Panic-driven denial of service in the AWS SDK for Go v2 EventStream decoder:
eventstream -> v1.7.8, service/s3 -> v1.97.3 (minimum patched versions, so the
change carries the fix and nothing else).
Verified against a measured baseline: go build ./... exit 0, and go test ./...
is 9 ok / 5 fail BOTH with and without this change — identical, so those
failures are pre-existing.
Several luxfi versions carry TWO different contents across this workspace,
because published tags were moved instead of a new patch being cut:
age@v1.5.0, pq@v1.0.3, threshold@v1.9.4, zap@v0.6.0, zap@v0.8.1.
Adjudicated before editing, since "checksum mismatch / SECURITY ERROR" is also
what a real supply-chain attack looks like. It is not one here: sum.golang.org
holds the OLD hash while proxy.golang.org and a direct fetch BOTH serve the same
NEW bytes. Two independent transports agreeing means nothing is rewriting
content in flight — the tag moved at source. The sumdb entry is a fossil:
GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never
consult the checksum DB and a moved tag splits consumers silently.
The old bytes are served by nothing now, so a stale pin can never build.
Corrected to the only content that exists, in BOTH line forms (h1: and
/go.mod h1:) — Go reports these one at a time, so a partial fix just relocates
the error.
Deliberately no `go mod tidy`: this changes no selected version, only the
recorded hash of versions already chosen.
Verified: `go list -m all` resolves with no checksum error.
The durable fix is upstream: never move a published tag, cut x.y.z+1 instead.
Resolves the workspace-wide cgo build blocker (cloud@v0.1.0's dead base/gateway/iam
pseudo-versions). vfs 0.4.2+ decoupled from cloud per HIP-0106. go mod tidy clean,
builds pure-Go.
ZapDB has native streaming Backup(w, since) + Load(r). The standalone
luxfi/zapdb-replicate repo was duplicate scaffolding. Sidecar daemon
+ restore init-container now live here under cmd/replicate/.
Pre-fold lineage: standalone repo at luxfi/zapdb-replicate; final
commit there c13a738 (deps Go 1.26.4 bump). No history was merged;
small repo, clean copy.
Canonical S3 SDK across the stack is the Hanzo S3 fork at
github.com/hanzos3/go-sdk (package `s3`, not `minio`). The fork
already had `module github.com/hanzos3/go-sdk` and `package s3`
landed on its `main` branch (5c5ecda); tagged v1.0.2 with the
Go 1.26.3 security bump on top of v1.0.1.
Replicator changes:
- import: `s3 "github.com/hanzos3/go-sdk"` (alias for clarity since
package name `s3` differs from last path segment `go-sdk`)
- field `Replicator.s3` → `Replicator.cli` so the field name no
longer shadows the package qualifier in struct literals
- all `minio.X` → `s3.X` (Client, New, Options, PutObject,
GetObject, ListObjects, *Options types)
No behavioral changes. All Replicator tests pass.
Removed /v4 suffix from module path and all internal imports.
Go module is now github.com/luxfi/zapdb (no major version suffix).
Import as: import "github.com/luxfi/zapdb"
No code changes — only module path and import rewrite.
Incremental and Snapshot methods buffer the entire backup in a
bytes.Buffer before encrypting and uploading. Marked for future
io.Pipe streaming conversion to avoid 3x memory overhead.
- Fix format string vet errors in db2_test.go and key_registry.go
for Go 1.26 stricter printf checks
- Update pb/gen.sh to add //go:build grpc tag after protoc generation
so protobuf types only compile with grpc tag (default uses ZAP
native binary encoding from types_zap.go)
- remove file `event_log.go`, because its content is unused
- this file was the only reference to `golang.org/x/net`, therefore we
can also remove this dependency
Replace proto.Marshal/Unmarshal with native pb.Marshal/pb.Unmarshal to
match the wire format used by luxfi/badger/v4. This ensures databases
written by nodes using the badger fork (v1.23.4) can be read by nodes
using zapdb (v1.23.5), preventing "proto: cannot parse invalid
wire-format data" errors during rolling upgrades.
Added types_zap.go and marshal_zap.go from luxfi/badger fork, which
provide custom LittleEndian binary encoding for ManifestChangeSet,
KV, Checksum, and other internal types. The standard protobuf
generated code (badgerpb4.pb.go) is now behind a grpc build tag.
Use sync.Once and helper functions to safely handle metric initialization
when the package is imported multiple times in test environments. This
fixes the "Reuse of exported var name" panic that occurred when running
coreth tests.
- Rename module from github.com/dgraph-io/badger/v4 to github.com/luxfi/zapdb/v4
- Update all internal imports to use new module path
- Preserve all ZAP enhancements from badger fork
AIX doesn't support a proper flock like linux, but it seems to have
enough support for process level file locking using fcntl.
For #2035
## Problem
GOOS=aix does not build. AIX does not support a linux-like flock, and
does not export `unix.Flock`.
## Solution
Create an AIX specific directory-locking implementation using the AIX
version of flock.
---------
Co-authored-by: Paul E. Murphy <murphyp@linux.ibm.com>
Co-authored-by: Matthew McNeely <matthew.mcneely@gmail.com>
**Description**
Correct an incorrect comment on the value size in skl.node.
Background: the PR https://github.com/dgraph-io/badger/pull/880 changed
the value size from uint16 to uint32, but the did not update the
comment.
**Checklist**
- [X] Code compiles correctly and linting passes locally
- [X] Tests added for new functionality, or regression tests for bug
fixes added as applicable
Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>
Fixes#2067
**Description**
This PR fixes an issue where Go's `append` returns `nil` when appending
an empty slice to a nil slice.
I added a check in `SafeCopy` to ensure we always return `[]byte{}` in
this case, along with a new unit test.
I also verified it using the test offered in the issue
**Checklist**
- [x] Code compiles correctly and linting passes locally
- [ ] For all _code_ changes, an entry added to the `CHANGELOG.md` file
describing and linking to
this PR
- [x] Tests added for new functionality, or regression tests for bug
fixes added as applicable
---------
Co-authored-by: Matthew McNeely <matthew.mcneely@gmail.com>
**Description**
Fix typos found via `codespell -S CHANGELOG.md -L
fo,committs,nd,hights,abd,hel,mmaped,siz`
**Checklist**
- [x] Code compiles correctly and linting passes locally
- [ ] For all _code_ changes, an entry added to the `CHANGELOG.md` file
describing and linking to
this PR
- [ ] Tests added for new functionality, or regression tests for bug
fixes added as applicable
- [ ] For public APIs, new features, etc., PR on [docs
repo](https://github.com/hypermodeinc/docs) staged and linked here
**Description**
This PR restricts the Dgraph CI workflow to only check core Dgraph
packages. The intent of this CI workflow is to immediately identify
badger@main compatibility issues with the main branch of Dgraph. Running
the entire Dgraph test suite is overkill -- this should immediately find
any badger incompatibilities with Dgraph.
**Description**
Resolves the following error :
./test.sh: line 8: [: =: unary operator expected
**Checklist**
- [x] Code compiles correctly and linting passes locally
- [ ] For all _code_ changes, an entry added to the `CHANGELOG.md` file
describing and linking to
this PR
- [ ] Tests added for new functionality, or regression tests for bug
fixes added as applicable
- [ ] For public APIs, new features, etc., PR on [docs
repo](https://github.com/hypermodeinc/docs)
staged and linked here
zeekay