pezkuwichain/pezkuwi-sdk
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(security): upgrade libp2p 0.54.1 → 0.56.0 to eliminate ring 0.16.20 vulnerability

Browse Source 
- Update libp2p from 0.54.1 to 0.56.0 in Cargo.toml
- Update libp2p-kad from 0.46.2 to 0.48.0 for compatibility
- Remove deprecated bandwidth logging (removed in libp2p 0.56)
  - transport.rs: Remove with_bandwidth_logging(), use websocket::Config
  - service.rs: Add NoBandwidthSink stub for bandwidth metrics
- Fix NetworkBehaviour derive macro changes:
  - behaviour.rs: Add From<Infallible> implementation for BehaviourOut
- Update pattern matching for new libp2p-swarm event fields:
  - request_responses.rs: Add connection_id to patterns
  - service.rs: Fix DialError::WrongPeerId field rename (endpoint → address)
  - service.rs: Add peer_id to IncomingConnectionError pattern
- Fix test file for new transport return type:
  - conformance.rs: Update transport usage

This eliminates the ring 0.16.20 security vulnerability (RUSTSEC-2024-0006)
by upgrading to ring 0.17.14 via the libp2p dependency chain.
This commit is contained in:
Kurdistan Tech Ministry
2025-12-23 05:29:36 +03:00
parent 2cc5880fd9
commit e96f346099
7 changed files with 142 additions and 335 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.toml
+2 -2
View File
@@ -889,9 +889,9 @@ landlock = { version = "0.3.0" }
lazy_static = { version = "1.5" }
libc = { version = "0.2.155" }
libfuzzer-sys = { version = "0.4" }
libp2p = { version = "0.54.1" }
libp2p = { version = "0.56.0" }
libp2p-identity = { version = "0.2.9" }
libp2p-kad = { version = "0.46.2", default-features = false }
libp2p-kad = { version = "0.48.0", default-features = false }
libsecp256k1 = { version = "0.7.0", default-features = false }
linked-hash-map = { version = "0.5.4" }
linked_hash_set = { version = "0.1.4" }