[Snyk] Upgrade libp2p from 0.26.2 to 0.32.4 #1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade libp2p from 0.26.2 to 0.32.4. See this package in npm: https://www.npmjs.com/package/libp2p See this project in Snyk: https://app.snyk.io/org/pardo/project/53b0aff5-b724-4c71-9678-c167f3521414?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade libp2p from 0.26.2 to 0.32.4.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version fixes:
SNYK-JS-WS-1296835
Why? Proof of Concept exploit, CVSS 5.3
(*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: libp2p
-
0.32.4 - 2021-08-20
-
0.32.3 - 2021-08-16
- uint8arrays is a dep (#964) (ba2b4d4)
-
0.32.2 - 2021-08-13
- browser example ci (3b33fb4)
- custom protocol name (#962) (ef24fab)
-
0.32.1 - 2021-07-22
- turn compliance tests into devDependency (#960) (0701de4)
-
0.32.0 - 2021-07-15
-
-
@ mpetrun5 and @ mpetrunic ❤️
- update to new multiformats (#948) (13cf476)
- uses the CID class from the new multiformats module
-
0.32.0-rc.0 - 2021-07-09
- do not allow dial to large number of multiaddrs (#954) (af723b3)
- update to new multiformats (#948) (13cf476)
- uses the CID class from the new multiformats module
-
0.31.8 - 2021-09-03
-
0.31.7 - 2021-06-14
- chat example with new multiaddr (#946) (d8ba284)
- dialer leaking resources after stopping (#947) (b291bc0)
-
0.31.6 - 2021-05-27
- keychain rotate passphrase (#944) (478963a)
-
0.31.5 - 2021-05-12
- store remote agent and protocol version during identify (#943) (818d2b2)
-
0.31.4 - 2021-05-12
-
0.31.3 - 2021-05-04
-
0.31.2 - 2021-04-30
-
0.31.1 - 2021-04-30
-
0.31.0 - 2021-04-28
-
0.31.0-rc.7 - 2021-04-27
-
0.31.0-rc.6 - 2021-04-22
-
0.31.0-rc.5 - 2021-04-21
-
0.31.0-rc.4 - 2021-04-20
-
0.31.0-rc.3 - 2021-04-19
-
0.31.0-rc.2 - 2021-04-16
-
0.31.0-rc.1 - 2021-04-16
-
0.31.0-rc.0 - 2021-04-15
-
0.30.13 - 2021-08-19
-
0.30.12 - 2021-03-27
-
0.30.11 - 2021-03-23
-
0.30.10 - 2021-03-09
-
0.30.9 - 2021-02-25
-
0.30.8 - 2021-02-11
-
0.30.7 - 2021-02-01
-
0.30.6 - 2021-01-29
-
0.30.5 - 2021-01-28
-
0.30.4 - 2021-01-27
-
0.30.3 - 2021-01-27
-
0.30.2 - 2021-01-21
-
0.30.1 - 2021-01-18
-
0.30.0 - 2020-12-16
-
0.30.0-rc.2 - 2020-12-15
-
0.30.0-rc.1 - 2020-12-11
-
0.30.0-rc.0 - 2020-12-10
-
0.29.4 - 2020-12-09
-
0.29.3 - 2020-11-04
-
0.29.2 - 2020-10-23
-
0.29.1 - 2020-10-22
-
0.29.0 - 2020-08-27
-
0.29.0-rc.1 - 2020-08-27
-
0.29.0-rc.0 - 2020-08-25
-
0.28.10 - 2020-08-05
-
0.28.9 - 2020-07-27
-
0.28.8 - 2020-07-20
-
0.28.7 - 2020-07-14
-
0.28.6 - 2020-07-14
-
0.28.5 - 2020-07-10
-
0.28.4 - 2020-07-03
-
0.28.3 - 2020-06-18
-
0.28.2 - 2020-06-15
-
0.28.1 - 2020-06-12
-
0.28.0 - 2020-06-05
-
0.28.0-rc.0 - 2020-05-28
-
0.27.9 - 2020-07-13
-
0.27.8 - 2020-05-06
-
0.27.7 - 2020-04-24
-
0.27.6 - 2020-04-16
-
0.27.5 - 2020-04-06
-
0.27.4 - 2020-03-31
-
0.27.3 - 2020-02-11
-
0.27.2 - 2020-02-05
-
0.27.1 - 2020-02-03
-
0.27.0 - 2020-01-28
-
0.27.0-rc.0 - 2020-01-24
-
0.27.0-pre.2 - 2020-01-07
-
0.27.0-pre.1 - 2019-12-15
-
0.27.0-pre.0 - 2019-12-12
-
0.26.2 - 2019-09-24
from libp2p GitHub release notesNo content.
Bug Fixes
Bug Fixes
Features
Bug Fixes
🔦 Highlights
🆕 Multiformats update
We updated to the new multiformats stack, removing older multiformats modules that are no longer maintained. This is a library defining common interfaces and low level building blocks for various interrelated multiformat technologies (multicodec, multihash, multibase, and CID). They can be used to implement custom base encoders / decoders / codecs, codec encoders /decoders and multihash hashers that comply to the interface that layers above assume.
Thanks to @ achingbrain for PRing all the libp2p modules ❤️
🔒 libp2p-noise updated
The new version of libp2p-noise is now faster and results in smaller bundles for applications built on top of libp2p. In short, bcrypto was replaced was by some of the goodies stablelib provides in an isolated fashion.
~27% decrease on its bundle size, from 191.5kb to 141.2kb (minified+gzipped), which represents a full bundle size decrease by ~10% in js-ipfs
~46% speed improvement
Types
libp2p-tcpandlibp2p-bootstrapexport types now 🎉 You can see the current state in #659Thanks to @ nazarhussain and @ acolytec3 for getting these in ❤️
🏗 API Changes
https://github.com/libp2p/js-libp2p/blob/master/doc/migrations/v0.31-v0.32.md
chore
BREAKING CHANGES
Bug Fixes
chore
BREAKING CHANGES
Co-authored-by: Vasco Santos [email protected]
Bug Fixes
Features
Bug Fixes
No content.
Commit messages
Package name: libp2p
Compare
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
🧐 View latest project report
🛠 Adjust upgrade PR settings
🔕 Ignore this dependency or unsubscribe from future upgrade PRs