Release v0.34.28 (celestiaorg#762)

* Prepare v0.34.28 release changelog

Signed-off-by: Thane Thomson <[email protected]>

* Build changelog

Signed-off-by: Thane Thomson <[email protected]>

* Add upgrading guidelines

Signed-off-by: Thane Thomson <[email protected]>

* Bump version to 0.34.28

Signed-off-by: Thane Thomson <[email protected]>

* Update release date

Signed-off-by: Thane Thomson <[email protected]>

---------

Signed-off-by: Thane Thomson <[email protected]>

Author: thanethomson

.changelog/unreleased/breaking-changes/558-tm10011.md .changelog/v0.34.28/breaking-changes/558-tm10011.md

@@ -0,0 +1,6 @@
+*April 26, 2023*
+
+This release fixes several bugs, and has had to introduce one small Go
+API-breaking change in the `crypto/merkle` package in order to address what
+could be a security issue for some users who directly and explicitly make use of
+that code.

.changelog/unreleased/bug-fixes/496-error-on-applyblock-should-panic.md .changelog/v0.34.28/bug-fixes/496-error-on-applyblock-should-panic.md

@@ -1,5 +1,39 @@
 # CHANGELOG
 
+## v0.34.28
+
+*April 26, 2023*
+
+This release fixes several bugs, and has had to introduce one small Go
+API-breaking change in the `crypto/merkle` package in order to address what
+could be a security issue for some users who directly and explicitly make use of
+that code.
+
+### BREAKING CHANGES
+
+- `[crypto/merkle]` Do not allow verification of Merkle Proofs against empty trees (`nil` root). `Proof.ComputeRootHash` now panics when it encounters an error, but `Proof.Verify` does not panic
+  ([\#558](https://github.com/cometbft/cometbft/issues/558))
+
+### BUG FIXES
+
+- `[consensus]` Unexpected error conditions in `ApplyBlock` are non-recoverable, so ignoring the error and carrying on is a bug. We replaced a `return` that disregarded the error by a `panic`.
+  ([\#496](https://github.com/cometbft/cometbft/pull/496))
+- `[consensus]` Rename `(*PeerState).ToJSON` to `MarshalJSON` to fix a logging data race
+  ([\#524](https://github.com/cometbft/cometbft/pull/524))
+- `[light]` Fixed an edge case where a light client would panic when attempting
+  to query a node that (1) has started from a non-zero height and (2) does
+  not yet have any data. The light client will now, correctly, not panic
+  _and_ keep the node in its list of providers in the same way it would if
+  it queried a node starting from height zero that does not yet have data
+  ([\#575](https://github.com/cometbft/cometbft/issues/575))
+
+### IMPROVEMENTS
+
+- `[crypto/sr25519]` Upgrade to go-schnorrkel@v1.0.0 ([\#475](https://github.com/cometbft/cometbft/issues/475))
+- `[jsonrpc/client]` Improve the error message for client errors stemming from
+  bad HTTP responses.
+  ([cometbft/cometbft\#638](https://github.com/cometbft/cometbft/pull/638))
+
 ## v0.34.27
 
 *Feb 27, 2023*

.changelog/unreleased/bug-fixes/524-rename-peerstate-tojson.md .changelog/v0.34.28/bug-fixes/524-rename-peerstate-tojson.md

@@ -2,6 +2,14 @@
 
 This guide provides instructions for upgrading to specific versions of CometBFT.
 
+## v0.34.28
+
+For users explicitly making use of the Go APIs provided in the `crypto/merkle`
+package, please note that, in order to fix a potential security issue, we had to
+make a breaking change here. This change should only affect a small minority of
+users. For more details, please see
+[\#557](https://github.com/cometbft/cometbft/issues/557).
+
 ## v0.34.27
 
 This is the first official release of CometBFT, forked originally from
@@ -40,7 +48,7 @@ subsequent major release of CometBFT.
 
 ### Building CometBFT
 
-CometBFT must be compiled using Go 1.19 or higher. The use of Go 1.18 is not 
+CometBFT must be compiled using Go 1.19 or higher. The use of Go 1.18 is not
 supported, since this version has reached end-of-life with the release of [Go 1.20][go120].
 
 ### Troubleshooting

.changelog/unreleased/bug-fixes/575-fix-light-client-panic.md .changelog/v0.34.28/bug-fixes/575-fix-light-client-panic.md

@@ -3,7 +3,7 @@ package version
 const (
 	// TMCoreSemVer is the used as the fallback version of CometBFT Core
 	// when not using git describe. It is formatted with semantic versioning.
-	TMCoreSemVer = "0.34.27"
+	TMCoreSemVer = "0.34.28"
 	// ABCISemVer is the semantic version of the ABCI library
 	ABCISemVer = "0.17.0"