matrix-media-repo
matrix-media-repo copied to clipboard
Bump github.com/ipfs/go-ipfs from 0.8.0 to 0.13.1
Bumps github.com/ipfs/go-ipfs from 0.8.0 to 0.13.1.
Release notes
Sourced from github.com/ipfs/go-ipfs's releases.
v0.13.1
go-ipfs v0.13.1 Release
This release includes security fixes for various DOS vectors when importing untrusted user input with
ipfs dag import
and thev0/dag/import
endpoint.View the linked security advisory for more information.
Changelog
- github.com/ipfs/go-ipfs:
- chore: update car
- github.com/ipld/go-car (v0.3.2 -> v0.4.0) & (v2.1.1 -> v2.4.0):
- Bump version in prep for releasing go-car
v0
- Revert changes to
insertionindex
- Revert changes to
index.Index
while keeping most of security fixes- Return error when section length is invalid
varint
- Drop repeated package name from
CarStats
- Benchmark
Reader.Inspect
with and without hash validation- Use consistent CID mismatch error in
Inspect
andBlockReader.Next
- Use streaming APIs to verify the hash of blocks in CAR
Inspect
- test: add fuzzing for reader#Inspect
- feat: add block hash validation to Inspect()
- feat: add Reader#Inspect() function to check basic validity of a CAR and return stats
- Remove support for
ForEach
enumeration from car-index-sorted- Use a fix code as the multihash code for
CarIndexSorted
- Fix testutil assertion logic and update index generation tests
- fix: tighter constraint of singleWidthIndex width, add index recommentation docs
- fix: explicitly disable serialization of insertionindex
- feat: MaxAllowed{Header,Section}Size option
- feat: MaxAllowedSectionSize default to 32M
- fix: use CidFromReader() which has overread and OOM protection
- fix: staticcheck catches
- fix: revert to internalio.NewOffsetReadSeeker in Reader#IndexReader
- fix index comparisons
- feat: Refactor indexes to put storage considerations on consumers
- test: v2 add fuzzing of the index
- fix: v2 don't divide by zero in width indexes
- fix: v2 don't allocate indexes too big
- test: v2 add fuzzing to Reader
- fix: v2 don't accept overflowing offsets while reading v2 headers
- test: v2 add fuzzing to BlockReader
- fix: v2 don't OOM if the header size is too big
- test: add fuzzing of NewCarReader
- fix: do bound check while checking for CIDv0
- fix: don't OOM if the header size is too big
- Add API to regenerate index from CARv1 or CARv2
... (truncated)
Changelog
Sourced from github.com/ipfs/go-ipfs's changelog.
v0.13.1 2022-07-06
This release includes security fixes for various DOS vectors when importing untrusted user input with
ipfs dag import
and thev0/dag/import
endpoint.View the linked security advisory for more information.
Changelog
- github.com/ipfs/go-ipfs:
- chore: update car
- github.com/ipld/go-car (v0.3.2 -> v0.4.0) & (v2.1.1 -> v2.4.0):
- Bump version in prep for releasing go-car
v0
- Revert changes to
insertionindex
- Revert changes to
index.Index
while keeping most of security fixes- Return error when section length is invalid
varint
- Drop repeated package name from
CarStats
- Benchmark
Reader.Inspect
with and without hash validation- Use consistent CID mismatch error in
Inspect
andBlockReader.Next
- Use streaming APIs to verify the hash of blocks in CAR
Inspect
- test: add fuzzing for reader#Inspect
- feat: add block hash validation to Inspect()
- feat: add Reader#Inspect() function to check basic validity of a CAR and return stats
- Remove support for
ForEach
enumeration from car-index-sorted- Use a fix code as the multihash code for
CarIndexSorted
- Fix testutil assertion logic and update index generation tests
- fix: tighter constraint of singleWidthIndex width, add index recommentation docs
- fix: explicitly disable serialization of insertionindex
- feat: MaxAllowed{Header,Section}Size option
- feat: MaxAllowedSectionSize default to 32M
- fix: use CidFromReader() which has overread and OOM protection
- fix: staticcheck catches
- fix: revert to internalio.NewOffsetReadSeeker in Reader#IndexReader
- fix index comparisons
- feat: Refactor indexes to put storage considerations on consumers
- test: v2 add fuzzing of the index
- fix: v2 don't divide by zero in width indexes
- fix: v2 don't allocate indexes too big
- test: v2 add fuzzing to Reader
- fix: v2 don't accept overflowing offsets while reading v2 headers
- test: v2 add fuzzing to BlockReader
- fix: v2 don't OOM if the header size is too big
- test: add fuzzing of NewCarReader
- fix: do bound check while checking for CIDv0
- fix: don't OOM if the header size is too big
- Add API to regenerate index from CARv1 or CARv2
- PrototypeChooser support (#305) (ipld/go-car#305)
- bump to newer blockstore err not found (#301) (ipld/go-car#301)
- Car command supports for
largebytes
nodes (#296) (ipld/go-car#296)- fix(test): rootless fixture should have no roots, not null roots
... (truncated)
Commits
8ffc7a8
Merge pull request #9092 from ipfs/release-v0.13.11b60d07
chore: bump version number to v0.13.1af27e43
chore: Add release notes for 0.13.1bc4f854
chore: update go-carc9d51bb
Merge pull request #9023 from ipfs/release-v0.13.03b88b44
Release v0.13.05614523
docs: v0.13.0 release notes6e1de05
chore: bump Go to 1.18.3 (#9021)85e3fa6
chore: upgrade to go-libp2p v0.19.47449a4b
feat: upgrade to [email protected] (#9005)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase
.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
-
@dependabot rebase
will rebase this PR -
@dependabot recreate
will recreate this PR, overwriting any edits that have been made to it -
@dependabot merge
will merge this PR after your CI passes on it -
@dependabot squash and merge
will squash and merge this PR after your CI passes on it -
@dependabot cancel merge
will cancel a previously requested merge and block automerging -
@dependabot reopen
will reopen this PR if it is closed -
@dependabot close
will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually -
@dependabot ignore this major version
will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this minor version
will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this dependency
will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) -
@dependabot use these labels
will set the current labels as the default for future PRs for this repo and language -
@dependabot use these reviewers
will set the current reviewers as the default for future PRs for this repo and language -
@dependabot use these assignees
will set the current assignees as the default for future PRs for this repo and language -
@dependabot use this milestone
will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the Security Alerts page.