go.mod: Temporarily replace go-libp2p-pubsub by dindinw/go-libp2p-pub…

[dindinw]

…sub v0.15.1 as a security workaround; switch back to the official release later.
see
libp2p/go-libp2p-pubsub#688

[MarcoPolo]

You shouldn't need this. Just updating go-libp2p and doing a go mod tidy should do what you want.

[dindinw]

@MarcoPolo
Upgrading go-libp2p to v0.48 did not resolve the issue, even using the modified go-libp2p-pubsub does not fix either, because the issue also exists in go-ethereum’s p2p/stunv2 and ipfs/boxo, so it cannot be easily fixed here. Given the complexity and cost, this issue might have to remain open for a while.
anyway, thanks for your advice.

[MarcoPolo]

sorry, I don't have the context here. My point is that you can update the Pion dependency directly in your application's go.mod without having to update all your dependencies.

[dindinw]

@MarcoPolo
Yes, you are correct BUT the Pion versions involved use different Go module paths (/v2, /v3), so Go treats them as completely different modules, not interchangeable versions.
That means if the bug in v2 will not be fixed( as confirmed by its maintainer), we cannot simply replace it with a v3 version in go.mod. We would have to remove all v2 usage and migrate all exist code to the v3 API, which is quite painful. I can only replace a version in go.mod, but I cannot eliminate an existing usage, the pion/dtls/v2 is just a indirect dependency of the project.