chore(deps): bump github.com/ipfs/boxo from 0.42.1-0.20260727115347-1c8cf646367f to 0.42.1

[dependabot]

Bumps github.com/ipfs/boxo from 0.42.1-0.20260727115347-1c8cf646367f to 0.42.1.

Release notes

Sourced from github.com/ipfs/boxo's releases.

v0.42.1

[!NOTE] This release was brought to you by the Shipyard team.

What's Changed

Added

• gateway: added WithMaxTraversalDepth. It limits how deep BlocksBackend descends into a DAG while it serves a CAR response. Traversal keeps per-level state, so its cost grows with depth. The limit is on by default at DefaultMaxTraversalDepth (1024), well above anything UnixFS produces. A file reaches terabytes by depth 4, and a HAMT adds about 4 levels per million directory entries. Pass a positive value to set your own limit, or WithMaxTraversalDepth(0) to remove the limit. #1197

Changed

• gateway: a CAR response that fails partway through now ends with [Gateway Error: CAR stream truncated, response is incomplete]. withRetrievalTimeout already uses the same marker when it cuts a response short. The gateway sets X-Stream-Error only once the body is streaming, so that header rarely reaches the client. A truncated CAR was otherwise indistinguishable from a complete one. The marker makes the trailing bytes invalid CAR, so a reader stops with an error instead of accepting a short DAG. This mostly helps operators. Gateways usually sit behind reverse proxies and third-party CDNs, so a short response leaves you guessing which hop cut it. Now the response says so itself. #1197
• routing/http/server: /routing/v1 responses no longer let a cache serve a two-day-old answer while the origin is healthy. Peer addresses in routing results come from short-lived sources such as relay reservations. A stale window measured in days handed clients addresses that had stopped working long ago. stale-while-revalidate is now 10 minutes for responses with results, and 1 minute for empty ones. That covers a background refresh. stale-if-error applies only when the origin is failing, so responses with results keep the 48h Amino DHT expiration window. For empty responses it is 1 hour. max-age is unchanged. #1195
• upgrade to go-libp2p v0.49.0

Fixed

• bitswap/network: ExtractHTTPAddress now brackets an IPv6 literal when it builds the provider URL. A peer that announces /ip6/<addr>/tcp/443/tls/http is now usable as an HTTP provider. Without brackets, url.Parse rejected the address under Go 1.26 and later, and the peer was skipped. On earlier versions it parsed, but the authority split at the last colon, so the client dialed a host and port that do not exist. #1196

Security

• The upgrade to boxo v0.49.0 includes a security fix for CVE-2026-57497: GHSA-g35j-m5xg-vh3q

Full Changelog: ipfs/boxo@v0.42.0...v0.42.1

Changelog

Sourced from github.com/ipfs/boxo's changelog.

[v0.42.1]

Added

• gateway: added WithMaxTraversalDepth. It limits how deep BlocksBackend descends into a DAG while it serves a CAR response. Traversal keeps per-level state, so its cost grows with depth. The limit is on by default at DefaultMaxTraversalDepth (1024), well above anything UnixFS produces. A file reaches terabytes by depth 4, and a HAMT adds about 4 levels per million directory entries. Pass a positive value to set your own limit, or WithMaxTraversalDepth(0) to remove the limit. #1197

Changed

• gateway: a CAR response that fails partway through now ends with [Gateway Error: CAR stream truncated, response is incomplete]. withRetrievalTimeout already uses the same marker when it cuts a response short. The gateway sets X-Stream-Error only once the body is streaming, so that header rarely reaches the client. A truncated CAR was otherwise indistinguishable from a complete one. The marker makes the trailing bytes invalid CAR, so a reader stops with an error instead of accepting a short DAG. This mostly helps operators. Gateways usually sit behind reverse proxies and third-party CDNs, so a short response leaves you guessing which hop cut it. Now the response says so itself. #1197
• routing/http/server: /routing/v1 responses no longer let a cache serve a two-day-old answer while the origin is healthy. Peer addresses in routing results come from short-lived sources such as relay reservations. A stale window measured in days handed clients addresses that had stopped working long ago. stale-while-revalidate is now 10 minutes for responses with results, and 1 minute for empty ones. That covers a background refresh. stale-if-error applies only when the origin is failing, so responses with results keep the 48h Amino DHT expiration window. For empty responses it is 1 hour. max-age is unchanged. #1195
• upgrade to go-libp2p v0.49.0

Fixed

• bitswap/network: ExtractHTTPAddress now brackets an IPv6 literal when it builds the provider URL. A peer that announces /ip6/<addr>/tcp/443/tls/http is now usable as an HTTP provider. Without brackets, url.Parse rejected the address under Go 1.26 and later, and the peer was skipped. On earlier versions it parsed, but the authority split at the last colon, so the client dialed a host and port that do not exist. #1196

Security

• The upgrade to boxo v0.49.0 includes a security fix for CVE-2026-57497: GHSA-g35j-m5xg-vh3q

[v0.42.0]

Added

• namesys: DNSLink lookups now return the DNS TXT record's TTL, and the gateway uses it as Cache-Control: max-age for /ipns/<dnslink-host> responses. Clients cache a DNSLink website for exactly as long as its DNS record allows and fetch updates once it expires, instead of relying on a static default. #329
  • Requires a resolver that reports TTLs, such as DNS-over-HTTPS via go-doh-resolver v0.6.0. The OS resolver cannot report TTLs: Go's standard library net.Resolver returns only record values, and libp2p's default DNS wiring (madns.DefaultResolver) wraps it, so domains it serves keep the old behavior. In Kubo, a DNS.Resolvers entry for . covers all domains.
  • WithDNSResolver detects TTL support automatically. NewDNSResolverWithTTL, WithDNSResolverWithTTL, and LookupTXTWithTTLFunc take a TTL-aware lookup directly. NewDNSResolver and LookupTXTFunc are unchanged and report an unknown TTL (0).
• gateway: GET/HEAD /ipfs/bafkqaaa?format=raw now always returns 200 with an empty body, so probing clients keep marking the gateway as functional even when its backend cannot serve identity CIDs. bitswap/network/httpnet sends this trustless gateway probe to check providers, and a failed probe drops the provider. Exported as gateway.EmptyIdentityCID. #1179
• path: added NewPathFromURI, which accepts native IPFS URIs (ipfs://cid, ipns://name, ipld://cid, and the schemeless ipfs:/ipns:/ipld: forms) and rewrites them to canonical content paths, so values copied from browsers and other tools parse as-is. NewPath stays strict and still rejects URI-shaped input, leaving untrusted parsing such as DNSLink records unchanged. #1182
• blockstore: CachedBlockstore now returns a value implementing the exported BloomCacheStatus interface (Wait/BloomActive/Rebuild) when a Bloom filter is configured, so callers can wait for and observe the result of the asynchronous filter build (previously these methods were unreachable on the unexported cache type), and retry a failed build with Rebuild. While a rebuild runs the filter is inactive (lookups fall through to the underlying blockstore, so results stay correct but unaccelerated) and it is activated again only on a complete enumeration. A new optional AllKeysChanWithErrer capability lets a Blockstore report an error that truncates AllKeysChan enumeration. #1184
• mfs: added WithFetchTimeout, a time limit on how long MFS waits when it has to fetch part of a tree from the network. MFS can hold a tree whose contents are pulled in on demand, for example a reference made with ipfs files cp /ipfs/<cid>. If a needed part is unavailable, MFS would otherwise wait for it forever, freezing every MFS operation and blocking a clean shutdown; with a timeout the wait ends in an error instead. On by default at a generous DefaultFetchTimeout (5 minutes) that only affects unreachable data; pass WithFetchTimeout(0) to disable. #1185

Changed

• namesys: a name that resolves through several hops (a DNSLink pointing at an IPNS name, or an IPNS chain) now uses the shortest TTL among them, so an update to any link in the chain reaches clients on time. Hops with an unknown TTL (0) are ignored; single-hop results are unchanged. #329
• namesys: TTLs in results now respect the operator's cap. WithMaxCacheTTL (in Kubo: Ipns.MaxCacheTTL) bounds the reported TTL, so Cache-Control: max-age never promises freshness past it. Cached results report their remaining lifetime instead of the original TTL, so a late cache hit no longer restarts the full caching period on clients. A cap of 0 still means "no local cache" and leaves the reported TTL alone. #329
• upgrade to go-multiaddr-dns v0.6.0 and go-doh-resolver v0.6.0, which add DNS TXT TTL reporting and turn on the DNSLink Cache-Control behavior above for DoH-backed setups.
• 🛠 mfs: File.Open now takes a context.Context. Writing to a file whose data has to be fetched from the network (for example, a lazy reference created with ipfs files cp) now uses that context, so the write stops when the context is cancelled, such as on a client timeout or when MFS shuts down, instead of waiting forever for a block that never arrives. Callers must add a context argument; pass the request's context to let a timeout cancel the write. #1185
• 🧪 testing: tests now use go-test v0.4.0 and math/rand/v2. go-test/random no longer has a global seed or a global sequence, so one test can no longer change the values another test expects to generate deterministically, a class of failure that showed up as an intermittent break in an unrelated test. A generator can also be reused now, instead of being rebuilt for every value. #1187
• 🛠 routing/offline: the offline router now stores value records in the same datastore layout as the go-libp2p-kad-dht value store (v0.42.0+), so a node sharing one datastore between the offline router and a DHT resolves records offline that were published online and vice versa. That interop previously relied on both sides coincidentally using the same key derivation, which the kad-dht v0.42.0 layout change broke. Records written in the old layout (root-level base32 keys) are no longer read; GetValue also returns routing.ErrNotFound instead of leaking datastore.ErrNotFound for missing records, and re-validates stored records on read so expired records (e.g. IPNS past its EOL) are no longer returned. By default a stored record is served until it stops being valid (for IPNS, its EOL), unchanged from before; the new WithMaxRecordAge option adds an optional store-age cap. Retention also depends on what else uses the datastore: when a go-libp2p-kad-dht instance shares it (via dht.ValueDatastore), that DHT's value store drops records older than amino.DefaultMaxRecordAge on read and sweeps them in the background, regardless of this router's setting. So a node that also runs a DHT follows the DHT's age cap, while an offline-only node keeps records until their EOL. #1189
• upgrade to go-libp2p-kad-dht v0.42.1, which includes a local record validation fix #1189

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)