You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If you have comments, questions, or feedback on this release, please post here.
If you experienced any bugs with the release, please post an issue.
🔦 Highlights
Experimental Pebble Datastore
Pebble provides a high-performance alternative to leveldb as the datastore, and provides a modern replacement for legacy badgerv1.
A fresh Kubo node can be initialized with pebbleds profile via ipfs init --profile pebbleds.
There are a number of parameters available for tuning pebble's performance to your specific needs. Default values are used for any parameters that are not configured or are set to their zero-value.
For a description of the available tuning parameters, see kubo/docs/datastores.md#pebbleds.
New metrics
Added 3 new go metrics: go_gc_gogc_percent, go_gc_gomemlimit_bytes and go_sched_gomaxprocs_threads as those are recommended by the Go team
Added network usage metrics: process_network_receive_bytes_total and process_network_transmit_bytes_total
lowpower profile no longer breaks DHT announcements
We've notices users were applying lowpower profile, and then reporting content routing issues. This was because lowpower disabled reprovider system and locally hosted data was no longer announced on Amino DHT.
This release changes lowpower profile to not change reprovider settings, ensuring the new users are not sabotaging themselves. It also adds annouce-on and announce-off profiles for controlling announcement settings separately.
[!IMPORTANT]
If you've ever applied the lowpower profile before, there is a high chance your node is not announcing to DHT anymore.
If you have Reprovider.Interval set to 0 you may want to wet it to 22h (or run ipfs config profile apply announce-on) to fix your system.
As a convenience, ipfs daemon will warn if reprovide system is disabled, creating oportinity to fix configuration if it was not intentional.
Improper Handling of Highly Compressed Data (Data Amplification)
Affected range
<=2.6.0
Fixed version
Not Fixed
CVSS Score
4.3
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Description
Impact
An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.
Patches
The problem is fixed in the following packages and versions:
github.com/go-jose/go-jose/v4 version 4.0.1
github.com/go-jose/go-jose/v3 version 3.0.3
gopkg.in/go-jose/go-jose.v2 version 2.6.3
The problem will not be fixed in the following package because the package is archived:
gopkg.in/square/go-jose.v2
github.com/rs/cors1.10.1 (golang)
pkg:golang/github.com/rs/cors@1.10.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected range
>=1.9.0 <1.11.0
Fixed version
1.11.0
Description
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
google.golang.org/grpc1.64.0 (golang)
pkg:golang/google.golang.org/grpc@1.64.0
Exposure of Sensitive Information to an Unauthorized Actor
Affected range
>=1.64.0 <1.64.1
Fixed version
1.64.1
Description
Impact
This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information.
Patches
The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0
Workarounds
If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.30.0->0.31.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
ipfs/kubo (ipfs/kubo)
v0.31.0Compare Source
lowpowerprofile no longer breaks DHT announcementsThis release was brought to you by the Shipyard team.
Overview
Release v0.31.0 issue #10499
🗣 Discuss
If you have comments, questions, or feedback on this release, please post here.
If you experienced any bugs with the release, please post an issue.
🔦 Highlights
Experimental Pebble Datastore
Pebble provides a high-performance alternative to leveldb as the datastore, and provides a modern replacement for legacy badgerv1.
A fresh Kubo node can be initialized with
pebbledsprofile viaipfs init --profile pebbleds.There are a number of parameters available for tuning pebble's performance to your specific needs. Default values are used for any parameters that are not configured or are set to their zero-value.
For a description of the available tuning parameters, see kubo/docs/datastores.md#pebbleds.
New metrics
go_gc_gogc_percent,go_gc_gomemlimit_bytesandgo_sched_gomaxprocs_threadsas those are recommended by the Go teamprocess_network_receive_bytes_totalandprocess_network_transmit_bytes_totalgo_memstat_lookups_totalmetric which was always 0lowpowerprofile no longer breaks DHT announcementsWe've notices users were applying
lowpowerprofile, and then reporting content routing issues. This was becauselowpowerdisabled reprovider system and locally hosted data was no longer announced on Amino DHT.This release changes
lowpowerprofile to not change reprovider settings, ensuring the new users are not sabotaging themselves. It also addsannouce-onandannounce-offprofiles for controlling announcement settings separately.go 1.23, boxo 0.24 and go-libp2p 0.36.5
Various bugfixes. Please update.
📝 Changelog
Full Changelog
car ls --unixfs-blocksto render two-column output (ipld/go-car#514)👨👩👧👦 Contributors
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.