search

apache / incubator-milagro-dta

Apache Milagro Decentralized Trust Authority
https://milagro.apache.org/
Apache License 2.0
11 stars 8 forks source link

Bump github.com/ipfs/go-ipfs from 0.4.22 to 0.13.1 #60

Open dependabot[bot] opened 1 year ago

dependabot[bot] commented 1 year ago

Bumps github.com/ipfs/go-ipfs from 0.4.22 to 0.13.1.

Release notes

Sourced from github.com/ipfs/go-ipfs's releases.

v0.13.1

go-ipfs v0.13.1 Release

This release includes security fixes for various DOS vectors when importing untrusted user input with ipfs dag import and the v0/dag/import endpoint.

View the linked security advisory for more information.

Changelog

  • github.com/ipfs/go-ipfs:
    • chore: update car
  • github.com/ipld/go-car (v0.3.2 -> v0.4.0) & (v2.1.1 -> v2.4.0):
    • Bump version in prep for releasing go-car v0
    • Revert changes to insertionindex
    • Revert changes to index.Index while keeping most of security fixes
    • Return error when section length is invalid varint
    • Drop repeated package name from CarStats
    • Benchmark Reader.Inspect with and without hash validation
    • Use consistent CID mismatch error in Inspect and BlockReader.Next
    • Use streaming APIs to verify the hash of blocks in CAR Inspect
    • test: add fuzzing for reader#Inspect
    • feat: add block hash validation to Inspect()
    • feat: add Reader#Inspect() function to check basic validity of a CAR and return stats
    • Remove support for ForEach enumeration from car-index-sorted
    • Use a fix code as the multihash code for CarIndexSorted
    • Fix testutil assertion logic and update index generation tests
    • fix: tighter constraint of singleWidthIndex width, add index recommentation docs
    • fix: explicitly disable serialization of insertionindex
    • feat: MaxAllowed{Header,Section}Size option
    • feat: MaxAllowedSectionSize default to 32M
    • fix: use CidFromReader() which has overread and OOM protection
    • fix: staticcheck catches
    • fix: revert to internalio.NewOffsetReadSeeker in Reader#IndexReader
    • fix index comparisons
    • feat: Refactor indexes to put storage considerations on consumers
    • test: v2 add fuzzing of the index
    • fix: v2 don't divide by zero in width indexes
    • fix: v2 don't allocate indexes too big
    • test: v2 add fuzzing to Reader
    • fix: v2 don't accept overflowing offsets while reading v2 headers
    • test: v2 add fuzzing to BlockReader
    • fix: v2 don't OOM if the header size is too big
    • test: add fuzzing of NewCarReader
    • fix: do bound check while checking for CIDv0
    • fix: don't OOM if the header size is too big
    • Add API to regenerate index from CARv1 or CARv2

... (truncated)

Changelog

Sourced from github.com/ipfs/go-ipfs's changelog.

v0.13.1 2022-07-06

This release includes security fixes for various DOS vectors when importing untrusted user input with ipfs dag import and the v0/dag/import endpoint.

View the linked security advisory for more information.

Changelog

  • github.com/ipfs/go-ipfs:
    • chore: update car
  • github.com/ipld/go-car (v0.3.2 -> v0.4.0) & (v2.1.1 -> v2.4.0):
    • Bump version in prep for releasing go-car v0
    • Revert changes to insertionindex
    • Revert changes to index.Index while keeping most of security fixes
    • Return error when section length is invalid varint
    • Drop repeated package name from CarStats
    • Benchmark Reader.Inspect with and without hash validation
    • Use consistent CID mismatch error in Inspect and BlockReader.Next
    • Use streaming APIs to verify the hash of blocks in CAR Inspect
    • test: add fuzzing for reader#Inspect
    • feat: add block hash validation to Inspect()
    • feat: add Reader#Inspect() function to check basic validity of a CAR and return stats
    • Remove support for ForEach enumeration from car-index-sorted
    • Use a fix code as the multihash code for CarIndexSorted
    • Fix testutil assertion logic and update index generation tests
    • fix: tighter constraint of singleWidthIndex width, add index recommentation docs
    • fix: explicitly disable serialization of insertionindex
    • feat: MaxAllowed{Header,Section}Size option
    • feat: MaxAllowedSectionSize default to 32M
    • fix: use CidFromReader() which has overread and OOM protection
    • fix: staticcheck catches
    • fix: revert to internalio.NewOffsetReadSeeker in Reader#IndexReader
    • fix index comparisons
    • feat: Refactor indexes to put storage considerations on consumers
    • test: v2 add fuzzing of the index
    • fix: v2 don't divide by zero in width indexes
    • fix: v2 don't allocate indexes too big
    • test: v2 add fuzzing to Reader
    • fix: v2 don't accept overflowing offsets while reading v2 headers
    • test: v2 add fuzzing to BlockReader
    • fix: v2 don't OOM if the header size is too big
    • test: add fuzzing of NewCarReader
    • fix: do bound check while checking for CIDv0
    • fix: don't OOM if the header size is too big
    • Add API to regenerate index from CARv1 or CARv2
    • PrototypeChooser support (#305) (ipld/go-car#305)
    • bump to newer blockstore err not found (#301) (ipld/go-car#301)
    • Car command supports for largebytes nodes (#296) (ipld/go-car#296)
    • fix(test): rootless fixture should have no roots, not null roots

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/incubator-milagro-dta/network/alerts).