build: fix dependency security alerts#1175
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses security vulnerabilities by upgrading the Postgres client to pgx v5. It includes comprehensive updates to the project's dependency tree, including minor version bumps and removals of deprecated packages. Additionally, it refines the default configuration for connecting to the daemon and introduces a temporary go.mod replacement to bridge the gap until the required lnd version is released. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request removes the legacy pgx v4 and pgproto3 dependency chain by migrating to pgx v5 and replacing the lnd/sqldb dependency with a newer revision. It also updates several other Go dependencies and refactors assets/client.go to avoid importing tapcfg by constructing default paths manually. However, setting MacaroonPath to an empty string in DefaultTapdConfig will cause client initialization to fail immediately when it attempts to read the macaroon file. It is recommended to default to the mainnet admin macaroon path instead.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
09fbe9e to
74cbb65
Compare
| RFQtimeout: defaultRfqTimeout, | ||
| Activate: false, | ||
| Host: "localhost:10029", | ||
| MacaroonPath: filepath.Join( |
There was a problem hiding this comment.
the new tapd macaroon path omits data. Tapd stores it at <tapdDir>/data/<network>/admin.macaroon, but Loop now looks under <tapdDir>/mainnet/admin.macaroon. Enabling tapd therefore fails immediately while reading
the macaroon.
There was a problem hiding this comment.
Good catch! I fixed it in a separate commit, since it is quite large and the feature is not critical to have it green in every commit.
Build the default tapd admin macaroon path from the configured Bitcoin network while preserving explicit path overrides. Add regression tests for tapd credential loading and network-specific path selection.
2 participants
This change resolves the current Go dependency security alerts by migrating the remaining PostgreSQL error handling to pgx v5, temporarily selecting the official lnd sqldb pgx v5 migration until it is included in a release, updating the affected crypto, networking, container runtime, database, and supporting dependencies, and raising the application module Go versions to 1.25.12 for the applicable standard-library security fixes.
The module files were tidied after the migration, removing the legacy pgx v4, pgconn, and pgproto3 dependency chain as well as other dependencies that are no longer reachable. The temporary sqldb replacement includes a comment explaining why it is required and when it can be removed.
The static-address open-channel
--memohelp text is normalized to remove embedded indentation and line breaks, so terminal, Markdown, and man-page output use ordinary spacing.Testing
make docswas run and the generated man page is included.Pull Request Checklist
release_notes.mdif your PR contains major features, breaking changes or bugfixes