[Merged by Bors] - Update go-libp2p dependency #4800

fasmat · 2023-08-09T14:22:41Z

Motivation

The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533

For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5

Changes

Update go-libp2p dependency to a fixed version.

Test Plan

n/a

TODO

Explain motivation or link existing issue(s)
Test changes and document test plan
Update documentation as needed

DevOps Notes

This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources)
This PR does not affect public APIs
This PR does not rely on a new version of external services (PoET, elasticsearch, etc.)
This PR does not make changes to log messages (which monitoring infrastructure may rely on)

dshulyak · 2023-08-09T14:31:53Z

lets please wait before merging, i want to look at changelog. we are not affected by the CVE, so it is not urgent

fasmat · 2023-08-09T14:34:38Z

It looks like staticcheck is a bit too strict in its analysis and complains that the new go-libp2p is using depreciated functionality. I will see if I can disable that, since there is no way for us to fix our dependencies to not use deprecated functions in their code.

EDIT: my mistake, the issue was in the code of go-spacemesh.

fasmat · 2023-08-09T15:51:28Z

bors try

bors · 2023-08-09T16:05:56Z

try

Build failed:

ci-status

codecov · 2023-08-09T20:52:38Z

Codecov Report

Merging #4800 (82360e1) into develop (6518d2b) will decrease coverage by 0.1%.
Report is 1 commits behind head on develop.
The diff coverage is 0.0%.

❗ Current head 82360e1 differs from pull request most recent head 959d010. Consider uploading reports for the commit 959d010 to get more accurate results

@@            Coverage Diff            @@
##           develop   #4800     +/-   ##
=========================================
- Coverage     77.0%   77.0%   -0.1%     
=========================================
  Files          260     260             
  Lines        29626   29626             
=========================================
- Hits         22841   22827     -14     
- Misses        5336    5348     +12     
- Partials      1449    1451      +2

Files Changed	Coverage Δ
p2p/host.go	`37.7% <0.0%> (ø)`

... and 5 files with indirect coverage changes

fasmat · 2023-08-09T21:35:46Z

bors merge

## Motivation The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533 For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5 ## Changes Update go-libp2p dependency to a fixed version. ## Test Plan n/a ## TODO  - [x] Explain motivation or link existing issue(s) - [x] Test changes and document test plan - [x] Update documentation as needed ## DevOps Notes  - [x] This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources) - [x] This PR does not affect public APIs - [x] This PR does not rely on a new version of external services (PoET, elasticsearch, etc.) - [x] This PR does not make changes to log messages (which monitoring infrastructure may rely on)

bors · 2023-08-09T21:53:24Z

Build failed:

ci-status

fasmat · 2023-08-09T22:00:11Z

bors merge

## Motivation The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533 For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5 ## Changes Update go-libp2p dependency to a fixed version. ## Test Plan n/a ## TODO  - [x] Explain motivation or link existing issue(s) - [x] Test changes and document test plan - [x] Update documentation as needed ## DevOps Notes  - [x] This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources) - [x] This PR does not affect public APIs - [x] This PR does not rely on a new version of external services (PoET, elasticsearch, etc.) - [x] This PR does not make changes to log messages (which monitoring infrastructure may rely on)

bors · 2023-08-09T22:26:11Z

Build failed:

ci-status

fasmat · 2023-08-10T10:05:48Z

bors merge

## Motivation The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533 For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5 ## Changes Update go-libp2p dependency to a fixed version. ## Test Plan n/a ## TODO  - [x] Explain motivation or link existing issue(s) - [x] Test changes and document test plan - [x] Update documentation as needed ## DevOps Notes  - [x] This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources) - [x] This PR does not affect public APIs - [x] This PR does not rely on a new version of external services (PoET, elasticsearch, etc.) - [x] This PR does not make changes to log messages (which monitoring infrastructure may rely on)

bors · 2023-08-10T10:09:24Z

Build failed:

systest-status

fasmat · 2023-08-10T10:24:50Z

go-multiaddr v0.11.0 broke libp2p v0.29.2 because of a non-backwards compatible update of a transient dependency (golang.org/x/exp). The fix for it is already approved and should soon be merged: libp2p/go-libp2p#2467

This PR is blocked until then.

fasmat · 2023-08-17T17:26:16Z

libp2p won't release a new minor version to resolve the dependency conflict, so we have to downgrade go-multiaddr for now until a version is available that is compatible with it.

fasmat · 2023-08-17T17:27:08Z

bors merge

## Motivation The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533 For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5 ## Changes Update go-libp2p dependency to a fixed version. ## Test Plan n/a ## TODO  - [x] Explain motivation or link existing issue(s) - [x] Test changes and document test plan - [x] Update documentation as needed ## DevOps Notes  - [x] This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources) - [x] This PR does not affect public APIs - [x] This PR does not rely on a new version of external services (PoET, elasticsearch, etc.) - [x] This PR does not make changes to log messages (which monitoring infrastructure may rely on)

bors · 2023-08-17T18:26:43Z

Pull request successfully merged into develop.

Build succeeded!

The publicly hosted instance of bors-ng is deprecated and will go away soon.

If you want to self-host your own instance, instructions are here.
For more help, visit the forum.

If you want to switch to GitHub's built-in merge queue, visit their help page.

fasmat requested a review from countvonzero as a code owner August 9, 2023 14:22

fasmat self-assigned this Aug 9, 2023

fasmat requested review from dshulyak and poszu as code owners August 9, 2023 14:22

poszu approved these changes Aug 9, 2023

View reviewed changes

dshulyak approved these changes Aug 9, 2023

View reviewed changes

bors bot added a commit that referenced this pull request Aug 9, 2023

Try #4800:

6fdce8a

fasmat force-pushed the fix-go-libp2p-dependency branch from ce9ec67 to 13ae6ac Compare August 9, 2023 20:31

fasmat force-pushed the fix-go-libp2p-dependency branch from 13ae6ac to 48f0841 Compare August 10, 2023 10:03

fasmat force-pushed the fix-go-libp2p-dependency branch 2 times, most recently from 0a0e6d0 to 19c199d Compare August 16, 2023 07:59

fasmat added 2 commits August 17, 2023 17:13

Update go-libp2p dependency

f9d866d

Fix deprecation warning

5a43c9b

fasmat force-pushed the fix-go-libp2p-dependency branch from 19c199d to 82360e1 Compare August 17, 2023 17:24

Fix dependency issues

959d010

fasmat force-pushed the fix-go-libp2p-dependency branch from 82360e1 to 959d010 Compare August 17, 2023 17:25

bors bot changed the title ~~Update go-libp2p dependency~~ [Merged by Bors] - Update go-libp2p dependency Aug 17, 2023

bors bot closed this Aug 17, 2023

bors bot deleted the fix-go-libp2p-dependency branch August 17, 2023 18:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Merged by Bors] - Update go-libp2p dependency #4800

[Merged by Bors] - Update go-libp2p dependency #4800

fasmat commented Aug 9, 2023

dshulyak commented Aug 9, 2023 •

edited

fasmat commented Aug 9, 2023 •

edited

fasmat commented Aug 9, 2023

bors bot commented Aug 9, 2023

codecov bot commented Aug 9, 2023 •

edited

fasmat commented Aug 9, 2023

bors bot commented Aug 9, 2023

fasmat commented Aug 9, 2023

bors bot commented Aug 9, 2023

fasmat commented Aug 10, 2023

bors bot commented Aug 10, 2023

fasmat commented Aug 10, 2023 •

edited

fasmat commented Aug 17, 2023

fasmat commented Aug 17, 2023

bors bot commented Aug 17, 2023

[Merged by Bors] - Update go-libp2p dependency #4800

[Merged by Bors] - Update go-libp2p dependency #4800

Conversation

fasmat commented Aug 9, 2023

Motivation

Changes

Test Plan

TODO

DevOps Notes

dshulyak commented Aug 9, 2023 • edited

fasmat commented Aug 9, 2023 • edited

fasmat commented Aug 9, 2023

bors bot commented Aug 9, 2023

try

codecov bot commented Aug 9, 2023 • edited

Codecov Report

fasmat commented Aug 9, 2023

bors bot commented Aug 9, 2023

fasmat commented Aug 9, 2023

bors bot commented Aug 9, 2023

fasmat commented Aug 10, 2023

bors bot commented Aug 10, 2023

fasmat commented Aug 10, 2023 • edited

fasmat commented Aug 17, 2023

fasmat commented Aug 17, 2023

bors bot commented Aug 17, 2023

dshulyak commented Aug 9, 2023 •

edited

fasmat commented Aug 9, 2023 •

edited

codecov bot commented Aug 9, 2023 •

edited

fasmat commented Aug 10, 2023 •

edited