
CVE-2026-34986; after changing the version entry for
github.com/go-jose/go-jose/v4 to v4.1.4 run go mod tidy and go list -m all to
ensure the new version is resolved, and audit any code paths that parse JWE
(look for uses of go-jose types and functions) to confirm key-wrapping
algorithms and empty encrypted_key fields are not accepted from untrusted input
if the update cannot be applied.

github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/huandu/go-clone v1.6.0 // indirect
github.com/huandu/go-clone/generic v1.7.2 // indirect
github.com/ipfs/boxo v0.17.1-0.20240131173518-89bceff34bf1 // indirect
github.com/ipfs/go-ds-pebble v0.5.0 // indirect
github.com/jordanschalm/lockctx v0.0.0-20250412215529-226f85c10956 // indirect
github.com/jordanschalm/lockctx v0.1.0 // indirect
github.com/k0kubun/pp/v3 v3.5.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/onflow/fixed-point v0.1.1 // indirect
github.com/onflow/flow-evm-bridge v0.1.0 // indirect
github.com/onflow/flow-ft/lib/go/templates v1.0.1 // indirect
github.com/onflow/flow-nft/lib/go/templates v1.3.0 // indirect
github.com/onflow/nft-storefront/lib/go/contracts v1.0.0 // indirect
github.com/onflow/flow-evm-bridge v0.2.1 // indirect
github.com/onflow/flow-ft/lib/go/templates v1.1.1 // indirect
github.com/onflow/flow-nft/lib/go/templates v1.4.1 // indirect
github.com/onflow/nft-storefront/lib/go/contracts v1.1.1-0.20260409183916-cddb825ea066 // indirect
github.com/pierrec/lz4/v4 v4.1.22 // indirect
github.com/pion/datachannel v1.5.10 // indirect
github.com/pion/dtls/v2 v2.2.12 // indirect
Expand All @@ -94,44 +96,45 @@ require (
github.com/pion/webrtc/v3 v3.3.5 // indirect
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/sony/gobreaker v0.5.0 // indirect
github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
github.com/wlynxg/anet v0.0.5 // indirect
github.com/zeebo/errs v1.4.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc // indirect
google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
)

require (
cloud.google.com/go v0.120.0 // indirect
cloud.google.com/go/compute/metadata v0.8.0 // indirect
cloud.google.com/go/iam v1.5.2 // indirect
cloud.google.com/go/storage v1.50.0 // indirect
cloud.google.com/go v0.123.0 // indirect
cloud.google.com/go/compute/metadata v0.9.0 // indirect
cloud.google.com/go/iam v1.5.3 // indirect
cloud.google.com/go/storage v1.56.0 // indirect
github.com/DataDog/zstd v1.5.6-0.20230824185856-869dae002e5e // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/SaveTheRbtz/mph v0.1.1-0.20240117162131-4166ec7869bc // indirect
github.com/StackExchange/wmi v1.2.1 // indirect
github.com/VictoriaMetrics/fastcache v1.13.0 // indirect
github.com/aws/aws-sdk-go-v2 v1.39.3 // indirect
github.com/aws/aws-sdk-go-v2/config v1.31.13 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.18.17 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.10 // indirect
github.com/aws/aws-sdk-go-v2 v1.41.1 // indirect
github.com/aws/aws-sdk-go-v2/config v1.32.7 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.19.7 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.5.1 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.10 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.10 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.10 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.7.0 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.15.0 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.29.7 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.2 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.38.7 // indirect
github.com/aws/smithy-go v1.23.1 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
github.com/aws/smithy-go v1.24.0 // indirect
github.com/benbjohnson/clock v1.3.5 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bits-and-blooms/bitset v1.24.0 // indirect
github.com/bits-and-blooms/bitset v1.24.4 // indirect
github.com/btcsuite/btcd/btcec/v2 v2.3.4 // indirect
github.com/cenkalti/backoff v2.2.1+incompatible // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
Expand All @@ -141,7 +144,7 @@ require (
github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b // indirect
github.com/cockroachdb/redact v1.1.5 // indirect
github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 // indirect
github.com/consensys/gnark-crypto v0.18.0 // indirect
github.com/consensys/gnark-crypto v0.18.1 // indirect
github.com/containerd/cgroups v1.1.0 // indirect
github.com/coreos/go-semver v0.3.0 // indirect
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
Expand All @@ -159,7 +162,7 @@ require (
github.com/flynn/noise v1.1.0 // indirect
github.com/francoispqt/gojay v1.2.13 // indirect
github.com/fsnotify/fsnotify v1.6.0 // indirect
github.com/fxamacker/cbor/v2 v2.8.1-0.20250402194037-6f932b086829 // indirect
github.com/fxamacker/cbor/v2 v2.9.2-0.20260331174317-a78e92ec038e // indirect
github.com/fxamacker/circlehash v0.3.0 // indirect
github.com/gabriel-vasile/mimetype v1.4.6 // indirect
github.com/gammazero/deque v1.0.0 // indirect
Expand All @@ -185,13 +188,13 @@ require (
github.com/google/pprof v0.0.0-20250630185457-6e76a2b096b5 // indirect
github.com/google/s2a-go v0.1.9 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
github.com/googleapis/gax-go/v2 v2.15.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
github.com/googleapis/gax-go/v2 v2.17.0 // indirect
github.com/gorilla/mux v1.8.1 // indirect
github.com/gorilla/websocket v1.5.3 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 // indirect
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/hashicorp/golang-lru v1.0.2 // indirect
Expand Down Expand Up @@ -264,12 +267,12 @@ require (
github.com/multiformats/go-multistream v0.6.0 // indirect
github.com/multiformats/go-varint v0.0.7 // indirect
github.com/olekukonko/tablewriter v0.0.5 // indirect
github.com/onflow/atree v0.11.0 // indirect
github.com/onflow/flow-core-contracts/lib/go/contracts v1.9.1 // indirect; v1.2.4-0.20230703193002-53362441b57d // indirect
github.com/onflow/flow-core-contracts/lib/go/templates v1.9.1 // indirect; v1.2.3 // indirect
github.com/onflow/flow-ft/lib/go/contracts v1.0.1 // indirect
github.com/onflow/flow-go-sdk v1.9.2 // indirect
github.com/onflow/flow-nft/lib/go/contracts v1.3.0 // indirect
github.com/onflow/atree v0.16.0 // indirect
github.com/onflow/flow-core-contracts/lib/go/contracts v1.10.2 // indirect; v1.2.4-0.20230703193002-53362441b57d // indirect
github.com/onflow/flow-core-contracts/lib/go/templates v1.10.2 // indirect; v1.2.3 // indirect
github.com/onflow/flow-ft/lib/go/contracts v1.1.1 // indirect
github.com/onflow/flow-go-sdk v1.10.3 // indirect
github.com/onflow/flow-nft/lib/go/contracts v1.4.1 // indirect
github.com/onflow/go-ethereum v1.16.2 // indirect
github.com/onflow/sdks v0.6.0-preview.1 // indirect
github.com/onflow/wal v1.0.2 // indirect
Expand All @@ -283,7 +286,7 @@ require (
github.com/polydawn/refmt v0.89.0 // indirect
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
github.com/prometheus/client_golang v1.20.5 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.61.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/psiemens/sconfig v0.1.0 // indirect
Expand All @@ -292,7 +295,7 @@ require (
github.com/quic-go/webtransport-go v0.8.1-0.20241018022711-4ac2c9250e66 // indirect
github.com/raulk/go-watchdog v1.3.0 // indirect
github.com/rivo/uniseg v0.4.7 // indirect
github.com/rogpeppe/go-internal v1.13.1 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
github.com/schollz/progressbar/v3 v3.18.0 // indirect
github.com/sethvargo/go-retry v0.2.3 // indirect
github.com/shirou/gopsutil v3.21.4-0.20210419000835-c7a38de76ee5+incompatible // indirect
Expand Down Expand Up @@ -322,28 +325,28 @@ require (
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/proto/otlp v1.5.0 // indirect
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/dig v1.18.0 // indirect
go.uber.org/fx v1.23.0 // indirect
go.uber.org/mock v0.5.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 // indirect
golang.org/x/mod v0.27.0 // indirect
golang.org/x/net v0.43.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sync v0.16.0 // indirect
golang.org/x/sys v0.36.0 // indirect
golang.org/x/term v0.34.0 // indirect
golang.org/x/text v0.28.0 // indirect
golang.org/x/time v0.12.0 // indirect
golang.org/x/tools v0.36.0 // indirect
golang.org/x/mod v0.31.0 // indirect
golang.org/x/net v0.49.0 // indirect
golang.org/x/oauth2 v0.35.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/sys v0.40.0 // indirect
golang.org/x/term v0.39.0 // indirect
golang.org/x/text v0.33.0 // indirect
golang.org/x/time v0.14.0 // indirect
golang.org/x/tools v0.40.0 // indirect
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
gonum.org/v1/gonum v0.16.0 // indirect
google.golang.org/api v0.247.0 // indirect
google.golang.org/api v0.267.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
Expand Down
Loading
Loading