add ch annotated dummy package as a sibling manifest

[UlysseCorbeil]

No description provided.

[dfuse-bot]

🔍 Vulnerabilities of ghcr.io/streamingfast/substreams:2da49ed

📦 Image Reference ghcr.io/streamingfast/substreams:2da49ed

digest	sha256:8f3a496126d4fe0945b8891bf37a61c80b4fb53ee7af5dcb2dea64986f364462
vulnerabilities
platform	linux/amd64
size	124 MB
packages	380

📦 Base Image ubuntu:24.04

also known as	c1ca75be10a22ea09ff0b7bbe8b82ee03553a4f9b795030ee2ec921e42418fc8 noble noble-20260810
digest	sha256:1e0a86e57d247923571b75e0aaf48a1449cf8c543d51fb3e07a4a7d7bfa79316
vulnerabilities

golang.org/x/crypto 0.55.0 (golang) pkg:golang/golang.org/x/crypto@0.55.0 # ./Dockerfile (31:31) COPY --from=build /app/substreams /app/substreams Affected range <0.56.0 Fixed version 0.56.0 Description Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection. Affected range <0.56.0 Fixed version 0.56.0 Description Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.