Skip to content

chore: fix govuln

97a066c
Select commit
Loading
Failed to load commit list.
Open

consensus/bor, internal/cli: full grpc implementation #2194

chore: fix govuln
97a066c
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed May 8, 2026 in 17m 28s

Code review found 2 important issues

Found 5 candidates, confirmed 2. See review comments for details.

Details

Severity Count
🔴 Important 2
🟡 Nit 0
🟣 Pre-existing 0
Severity File:Line Issue
🔴 Important internal/cli/server/server.go:487-488 MaxSendMsgSize=25MB caps regress bor debug pprof for profiles >25MB
🔴 Important cmd/keeper/go.mod:50-53 cmd/keeper/go.mod stale relative to parent govuln-fixed module

Annotations

Check failure on line 488 in internal/cli/server/server.go

See this annotation in the file changed.

@claude claude / Claude Code Review

MaxSendMsgSize=25MB caps regress bor debug pprof for profiles >25MB

The new `grpc.MaxSendMsgSize(25MB)` / `grpc.MaxRecvMsgSize(25MB)` caps at `internal/cli/server/server.go:487-488` are registered on the same `grpc.NewServer` that hosts the pre-existing `proto.BorServer` admin RPCs (`DebugPprof`, `DebugBlock`, `ChainWatch`). `internal/cli/server/service.go:25` declares `chunkSize = 1024*1024*1024` (1 GB) and `grpc_net_conn.ChunkedEncoder` only splits when `len(p) > size` — so any pprof payload between 25 MB and 1 GB is sent in a single `SendMsg` and rejected wit

Check failure on line 53 in cmd/keeper/go.mod

See this annotation in the file changed.

@claude claude / Claude Code Review

cmd/keeper/go.mod stale relative to parent govuln-fixed module

Commit 97a066c ("chore: fix govuln") on this branch bumped the parent `go.mod` to `golang.org/x/crypto v0.50.0`, `golang.org/x/sync v0.20.0`, and `golang.org/x/sys v0.43.0` as a govulncheck remediation, but `cmd/keeper/go.mod` still pins v0.46.0 / v0.19.0 / v0.42.0 — `cd cmd/keeper && GOFLAGS="-mod=readonly" go vet ./...` fails with "updates to go.mod needed". Because cmd/keeper is its own module (with `replace github.com/ethereum/go-ethereum => ../../`), builds initiated from cmd/keeper resolve