Skip to content

chore(deps): bump github.com/cosmos/cosmos-sdk from 0.54.3 to 0.55.0 - #6

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/cosmos/cosmos-sdk-0.55.0
Open

chore(deps): bump github.com/cosmos/cosmos-sdk from 0.54.3 to 0.55.0#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/cosmos/cosmos-sdk-0.55.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown

Bumps github.com/cosmos/cosmos-sdk from 0.54.3 to 0.55.0.

Release notes

Sourced from github.com/cosmos/cosmos-sdk's releases.

v0.55.0

Cosmos SDK v0.55.0 Release Notes

🚀 Highlights

Announcing Cosmos SDK v0.55

We are pleased to announce the release of Cosmos SDK v0.55! We’re excited to be delivering a new version of the Cosmos SDK that provides key features and updates around consensus key rotation and new post quantum key types.

Upgrading to this version of the Cosmos SDK from any v0.54.x release will require a coordinated chain upgrade.

For more upgrade information, check out our upgrading guide

📝 Changelog

Check out the changelog for an exhaustive list of changes, or compare changes from the last release.

v0.54.4

This release contains important security fixes. We recommend all chains upgrade to this patch release as soon as possible using a coordinated upgrade.

This release is state breaking.

What's Changed

... (truncated)

Changelog

Sourced from github.com/cosmos/cosmos-sdk's changelog.

v0.55.0 - 2026-07-27

Breaking Changes

  • (mempool) #25338 Respect gas wanted returned by the ante handler for block selection. Adds InsertWithOption to the Mempool interface (carries the ante-reported GasWanted) and changes the SelectBy callback to receive a mempool.Tx wrapper that exposes the stored value.
  • (tx) #26456 Remove SIGN_MODE_TEXTUAL and all associated implementation (x/tx/signing/textual, x/auth/tx/textual.go, TextualCoinMetadataQueryFn). The proto enum value is reserved to prevent future reuse. ADR-050 is marked archived.
  • (modules) #26421 Remove the x/protocolpool module and its API/proto surface from the SDK. Applications upgrading from v0.54 should include protocolpool in deleted store upgrades.
  • (genutils) #26468 Consolidate ExportGenesisFileWithTime arguments to preserve consensus params.

Features

  • (abci) #25620 Add support for new application side mempool ABCI methods.
  • (abci) #25969 Add support for new ABCI methods, InsertTx and ReapTxs.
  • (blockstm) #26208 Add Block-STM configuration support: block-executor, block-stm-workers and block-stm-pre-estimate.
  • (blockstm) #25909 Cache pre-state to optimize value-based validation.
  • (deps) #26388 Bump CometBFT version to v0.39.3.
  • (staking) #26440 Add basic key rotation for validator consensus keys.
  • (crypto) #26436 Add ML-DSA-65 (FIPS 204) post-quantum validator consensus key type, with SDK key wrappers, Amino + interface-registry registration, multisig support, and a hd.MlDsa65Type constant.
  • (blockstm) #26467 Track existence for Has() reads to reduce false conflicts.
  • (staking) #26485 Add key_rotation_fee to x/staking params and register associated 5->6 migration.
  • (staking) #26461 Wire MsgRotateConsPubKey into cli and add a happy path system test.
  • (staking) #26471 Add genesis import/export support for validator consensus key rotation.
  • (crypto) #26472 Add ML-DSA-65 (FIPS 204) support for user account keys: mnemonic-based keyring creation/recovery (--algo ml_dsa_65), transaction signing/verification, and an ante-handler signature-verification gas cost (Params.SigVerifyCostMlDsa65).
  • (enterprise/poa) #26590 Add MsgRotateConsPubKey for POA validator consensus key rotation (operator self-service plus admin override).
  • (enterprise/poa) #26614 Add ML-DSA-65 (mldsa65) validator key support to the PoA module via a WithMlDsa65Support() module option, raising MaxPubKeyLength to accommodate the larger keys.
  • (crypto) #26615 Add secp256k1eth validator consensus key type.

Improvements

  • (server/config) #26572 Warn that query-gas-limit = 0 (the default) is unbounded and exposes public RPC nodes to DoS via expensive queries.
  • (docs) #25918 Regenerate Swagger API spec to reflect current proto state, including authority field on consensus params and removal of stale module-config definitions.
  • (baseapp) #22368 Add -race-mode regression test (TestABCI_Race_GRPC_Query_During_Commit) covering concurrent BaseApp.Query and FinalizeBlock/Commit. Pins down the state-management mutex work added in #24655 and follow-ups so the data race reported against v0.50.x cannot regress silently.
  • (x/staking, x/slashing) #26481 Resolve evidence against recently rotated consensus keys and migrate slashing signing state to the active consensus key.
  • (x/auth/tx) #25221 Add ConfigOptions.AminoJSONEncoder so applications can configure a custom aminojson.Encoder (e.g. custom field encodings) for the SIGN_MODE_LEGACY_AMINO_JSON handler without replicating the SDK's HandlerMap construction.
  • chore(x/auth) #26567: add a human-readable error
  • (blockstm) #26592 Validate ExecuteBlock inputs (block size, store index mapping, and estimates) at the exported entry point so invalid input returns a descriptive error instead of an opaque "index out of range" panic.
  • (cli) #26604 Add consensus key algo to init and testnet CLIs.
  • (crypto) #26626 Update mldsa65 PubKey Address logic to validate length, remove unpacking.
  • (staking) #26619 Emit rotate_cons_pubkey and apply_cons_pubkey_rotation events during key rotation.

Bug Fixes

  • (codec) #26587 Lower the nested google.protobuf.Any recursion depth cap in unknown-field validation from 10,000 to 64, reducing CPU-amplification DoS risk from deeply nested Any wrappers. No legitimate message nests Any anywhere near that deep.
  • (x/feegrant) #26596 Honor the PageRequest offset and count_total in the Allowances and AllowancesByGranter gRPC queries, which previously collected grants inside the pagination predicate and so returned offset-skipped and beyond-limit results.
  • (x/authz) #26588 Cap the number of expired grants pruned per BeginBlocker call to 200, matching x/feegrant's existing pattern, so a block where many grants expire at once can't cause unbounded work.
  • (client) #26524 Fix file handle leak in the snapshot dump command where chunk files were deferred-closed inside the loop, keeping every chunk's handle open until the command returned (follow-up to #25811).
  • (x/distribution) #26518 Return an error from internal historical rewards reads when the record is absent, preventing recovered reference-count panics during BlockSTM speculative execution.
  • (x/auth) #26515 Bound the pubkey and signature indices in ConsumeMultisignatureVerificationGas and VerifyMultisignature so a multisig signature with a bit array larger than the key set, or with more set bits than supplied signatures, returns an error instead of panicking with index out of range.
  • (x/distribution) #26406 Add fallback paths (delegator/validator owner, then community pool) when withdrawing delegator rewards or validator commission to a blocked address during Begin/EndBlockers. user msg initiated paths still return ErrUnauthorized when withdrawing to blocked addresses.
  • (x/gov) #26353 Fix leading comma in proposal_messages event attribute emitted by SubmitProposal.

... (truncated)

Commits
  • 64fd208 chore(deps): bump cosmossdk.io/api version (#26683)
  • 2e918aa chore: api changelog typo (#26682)
  • 864de88 chore: bump cometbft to v0.40.0 (#26680)
  • a86df25 chore: changelog updates for v0.55.0 release (#26681)
  • d3f6a85 chore(api): api changelog updates for v1.1.0 (#26679)
  • 9e1c878 chore(api): update proto generation with latest changes (#26678)
  • 0203d4c fix(poa): always return error when migrating fees to an occupied key (#26642)
  • bac34e7 chore: Add upgrade doc (#26643)
  • 10881ce build(deps): Bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /tools/conf...
  • 8083adf fix(staking): allow multiple history entires in genesis import, and fix label...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump github.com/cosmos/cosmos-sdk from 0.54.3 to 0.55.0
d0e26af 
Bumps [github.com/cosmos/cosmos-sdk](https://github.com/cosmos/cosmos-sdk) from 0.54.3 to 0.55.0.
- [Release notes](https://github.com/cosmos/cosmos-sdk/releases)
- [Changelog](https://github.com/cosmos/cosmos-sdk/blob/main/CHANGELOG.md)
- [Commits](cosmos/cosmos-sdk@v0.54.3...v0.55.0)

---
updated-dependencies:
- dependency-name: github.com/cosmos/cosmos-sdk
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants