chore: update kubo v0.41.0 - #133
Merged
Merged
Conversation
- upgrade go 1.26.3, kubo v0.41.0, libp2p v0.48.0, go-ds-badger2 v0.1.5 - add Path() method to RepoMobile (new in repo.Repo interface, kubo v0.41.0) - replace DefaultBootstrapAddresses with AutoPlaceholder (removed upstream) - pass repo directory instead of sqlite file path to NewRepoMobile Signed-off-by: D4ryl00 <d4ryl00@gmail.com>
golangci-lint 1.59.1 cannot read go1.26 export data ("unsupported
version: 2"). Bump it to 2.12.2 and migrate the config to the v2 format.
Fix the issues newly surfaced by the updated staticcheck/gosec rules:
- rename builtin-shadowing vars (max, clear)
- migrate deprecated cfg.Reprovider to cfg.Provide (kubo v0.41)
- fix non-constant format string in fmt.Errorf
- exclude noisy gosec G115 (safe int conversions) and annotate the
G118 false positive (cancel is tracked and called elsewhere)
Signed-off-by: D4ryl00 <d4ryl00@gmail.com>
kubo v0.41 changed two defaults that broke weshnet:
- Bitswap broadcast control is now enabled by default, reducing the set
of peers a WANT is broadcast to based on prior block-serving history.
In weshnet's small meshes a freshly connected peer is never asked for
blocks, so orbitdb log entries never replicate (heads arrive over
pubsub but the entries can't be fetched). Disable broadcast control in
the base config and in the test repo to restore broadcast-to-all.
- The DHT sweeping reprovider is now enabled by default and keeps a
dedicated keystore datastore whose lock is not released synchronously
on node Close, making a persistent repo fail to reopen ("resource
temporarily unavailable"). Disable it for persistent repos.
Fixes the stable tests Test_Add_Messages_To_Cache, TestReactivate*,
and ExampleNewPersistentServiceClient_basic.
Signed-off-by: D4ryl00 <d4ryl00@gmail.com>
D4ryl00
marked this pull request as ready for review
June 3, 2026 23:33
Contributor
|
@D4ryl00, what do you think about the recommended upgrades from guardrails? |
Resolve the reachable vulnerabilities reported by govulncheck (5 -> 1): - GO-2026-5039 (net/textproto) and GO-2026-5037 (crypto/x509): fixed by bumping the go directive and toolchain to 1.26.4. Raising the go directive (not just the toolchain) ensures the stdlib fix propagates to consumers importing weshnet as a library. - GO-2026-5026 (golang.org/x/net): x/net v0.53.0 -> v0.55.0. - GO-2025-4173 (eclipse/paho.mqtt.golang): v1.4.2 -> v1.5.1. The only remaining reachable vulnerability, GO-2024-3218 (DHT content censorship in go-libp2p-kad-dht), has no upstream fix available. Signed-off-by: D4ryl00 <d4ryl00@gmail.com>
Collaborator
Author
Only |
jefft0
approved these changes
Jun 5, 2026
jefft0
left a comment
jefft0
left a comment
Contributor
There was a problem hiding this comment.
All Ci checks pass. Looks good. Need to merge this as a dependency.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Path() stringmethod toRepoMobileto satisfy the updatedrepo.Repointerface introduced in kubo v0.41.0DefaultBootstrapAddresseswithAutoPlaceholderNewRepoMobilecall to pass the repo directory instead of the sqlite file path (kubo now callsPath()to create keystore subdirectories)Dependencies