Skip to content

Feature/hardening backlog #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nnlgsakib merged 3 commits into from
Aug 22, 2026
Merged

Feature/hardening backlog #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
aba06de
fix(ipc): keep test socket path under macOS 104-byte limit
nnlgsakib Aug 22, 2026
5fc119c
fix(deps): clear 13 of 14 called vulnerabilities (XC-012)
nnlgsakib Aug 22, 2026
d2b2de2
fix(explorer-web): resolve high/moderate npm audit findings (XC-013)
nnlgsakib Aug 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,13 @@ jobs:

govulncheck:
name: Vulnerabilities (govulncheck)
# Reporting-only until the 14 called vulnerabilities (5 modules +
# stdlib, found 2026-08-22) are triaged: Go toolchain bump to
# 1.25.13, grpc v1.82.1, x/text v0.39.0, pion/dtls v3.1.4,
# webtransport-go v0.11.1. One finding has no fix available yet.
# Reporting-only because of exactly one remaining finding,
# GO-2024-3218 (Kademlia DHT censorship): no upstream fix exists
# ("Fixed in: N/A") — it is an architectural property of Kad DHTs.
# Everything else was cleared by the 2026-08-22 dependency bumps
# (toolchain 1.25.13, grpc v1.82.1, x/text v0.39.0, pion/dtls
# v3.1.4, webtransport-go v0.11.1). Flip to enforcing if upstream
# ships a fix and we take it.
continue-on-error: true
runs-on: ubuntu-latest
steps:
Expand Down
12 changes: 12 additions & 0 deletions core/ipc/ipc_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,18 @@ func TestIPCListenerAndDialer(t *testing.T) {
tempDir := t.TempDir()
sockPath := filepath.Join(tempDir, "test_membuss.sock")

// macOS caps unix-socket paths at 104 bytes; the per-test TempDir
// under /var/folders can exceed it and bind fails with EINVAL.
// /tmp is short enough everywhere.
if runtime.GOOS != "windows" && len(sockPath) >= 100 {
shortDir, err := os.MkdirTemp("/tmp", "mb-ipc")
if err != nil {
t.Fatalf("short temp dir: %v", err)
}
t.Cleanup(func() { os.RemoveAll(shortDir) })
sockPath = filepath.Join(shortDir, "test_membuss.sock")
}

lis, err := Listen(sockPath)
if err != nil {
t.Fatalf("Listen failed: %v", err)
Expand Down
20 changes: 10 additions & 10 deletions explorer-web/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

35 changes: 16 additions & 19 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,14 @@
module github.com/nnlgsakib/membuss

go 1.25.10
go 1.25.13

require (
github.com/bits-and-blooms/bloom/v3 v3.7.1
github.com/cockroachdb/pebble v1.1.5
github.com/dop251/goja v0.0.0-20260806115107-493f22071ef6
github.com/gabriel-vasile/mimetype v1.4.13
github.com/go-chi/chi/v5 v5.3.0
github.com/google/uuid v1.6.0
github.com/gorilla/websocket v1.5.3
github.com/ipfs/go-cid v0.6.1
github.com/ipfs/go-datastore v0.9.1
Expand All @@ -15,16 +17,19 @@ require (
github.com/libp2p/go-libp2p-kad-dht v0.41.0
github.com/libp2p/go-libp2p-pubsub v0.16.0
github.com/libp2p/go-libp2p-record v0.3.1
github.com/libp2p/go-msgio v0.3.0
github.com/multiformats/go-multiaddr v0.16.1
github.com/multiformats/go-multihash v0.2.3
github.com/oschwald/maxminddb-golang v1.13.1
github.com/prometheus/client_golang v1.23.2
github.com/spf13/cobra v1.10.2
github.com/tetratelabs/wazero v1.12.0
golang.ngrok.com/ngrok v1.13.0
golang.org/x/crypto v0.53.0
golang.org/x/sync v0.21.0
golang.org/x/term v0.44.0
golang.org/x/time v0.12.0
google.golang.org/grpc v1.81.1
google.golang.org/grpc v1.82.1
google.golang.org/protobuf v1.36.11
gopkg.in/yaml.v3 v3.0.1
)
Expand All @@ -42,11 +47,9 @@ require (
github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b // indirect
github.com/cockroachdb/redact v1.1.5 // indirect
github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/davidlazar/go-crypto v0.0.0-20200604182044-b73af7476f6c // indirect
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
github.com/dlclark/regexp2/v2 v2.5.2 // indirect
github.com/dop251/goja v0.0.0-20260806115107-493f22071ef6 // indirect
github.com/dunglas/httpsfv v1.1.0 // indirect
github.com/filecoin-project/go-clock v0.1.0 // indirect
github.com/flynn/noise v1.1.0 // indirect
Expand All @@ -59,7 +62,6 @@ require (
github.com/golang/snappy v0.0.5-0.20231225225746-43d5d4cd4e0e // indirect
github.com/google/gopacket v1.1.19 // indirect
github.com/google/pprof v0.0.0-20250202011525-fc3143867406 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/hashicorp/golang-lru v1.0.2 // indirect
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
github.com/huin/goupnp v1.3.0 // indirect
Expand All @@ -83,7 +85,6 @@ require (
github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
github.com/libp2p/go-libp2p-kbucket v0.8.0 // indirect
github.com/libp2p/go-libp2p-routing-helpers v0.7.5 // indirect
github.com/libp2p/go-msgio v0.3.0 // indirect
github.com/libp2p/go-netroute v0.4.0 // indirect
github.com/libp2p/go-reuseport v0.4.0 // indirect
github.com/libp2p/go-yamux/v5 v5.0.1 // indirect
Expand All @@ -107,7 +108,7 @@ require (
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
github.com/pion/datachannel v1.5.10 // indirect
github.com/pion/dtls/v3 v3.1.2 // indirect
github.com/pion/dtls/v3 v3.1.4 // indirect
github.com/pion/ice/v4 v4.0.10 // indirect
github.com/pion/interceptor v0.1.40 // indirect
github.com/pion/logging v0.2.4 // indirect
Expand All @@ -124,19 +125,16 @@ require (
github.com/pion/turn/v4 v4.0.2 // indirect
github.com/pion/webrtc/v4 v4.1.2 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/polydawn/refmt v0.89.1-0.20231129105047-37766d95467a // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.67.5 // indirect
github.com/prometheus/procfs v0.20.1 // indirect
github.com/quic-go/qpack v0.6.0 // indirect
github.com/quic-go/quic-go v0.59.1 // indirect
github.com/quic-go/webtransport-go v0.10.0 // indirect
github.com/quic-go/quic-go v0.60.0 // indirect
github.com/quic-go/webtransport-go v0.11.1 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
github.com/spaolacci/murmur3 v1.1.0 // indirect
github.com/spf13/pflag v1.0.9 // indirect
github.com/stretchr/testify v1.11.1 // indirect
github.com/tetratelabs/wazero v1.12.0 // indirect
github.com/whyrusleeping/go-keyspace v0.0.0-20160322163242-5b898ac5add1 // indirect
github.com/wlynxg/anet v0.0.5 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
Expand All @@ -151,15 +149,14 @@ require (
go.yaml.in/yaml/v2 v2.4.4 // indirect
golang.ngrok.com/muxado/v2 v2.0.1 // indirect
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
golang.org/x/mod v0.36.0 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/sync v0.21.0 // indirect
golang.org/x/mod v0.37.0 // indirect
golang.org/x/net v0.56.0 // indirect
golang.org/x/sys v0.46.0 // indirect
golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6 // indirect
golang.org/x/text v0.38.0 // indirect
golang.org/x/tools v0.45.0 // indirect
golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 // indirect
golang.org/x/text v0.39.0 // indirect
golang.org/x/tools v0.47.0 // indirect
gonum.org/v1/gonum v0.17.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
lukechampine.com/blake3 v1.4.1 // indirect
)
Loading
Loading