[github.com/ipld/go-codec-dagpb] go-codec-dagpb vulnerable to panic when decoding invalid blocks

go-codec-dagpb is an implementation of the DAG-PB spec for Go. The dag-pb codec can panic when decoding invalid blocks. This issue has been patched in version 1.5.0.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-2584
• https://github.com/ipld/go-codec-dagpb/commit/a17ace35cc760a2698645c09868f9050fa219f57
• https://pkg.go.dev/vuln/GO-2022-0422
• https://github.com/advisories/GHSA-967g-cjx4-h7j6