From 6dbe33d36a9529b35de489a98ff517cad47926c9 Mon Sep 17 00:00:00 2001
From: bb111189 <4401980+bb111189@users.noreply.github.com>
Date: Wed, 4 Feb 2026 10:46:02 +0800
Subject: [PATCH] fix: resolve Go dependency vulnerabilities

- Add replace directive for github.com/nwaples/rardecode => v2.2.2 (fixes alert #87)

Note: Alerts #85 and #86 for github.com/babylonlabs-io/babylon/v3 cannot be
resolved due to broken upstream dependencies. The pseudo-versions
v0.1.2-0.20250729110047-6d5e98aba949 (finality-gadget) and
v1.99.0-devnet.6.0.20250815092853-9afb7af08b9b (finality-provider) reference
commits that no longer exist in the upstream repositories.
---
 go.mod | 1 +
 1 file changed, 1 insertion(+)

diff --git a/go.mod b/go.mod
index 527b185..7008d0f 100644
--- a/go.mod
+++ b/go.mod
@@ -352,4 +352,5 @@ replace (
 	github.com/strangelove-ventures/tokenfactory => github.com/babylonlabs-io/tokenfactory v0.50.6-wasmvm2
 	// Downgraded to stable version see: https://github.com/cosmos/cosmos-sdk/pull/14952
 	github.com/syndtr/goleveldb => github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7
+	github.com/nwaples/rardecode => github.com/nwaples/rardecode/v2 v2.2.2
 )