GitLab

This commit upgrades go-ipfs-cmds and configures the commands HTTP API Handler
to only allow POST/OPTIONS, disallowing GET and others in the handling of
command requests in the IPFS HTTP API (where before every type of request
method was handled, with GET/POST/PUT/PATCH being equivalent).

The Read-Only commands that the HTTP API attaches to the gateway endpoint will
additional handled GET as they did before (but stop handling PUT,DELETEs).

By limiting the request types we address the possibility that a website
accessed by a browser abuses the IPFS API by issuing GET requests to it which
have no Origin or Referrer set, and are thus bypass CORS and CSRF protections.

This is a breaking change for clients that relay on GET requests against the
HTTP endpoint (usually :5001). Applications integrating on top of the
gateway-read-only API should still work (including cross-domain access).
Co-Authored-By: Steven Allen <steven@stebalien.com>
Co-Authored-By: Marcin Rataj <lidel@lidel.org>

Revert last change (the default is now printed twice)

chore: update libp2p deps

Prepare for an RC. This also re-re-disables stream write coalescing till we get
a chance to thoroughly profile it.

chore(deps): bump github.com/ipfs/go-ds-flatfs from 0.4.0 to 0.4.1

Fix #4996: Improve help text for "ipfs files cp"

And align capitalization.

Bumps [github.com/ipfs/go-ds-flatfs](https://github.com/ipfs/go-ds-flatfs) from 0.4.0 to 0.4.1.
- [Release notes](https://github.com/ipfs/go-ds-flatfs/releases)
- [Commits](https://github.com/ipfs/go-ds-flatfs/compare/v0.4.0...v0.4.1)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

chore(deps): bump go.uber.org/fx from 1.10.0 to 1.11.0

chore(deps): bump github.com/hashicorp/go-multierror from 1.0.0 to 1.1.0

chore(deps): bump github.com/ipfs/go-ds-badger from 0.2.2 to 0.2.3

changed brew to brew cask

Bumps [github.com/ipfs/go-ds-badger](https://github.com/ipfs/go-ds-badger) from 0.2.2 to 0.2.3.
- [Release notes](https://github.com/ipfs/go-ds-badger/releases)
- [Commits](https://github.com/ipfs/go-ds-badger/compare/v0.2.2...v0.2.3)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [go.uber.org/fx](https://github.com/uber-go/fx) from 1.10.0 to 1.11.0.
- [Release notes](https://github.com/uber-go/fx/releases)
- [Changelog](https://github.com/uber-go/fx/blob/master/CHANGELOG.md)
- [Commits](https://github.com/uber-go/fx/compare/v1.10.0...v1.11.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Mounting complained that the daemon was running.

Bumps [github.com/hashicorp/go-multierror](https://github.com/hashicorp/go-multierror) from 1.0.0 to 1.1.0.
- [Release notes](https://github.com/hashicorp/go-multierror/releases)
- [Commits](https://github.com/hashicorp/go-multierror/compare/v1.0.0...v1.1.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

fix: remove internal relay discovery

This logic collects a list of known relays by testing every new connection.

It exists so we can dial /p2p-circuit/p2p/QmFoobar addresses (circuit addresses
that don't specify the relay). However, this kind of address is useless outside
of basic demos as a random relay is practically guaranteed to not be connected
to the target peer. Picking a random relay to connect to some peer is almost
_never_ the desired behavior.

docs/experimental-features.md: typo

Co-Authored-By: Will <willscott@gmail.com>

fix: get rid of shutdown errors

Instead of feeding through the top-level context, feed through a cancel-free
context (that still carries the same context values). Then, when the top-level
context is canceled, call `stop` to shut everything down in-order. Finally,
cancel the inner context to make sure everything has been cleaned up.

Ideally, we just wouldn't use contexts for this. But this is strictly better
than what we have.

Merge pull request #7057 from ipfs/dependabot/go_modules/github.com/libp2p/go-libp2p-peerstore-0.2.2

chore(deps): bump github.com/libp2p/go-libp2p-peerstore from 0.2.1 to 0.2.2

chore(deps): bump github.com/ipfs/go-ipfs-files from 0.0.7 to 0.0.8

Bumps [github.com/libp2p/go-libp2p-peerstore](https://github.com/libp2p/go-libp2p-peerstore) from 0.2.1 to 0.2.2.
- [Release notes](https://github.com/libp2p/go-libp2p-peerstore/releases)
- [Commits](https://github.com/libp2p/go-libp2p-peerstore/compare/v0.2.1...v0.2.2)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [github.com/ipfs/go-ipfs-files](https://github.com/ipfs/go-ipfs-files) from 0.0.7 to 0.0.8.
- [Release notes](https://github.com/ipfs/go-ipfs-files/releases)
- [Commits](https://github.com/ipfs/go-ipfs-files/compare/v0.0.7...v0.0.8)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

feat: tls by default

Switches to TLS as the default security transports.

fix: downgrade to go 1.13

Go 1.14 has a timer reset deadlock (https://github.com/golang/go/issues/38070).

This also downgrades quic-go until either a go patch release fixes this issue or
a version of quic-go is released that works with go 1.13.

chore(deps): bump github.com/ipfs/go-ds-badger from 0.2.1 to 0.2.2

chore(deps): bump github.com/libp2p/go-libp2p from 0.7.1 to 0.7.2

Bumps [github.com/ipfs/go-ds-badger](https://github.com/ipfs/go-ds-badger) from 0.2.1 to 0.2.2.
- [Release notes](https://github.com/ipfs/go-ds-badger/releases)
- [Commits](https://github.com/ipfs/go-ds-badger/compare/v0.2.1...v0.2.2)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [github.com/libp2p/go-libp2p](https://github.com/libp2p/go-libp2p) from 0.7.1 to 0.7.2.
- [Release notes](https://github.com/libp2p/go-libp2p/releases)
- [Changelog](https://github.com/libp2p/go-libp2p/blob/master/NEWS.md)
- [Commits](https://github.com/libp2p/go-libp2p/compare/v0.7.1...v0.7.2)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

chore: update golang