update go dependency

[rabbitprincess]

What is changed?

update dependency to solve vulnerability issues ( CVE-2023-44487 )

Done

• google.golang.org/grpc
• github.com/improbable-eng/grpc-web
• golang.org/x/crypto, /x/net

#286, #301

TODO

• github.com/btcsuite/btcd
• github.com/libp2p/go-libp2p

#242, #273

[kroggen]

I implemented the replacement of btcd/btcec with dcrec/secp256k1

You can review the changes here

If you think they are OK, you can move the commit to this branch using this:

git fetch
git checkout topic/update-go-dependency
git merge topic/update-secp256k1

The go.mod is now referencing the btcd as an indirect dependency, probably because libp2p is not updated yet. Once you update it, the indirect dependency may be removed

[kroggen]

@gokch
When you edit the title or the first comment, it will trigger a new run of CI workflow.
(it run 4 times yesterday, ~18 minutes each)
You can click on the "Actions" tab above, then select the run and "Cancel Job" to avoid running unnecessary duplicate CI jobs

[rabbitprincess]

I implemented the replacement of btcd/btcec with dcrec/secp256k1

You can review the changes here

If you think they are OK, you can move the commit to this branch using this:

git fetch
git checkout topic/update-go-dependency
git merge topic/update-secp256k1

The go.mod is now referencing the btcd as an indirect dependency, probably because libp2p is not updated yet. Once you update it, the indirect dependency may be removed

Good. but if not update libp2p dependency, it will be using a different secp256k1 library between account / libp2p.
I expect it is no problem, but it safer not to update now.

It seems better to update at the same time when libp2p is updated. ( @sg31park work on it. )

[kroggen]

Oh, I thougth that libp2p would be updated within this PR, because of the checkboxes above

[kslee8282]

sync success

[hayarobi]

lgtm