chore(deps): bump the ipfs-ecosystem group across 1 directory with 3 updates

[dependabot]

Bumps the ipfs-ecosystem group with 3 updates in the / directory: github.com/ipfs/go-ds-measure, github.com/ipfs/go-ipld-cbor and github.com/ipfs/go-test.

Updates github.com/ipfs/go-ds-measure from 0.2.2 to 0.2.3

Release notes

Sourced from github.com/ipfs/go-ds-measure's releases.

v0.2.3

What's Changed

• ci: uci/copy-templates by @​web3-bot in ipfs/go-ds-measure#55
• ci: uci/update-go by @​web3-bot in ipfs/go-ds-measure#56
• Upgrade to GitHub-native Dependabot by @​dependabot-preview[bot] in ipfs/go-ds-measure#34
• ci: uci/update-go by @​web3-bot in ipfs/go-ds-measure#60
• update dependencies by @​gammazero in ipfs/go-ds-measure#62

Full Changelog: ipfs/go-ds-measure@v0.2.2...v0.2.3

Commits

• dd792e7 Merge pull request #63 from ipfs/release-v0.2.3
• 8a31a3d chore: release v0.2.3
• a4a333b Merge pull request #62 from ipfs/update-deps
• abceda8 update dependencies
• 3b8a4ce chore!: bump go.mod to Go 1.25 and run go fix (#60)
• 8592803 Merge pull request #34 from ipfs/dependabot/add-v2-config-file
• 0d571fe chore!: bump go.mod to Go 1.24 and run go fix (#56)
• e693a20 ci: uci/copy-templates (#55)
• See full diff in compare view

Updates github.com/ipfs/go-ipld-cbor from 0.2.1 to 0.3.0

Release notes

Sourced from github.com/ipfs/go-ipld-cbor's releases.

v0.3.0

What's Changed

• ci: uci/update-go by @​web3-bot in ipfs/go-ipld-cbor#112
• update dependencies by @​gammazero in ipfs/go-ipld-cbor#113
• build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 by @​dependabot[bot] in ipfs/go-ipld-cbor#114
• ci: uci/update-go by @​web3-bot in ipfs/go-ipld-cbor#115
• chore(ci): add dependabot config by @​rvagg in ipfs/go-ipld-cbor#117
• build(deps): bump github.com/ipfs/go-block-format from 0.2.2 to 0.2.3 by @​dependabot[bot] in ipfs/go-ipld-cbor#121
• build(deps): bump github.com/ipfs/go-ipld-format from 0.6.2 to 0.6.3 by @​dependabot[bot] in ipfs/go-ipld-cbor#120
• build(deps): bump github.com/polydawn/refmt from 0.89.0 to 0.90.0 by @​dependabot[bot] in ipfs/go-ipld-cbor#122
• build(deps): bump github.com/ipfs/go-cid from 0.5.0 to 0.6.1 by @​dependabot[bot] in ipfs/go-ipld-cbor#118
• test: simplify hashing test by @​rvagg in ipfs/go-ipld-cbor#123
• feat: increased strictness in decoding by @​rvagg in ipfs/go-ipld-cbor#124

Full Changelog: ipfs/go-ipld-cbor@v0.2.1...v0.3.0

Commits

• 5340b1f chore: v0.3.0 bump (#125)
• 555f5c9 feat: increased strictness in decoding (#124)
• e35c98b chore: simplify hashing test (#123)
• e2915de build(deps): bump github.com/ipfs/go-cid from 0.5.0 to 0.6.1
• 087b8c9 build(deps): bump github.com/polydawn/refmt from 0.89.0 to 0.90.0
• 2353905 build(deps): bump github.com/ipfs/go-ipld-format from 0.6.2 to 0.6.3
• cc4378c build(deps): bump github.com/ipfs/go-block-format from 0.2.2 to 0.2.3
• 44e6799 chore(ci): add dependabot config (#117)
• e768cc7 chore!: bump go.mod to Go 1.25 and run go fix (#115)
• 45ea518 build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#114)
• Additional commits viewable in compare view

Updates github.com/ipfs/go-test from 0.3.0 to 0.4.0

Release notes

Sourced from github.com/ipfs/go-test's releases.

v0.4.0

What's Changed

• feat: allow reuse of random source by @​gammazero in ipfs/go-test#37

For tests that need to keep generating random test data, it is more efficient to continue using the same random source instead of creating a new one each time data is generated. This also applies to the generation logic itself when one part of the generation logic uses another.

This PR lets the caller create a pseudo-random number source that can be uses reused for generating test data. This is also use within the test logic itself to avoid creating unnecessary random sources.

Also included in this PR are new functions, Name and NameSize, that generate fixed-size and random-size random name strings, and StringToSeed and Uint64ToSeed to create seed values.

This PR fixes two minor defects in the random/files package. First, random-size names never reached the maximum size. Second, the file names were more likely to contain a "0" due to its inclusion twice in the alphabet used for file name generation. Also fixes is a minor defect with ensuring unique addresses.

Finally, this PR migrates from /math/rand/ to /math/rand/v2 and uses ChaCha8 as its random number source.

Summary of changes in this PR:

• Enable reuse of pseudo-random source for data generation
• Internal efficiency improvements due to reuse of random source
• Fix error with ensuring unique addresses
• Fix minor defects with random file name generation
• Increases test coverage.
• Adds two new APIs Name and NameSize, for generating fixes and random-sized random names.
• No global seed or sequence.
• Added StringToSeed and Uint64ToSeed to create seed values
• Update CLI tools to take strings to create seed values
• Move from /math/rand to /math/rand/v2`

The move to a different number generator, ChaCha8, means that different values will be generated than before, and tests depending on deterministic random values need to be updated.

⚠️ BREAKING API Changes

• Seed value changed from uint64 to [32]byte as needed for ChaCha8
• Do not support global seed
• Do not support global sequence
• Make Sequence a separate type
• NewRand and NewSeededRand no longer create a *rand.Rand. This is only breaking in cases where *rand.Rand is expected. Expecting io.Reader will continue to work.
• Bytes and BlocksOfSize now take an int64 as the size argument, which is more consistent with the golang standard library.
• Deterministic random values output by API are different in this release.

Non-breaking API Changes

• Added Name and NameSize functions to API
• Added NewSeed function to create new seed of type [32]byte
• Added StringToSeed and Uint64ToSeed to create [32]byte seed values
• Deprecated NewRand and NewSeededRand

Full Changelog: ipfs/go-test@v0.3.0...v0.4.0

Commits

• 5c58942 release v0.4.0 (#39)
• 27d014e feat: allow reuse of random source plus upgrades and fixes, (#37)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​ipfs/​go-test@​v0.3.0 ⏵ v0.4.0	+1
	github.com/​ipfs/​go-ipld-cbor@​v0.2.1 ⏵ v0.3.0
	github.com/​ipfs/​go-ds-measure@​v0.2.2 ⏵ v0.2.3

View full report