Advisories for Golang/Github.com/Ipld/Go-Codec-Dagpb package

The dag-pb codec can panic when decoding invalid blocks.

Impact Decoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic. The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread. Patches The issue is fixed in v1.3.1 and above. Consumers can discover the versions of go-codec-dagpb in a module's dependency graph using the following command in …