archetech / archon / 34242882561

87%

push

github

chore(deps): Update kubo to v0.43.0 for the memory-exhaustion fixes (#1077)

v0.43.0 closes several remotely triggerable memory-exhaustion issues,
and the node publishes 4001 on TCP and UDP: WebTransport holds the body
of an unrecognised message while skipping it (CVE-2026-57497), HTTP/3
trailers decompress unbounded (CVE-2026-40898), and a peer can flood the
peerstore, plant protocol entries through chunked identify, or crash the
daemon through a data race in routing queries. The pubsub advisory needs
Pubsub.Enabled or Ipns.UsePubsub, which nothing here sets.

Verified against a throwaway 0.43.0 container: every call the client
makes -- id, add, cat, block.put, block.get, swarm.connect, swarm.peers,
config.get, config.set on Peering.Peers -- and the compose healthcheck
command. Both versions report repo 18, so no migration runs.


Claude-Session: https://claude.ai/code/session_01GYGMfX3foBcVqP7AQNXjWj

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

3978 of 4566 branches covered (87.12%)

Branch coverage included in aggregate %.

8625 of 9051 relevant lines covered (95.29%)

717.32 hits per line