Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update IPFS Kubo to 0.29.0 #38979

Closed
lidel opened this issue Jun 11, 2024 · 2 comments · Fixed by brave/brave-core-crx-packager#933
Closed

Update IPFS Kubo to 0.29.0 #38979

lidel opened this issue Jun 11, 2024 · 2 comments · Fixed by brave/brave-core-crx-packager#933
Assignees

Comments

@lidel
Copy link

lidel commented Jun 11, 2024

cc @cypt4 (#37578 can be closed)

Signed Binaries: https://dist.ipfs.tech/kubo/v0.29.0/
Release Notes: https://github.com/ipfs/kubo/blob/master/docs/changelogs/v0.29.md (ipfs/kubo#10353)

@bbondy
Copy link
Member

bbondy commented Jun 18, 2024

Anything security sensitive? Didn't notice anything in the release notes.
I think we'll likely not do this otherwise due to #38979

@lidel
Copy link
Author

lidel commented Jun 19, 2024

No actively exploited issues, but it includes update to go-libp2p 0.34 which comes with two types of fixes that have security impact short/mid-term:

  • Resource manager that is now IP aware, and ships with preconfigured connection limits per CIDR, making unknown / future DoS attacks more expensive (connection-based DoS have to become DDoS, coming from different networks).
  • Stability/security fixes for /webrtc-direct transport as well. It is not used by many nodes atm, but will be enabled by default in Kubo 0.30, and the more nodes will expose such listener, Brave users will start connecting over this transport to peers that don't have other transports (even if Brave is stuck on older version, the majority of swarm will upgrade).

Ack, I understand the feasibility of this update depends on ETA of #37735 (fwiw Kubo release cadence is every ~5 weeks, and Brave is already 2 versions behind).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants