09/06/26 Bi-Weeky libp2p Spec Meeting

[johannamoran]

Meeting Link

https://meet.google.com/gfr-oeei-bws

Attendees

@seetadev
@johannamoran

Agenda

WebRTC Direct V2

• [Summary] by lidel on WebRTC-Direct + Chrome changes (specs#672 comment at WebRTC-Direct: Chrome may be removing ICE credential munging #672 (comment) )
• [Spec PR Link] docs: webrtc-direct-v2 #715
• [Issue Link] WebRTC-Direct transport at risk due to Chrome changes (ICE credential munging): alignment and next steps go-libp2p#3499
• [js-libp2p PR Link] feat: webrtc-direct-v2 js-libp2p#3480
• [py-libp2p PR Link] feat(webrtc): add WebRTC transport scaffolding (spec compliance + tests) py-libp2p#1309 (comment)
• [go-libp2p Reference Link] feat(webrtc): stable /certhash across restarts go-libp2p#3512

Next Steps

• PR are in progress i.e. js, py and go
• Spec status for docs: webrtc-direct-v2 #715 will have the status candidate recommendation' once the PRs are ready for review and merge.

---

PQC

• [Spec PR Link] docs: pkix #717
• [js-libp2p PR Link] feat: Post quantum identities with ML-DSA js-libp2p#3432

Next Steps

• Recommended js aligns with Spec PR docs: pkix #717 and will recommend all other implementations aligns on this also.

---

[SECURITY] GossipSub Memory Exhaustion via Unbounded Remote Topic Subscriptions

• [Advisory Link 1] https://vulnerability.circl.lu/vuln/ghsa-4f8r-922h-2vgv
• [Advisory Link 2] GHSA-4f8r-922h-2vgv
• [cpp-libp2p PR Issue Link] Security: GossipSub Memory Exhaustion via Unbounded Remote Topic Subscriptions cpp-libp2p#349

Next Steps

• PR will be raised in cpp-libp2p and once reviewed and merged @johannamoran will raise a spec PR for the same.

---

Memory leak in clearPeerFromTopicsState retains empty topic maps indefinitely

• [Issue Link] Memory leak in clearPeerFromTopicsState retains empty topic maps indefinitely go-libp2p-pubsub#705

Next Steps

• Implementations are advised to review this issue and PR and ensure GossipSub and PubSub modules are spec compliant. Please check for any memory leak issues.