Note
This release was brought to you by the Shipyard team.
Changed
- upgrade to
boxov0.43.1 - update
go-ds-pebbleto v0.5.12 - upgrade to
go-libp2p-kad-dhtv0.42.1 - upgrade to
go-libp2pv0.49.0 - upgrade to
go-testv0.4.1 (includes v0.4.0).
Security
go-libp2pupdate contains security enhancements for DoS/hardening:- fix for CVE-2026-57497: GHSA-g35j-m5xg-vh3q
- 3501 bounds protocols accepted per peer in identify (a peer could plant 1800+ protocol entries in your peerstore via chunked identify)
- 3486 caps unconnected addrs per peer (stops DHT gossip flooding the peerstore with stale addrs; relevant to us)
- 3500 caps webrtc remote addrs per ufrag
- 3487 evicts stale certified addrs when a newer signed peer record drops them (an address a peer once advertised no longer lingers after removal)
Full Changelog: v1.23.2...v1.24.0