fix(server): delegate CometLoggerWrapper.Warn, bump grpc and x/net

[marcello33]

Summary

CometLoggerWrapper.Warn called itself without bound:

• With(keyvals) returns another CometLoggerWrapper.
• Its Warn then repeats the same With(...).Warn(...).

So the first Warn on a CometBFT logger in a heimdall process would overflow the goroutine stack and crash the node. It also passed keyvals un-spread as a single With argument. Upstream v0.50 has no Warn on this wrapper. It came in with our CometBFT fork's Logger interface (initially a no-op, then this body in 11853a396d).

Warn now delegates to the embedded cosmossdk.io/log logger, the same way With already does.

Today this is latent. The cometbft fork at v0.3.8-polygon has no live .Warn( call (only two commented-out ones in p2p/pex), and neither do heimdall or this fork outside log/. Any future Warn in CometBFT code would hit it.

Also in this PR: govulncheck on devel was red for reasons unrelated to the fix above.

• Old grpc (GO-2026-6443, -6348, -6061) and x/net (GO-2026-5026).
• The Go 1.26.5 stdlib, pinned in the workflow (net/http, net/url, crypto/tls, html/template, encoding/asn1).

Changes:

• Root module bumped to google.golang.org/grpc v1.83.2 and golang.org/x/net v0.58.0, matching heimdall-v2 develop (It'd be nice to print the PubKey as well cosmos/cosmos-sdk#647). go get also pulled transitive bumps: x/crypto, x/sys, x/term, x/text, x/sync, otel, genproto, protobuf v1.36.11.
• The govulncheck workflow now runs on Go 1.26.8.

Executed tests

• New TestCometLoggerWrapperWarn: a With("module", ...).Warn(msg, kv...) chain emits one warn line that carries the message, the With context and the call keyvals.
• Negative control: against the previous Warn the test binary dies with runtime: goroutine stack exceeds 1000000000-byte limit. With the fix it passes, including under -race.
• With Go 1.26.8, govulncheck on the root module reports Your code is affected by 0 vulnerabilities. go build ./... is clean, and go test passes for server/..., baseapp/..., x/auth/..., x/bank/..., x/gov/..., codec/..., types/... and client/....
• golangci-lint (v1, the repo config) and go vet are clean on server/log. diffguard with mutation: exit 0, 100% kill.

Rollout notes

• The Warn fix is not consensus-affecting: log output only. The dependency bumps follow what heimdall-v2 already runs on develop; CI test-unit covers the rest of the module.
• Needs a fork tag bump in heimdall-v2 (github.com/0xPolygon/cosmos-sdk replace) to take effect there. It's independent of heimdall-v2#657.

[marcello33]

@claude review

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused fix is correct and adequately covered by a regression test.

Review effort: Balanced
Findings: None

What changed in this PR

Fixes infinite recursion in CometLoggerWrapper.Warn by delegating to the embedded SDK logger.

Changes:

• Delegates warning messages and key/value fields correctly.
• Adds regression coverage for contextual warning output.

File	Description
server/​log/​cmt_logger.go	Corrects warning delegation.
server/​log/​cmt_logger_test.go	Verifies warning level, message, and fields.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.