What the developer wrote
Authored by yyforyongyu
mod: bump sqldb to v1.0.13
Bump only the require version for github.com/lightningnetwork/lnd/sqldb
from v1.0.11 to v1.0.13. The local replace directive (=> ./sqldb) is
kept on purpose, so lnd itself continues to build against the in-tree
sqldb package on the release branch -- no behavioral change here.
The important part is downstream module resolution. Go does not
propagate replace directives from dependencies, so downstream consumers
of lnd only see the require version. Before this bump, they could
resolve an older tagged sqldb that did not contain the current
release-branch sqlc types and migrations, causing build failures.
The new sqldb/v1.0.13 tag was created from the v0.21 release-branch
commit that contains the same sqldb code lnd currently uses via the
local replace. Downstream consumers now fetch a tagged module matching
the release branch; the replace will be dropped in a follow-up cleanup.
What changed, and why it matters
This is a routine Go module version bump in a build configuration file (go.mod). It changes the declared dependency version for an internal sub-module so that downstream projects compiling against lnd fetch a matching tagged release. The commit explicitly states there is no behavioral change in lnd itself, because a local replace directive still forces lnd to use its own in-tree copy of the code. There is no indication of a security fix or vulnerability.
No security action required. Treat as normal build/maintenance dependency metadata update.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates go.mod: github.com/lightningnetwork/lnd/sqldb from v1.0.11 to v1.0.13. A local replace (=> ./sqldb) remains in place, so lnd’s build is unchanged. The purpose is to ensure downstream consumers of lnd as a module resolve a sqldb tag that matches the release-branch sqlc types and migrations, preventing build failures caused by Go’s non-propagation of replace directives. The diff is a single-line version change with no code modifications.
Changed components
go.mod dependency declaration for github.com/lightningnetwork/lnd/sqldbInspect captured patch +1 / −1
diff --git a/go.mod b/go.mod
index 9045296..856b7fe 100644
--- a/go.mod
+++ b/go.mod
@@ -40,7 +40,7 @@ require (
github.com/lightningnetwork/lnd/healthcheck v1.2.6
github.com/lightningnetwork/lnd/kvdb v1.5.1
github.com/lightningnetwork/lnd/queue v1.2.0
- github.com/lightningnetwork/lnd/sqldb v1.0.11
+ github.com/lightningnetwork/lnd/sqldb v1.0.13
github.com/lightningnetwork/lnd/ticker v1.1.1
github.com/lightningnetwork/lnd/tlv v1.3.2
github.com/lightningnetwork/lnd/tor v1.1.6
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.