Skip to content

Upgrade vulnerable Prover dependencies #1650

@eloi010

Description

@eloi010

The Prover is currently using the gnark library version 0.12 as shown below:

github.com/consensys/gnark v0.12.1-0.20250501002417-facdd9882b80

The mentioned version is affected by two publicly-known vulnerabilities. See: GHSA-9fvj-xqr2-xwg8 and GHSA-95v9-hv42-pwrj. Even though they may not be currently affecting the Prover, it is recommended to upgrade to the latest version available. At the time of writing this is 0.14: https://github.com/Consensys/gnark/releases/tag/v0.14.0

For more information:

Additionally, consider upgrading to the latest version of Go available at the time of writing 1.24.9.

Metadata

Metadata

Labels

ProverTag to use for all work impacting the prover

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions