chore: update ipfs deps

[hacdias]

Depends on #1895.

License: MIT
Signed-off-by: Henrique Dias hacdias@gmail.com

[hacdias]

@lidel after upgrading the IPFS-related dependencies, now I get a 403 error whenever we try to call ipfs.id() unless I add * to the Access-Control-Allow-Origin API's field in the daemon settings. This seems quite odd as we're not in a browser environment. Were there any security-related changes on the HTTP Client or ipfsd-ctl that may have caused this?

[lidel]

(I rebased this PR on top of main which already included all the other updates)

@hacdias no idea what changed – perhaps some fetch polyfill deep inside on dependencies? I've seen some dark arts happening around ipfs/js-ipfs-utils#136 👻

Setting Access-Control-Allow-Origin is a security risk, we need to find a proper fix.

[lidel]

@achingbrain does this look familiar? Did anything land in js-ipfs-http-client (or its deps) that could change the way fetch works?

[achingbrain]

@lidel nothing springs immediately to mind & we're running ipfs-http-client tests against go-ipfs@0.9.1 in CI, same as the deps here.

ipfs/js-ipfs-utils#136 is just to stop using the undocumented npm:some-module dep version override style in favour of a tarball so codepen-style environments can use it. We need node-fetch with node-fetch/node-fetch#1172 applied otherwise stream errors that occur during pubsub subscriptions are swallowed silently 🙄.

47.x.x to 52.x.x is quite a big jump though, could you step through each version to find out which one stopped working?

[hacdias]

@achingbrain upgrading from 47.x to 48.x seems to create the issue. I wonder if it is related to ipfs/js-ipfs#3275

It seems there's an header 'Origin' with the value 'null' being sent. Shouldn't it just be omitted? (Adding 'null' to the allowed origins works, but setting the mode to no-cors does not work)

[hacdias]

@lidel seems that removing our old CORS logic for IPFS Desktop solves the issue successfully. Could you please take a look at this PR?

(PS: I could not run the tests locally - electron-userland/spectron#929 - gotta work on #1937)

[lidel]

LGTM, but will merge after I'm back in January :)