Skip to content

fix(floodsub): remove rand 0.7 dependency#6524

Open
pengqima wants to merge 2 commits into
libp2p:masterfrom
pengqima:fix-floodsub-rand-advisory
Open

fix(floodsub): remove rand 0.7 dependency#6524
pengqima wants to merge 2 commits into
libp2p:masterfrom
pengqima:fix-floodsub-rand-advisory

Conversation

@pengqima

@pengqima pengqima commented Jul 16, 2026

Copy link
Copy Markdown

Description

Replace floodsub's cuckoo filter with a bounded cache of 64-bit message hashes.

The new cache preserves the previous approximate limit of 2^20 entries, refreshes the eviction order when a duplicate is observed, and evicts the least recently seen hash when full. This keeps duplicate suppression bounded without retaining complete messages.

Removing cuckoofilter also removes its transitive dependency on rand 0.7.3, which is flagged by RUSTSEC-2026-0097. There are no public API changes.

Fixes #6419.

AI Assistance Disclosure

Tools used (required — write none if no AI was used): none

Attestation (required):

  • I have read every line of this diff, understand what it does, and can explain it in review.

Notes & open questions

Change checklist

  • I have performed a self-review of my own code
  • I have made corresponding changes to the documentation
  • I have added tests that prove my fix is effective or that my feature works
  • A changelog entry has been made in the appropriate crates

@jxs jxs left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this! left a comment

};

// Match the approximate maximum entry count of the previous cuckoo filter.
const RECEIVED_CACHE_CAPACITY: usize = 1 << 20;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AFAIR, this doesn't directly map to the cuckoofilter's limit of 2^20 entries, RECEIVED_CACHE_CAPACITY is in items.
A CuckooFilter entry is 1byte on a fixed size 1MiB table, whereas LinkedHashSet is using u64, 8 bytes per entry which at 1 << 20 may be ~32‑48 MiB if full. We should probably reduce this to 1 << 16 which I'd say doesn't make that big of a difference and maintains similar rss

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove rand 0.7.3 from libp2p-floodsub

2 participants