chore(deps): update module github.com/ipld/go-ipld-prime to v0.23.0 [security] - #10
Closed
dwertent wants to merge 1 commit into
Closed
Conversation
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: nodebuilder/tests/tastora/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
There was a problem hiding this comment.
Pull request overview
This PR updates the Celestia Node Go module dependencies to remediate security advisories by bumping github.com/ipld/go-ipld-prime to v0.23.0 (and aligning related transitive dependencies across the root module and the tastora test submodule).
Changes:
- Bump
github.com/ipld/go-ipld-primefromv0.21.0→v0.23.0(indirect) in both the root module andnodebuilder/tests/tastora. - Update several related/transitive dependencies (e.g.
github.com/ipfs/go-cid,github.com/multiformats/*,golang.org/x/*) as a result of the module update/tidy. - Update the
nodebuilder/tests/tastoramodule’s Go version directive.
Reviewed changes
Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
go.mod |
Bumps go-ipld-prime and other transitive deps in the root module. |
nodebuilder/tests/tastora/go.mod |
Mirrors dependency bumps for the tastora submodule and adjusts its go directive. |
nodebuilder/tests/tastora/go.sum |
Updates dependency checksums consistent with the submodule’s dependency resolution. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| module github.com/celestiaorg/celestia-node/nodebuilder/tests/tastora | ||
|
|
||
| go 1.25.9 | ||
| go 1.25.11 |
| github.com/ipfs/boxo v0.33.1 | ||
| github.com/ipfs/go-block-format v0.2.2 | ||
| github.com/ipfs/go-cid v0.5.0 | ||
| github.com/ipfs/go-cid v0.6.1 |
Author
|
Closing: opened during a CVE-remediation test session on 2026-06-15; not needed (superseded by consolidated grouped/direct-only/severity-filtered config). Sorry for the noise. |
dwertent
deleted the
renovate/go-github.com-ipld-go-ipld-prime-vulnerability
branch
June 18, 2026 16:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.21.0→v0.23.0go-ipld-prime: DAG-CBOR decoder unbounded memory allocation from CBOR headers
CVE-2026-35480 / GHSA-378j-3jfj-8r9f
More information
Details
The DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation.
A CBOR map or list header can declare an arbitrarily large number of entries, causing the decoder to preallocate proportionally large backing structures before any entries are actually read. Because the allocation budget is only decremented as entries are decoded (not when sizes are declared), this cost is effectively invisible to the budget system. This is compounded by nesting: each level of a nested structure triggers its own unchecked preallocation while consuming minimal budget (one entry per parent level), so a payload under 100 bytes with 10 levels of nesting can cause over 9GB of allocation.
Schema-free decoding (i.e. using
basicnode.Prototype.Any) allows arbitrary nesting depth. Schema-bound decoding limits nesting to the schema's structure, but any field typed asAnyin the schema permits unconstrained nesting within that field.The fix caps the preallocation size hint to 1024 entries and decrements the allocation budget when collection sizes are declared. The declared length is still used for entry-count validation, and collections grow dynamically as entries are decoded, so correctly-formed data is unaffected, even beyond the preallocation limit.
Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth
CVE-2026-42328 / GHSA-w239-58x2-q8p5
More information
Details
The DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow (distinct from a recoverable panic).
For DAG-CBOR, a payload of approximately 2 MB, consisting of repeated
0x81(array-of-1) bytes followed by a terminator, produces around 2 million recursion frames and reliably exhausts Go's default 1 GB goroutine stack. The existing allocation budget does not prevent this: each nested collection header costs only a handful of budget units, so the stack is exhausted before the budget is. DAG-JSON has equivalent exposure via[[[...]]]-style payloads; it has no budget system and is therefore unprotected against recursion depth as well.Schema-free decoding (using
basicnode.Prototype.Any) allows arbitrary nesting depth. Schema-bound decoding bounds nesting only when the schema itself is non-recursive and contains no fields typed asAny; schemas with recursive type references or anyAny-typed fields permit unconstrained nesting at those points.The fix adds a configurable
MaxDepthoption to both decoders, defaulting to 1024 nested levels. The decoder returnsErrDecodeDepthExceededwhen a payload nests beyond the limit. Well-formed IPLD data rarely approaches this depth in practice; the default is generous for legitimate use while preventing stack exhaustion.Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
ipld/go-ipld-prime (github.com/ipld/go-ipld-prime)
v0.23.0Compare Source
What's Changed
Full Changelog: ipld/go-ipld-prime@v0.22.0...v0.23.0
v0.22.0Compare Source
What's Changed
New Contributors
Full Changelog: ipld/go-ipld-prime@v0.21.0...v0.22.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.