chore: bump sdk math package from retracted version

[0xstepit]

Summary by CodeRabbit

• Chores
  • Updated Go language requirement to v1.24.0.
  • Bumped cosmossdk.io/math dependency to v1.5.3.
  • Removed an unnecessary indirect dependency.
  • No changes to public APIs or runtime behavior; build/dependency maintenance only.

[coderabbitai]

Walkthrough

Dependency-only updates across multiple go.mod files: cosmossdk.io/math bumped from v1.5.1 to v1.5.3, an indirect github.com/cockroachdb/apd/v3 v3.2.1 entry removed, and the Go directive normalized from 1.24 to 1.24.0.

Changes

Cohort / File(s)	Summary
Root module dependency updates go.mod	cosmossdk.io/math updated from v1.5.1 → v1.5.3
End-to-end module updates e2e/go.mod	cosmossdk.io/math updated v1.5.1 → v1.5.3; removed indirect github.com/cockroachdb/apd/v3 v3.2.1
Simulation app module updates simapp/go.mod	cosmossdk.io/math updated (indirect) v1.5.1 → v1.5.3; removed indirect github.com/cockroachdb/apd/v3 v3.2.1
Tooling Go version normalization tool/go.mod	go directive changed from 1.24 → 1.24.0

Sequence Diagram(s)

(No sequence diagrams provided — changes are dependency/version updates only and do not alter control flow.)

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

• Pure dependency/version adjustments with no code or API changes.
• Quick checks recommended:
  • Verify go.sum consistency and that go mod tidy passes.
  • Confirm module builds in CI for the updated cosmossdk.io/math version.

Poem

🐰 I hopped through mods at break of day,
Bumped the math and chased the stray,
Removed an indirect that hid away,
Tiny tweaks — the build will play,
A carrot-cheer for smooth array 🥕

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: bump sdk math package from retracted version' accurately describes the main change: upgrading cosmossdk.io/math dependency from a retracted version (v1.5.1) to v1.5.3 across multiple go.mod files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch stepit/upgrade-cosmossdk-math

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d1a48bd and f774bf0.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• e2e/go.mod (1 hunks)
• go.mod (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (2)

• e2e/go.mod
• go.mod

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: prepare
• GitHub Check: build
• GitHub Check: lint
• GitHub Check: unit-test

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

go.mod (1)

1-50: Inconsistent Go version specifications across modules.

root go.mod and simapp/go.mod remain at go 1.24, while tool/go.mod and e2e/go.mod are bumped to go 1.24.0. For consistency and clarity, consider updating all modules to the same Go version specification (either all 1.24 or all 1.24.0).

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 07790a6 and d1a48bd.

⛔ Files ignored due to path filters (4)

• e2e/go.sum is excluded by !**/*.sum
• go.sum is excluded by !**/*.sum
• go.work is excluded by !**/*.work
• simapp/go.sum is excluded by !**/*.sum

📒 Files selected for processing (4)

• e2e/go.mod (1 hunks)
• go.mod (1 hunks)
• simapp/go.mod (1 hunks)
• tool/go.mod (1 hunks)

🧰 Additional context used

🧠 Learnings (2)

📚 Learning: 2025-08-25T10:35:00.822Z

Learnt from: CR
Repo: noble-assets/orbiter PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-08-25T10:35:00.822Z
Learning: Applies to **/*.go : Go code must be formatted and pass golangci-lint

Applied to files:

• tool/go.mod

📚 Learning: 2025-10-13T11:49:11.266Z

Learnt from: MalteHerrmann
Repo: noble-assets/orbiter PR: 49
File: controller/adapter/ibc.go:74-81
Timestamp: 2025-10-13T11:49:11.266Z
Learning: In the orbiter codebase, when packet parsing determines a packet is not intended for the orbiter module (e.g., invalid ICS-20 data or wrong receiver), return a typed sentinel error `core.ErrNoOrbiterPacket` instead of (nil, nil). Callers should check with `errors.Is(err, core.ErrNoOrbiterPacket)` to implement fallback behavior, avoiding nil pointer panics and making intent explicit.

Applied to files:

• e2e/go.mod

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: unit-test
• GitHub Check: prepare
• GitHub Check: build
• GitHub Check: lint

🔇 Additional comments (5)

tool/go.mod (1)

3-3: Go version specification is more explicit.

Bumping to go 1.24.0 is good for pinning exact toolchain requirements. However, note that root go.mod and simapp/go.mod remain at go 1.24 (see earlier comment about inconsistency).

e2e/go.mod (2)

7-7: Verify cosmossdk.io/math v1.5.3 release and check for security advisories.

The patch upgrade to v1.5.3 aligns with updates in other modules. Ensure the release is valid and has no known CVEs.

---

3-3: Go version pinned to exact patch level.

The bump from go 1.24 to go 1.24.0 aligns with tool/go.mod. This is consistent with the broader effort to specify exact toolchain versions.

simapp/go.mod (1)

38-38: No issues found — cosmossdk.io/math v1.5.3 is valid and unaffected by known vulnerabilities.

v1.5.3 is the latest released version published Apr 4, 2025. The known security advisory ASA-2024-010 / GHSA-7225-m954-23v7 affected cosmossdk.io/math <= v1.3.0 and was patched in v1.4.0. Since v1.5.3 is released after this patch, the dependency is free from this CVE.

go.mod (1)

12-12: cosmossdk.io/math v1.5.3 is valid and secure—no action required.

v1.5.3 was released on April 4, 2025, and no CVE is listed for this version; the only known public advisory (ASA-2024-010) affects v1.3.0 and earlier, patched in v1.4.0.