Skip to content

upgrade to go-libp2p v0.49.0 and boxo v0.42.1 - #467

Merged
gammazero merged 3 commits into
mainfrom
go-libp2p-v0.49.0
Jul 31, 2026
Merged

upgrade to go-libp2p v0.49.0 and boxo v0.42.1#467
gammazero merged 3 commits into
mainfrom
go-libp2p-v0.49.0

Conversation

@gammazero

Copy link
Copy Markdown
Contributor

The update to go-libp2p 0.49.0 update contains security fixes and enhancements for DoS/hardening:

  • fix for CVE-2026-57497: GHSA-g35j-m5xg-vh3q
  • 3501 bounds protocols accepted per peer in identify (a peer could plant 1800+ protocol entries in your peerstore via chunked identify)
  • 3486 caps unconnected addrs per peer (stops DHT gossip flooding the peerstore with stale addrs; relevant to us)
  • 3500 caps webrtc remote addrs per ufrag
  • 3487 evicts stale certified addrs when a newer signed peer record drops them (an address a peer once advertised no longer lingers after removal)

The update to `go-libp2p` 0.49.0 update contains security fixes and enhancements for DoS/hardening
@gammazero
gammazero merged commit 9b909b0 into main Jul 31, 2026
13 of 15 checks passed
@gammazero
gammazero deleted the go-libp2p-v0.49.0 branch July 31, 2026 07:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant