Skip to content

chore: update libp2p to 0.56.0#786

Open
amaury1093 wants to merge 4 commits into
a16z:masterfrom
Inco-fhevm:am/update-libp2p
Open

chore: update libp2p to 0.56.0#786
amaury1093 wants to merge 4 commits into
a16z:masterfrom
Inco-fhevm:am/update-libp2p

Conversation

@amaury1093

@amaury1093 amaury1093 commented Mar 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Update to latest libp2p version, and in the same time bumping some transitive dependencies which resolve vulnerabilities (e.g. https://rustsec.org/advisories/RUSTSEC-2024-0344.html)

There were some breaking changes between the 2 version of libp2p:

  • Replaced mplex::MplexConfig import with yamux module
  • Replaced libp2p_identity::Keypair import with libp2p::identity::Keypair (avoids two conflicting versions of libp2p-identity)
  • Rewrote create_swarm() to use the new fluent SwarmBuilder API (with_existing_identity -> with_tokio -> with_tcp -> with_behaviour -> build)

Edit: CI fails, but cargo test passes

@socket-security

socket-security Bot commented Apr 16, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedcargo/​libp2p@​0.51.4 ⏵ 0.56.083 -1710093100100
Updatedcargo/​libp2p-identity@​0.1.3 ⏵ 0.2.1310010093100100

View full report

@socket-security

socket-security Bot commented Apr 16, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
High CVE: Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145

CVE: GHSA-vxx9-2994-q338 Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145 (HIGH)

Affected versions: < 0.13.10

Patched version: 0.13.10

From: ? → cargo/yamux@0.12.1

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/yamux@0.12.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

This was referenced May 27, 2026
Closed
Merged
mfw78 added a commit to nxm-rs/helios that referenced this pull request May 28, 2026
@mfw78 @amaury1093
chore(opstack): cherry-pick a16z#786 to bump libp2p 0.51 → 0.56 (#10)
eb62d83 
* chore: update libp2p to 0.56.0

* fix: fix clippy

* fix: Fix clippy

---------

Co-authored-by: Amaury <1293565+amaury1093@users.noreply.github.com>
@amunt0 amunt0 mentioned this pull request Jun 3, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@amaury1093 @kourtellosg