Update module github.com/ipfs/boxo to v0.42.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/ipfs/boxo	v0.36.0 → v0.42.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

ipfs/boxo (github.com/ipfs/boxo)

v0.42.2

Compare Source

Added

• bitswap/network/httpnet: DefaultConnectFailureBackoff constant, the wait before Connect re-probes an endpoint after a failed probe.
• bitswap/network/httpnet: CooldownTracker type with NewCooldownTracker, SharedCooldownTracker and the WithCooldownTracker option, for controlling where per-host backoff state lives.

Changed

• ✨ bitswap/network/httpnet: removed the background ping loop that probed every connected HTTP peer with GET/HEAD /ipfs/bafkqaaa every 5 seconds for the lifetime of the process (old: fixed 5s cadence per peer, results discarded; new: no periodic probes). Idle HTTP peers generate no background traffic.
• bitswap/network/httpnet: latency to HTTP peers is measured from the Connect probe and from real retrieval responses instead of periodic pings.
• bitswap/network/httpnet: Connect and Ping honor per-host cooldowns; after a failed endpoint probe, Connect does not re-probe the host until Retry-After (when provided) or DefaultConnectFailureBackoff elapses (old: no backoff, re-probe on every call).
• bitswap/network/httpnet: per-host cooldowns live in a process-wide registry (SharedCooldownTracker) so backoff deadlines survive short-lived Network instances (old: per-instance state, forgotten on every restart); Network.Stop no longer stops the registry, and WithCooldownTracker gives a Network a private one.

Removed

• bitswap/network/httpnet: HTTP 410 is no longer accepted as a successful answer to the connection probe; it was a workaround for a provider that has since shut down. 410 on real block requests still counts as a valid "content unavailable" reply.

Fixed

• bitswap/network/httpnet: message senders created while a host was in cooldown no longer treat that cooldown as permanent; the request path resumes once the cooldown expires.
• bitswap/network/bsnet: peers already connected when Bitswap starts are now recognised. libp2p only reports connections opened after a notifier is registered, so a peer connected during node startup stayed invisible to Bitswap for the life of that connection, and no want was ever sent to it. Nodes with another way to find content usually masked this; nodes relying on an already-connected peer could wait forever.

v0.42.1

Compare Source

Added

• gateway: added WithMaxTraversalDepth. It limits how deep BlocksBackend descends into a DAG while it serves a CAR response. Traversal keeps per-level state, so its cost grows with depth. The limit is on by default at DefaultMaxTraversalDepth (1024), well above anything UnixFS produces. A file reaches terabytes by depth 4, and a HAMT adds about 4 levels per million directory entries. Pass a positive value to set your own limit, or WithMaxTraversalDepth(0) to remove the limit. #​1197

Changed

• gateway: a CAR response that fails partway through now ends with [Gateway Error: CAR stream truncated, response is incomplete]. withRetrievalTimeout already uses the same marker when it cuts a response short. The gateway sets X-Stream-Error only once the body is streaming, so that header rarely reaches the client. A truncated CAR was otherwise indistinguishable from a complete one. The marker makes the trailing bytes invalid CAR, so a reader stops with an error instead of accepting a short DAG. This mostly helps operators. Gateways usually sit behind reverse proxies and third-party CDNs, so a short response leaves you guessing which hop cut it. Now the response says so itself. #​1197
• routing/http/server: /routing/v1 responses no longer let a cache serve a two-day-old answer while the origin is healthy. Peer addresses in routing results come from short-lived sources such as relay reservations. A stale window measured in days handed clients addresses that had stopped working long ago. stale-while-revalidate is now 10 minutes for responses with results, and 1 minute for empty ones. That covers a background refresh. stale-if-error applies only when the origin is failing, so responses with results keep the 48h Amino DHT expiration window. For empty responses it is 1 hour. max-age is unchanged. #​1195
• upgrade to go-libp2p v0.49.0

Fixed

• bitswap/network: ExtractHTTPAddress now brackets an IPv6 literal when it builds the provider URL. A peer that announces /ip6/<addr>/tcp/443/tls/http is now usable as an HTTP provider. Without brackets, url.Parse rejected the address under Go 1.26 and later, and the peer was skipped. On earlier versions it parsed, but the authority split at the last colon, so the client dialed a host and port that do not exist. #​1196

Security

• The upgrade to go-libp2p v0.49.0 includes a security fix for CVE-2026-57497: GHSA-g35j-m5xg-vh3q

v0.42.0

Compare Source

Added

• namesys: DNSLink lookups now return the DNS TXT record's TTL, and the gateway uses it as Cache-Control: max-age for /ipns/<dnslink-host> responses. Clients cache a DNSLink website for exactly as long as its DNS record allows and fetch updates once it expires, instead of relying on a static default. #​329
  • Requires a resolver that reports TTLs, such as DNS-over-HTTPS via go-doh-resolver v0.6.0. The OS resolver cannot report TTLs: Go's standard library net.Resolver returns only record values, and libp2p's default DNS wiring (madns.DefaultResolver) wraps it, so domains it serves keep the old behavior. In Kubo, a DNS.Resolvers entry for . covers all domains.
  • WithDNSResolver detects TTL support automatically. NewDNSResolverWithTTL, WithDNSResolverWithTTL, and LookupTXTWithTTLFunc take a TTL-aware lookup directly. NewDNSResolver and LookupTXTFunc are unchanged and report an unknown TTL (0).
• gateway: GET/HEAD /ipfs/bafkqaaa?format=raw now always returns 200 with an empty body, so probing clients keep marking the gateway as functional even when its backend cannot serve identity CIDs. bitswap/network/httpnet sends this trustless gateway probe to check providers, and a failed probe drops the provider. Exported as gateway.EmptyIdentityCID. #​1179
• path: added NewPathFromURI, which accepts native IPFS URIs (ipfs://cid, ipns://name, ipld://cid, and the schemeless ipfs:/ipns:/ipld: forms) and rewrites them to canonical content paths, so values copied from browsers and other tools parse as-is. NewPath stays strict and still rejects URI-shaped input, leaving untrusted parsing such as DNSLink records unchanged. #​1182
• blockstore: CachedBlockstore now returns a value implementing the
  exported BloomCacheStatus interface (Wait/BloomActive/Rebuild) when a
  Bloom filter is configured, so callers can wait for and observe the result of
  the asynchronous filter build (previously these methods were unreachable on the
  unexported cache type), and retry a failed build with Rebuild. While a
  rebuild runs the filter is inactive (lookups fall through to the underlying
  blockstore, so results stay correct but unaccelerated) and it is activated
  again only on a complete enumeration. A new optional AllKeysChanWithErrer
  capability lets a Blockstore report an error that truncates AllKeysChan
  enumeration. #​1184
• mfs: added WithFetchTimeout, a time limit on how long MFS waits when it has to fetch part of a tree from the network. MFS can hold a tree whose contents are pulled in on demand, for example a reference made with ipfs files cp /ipfs/<cid>. If a needed part is unavailable, MFS would otherwise wait for it forever, freezing every MFS operation and blocking a clean shutdown; with a timeout the wait ends in an error instead. On by default at a generous DefaultFetchTimeout (5 minutes) that only affects unreachable data; pass WithFetchTimeout(0) to disable. #​1185

Changed

• namesys: a name that resolves through several hops (a DNSLink pointing at an IPNS name, or an IPNS chain) now uses the shortest TTL among them, so an update to any link in the chain reaches clients on time. Hops with an unknown TTL (0) are ignored; single-hop results are unchanged. #​329
• namesys: TTLs in results now respect the operator's cap. WithMaxCacheTTL (in Kubo: Ipns.MaxCacheTTL) bounds the reported TTL, so Cache-Control: max-age never promises freshness past it. Cached results report their remaining lifetime instead of the original TTL, so a late cache hit no longer restarts the full caching period on clients. A cap of 0 still means "no local cache" and leaves the reported TTL alone. #​329
• upgrade to go-multiaddr-dns v0.6.0 and go-doh-resolver v0.6.0, which add DNS TXT TTL reporting and turn on the DNSLink Cache-Control behavior above for DoH-backed setups.
• 🛠 mfs: File.Open now takes a context.Context. Writing to a file whose data has to be fetched from the network (for example, a lazy reference created with ipfs files cp) now uses that context, so the write stops when the context is cancelled, such as on a client timeout or when MFS shuts down, instead of waiting forever for a block that never arrives. Callers must add a context argument; pass the request's context to let a timeout cancel the write. #​1185
• 🧪 testing: tests now use go-test v0.4.0 and math/rand/v2. go-test/random no longer has a global seed or a global sequence, so one test can no longer change the values another test expects to generate deterministically, a class of failure that showed up as an intermittent break in an unrelated test. A generator can also be reused now, instead of being rebuilt for every value. #​1187
• 🛠 routing/offline: the offline router now stores value records in the same datastore layout as the go-libp2p-kad-dht value store (v0.42.0+), so a node sharing one datastore between the offline router and a DHT resolves records offline that were published online and vice versa. That interop previously relied on both sides coincidentally using the same key derivation, which the kad-dht v0.42.0 layout change broke. Records written in the old layout (root-level base32 keys) are no longer read; GetValue also returns routing.ErrNotFound instead of leaking datastore.ErrNotFound for missing records, and re-validates stored records on read so expired records (e.g. IPNS past its EOL) are no longer returned. By default a stored record is served until it stops being valid (for IPNS, its EOL), unchanged from before; the new WithMaxRecordAge option adds an optional store-age cap. Retention also depends on what else uses the datastore: when a go-libp2p-kad-dht instance shares it (via dht.ValueDatastore), that DHT's value store drops records older than amino.DefaultMaxRecordAge on read and sweeps them in the background, regardless of this router's setting. So a node that also runs a DHT follows the DHT's age cap, while an offline-only node keeps records until their EOL. #​1189
• upgrade to go-libp2p-kad-dht v0.42.1, which includes a local record validation fix #​1189
• upgrade to go-unixfsnode v1.10.5
• upgrade to go-cid v0.6.2
• upgrade to go-libp2p v0.48.1-0.20260709142922-ec408fcc60c9 to get security and other fixes.

Removed

• 🛠 util: removed the deprecated NewSeededRand and NewTimeSeededRand. Use go-test/random instead. #​1187
• Remove dependency on whyrusleeping/base32 so that boxo only depends on one base32 package, multiformats/go-base32.

Fixed

• namesys: a custom sequence number of 0 is now rejected with ErrInvalidSequence also when the name has no existing record, matching the documented behavior that an explicitly supplied sequence must be at least 1.
• gateway: 304 Not Modified responses to If-None-Match and If-Modified-Since now carry Etag and the Cache-Control their 200 counterpart sends, so a client cache renews its freshness window when it revalidates. A bare 304 left the stored response expired, forcing a revalidation round-trip on every request after the first expiry even when the gateway had just confirmed the content is unchanged. Together with the DNSLink TTL work above, this addresses #​329 for web content; CAR and IPNS-record downloads keep their format-specific Etag handling.
• gateway: fixed a data race in the remote blockstore, CAR fetcher, and value store. Each picked a gateway URL out of its list using a per-instance *rand.Rand, which is not safe to use from more than one goroutine, so a gateway serving requests in parallel was racing on every request. They now use the top-level math/rand/v2 functions, which are safe to share. #​1187
• blockstore: the Bloom filter cache no longer activates after an incomplete
  build. Previously, if AllKeysChan enumeration was truncated by a
  mid-iteration datastore error (which was only logged, never propagated) or by a
  cancelled context, the cache treated the closed channel as a complete build and
  activated a Bloom filter holding only a subset of the stored CIDs. It then
  answered "not present" conclusively for blocks that exist but were never
  indexed, reporting present blocks as missing (Has returns false,
  Get/GetSize/View return not-found, DeleteBlock becomes a silent no-op).
  The build now activates the filter only when enumeration is known to have
  completed; otherwise it records the error (observable via
  BloomCacheStatus.Wait) and the cache degrades to correct pass-through. This
  also fixes a race where a cancelled build could still mark the filter active.
  #​1183

Security

• go-libp2p update contains security enhancements for DoS/hardening
  • 3501 bounds protocols accepted per peer in identify (a peer could plant 1800+ protocol entries in your peerstore via chunked identify)
  • 3486 caps unconnected addrs per peer (stops DHT gossip flooding the peerstore with stale addrs; relevant to us)
  • 3500 caps webrtc remote addrs per ufrag
  • 3487 evicts stale certified addrs when a newer signed peer record drops them (an address a peer once advertised no longer lingers after removal)

v0.41.0

Compare Source

Added

• ipld/merkledag/traverse: added the Visited interface and Options.Visited field, so callers can plug in their own set for skipping duplicates when SkipDuplicates is on. *go-cid.Set already works as one; a bounded or disk-backed set keeps memory low on very large DAGs.

Changed

• upgrade to go-ipld-prime v0.24.0
• upgrade to polydawn/refmt v0.90.0
• upgrade to go-car/v2 v2.17.0
• upgrade to go.opentelemetry.io to v1.44.0(includes v1.43.0)

Fixed

• routing/http/server: GET /routing/v1/ipns/{name} no longer gives a cache a window that outlasts the record. It caps max-age to the record's remaining validity and sizes the stale window (stale-while-revalidate/stale-if-error) to the time left after it, so the two never cross the record's EOL. An expired record, or one whose ValidityType is not EOL (unknown expiration), returns Cache-Control: no-store, and a negative TTL no longer yields a negative max-age. #​1166
• gateway: serving a raw IPNS record (GET /ipns/{name}?format=ipns-record) now caps max-age to the record's remaining validity and never lets it go negative, so a cache cannot reuse the record past its EOL. #​1166
• namesys: the IPNS resolver now floors a negative record TTL at zero, so a malformed record can no longer surface a negative TTL through Result.TTL. #​1166
• namesys: a cache hit now reports the TTL remaining in the cache entry rather than the record's original TTL, so a late hit near a record's EOL can no longer advertise a freshness lifetime that outlives the record. #​1166
• ipns: NewRecord floors a negative TTL at zero and Validate rejects records carrying one. #​1166
• bitswap/network/bsnet: stop marking a peer unresponsive on a single failed send attempt. send() is retried by multiAttempt(), which already marks the peer once all retries are exhausted; marking on the first failure could permanently sideline a peer that had just reconnected (the disconnect notification being suppressed), hanging fetches from it until it fully disconnected. #​1164

Security

• tracing: bumped OpenTelemetry OTLP exporters to v1.43.0, which caps the HTTP exporter's response body at 4 MiB. A hostile or man-in-the-middle collector could otherwise exhaust its memory (CVE-2026-39882). The gRPC exporter is unaffected.

v0.40.0

Compare Source

Added

• retrieval: added State.Snapshot, State.Apply, and State.Notify so consumers can stream State across a process boundary, e.g. to drive a live progress bar in Kubo's cat, get, or dag export. #​1153
• 🛠 pinning/pinner: added Pinner.Close() error. Close cancels every in-flight operation's context, including streaming goroutines from RecursiveKeys, DirectKeys, and InternalPins, and waits for them to return. A scalar method that observes the cancellation may return context.Canceled; a stream interrupted by Close may surface ErrClosed on the channel before it closes. After Close returns, every other method returns the new ErrClosed sentinel; streaming methods deliver it as StreamedPin.Err on a single entry, then close the channel. Close is idempotent and goroutine-safe. Action required: downstream Pinner implementations must add Close. #​1150
• pinning/pinner/dspinner: implements Close. Close cancels the contexts of in-flight operations, so snapshot iteration in RecursiveKeys/DirectKeys and DAG fetches in Pin bail out promptly instead of draining to completion. Close returns as soon as those operations honor their ctx. Hosts owning the datastore should call Close on the pinner before closing the datastore to avoid the use-after-close panic path in stores such as pebble. #​1150
• routing/http/types/iter: added Limit, an iterator that caps another iterator at a fixed number of values. #​1157
• routing/providerquerymanager: new WithFindPeerFallback option. When set, a one-shot FindPeer fallback runs if the first dial to a provider fails; the manager retries the dial with the fresh AddrInfo, but only if FindPeer surfaced at least one address that wasn't already in the routing-record set just tried. Rescues providers whose routing-record snapshot is thin or stale but whose actual addresses are still reachable, without wasting a retry on a duplicate address set. Disabled by default; pass WithFindPeerFallback(myDHT) to enable.

Changed

• upgrade to go-libp2p-kad-dht v0.40.0

• 🛠 files: the File interface no longer embeds io.Seeker. Seekability is now explicit in the type system instead of implied by an always-present Seek method that returned ErrNotSupported at runtime for non-seekable inputs. Callers that need to seek type-assert to io.Seeker; the assertion is an honest capability check rather than a guess. Seekable implementations (ReaderFile wrapping a seekable reader, Symlink, UnixFS files returned from the gateway and importer) still satisfy the assertion. Non-seekable implementations (HTTP multipart streams, WebFile) now fail the assertion at compile-aware sites instead of producing runtime errors deep in third-party code. The previous behavior forced downstream workarounds: e.g. ipfs/kubo#11253 had to wrap files.File in a plain io.Reader/io.Closer to strip Seek and force go-car's forward-only fallback, because go-car's NewBlockReader trusted the interface and called Seek, which failed with "operation not supported" on CARv2 imports over the HTTP API. With this change the trap stops existing.

  Action required. Replace direct Seek calls on files.File with a type assertion:

  // before
  n, err := f.Seek(offset, io.SeekStart)
  
  // after
  seeker, ok := f.(io.Seeker)
  if !ok {
      return fmt.Errorf("file does not support seeking")
  }
  n, err := seeker.Seek(offset, io.SeekStart)

  See ipfs/kubo#11254 for a worked example of the call-site update. #​1128

• ✨ routing/http/server: the Delegated Routing server now passes limit=0 (unbounded) to DelegatedRouter.FindProviders/FindPeers and applies the configured records limit itself, after filtering. Filtered requests now return a full page of results instead of fewer than requested. The server reads the delegate's iterator lazily and closes it once it has enough records. Action required: delegate implementations should return results lazily and stop work on Close. A delegate that previously used the limit argument to end its walk early should now end the walk on Close instead. #​1157

• path/resolver: ResolveToLastNode, ResolvePath, and ResolvePathComponents now populate retrieval.State on the request context when one is attached. They advance the state to PhasePathResolution, record the root CID from the input path, and record the terminal CID once resolution completes. Until now only the gateway backends populated these fields, leaving non-gateway callers (CLIs, custom tools) without phase or CID diagnostics on retrieval errors. The new calls are idempotent with the existing gateway-side ones, so behavior on the gateway path is unchanged.

Fixed

• files: now builds under GOOS=js GOARCH=wasm and GOOS=wasip1 GOARCH=wasm. #​935
• routing/http/server: filtered /routing/v1/providers and /routing/v1/peers requests now return up to the configured records limit. Previously the limit was applied before filter-addrs/filter-protocols ran, so records dropped by the filters shrank the response below the limit. The limit now applies after filtering. #​1157
• routing/http/types/iter: Filter.Next now iterates instead of recursing on rejected values, so the goroutine stack stays flat even when a long run of records is filtered out. This matters now that the server pulls unbounded results from the delegate. #​1157

v0.39.0

Compare Source

Added

• gateway: Config.MaxDeserializedResponseSize allows setting a maximum file/directory size for deserialized gateway responses. Content exceeding this limit returns 410 Gone, directing users to run their own IPFS node. Trustless response formats (application/vnd.ipld.raw, application/vnd.ipld.car) are not affected. The size is read from the UnixFS root block, so no extra block fetches are needed for the check. #​1138
• gateway: Config.MaxUnixFSDAGResponseSize allows setting a maximum content size applied to all response formats (deserialized, raw blocks, CAR, TAR). Content exceeding this limit returns 410 Gone. For most handlers the check reuses size information already available in the request path; for CAR responses a lightweight Head call is made only when the limit is configured. #​1138

Changed

• bitswap/server: the default peer comparator now schedules peers fairly. A peer that has never been served, or has waited longer than 10s, outranks non-starved peers. Pending counts cap at 16 for ordering purposes, so peers with small wantlists no longer wait behind peers with large ones. The final tiebreak uses a per-process salted hash of peer.ID, so no peer can craft an ID that permanently outranks everyone. Engines built with WithTaskComparator keep their existing behavior. #​1141
• upgrade to go-libp2p-kad-dht v0.39.1

Fixed

• bitswap/network/bsnet: SendMessage and handleNewStream now close streams in a background goroutine. Previously, stream.Close could hold the caller for up to DefaultNegotiationTimeout (10s) while lazyClientConn.Close waited for the remote peer to complete the multistream handshake. This saturated the bitswap TaskWorkerCount pool when peers were unresponsive and stopped bitswap from serving blocks to other peers. As a side effect, SendMessage no longer returns errors from stream.Close; close failures are logged at Debug. #​1142
• bitswap/server: a peer with a single pending want no longer waits behind peers with large wantlists. #​1141
• pinner/dspinner: RecursiveKeys and DirectKeys now snapshot the pin index under the read lock and release it before emitting pins, so a slow consumer (e.g. the reprovider draining the channel at DHT speed under Provide.Strategy=pinned*) can no longer starve Pin/Unpin/Flush writers. #​1140

v0.38.0

Compare Source

Added

• ipns: NewRecord accepts WithMetadata(map[string]any) option for storing custom scalar key-value pairs (string, []byte, int64, int, bool) in the signed DAG-CBOR data of IPNS records. Metadata can be read back via Record.Metadata (returns typed MetadataValue with Kind() discriminator) and iterated with Record.MetadataEntries. Reserved IPNS field names, empty keys, and unsupported value types are rejected. #​1085
• dag/walker: new package for memory-efficient DAG traversal with deduplication. VisitedTracker interface with BloomTracker (scalable bloom filter chain, ~4 bytes/CID vs ~75 bytes for a map) and MapTracker (exact, for tests). WalkDAG provides iterative DFS traversal with integrated dedup, supporting dag-pb, dag-cbor, raw, and other registered codecs. ~2x faster than the legacy go-ipld-prime selector-based traversal. WalkEntityRoots emits only entity roots (files, directories, HAMT shards) instead of every block, skipping internal file chunks. #​1124
• pinner: NewUniquePinnedProvider and NewPinnedEntityRootsProvider log and skip corrupted pin entries instead of aborting the provide cycle, allowing remaining pins to still be provided. #​1124
• routing/http/client: WithProviderInfoFunc option resolves provider addresses at provide-time instead of client construction time. This only impacts legacy HTTP-only custom routing setups that depend on IPIP-526 and were sending unresolved 0.0.0.0 addresses in provider records instead of actual interface addresses. #​1115
• chunker: added Register function to allow custom chunkers to be registered for use with FromString.
• mfs: added Directory.Mode() and Directory.ModTime() getters to match the existing File.Mode() and File.ModTime() API. #​1131

Changed

• provider: NewPrioritizedProvider now continues to the next stream when one fails instead of stopping all streams. NewConcatProvider added for pre-deduplicated streams. #​1124
• chunker: FromString now rejects malformed size- strings with extra parameters (e.g. size-123-extra was previously silently accepted).
• gateway: compliance with gateway-conformance v0.13
• upgrade to go-libp2p v0.48.0
• 🛠 mfs: replaced RootOption with a unified Option functional options pattern (e.g. WithCidBuilder, WithChunker, WithMaxLinks). NewRoot, NewEmptyRoot, MkdirWithOpts, and NewEmptyDirectory now accept ...Option. Mkdir takes a MkdirOpts struct (narrowed to Mkparents and Flush flags) followed by ...Option for directory configuration. #​1125

Removed

• gateway: removed dead DoH resolver for .crypto TLD (Unstoppable Domains) #​772
• cmd/boxo-migrate: removed code for go-ipfs migration -- no longer needed.
• cmd/deprecator: removed code to deprecare relocated ipfs packages -- no longer needed.

Fixed

• bitswap/server: incoming identity CIDs in wantlist messages are now silently ignored instead of killing the connection to the remote peer. Some IPFS implementations naively send identity CIDs, and disconnecting them for it caused unnecessary churn. #​1117
• bitswap/network: ExtractHTTPAddress now infers default ports for portless HTTP multiaddrs (e.g. /dns/host/https without /tcp/443). #​1123
• mfs: FileDescriptor operations are serialized with a mutex, preventing data races on the underlying DagModifier when FUSE mounts or Kubo RPC commands dispatch concurrent Read, Write, Seek, Truncate, Flush, or Close calls. Flush after Close returns ErrClosed. #​1131 #​1133
• mfs: preserve CidBuilder and SizeEstimationMode across setNodeData(), Mkdir() and NewRoot(). #​1125
• mfs: closing a file descriptor after its directory entry was removed (e.g. FUSE RELEASE racing with RENAME) no longer re-adds the stale entry to the parent directory. #​1134
• mfs: SetMode and SetModTime no longer drop file content links when updating UnixFS metadata. #​1134

v0.37.0

Compare Source

Added

• ipld/unixfs/io: added SizeEstimationMode for configurable HAMT sharding threshold decisions. Supports legacy link-based estimation (SizeEstimationLinks), accurate block-based estimation (SizeEstimationBlock), or disabling size-based thresholds (SizeEstimationDisabled). #​1088, IPIP-499
• ipld/unixfs/io: added UnixFSProfile with UnixFS_v0_2015 and UnixFS_v1_2025 presets for CID-deterministic file and directory DAG construction. #​1088, IPIP-499
• files: NewSerialFileWithOptions now supports controlling whether symlinks are preserved or dereferenced before being added to IPFS. See SerialFileOptions.DereferenceSymlinks. #​1088, IPIP-499

Changed

• 🛠 chunker, ipld/unixfs/importer/helpers: block size limits raised from 1MiB to 2MiB to match the bitswap spec. Max chunker size is 2MiB - 256 bytes to leave room for protobuf framing when --raw-leaves=false. IPIP-499 profiles use lower chunk sizes (256KiB and 1MiB) and are not affected.
• 🛠 chunker: DefaultBlockSize changed from const to var to allow runtime configuration via global profiles. #​1088, IPIP-499
• gateway: 🛠 ✨ IPIP-523 ?format= URL query parameter now takes precedence over Accept HTTP header, ensuring deterministic HTTP cache behavior and allowing browsers to use ?format= even when they send Accept headers with specific content types. #​1074
• gateway: 🛠 ✨ IPIP-524 codec conversions (e.g., dag-pb to dag-json, dag-json to dag-cbor) are no longer performed by default. Requesting a format that differs from the block's codec now returns HTTP 406 Not Acceptable with a hint to fetch raw blocks (?format=raw) and convert client-side. Set Config.AllowCodecConversion to true to restore the old behavior. #​1077
• gateway: compliance with gateway-conformance v0.10.0 (since v0.8: relaxed DAG-CBOR HTML preview cache headers, relaxed CAR 200/404 for missing paths, IPIP-523 format query precedence, IPIP-524 codec mismatch returns 406)
• upgrade to go-ipld-prime v0.22.0
• upgrade to go-libp2p-kad-dht v0.38.0

Removed

• tracing: opentelemetry zipkin exporter (go.opentelemetry.io/otel/exporters/zipkin) is deprecated and has been removed. It is recommended to switch to OTLP. Configure your application to send traces using OTLP and enable Zipkin’s OTLP ingestion support.

Fixed

• 🛠 ipld/unixfs/io: fixed HAMT sharding threshold comparison to use > instead of >=. A directory exactly at the threshold now stays as a basic (flat) directory, aligning behavior with code documentation and the JS implementation. This is a theoretical breaking change, but unlikely to impact real-world users as it requires a directory to be exactly at the threshold boundary. If you depend on the old behavior, adjust HAMTShardingSize to be 1 byte lower. #​1088, IPIP-499
• ipld/unixfs/mod: fixed sparse file writes in MFS. Writing past the end of a file (e.g., ipfs files write --offset 1000 /file on a smaller file) would lose data because expandSparse created the zero-padding node but didn't update the internal pointer. Subsequent writes went to the old unexpanded node.
• ipld/unixfs/io: fixed mode/mtime metadata loss during Basic<->HAMT directory conversions. Previously, directories with WithStat(mode, mtime) would lose this metadata when converting between basic and sharded formats, or when reloading a HAMT directory from disk.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 49 additional dependencies were updated

Details:

Package	Change
github.com/golang-jwt/jwt/v5	v5.2.1 -> v5.3.1
github.com/ipfs/go-cid	v0.6.0 -> v0.6.2
github.com/ipfs/go-ipld-format	v0.6.3 -> v0.6.4
github.com/libp2p/go-libp2p	v0.48.0 -> v0.49.0
github.com/libp2p/go-libp2p-kad-dht	v0.38.0 -> v0.42.1
filippo.io/keygen	v0.0.0-20260114151900-8e2790ea4c5b -> v1.0.0
github.com/decred/dcrd/dcrec/secp256k1/v4	v4.4.0 -> v4.4.1
github.com/gabriel-vasile/mimetype	v1.4.12 -> v1.4.13
github.com/gammazero/chanqueue	v1.1.1 -> v1.1.2
github.com/ipfs/bbloom	v0.0.4 -> v0.1.0
github.com/ipfs/go-block-format	v0.2.3 -> v0.2.4
github.com/ipfs/go-cidutil	v0.1.0 -> v0.1.2
github.com/ipfs/go-ipld-legacy	v0.2.2 -> v0.3.0
github.com/ipfs/go-log/v2	v2.9.1 -> v2.9.2
github.com/ipfs/go-unixfsnode	v1.10.2 -> v1.10.6
github.com/ipld/go-car/v2	v2.16.0 -> v2.17.0
github.com/ipld/go-ipld-prime	v0.21.0 -> v0.24.0
github.com/klauspost/cpuid/v2	v2.3.0 -> v2.4.0
github.com/koron/go-ssdp	v0.0.6 -> v0.9.1
github.com/libp2p/go-doh-resolver	v0.5.0 -> v0.6.0
github.com/libp2p/go-libp2p-kbucket	v0.8.0 -> v0.9.0
github.com/libp2p/go-yamux/v5	v5.0.1 -> v5.1.0
github.com/mattn/go-isatty	v0.0.20 -> v0.0.22
github.com/mr-tron/base58	v1.2.0 -> v1.3.0
github.com/multiformats/go-multiaddr-dns	v0.4.1 -> v0.6.0
github.com/multiformats/go-multibase	v0.2.0 -> v0.3.0
github.com/polydawn/refmt	v0.89.0 -> v0.90.0
github.com/prometheus/client_golang	v1.23.2 -> v1.24.1
github.com/prometheus/common	v0.66.1 -> v0.70.1
github.com/prometheus/procfs	v0.17.0 -> v0.21.1
github.com/quic-go/quic-go	v0.59.0 -> v0.60.0
github.com/quic-go/webtransport-go	v0.10.0 -> v0.11.1
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.63.0 -> v0.69.0
go.opentelemetry.io/otel	v1.40.0 -> v1.44.0
go.opentelemetry.io/otel/metric	v1.40.0 -> v1.44.0
go.opentelemetry.io/otel/trace	v1.40.0 -> v1.44.0
go.uber.org/mock	v0.5.2 -> v0.6.0
go.uber.org/zap	v1.27.1 -> v1.28.0
go.yaml.in/yaml/v2	v2.4.3 -> v2.4.4
golang.org/x/crypto	v0.48.0 -> v0.54.0
golang.org/x/exp	v0.0.0-20260112195511-716be5621a96 -> v0.0.0-20260718201538-764159d718ef
golang.org/x/mod	v0.32.0 -> v0.38.0
golang.org/x/net	v0.50.0 -> v0.57.0
golang.org/x/sync	v0.19.0 -> v0.22.0
golang.org/x/sys	v0.41.0 -> v0.47.0
golang.org/x/telemetry	v0.0.0-20260109210033-bd525da824e2 -> v0.0.0-20260717140457-bdb89881bb75
golang.org/x/text	v0.34.0 -> v0.40.0
golang.org/x/time	v0.12.0 -> v0.15.0
golang.org/x/tools	v0.41.0 -> v0.48.0