Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump o1js from 0.17.0 to 1.4.0 in /packages/mina #791

Closed

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 26, 2024

Bumps o1js from 0.17.0 to 1.4.0.

Changelog

Sourced from o1js's changelog.

1.4.0 - 2024-06-25

Added

  • SHA256 low-level API exposed via Gadgets.SHA256. o1-labs/o1js#1689 @​Shigoto-dev19
  • Added the option to specify custom feature flags for sided loaded proofs in the DynamicProof class. o1-labs/o1js#1688
    • Feature flags are required to tell Pickles what proof structure it should expect when side loading dynamic proofs and verification keys.
    • FeatureFlags is now exported and provides a set of helper functions to compute feature flags correctly.

Deprecated

  • MerkleMap.computeRootAndKey() deprecated in favor of MerkleMap.computeRootAndKeyV2() due to a potential issue of computing hash collisions in key indicies o1-labs/o1js#1694

1.3.1 - 2024-06-11

Breaking Changes

  • Improve efficiency of Experimental.OffchainState implementation o1-labs/o1js#1672
    • Comes with breaking changes to the internal circuits of OffchainState
    • Also, introduce offchainState.commitments() to initialize the state commitments onchain. Using OffchainStateCommitments.empty() no longer works.

Added

  • Experimental.IndexedMerkleMap, a better primitive for Merkleized storage o1-labs/o1js#1666 o1-labs/o1js#1671
    • Uses 4-8x fewer constraints than MerkleMap
    • In contrast to MerkleTree and MerkleMap, IndexedMerkleMap has a high-level API that can be used in provable code
  • Added Ecdsa.verifyV2() and Ecdsa.verifySignedHashV2 methods to the Ecdsa class. o1-labs/o1js#1669

Deprecated

  • Int64.isPositive() and Int64.mod() deprecated because they behave incorrectly on -0 o1-labs/o1js#1660
    • This can pose an attack surface, since it is easy to maliciously pick either the +0 or the -0 representation
    • Use Int64.isPositiveV2() and Int64.modV2() instead
    • Also deprecated Int64.neg() in favor of Int64.negV2(), for compatibility with v2 version of Int64 that will use Int64.checkV2()
  • Ecdsa.verify() and Ecdsa.verifySignedHash() deprecated in favor of Ecdsa.verifyV2() and Ecdsa.verifySignedHashV2() due to a security vulnerability found in the current implementation o1-labs/o1js#1669

Fixed

1.3.0 - 2024-05-23

Added

  • Added base64Encode() and base64Decode(byteLength) methods to the Bytes class. o1-labs/o1js#1659

Fixes

  • Fix type inference for method.returns(Type), to require a matching return signature o1-labs/o1js#1653
  • Fix Struct.empty() returning a garbage object when one of the base types doesn't support empty() o1-labs/o1js#1657

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [o1js](https://github.com/o1-labs/o1js) from 0.17.0 to 1.4.0.
- [Changelog](https://github.com/o1-labs/o1js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/o1-labs/o1js/commits)

---
updated-dependencies:
- dependency-name: o1js
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jun 26, 2024
Copy link
Contributor Author

dependabot bot commented on behalf of github Jul 25, 2024

Superseded by #806.

@dependabot dependabot bot closed this Jul 25, 2024
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/packages/mina/o1js-1.4.0 branch July 25, 2024 15:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants