bring in github.com/jaypipes/[email protected]

[jaypipes]

I cut a new release of the pcidb library (v1.0.0) to address a
particular issue (jaypipes/pcidb#28) that was causing pain for the
maintainers of the PCI-IDS database. This PR simply brings in that
latest patched version of pcidb, which includes disabling by default the
network fetch of the PCI-IDS database when no local database file is
found.

Signed-off-by: Jay Pipes [email protected]

[ffromani]

I'll check all the CIs of the projects I know they consume ghw and make sure they move to the up to date ghw (or at very least pcidb) ASAP, or if this is not possible provide mitigations to avoid jaypipes/pcidb#28

[ffromani]

gh actions outage: https://www.githubstatus.com/incidents/y5hdmv0p49x3
monitoring and merging once CI runs and passes.

[taigrr]

@jaypipes can you cut a new release of this so libraries can bring the changes in?

[ffromani]

In some projects it could be simpler to just update the pcidb dependency. Version 1.0.0 of pcidb is fully compatible with 0.6.0 except for the network fetch behaviour.

Example: k8stopologyawareschedwg/resource-topology-exporter@469e51e

disclosure: this project is consuming ghw + pcidb but is very unlikely to have contributed to the excessive request load, but as contributor I'm updating anyway because not hitting the network by default is a good behaviour per se.

[jaypipes]

@jaypipes can you cut a new release of this so libraries can bring the changes in?

yep, doing so now... sorry, there was something going on with Github Actions yesterday... also, I wanted to revert the iSCSI drive type change.

[taigrr]

@fromanirh that would work on more recent versions of go, but iirc some don't let you bring in a newer package in go.mod that you're not using expressly/as a direct dependency, if it's only a subdependency. Making sure at least one dependency is bringing in the new subdependency (assuming they're all the same major version, which they are) should work on all go versions.

Thanks jay!