Vulnerability in go-algorand project

While working on go-algorand project, I scanned the dependency manifest and found that it uses a vulnerable version of **`github.com/ipld/go-ipld-prime`**. The scan revealed an unbounded memory allocation issue in the DAG-CBOR decoder, where crafted payloads can trigger excessive memory usage, potentially leading to a denial of service.

[CVE Report](https://vulert.com/vuln-scan/list/baa78ea9-b0e6-4add-bc77-392a6d331e5c?sort_order=desc&sort_by=created_at)
[CVE Link](https://vulert.com/vuln-db/CVE-2026-35480)