chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@aptre/common	0.16.4 -> 0.16.6					devDependencies	patch
actions/checkout	v4.1.5 -> v4.1.6					action	patch
github.com/libp2p/go-libp2p	v0.33.2 -> v0.34.0					require	minor
github.com/multiformats/go-multiaddr	v0.12.3 -> v0.12.4					require	patch
github.com/nats-io/nats-server/v2	v2.10.14 -> v2.10.16					require	patch
github.com/nats-io/nats.go	v1.34.1 -> v1.35.0					require	minor
github.com/quic-go/quic-go	v0.43.1 -> v0.44.0					require	minor
github/codeql-action	v3.25.5 -> v3.25.6					action	patch

---

Release Notes

aperturerobotics/common (@​aptre/common)

v0.16.6

Compare Source

v0.16.5

Compare Source

actions/checkout (actions/checkout)

v4.1.6

Compare Source

• Check platform to set archive extension appropriately by @​cory-miller in https://github.com/actions/checkout/pull/1732

libp2p/go-libp2p (github.com/libp2p/go-libp2p)

v0.34.0

Compare Source

⚠️ Breaking Changes ⚠️

1. Transient Connections are now called Limited Connections. The prior terminology was confusing to many, and conflicted with the transient definition in the resource manager. The term actually referred to a connection that was relayed and limited in some aspect (either data or time).
2. libp2phttp: The well-known resource for libp2p protocols has changed. See the discussion thread for context. This means that new clients will not be able to reach the well-known endpoint automatically on old servers, and new servers won't respond to the old well-known endpoint to old clients. If you do not fully control the deployment of this, you should set EnableCompatibilityWithLegacyWellKnownEndpoint in libp2phttp.Host to true to enable backwards compatibility. This is not the default behavior because libp2phttp is still experimental and things are generally permitted to break. In this case supporting backwards compatibility was simple enough and we generally don't like breaking users even on an experimental feature.
3. ResourceManager: This probably only affects 0.01% of use cases. The resource manager is now IP aware. Meaning it will set limits for how many connections it tracks per IP address or IP Address range (CIDR subnet). Look at ‎WithLimitPeersPerCIDR‎ for how to configure it. Almost all users will not need to touch this. If you're tests are suddenly breaking, this is might be why

🔦 Highlights

WebRTC Direct

• We've significantly improved support for webrtc-direct transport with multiple security and performance fixes.
• Based on the experience of webrtc-direct on v0.34 we intend to make it non experimental in v0.35

Transient Connections are now called Limited Connections

• Connections to peers over relayed or other limited connections, previously called transient are now called limited throughout the code. Limited is more descriptive of the connection's behavior and it avoids conflict with Resource Manager's Transient scope.
• For Connections, the Transient connection state has been renamed to Limited. This is a breaking change and you'll have to replace uses of conn.Stat().Transient with conn.Stat().Limited
• Network context functions like network.WithUseTransient are deprecated, use their limited alternatives like network.WithUseLimited.

Limited Connectedness state

• Peers connected to the host via relayed or any other limited connection now report their connectivity state as Limited.
• This state is also reflected in EvtPeerConnectednessChanged event. Consumers only interested in peers connected over Unlimited connections can ignore events with Limited Connectedness. NOTE: This changes the behavior of the Connected Connectedness state. Previously it included all limited connections and now it doesn't. To keep existing behavior in your code you can replace checks connectedness == network.Connected with connectedness != network.NotConnected

What's Changed

• webrtc: setup datachannel handlers before connecting to a peer by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2716
• webrtc: close mux when closing listener by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2717
• ping: use context.Afterfunc to avoid a lingering goroutine by @​Jorropo in https://github.com/libp2p/go-libp2p/pull/2723
• Small code improvements by @​AnomalRoil in https://github.com/libp2p/go-libp2p/pull/2722
• webrtc: use a common logger for all pion logging by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2718
• fix: ReserveMemory error cannot be printed by @​wlynxg in https://github.com/libp2p/go-libp2p/pull/2725
• webrtc: fix bug with logger wrapper by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2727
• chore: update examples to v0.33.0 by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2728
• webrtc: increase receive buffer size on listener by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2730
• security: remove unnecessary noise code by @​Dreamacro in https://github.com/libp2p/go-libp2p/pull/2738
• chore: bump quic-go by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2742
• add more info to "protocol mux failed" by @​zhiqiangxu in https://github.com/libp2p/go-libp2p/pull/2734
• webrtc: set sctp receive buffer size to 100kB by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2745
• ci: uci/copy-templates by @​web3-bot in https://github.com/libp2p/go-libp2p/pull/2747
• use Fx to start and stop the host, swarm, autorelay and quicreuse by @​marten-seemann in https://github.com/libp2p/go-libp2p/pull/2118
• quicreuse: remove workaround for quic-go listener close deadlock by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2746
• Use any port, not a specific one for HTTP examples by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2748
• feat: add tls WithKeyLogWriter option by @​wlynxg in https://github.com/libp2p/go-libp2p/pull/2750
• webrtc: add NullResourceManager, fixes panic by @​dozyio in https://github.com/libp2p/go-libp2p/pull/2752
• webrtc: run onDone callback immediately on close by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2729
• autonat: Clean up after close by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2749
• quic: make server cmd use RFC 9000 instead of draft-29 by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2753
• libp2phttp: Rename well-known resource by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2757
• fix: revert gorilla/websocket from 1.5.1 to 1.5.0 by @​wlynxg in https://github.com/libp2p/go-libp2p/pull/2763
• Update chat with rendezvous example by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2769
• Identify: emit useful events after identification by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2759
• libp2phttp: Return connection: close when doing http over streams by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2756
• Update: update incomplete readmes by @​apenzk in https://github.com/libp2p/go-libp2p/pull/2767
• Fix comment by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2775
• basichost: append certhash for webrtc addresses provided via address factory by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2774
• Add a "transient" network connectivity state by @​Stebalien in https://github.com/libp2p/go-libp2p/pull/2696
• webrtc: add webrtc addresses to host normalizer by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2784
• Update github.com/quic-go/quic-go dependency by @​fasmat in https://github.com/libp2p/go-libp2p/pull/2780
• fix: DNS protocol address is not reserved by @​wlynxg in https://github.com/libp2p/go-libp2p/pull/2792
• identify: refactor observed address manager to do address mapping at thin waist(IP+TCP/UDP) layer by @​sukunrt in https://github.com/libp2p/go-libp2p/pull/2793
• rcmgr: Add conn_limiter to limit number of conns per ip cidr by @​MarcoPolo in https://github.com/libp2p/go-libp2p/pull/2788

New Contributors

• @​AnomalRoil made their first contribution in https://github.com/libp2p/go-libp2p/pull/2722
• @​wlynxg made their first contribution in https://github.com/libp2p/go-libp2p/pull/2725
• @​Dreamacro made their first contribution in https://github.com/libp2p/go-libp2p/pull/2738
• @​zhiqiangxu made their first contribution in https://github.com/libp2p/go-libp2p/pull/2734
• @​apenzk made their first contribution in https://github.com/libp2p/go-libp2p/pull/2767
• @​fasmat made their first contribution in https://github.com/libp2p/go-libp2p/pull/2780

Full Changelog: libp2p/go-libp2p@v0.33.0...v0.34.0

multiformats/go-multiaddr (github.com/multiformats/go-multiaddr)

v0.12.4

Compare Source

What's Changed

Improved classification of IPv6 public addresses. For details see:

• net: restrict unicast ip6 public address space by @​sukunrt in https://github.com/multiformats/go-multiaddr/pull/235

Full Changelog: multiformats/go-multiaddr@v0.12.3...v0.12.4

nats-io/nats-server (github.com/nats-io/nats-server/v2)

v2.10.16

Changelog

Refer to the 2.10 Upgrade Guide for backwards compatibility notes with 2.9.x.

[!WARNING]
A possible regression may result in a server panic at startup when tav.idx files were incorrectly truncated down to zero bytes. You can work around this problem by deleting tav.idx files that are zero bytes in length before starting the server. Zero-byte files could exist as a result of a previous server crash before a successful file sync to disk occurred.

Go Version

• 1.22.3 (#​5438)

Dependencies

• github.com/nats-io/jwt/v2 v2.5.6 (#​5328)
• golang.org/x/sys v0.20.0 (#​5388)
• golang.org/x/crypto v0.23.0 (#​5413)

Added

• Added Left and Right subject mapping operations (#​5337) Thanks to @​sspates for the contribution!
• Add a /expvarz monitoring endpoint (#​5374)

Improved

Accounts

• Change AccountResolver() to use read lock to prevent contention (#​5351)
• Improve muxed routes with large subject space (#​5399)

Gateway

• Outbound may fail to detect stale connection (#​5356) Thanks to @​wjordan for the report!

JetStream

• Optimize stream subject matching implementation (#​5316, #​5324, #​5329, #​5342, #​5353)
• Improve filestore LoadNextMsg performance (#​5401)
• Prevent blocking writes on meta state filestore flush (#​5333)
• Add logging to measure writeFullState and enforceMsgPerSubjectLimit (#​5340)
• Do not hold filestore lock on msg block loads when looking up the first sequence for subject (#​5363)
• Improve various stream sourcing and mirror behaviors and performance (#​5366, #​5372, #​5379, #​5389)
• Increase the compression threshold for Raft traffic (#​5371)
• Put a maximum idle flush time for the filestore (#​5370)
• Updated subject state expiration (#​5377)
• Simplify writing the full state to index.db (#​5378)
• Added in separate last subject timestamp to track access (#​5380)
• Check consumer leader status without locks (#​5386)
• Various Raft improvements with limited to no state (#​5427)
• Improved consumer with AckAll performance of first ack with large first stream sequence (#​5446)
• Various stream catchup improvements (#​5454)

WebSocket

• Improve generating INFO data to send to clients (#​5405)

Fixed

Config

• Fix to properly deal with block scopes in lexer (#​5406, #​5431, #​5436)

JetStream

• Fix potential deadlock if a panic occurs during calculateSyncRequest (#​5321)
• Fix corner cases of subject matching (#​5318, #​5339) Thanks to @​mihaitodor for the report!
• Prevent stepping down for old election terms (#​5314)
• Prevent WAL truncation during catch-up until after peerstate/snapshot check (#​5330)
• Fix various delivery counter logic (#​5338, #​5361)
• Reset election timeout only on granted vote request (#​5315)
• Ensure stream catchup syncs after server crash and restart (#​5362)
• Prevent race condition for mirroring a consumer (#​5369)
• Ensure messages are removed after consumer updates occur on interest-based streams (#​5384) Thanks to @​MauriceVanVeen for the report and contribution!
• Cleanup messages on interest stream after consumer interest changes (#​5385) Thanks to @​tyler-eon for the report and @​MauriceVanVeen for the contribution!
• Fix potential redelivery of acked messages during server restarts (#​5419)
• Hold onto tombstones for previous blocks on compact (#​5426)
• Fixes for rescaling streams with sources (#​5428)

WebSocket

• Fix data races during shutdown (#​5398)

Chores

• Various test improvements (#​5319, #​5332, #​5341)
• Document field names (#​5359)

Complete Changes

nats-io/nats.go (github.com/nats-io/nats.go)

v1.35.0

Compare Source

Changelog

Added

• Service API:
  • Added API to read reply subject from micro.Request. Thanks @​mcosta74 for the contribution (#​1589)
• Core NATS:
  • Added ForceReconnect method on connection for manually triggering reconnect (#​1624)

Fixed

• KeyValue:
  • Fixed invalid DiscardPolicy being set when creating a new KeyValue store using the jetstream package. Previously created KV instances will be auto-repaired when calling CreateKeyValue (#​1616, #​1617)
• JetStream:
  • Fixed validation for streams, consumers and KV buckets to avoid protocol errors (#​1613)
• Core NATS:
  • Fixed ConnectedCB not being invoked when using RetryOnFailedConnect: true and the initial nats.Connect fails (#​1619)

Improved

• Core NATS:
  • Remove unnecessary allocations from readMIMEHeader (#​1609)
• KeyValue:
  • Added json tags to KeyValueConfig struct. Thanks @​pricelessrabbit for the contribution (#​1630)
• Legacy JetStream:
  • Added documentation for StreamConfig in jsm.go. Thanks @​kazmerdome for the contribution (#​1625)

Complete Changes

quic-go/quic-go (github.com/quic-go/quic-go)

v0.44.0

Compare Source

v0.44 contains a lot of fixes related to HTTP Datagrams, new logic to determine (and configure) the QUIC packet size, as well as a significant speedup of the various parsers.

HTTP Datagram-related Fixes

The last release introduced support for HTTP Datagrams (RFC 9297). This release resolves a number of problems we discovered in the initial implementation:

• reject sending of DATAGRAM frames that exceed the currently available MTU (https://github.com/quic-go/quic-go/pull/4497)
• http3: deadline errors are now ignored in stream state tracking (https://github.com/quic-go/quic-go/pull/4495)
• http3: refuse to send HTTP datagrams associated with a closed stream (https://github.com/quic-go/quic-go/pull/4488)
• http3: use the send stream context for tracking the stream state (https://github.com/quic-go/quic-go/pull/4489)
• http3: fix memory leak caused by stream state tracking (https://github.com/quic-go/quic-go/pull/4523). Thanks to @​GeorgeMac for debugging and fixing!

QUIC Packet Size and Path MTU Discovery

• The initial packet size is now configurable via quic.Config. Most users should not use this config option, but instead rely on Path MTU discovery (https://github.com/quic-go/quic-go/pull/4503)
• The client's initial packet size was increased to 1280 bytes (https://github.com/quic-go/quic-go/pull/4500)
• Respect the client's max_udp_payload_size transport parameter (https://github.com/quic-go/quic-go/pull/4514)
• qlog: add support for the mtu_updated event (https://github.com/quic-go/quic-go/pull/4517)

Speeding up Parsing the variable-length Integers

The QUIC varint parser was rewritten to act on byte slices instead of a bytes.Reader. This is significantly faster (https://github.com/quic-go/quic-go/pull/4475). The new parser is now used for parsing QUIC frames (https://github.com/quic-go/quic-go/pull/4484), the QUIC packet header (https://github.com/quic-go/quic-go/pull/4481), the QUIC transport parameters (https://github.com/quic-go/quic-go/pull/4483) and HTTP datagrams (https://github.com/quic-go/quic-go/pull/4478).

Other Notable Changes

• http3: ParseCapsule now returns an io.EOF (and not an io.UnexpectedEOF) if the underlying reader returns an io.EOF on the first byte (https://github.com/quic-go/quic-go/pull/4476)
• http3: ListenAndServe was renamed to ListenAndServeTLS (https://github.com/quic-go/quic-go/pull/4522). Thanks to @​ETZhangSX!
• http3: reserved frame types now cause a connection error, as required by the RFC (https://github.com/quic-go/quic-go/pull/4467)
• http3: pass the correct Connection to the ConnContext callback (https://github.com/quic-go/quic-go/pull/4480). Thanks to @​rthellend!

quic-go needs your support!

Is your project / company relying on quic-go?
Please consider funding the project. Any support is highly appreciated!

What's Changed

• build(deps): bump golangci/golangci-lint-action from 4 to 5 by @​dependabot in https://github.com/quic-go/quic-go/pull/4472
• http3: return an io.EOF when parsing a capsule fails on the first byte by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4476
• quicvarint: add a function to parse a varint from a byte slice by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4475
• http3: avoid allocation when parsing the datagram's quarter stream ID by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4478
• http3: Pass original Conn to ConnContext by @​rthellend in https://github.com/quic-go/quic-go/pull/4480
• http3: reject reserved frame types by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4467
• fix capture of loop variable in connection probe packet tests by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4486
• http3: refuse to send datagrams associated with a closed stream by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4488
• http3: use the stream context to detect when the send side is closed by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4489
• wire: use quicvarint.Parse to when parsing transport parameters by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4482
• wire: use quicvarint.Parse when parsing frames by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4484
• wire: refactor header parsing to use quicvarint.Parse by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4481
• wire: reduce allocations when parsing transport parameters by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4483
• fix incorrect reuse of UDP connection in handshake benchmark by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4491
• http3: fix race condition when creating state tracking stream by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4493
• ci: run benchmarks by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4492
• http3: ignore deadline errors when tracking QUIC stream states by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4495
• ci: update golangci-lint-action to v6 and golangci-lint to v1.58.0 by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4494
• ci: disable exhaustive linter for test files by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4499
• add an integration test for DPLPMTUD by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4498
• reject sending of DATAGRAM frames that exceed the current MTU by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4497
• wire: write configured value of max_udp_payload_size transport parameter by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4501
• increase initial packet size to 1280 bytes (for both IPv4 and IPv6) by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4500
• make the initial packet size configurable by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4503
• update all golang.org/x dependencies by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4506
• initialize the MTU discoverer when processing the transport parameters by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4514
• retry the MTU integration test up to 3 times by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4519
• logging / qlog: add support for DPLPMTUD by @​marten-seemann in https://github.com/quic-go/quic-go/pull/4517
• http3: rename ListenAndServe to ListenAndServeTLS by @​ETZhangSX in https://github.com/quic-go/quic-go/pull/4522
• fix(http3): handle streamStateSendAndReceiveClosed in onStreamStateChange by @​GeorgeMac in https://github.com/quic-go/quic-go/pull/4523

New Contributors

• @​ETZhangSX made their first contribution in https://github.com/quic-go/quic-go/pull/4522

Full Changelog: quic-go/quic-go@v0.43.0...v0.44.0

github/codeql-action (github/codeql-action)

v3.25.6

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.