weshnet icon indicating copy to clipboard operation
weshnet copied to clipboard

Chore/update kubo 0.29.0

Open D4ryl00 opened this issue 1 year ago • 1 comments

This PR updates kubo to v0.29.0 and its dependencies. Because there are a lot a break changes between the previous version and this new one, a lot of fixes were made in this PR. The gRPC package deprecated DialContext in favor of NewClient, the DNS resolver should be explicitly used: https://stackoverflow.com/questions/78485578/how-to-use-the-bufconn-package-with-grpc-newclient

We removed gogoproto for the API generation, but copied from it the utility functions to read/write proto messages, into the new package protoio. The API is now generated with the official Golang protoc plugin instead of gogoproto.

D4ryl00 avatar Aug 05 '24 15:08 D4ryl00

:warning: We detected 20 security issues in this pull request:

Insecure Access Control (1)
Severity Details Docs
High Title: Missing User Instruction
https://github.com/berty/weshnet/blob/3a83c6630c5cef5d9c2acc2041650945bc4b0cfb/tool/docker-protoc/Dockerfile#L4
:books:

More info on how to fix Insecure Access Control in Dockerfile.


Vulnerable Libraries (19)
Severity Details
High pkg:golang/golang.org/x/[email protected] upgrade to: > v0.23.0
High pkg:golang/github.com/srikrsna/[email protected] upgrade to: > v1.0.1
High pkg:golang/github.com/multiformats/[email protected] upgrade to: > v0.12.4
N/A pkg:golang/google.golang.org/[email protected] upgrade to: 1.64.1
High pkg:golang/github.com/ipfs/[email protected] upgrade to: > v0.1.0
Critical pkg:golang/github.com/libp2p/[email protected] upgrade to: > v0.25.2
High pkg:golang/github.com/prometheus/[email protected] upgrade to: > v1.19.1
Critical pkg:golang/github.com/berty/[email protected] upgrade to: > v0.5.1
Critical pkg:golang/berty.tech/[email protected] upgrade to: > v1.10.3-0.20240719141234-29e2d26e2aeb
Critical pkg:golang/github.com/libp2p/[email protected] upgrade to: > v0.11.1-0.20240711152552-e508d8643ddb
Critical pkg:golang/berty.tech/[email protected] upgrade to: > v1.3.1-0.20240722095251-c6b363b38785
Critical pkg:golang/github.com/libp2p/[email protected] upgrade to: > v0.34.1
High pkg:golang/go.uber.org/[email protected] upgrade to: > v1.27.0
Critical pkg:golang/github.com/ipfs/[email protected] upgrade to: > v0.29.0
High pkg:golang/github.com/stretchr/[email protected] upgrade to: > v1.9.0
High pkg:golang/go.uber.org/[email protected] upgrade to: > v1.3.0
Medium pkg:golang/github.com/multiformats/[email protected] upgrade to: > v0.2.3
Critical pkg:golang/berty.tech/[email protected] upgrade to: > v1.22.2-0.20240719144258-ec7d1faaca68
High pkg:golang/golang.org/x/[email protected] upgrade to: > v0.21.0

More info on how to fix Vulnerable Libraries in Go.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

guardrails[bot] avatar Aug 05 '24 15:08 guardrails[bot]