dependabot[bot] opened a new pull request, #60: URL: https://github.com/apache/incubator-milagro-dta/pull/60
Bumps [github.com/ipfs/go-ipfs](https://github.com/ipfs/go-ipfs) from 0.4.22 to 0.13.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ipfs/go-ipfs/releases";>github.com/ipfs/go-ipfs's releases</a>.</em></p> <blockquote> <h2>v0.13.1</h2> <h1>go-ipfs v0.13.1 Release</h1> <p>This release includes security fixes for various DOS vectors when importing untrusted user input with <code>ipfs dag import</code> and the <a href="https://docs.ipfs.io/reference/http/api/#api-v0-dag-import";><code>v0/dag/import</code></a> endpoint.</p> <p>View the linked <a href="https://github.com/ipfs/go-ipfs/security/advisories/GHSA-f2gr-7299-487h";>security advisory</a> for more information.</p> <h2>Changelog</h2> <!-- raw HTML omitted --> <ul> <li>github.com/ipfs/go-ipfs: <ul> <li>chore: update car</li> </ul> </li> <li>github.com/ipld/go-car (v0.3.2 -> v0.4.0) & (v2.1.1 -> v2.4.0): <ul> <li>Bump version in prep for releasing go-car <code>v0</code></li> <li>Revert changes to <code>insertionindex</code></li> <li>Revert changes to <code>index.Index</code> while keeping most of security fixes</li> <li>Return error when section length is invalid <code>varint</code></li> <li>Drop repeated package name from <code>CarStats</code></li> <li>Benchmark <code>Reader.Inspect</code> with and without hash validation</li> <li>Use consistent CID mismatch error in <code>Inspect</code> and <code>BlockReader.Next</code></li> <li>Use streaming APIs to verify the hash of blocks in CAR <code>Inspect</code></li> <li>test: add fuzzing for reader#Inspect</li> <li>feat: add block hash validation to Inspect()</li> <li>feat: add Reader#Inspect() function to check basic validity of a CAR and return stats</li> <li>Remove support for <code>ForEach</code> enumeration from car-index-sorted</li> <li>Use a fix code as the multihash code for <code>CarIndexSorted</code></li> <li>Fix testutil assertion logic and update index generation tests</li> <li>fix: tighter constraint of singleWidthIndex width, add index recommentation docs</li> <li>fix: explicitly disable serialization of insertionindex</li> <li>feat: MaxAllowed{Header,Section}Size option</li> <li>feat: MaxAllowedSectionSize default to 32M</li> <li>fix: use CidFromReader() which has overread and OOM protection</li> <li>fix: staticcheck catches</li> <li>fix: revert to internalio.NewOffsetReadSeeker in Reader#IndexReader</li> <li>fix index comparisons</li> <li>feat: Refactor indexes to put storage considerations on consumers</li> <li>test: v2 add fuzzing of the index</li> <li>fix: v2 don't divide by zero in width indexes</li> <li>fix: v2 don't allocate indexes too big</li> <li>test: v2 add fuzzing to Reader</li> <li>fix: v2 don't accept overflowing offsets while reading v2 headers</li> <li>test: v2 add fuzzing to BlockReader</li> <li>fix: v2 don't OOM if the header size is too big</li> <li>test: add fuzzing of NewCarReader</li> <li>fix: do bound check while checking for CIDv0</li> <li>fix: don't OOM if the header size is too big</li> <li>Add API to regenerate index from CARv1 or CARv2</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ipfs/kubo/blob/v0.13.1/CHANGELOG.md";>github.com/ipfs/go-ipfs's changelog</a>.</em></p> <blockquote> <h2>v0.13.1 2022-07-06</h2> <p>This release includes security fixes for various DOS vectors when importing untrusted user input with <code>ipfs dag import</code> and the <a href="https://docs.ipfs.io/reference/http/api/#api-v0-dag-import";><code>v0/dag/import</code></a> endpoint.</p> <p>View the linked <a href="https://github.com/ipfs/go-ipfs/security/advisories/GHSA-f2gr-7299-487h";>security advisory</a> for more information.</p> <h3>Changelog</h3> <ul> <li>github.com/ipfs/go-ipfs: <ul> <li>chore: update car</li> </ul> </li> <li>github.com/ipld/go-car (v0.3.2 -> v0.4.0) & (v2.1.1 -> v2.4.0): <ul> <li>Bump version in prep for releasing go-car <code>v0</code></li> <li>Revert changes to <code>insertionindex</code></li> <li>Revert changes to <code>index.Index</code> while keeping most of security fixes</li> <li>Return error when section length is invalid <code>varint</code></li> <li>Drop repeated package name from <code>CarStats</code></li> <li>Benchmark <code>Reader.Inspect</code> with and without hash validation</li> <li>Use consistent CID mismatch error in <code>Inspect</code> and <code>BlockReader.Next</code></li> <li>Use streaming APIs to verify the hash of blocks in CAR <code>Inspect</code></li> <li>test: add fuzzing for reader#Inspect</li> <li>feat: add block hash validation to Inspect()</li> <li>feat: add Reader#Inspect() function to check basic validity of a CAR and return stats</li> <li>Remove support for <code>ForEach</code> enumeration from car-index-sorted</li> <li>Use a fix code as the multihash code for <code>CarIndexSorted</code></li> <li>Fix testutil assertion logic and update index generation tests</li> <li>fix: tighter constraint of singleWidthIndex width, add index recommentation docs</li> <li>fix: explicitly disable serialization of insertionindex</li> <li>feat: MaxAllowed{Header,Section}Size option</li> <li>feat: MaxAllowedSectionSize default to 32M</li> <li>fix: use CidFromReader() which has overread and OOM protection</li> <li>fix: staticcheck catches</li> <li>fix: revert to internalio.NewOffsetReadSeeker in Reader#IndexReader</li> <li>fix index comparisons</li> <li>feat: Refactor indexes to put storage considerations on consumers</li> <li>test: v2 add fuzzing of the index</li> <li>fix: v2 don't divide by zero in width indexes</li> <li>fix: v2 don't allocate indexes too big</li> <li>test: v2 add fuzzing to Reader</li> <li>fix: v2 don't accept overflowing offsets while reading v2 headers</li> <li>test: v2 add fuzzing to BlockReader</li> <li>fix: v2 don't OOM if the header size is too big</li> <li>test: add fuzzing of NewCarReader</li> <li>fix: do bound check while checking for CIDv0</li> <li>fix: don't OOM if the header size is too big</li> <li>Add API to regenerate index from CARv1 or CARv2</li> <li>PrototypeChooser support (<a href="https://github-redirect.dependabot.com/ipfs/go-ipfs/issues/305";>#305</a>) (<a href="https://github-redirect.dependabot.com/ipld/go-car/pull/305";>ipld/go-car#305</a>)</li> <li>bump to newer blockstore err not found (<a href="https://github-redirect.dependabot.com/ipfs/go-ipfs/issues/301";>#301</a>) (<a href="https://github-redirect.dependabot.com/ipld/go-car/pull/301";>ipld/go-car#301</a>)</li> <li>Car command supports for <code>largebytes</code> nodes (<a href="https://github-redirect.dependabot.com/ipfs/go-ipfs/issues/296";>#296</a>) (<a href="https://github-redirect.dependabot.com/ipld/go-car/pull/296";>ipld/go-car#296</a>)</li> <li>fix(test): rootless fixture should have no roots, not null roots</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ipfs/kubo/commit/8ffc7a8a6c0d9ecdffd3624688fbf0cf348752d2";><code>8ffc7a8</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/ipfs/go-ipfs/issues/9092";>#9092</a> from ipfs/release-v0.13.1</li> <li><a href="https://github.com/ipfs/kubo/commit/1b60d07d6c137af401e629bf201d2cbfd8e1c3ab";><code>1b60d07</code></a> chore: bump version number to v0.13.1</li> <li><a href="https://github.com/ipfs/kubo/commit/af27e43632da2db676cadc3b6069dd6a64f7d4a5";><code>af27e43</code></a> chore: Add release notes for 0.13.1</li> <li><a href="https://github.com/ipfs/kubo/commit/bc4f854ade2c5713bb9bba2039d3ee8fc03c6441";><code>bc4f854</code></a> chore: update go-car</li> <li><a href="https://github.com/ipfs/kubo/commit/c9d51bbe0133968858aa9991b7f69ec269126599";><code>c9d51bb</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/ipfs/go-ipfs/issues/9023";>#9023</a> from ipfs/release-v0.13.0</li> <li><a href="https://github.com/ipfs/kubo/commit/3b88b441b02c48a55d34c158706a4592db5e2eac";><code>3b88b44</code></a> Release v0.13.0</li> <li><a href="https://github.com/ipfs/kubo/commit/56145237bb3d636448ab0d54b267958279b622c8";><code>5614523</code></a> docs: v0.13.0 release notes</li> <li><a href="https://github.com/ipfs/kubo/commit/6e1de05cd1cfba669406d906e5615d69c48f3c12";><code>6e1de05</code></a> chore: bump Go to 1.18.3 (<a href="https://github-redirect.dependabot.com/ipfs/go-ipfs/issues/9021";>#9021</a>)</li> <li><a href="https://github.com/ipfs/kubo/commit/85e3fa60c599225ea6cef24dc27a9393013a685f";><code>85e3fa6</code></a> chore: upgrade to go-libp2p v0.19.4</li> <li><a href="https://github.com/ipfs/kubo/commit/7449a4b9189fa62a36a80121a2927a5570d623bc";><code>7449a4b</code></a> feat: upgrade to [email protected] (<a href="https://github-redirect.dependabot.com/ipfs/go-ipfs/issues/9005";>#9005</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ipfs/go-ipfs/compare/v0.4.22...v0.13.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/incubator-milagro-dta/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
