Use replace statements to enforce consistent versioning.

[faddat]

Hi, I think this is a potoentially serious issue.

Before this commit, there are versions of tm as early as 0.34.0 and sdk 0.42.5 and iavl 16 being imported into wasmd. After the replace statements are added, the versioning is consistent throughout the application, which ought to at the very least improve safety.

This also fixes CI. I think.

[codecov]

Codecov Report

Merging #692 (bd5dea9) into master (3580520) will decrease coverage by 0.03%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master     #692      +/-   ##
==========================================
- Coverage   60.24%   60.21%   -0.04%     
==========================================
  Files          48       48              
  Lines        5361     5361              
==========================================
- Hits         3230     3228       -2     
- Misses       1902     1903       +1     
- Partials      229      230       +1     

Impacted Files	Coverage Δ
x/wasm/keeper/keeper.go	87.91% <0.00%> (-0.35%)	⬇️

[ethanfrey]

go mod tidy wouldn't have fixed this?
any idea where those imports come from? usually it is just leftover in the go.sum file from earlier

[faddat]

Yep, see the PR on wasmvm. That accounts for at least some of them.

[faddat]

@ethanfrey if we cut a release of wasmvm tagged like beta3, I can try this out and see how many of the replaces I can remove from go.mod here.

[alpe]

👍 Thanks for the PR. Nice findings.
I will have an 👀 on the replace statements
🤔 The CircleCI executor was redundant with the docker image, I think. Please open an issue if you have other problems with CI

[peterbourgon]

Before this commit, there are versions of tm as early as 0.34.0 and sdk 0.42.5 and iavl 16 being imported into wasmd.

This likely isn't true, and I think stems from a misunderstanding of the meaning of entries in the go.sum file. Also, the replace directive isn't meant to be used as a way to pin versions, or to be long-lived, and it's not respected by downstream consumers.

This PR should probably be reverted.

[ethanfrey]

Those replace statements just caused me confusion in another update PR.
Maybe we should revisit this