Bump earthstar from 5.7.4 to 6.8.5

[dependabot]

Bumps earthstar from 5.7.4 to 6.8.5.

Release notes

Sourced from earthstar's releases.

v6.8.0: Support extra properties in docs during syncing

We now support this new section of the specification: https://earthstar-docs.netlify.app/docs/reference/earthstar-specification/#extra-fields-for-syncing

When sending documents over the network, peers may add additional properties as synchronization metadata. These extra fields MUST all have names beginning with an underscore to separate them from the core fields, and the the receiving peer MUST remove these fields before storing the document.

Likewise, when Earthstar libraries store documents internally, and send them over the network, they MAY add their own extra fields which MUST have names beginning with an underscore.

This should let us sync with stone-soup which adds an extra property _localIndex to the documents it sends. For now we discard this extra property when we receive it.

We're not currently checking the underscore rule; we just know which fields are extra fields because they're not the expected core fields.

v6.7.0: set max content length to 4mb

Documents now have a limit on their content length: 4 million bytes (measured as utf-8 enoded bytes). Now every field in a Document has a length limit.

Note that documents encoded as JSON can be about 500 bytes larger than this limit because of the other fields; this limit is specifically for the content field.

This closes earthstar-project/earthstar#89 .

The specification has been updated; see https://earthstar-docs.netlify.app/docs/reference/earthstar-specification#content

Stone-soup is also updated to match, as of v2.1.1.

v6.6.2: Bugfix: Replace multibase package with rfc4648

This fixes issue earthstar-project/earthstar#118

It also just seems to be a more solid, tightly focused package anyway.

This is purely a bugfix for compilation/bundling troubles, it should be completely backwards compatible at runtime.

Small bugfixes

Fixes

Some defenses against malformed input, discovered by earthstar-fuzz

Sort-of breaking change

We have a "standalone browser build" in dist/ that can be just dropped into an HTML file without using a bundler.

It used to be named earthstar-v6.6.1.js and now it's just named earthstar.js because it was too much work to rename it by hand every time. PRs accepted to automate that process.

If you access the file via a CDN like jsdelivr (see docs below) you can still specify the version.

Wrote some docs about using that file: Using the standalone browser build

v6.6.0: Added a function: insertVariablesIntoTemplate

Commit: earthstar-project/earthstar@d20e725

This completes the set of template functionality. It lets you insert specific variable values into a template, e.g.

... (truncated)

Commits

• 60e06b3 6.8.5
• 9f389dc switch to new style of .npmignore
• ce06c1e 6.8.4
• b9214a6 update .npmignore
• fddd548 6.8.3
• 6197108 bump deps including sqlite
• 5e626bc bump dev-deps
• 72f29ed 6.8.2
• 8900144 enforce that extra doc fields start with underscore, as per specification
• 14f6365 6.8.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)