fix(deps): update module github.com/ipfs/boxo to v0.40.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/ipfs/boxo	v0.38.0 → v0.40.0

---

Release Notes

ipfs/boxo (github.com/ipfs/boxo)

v0.40.0

Compare Source

Added

• retrieval: added State.Snapshot, State.Apply, and State.Notify so consumers can stream State across a process boundary, e.g. to drive a live progress bar in Kubo's cat, get, or dag export. #​1153
• 🛠 pinning/pinner: added Pinner.Close() error. Close cancels every in-flight operation's context, including streaming goroutines from RecursiveKeys, DirectKeys, and InternalPins, and waits for them to return. A scalar method that observes the cancellation may return context.Canceled; a stream interrupted by Close may surface ErrClosed on the channel before it closes. After Close returns, every other method returns the new ErrClosed sentinel; streaming methods deliver it as StreamedPin.Err on a single entry, then close the channel. Close is idempotent and goroutine-safe. Action required: downstream Pinner implementations must add Close. #​1150
• pinning/pinner/dspinner: implements Close. Close cancels the contexts of in-flight operations, so snapshot iteration in RecursiveKeys/DirectKeys and DAG fetches in Pin bail out promptly instead of draining to completion. Close returns as soon as those operations honor their ctx. Hosts owning the datastore should call Close on the pinner before closing the datastore to avoid the use-after-close panic path in stores such as pebble. #​1150
• routing/http/types/iter: added Limit, an iterator that caps another iterator at a fixed number of values. #​1157
• routing/providerquerymanager: new WithFindPeerFallback option. When set, a one-shot FindPeer fallback runs if the first dial to a provider fails; the manager retries the dial with the fresh AddrInfo, but only if FindPeer surfaced at least one address that wasn't already in the routing-record set just tried. Rescues providers whose routing-record snapshot is thin or stale but whose actual addresses are still reachable, without wasting a retry on a duplicate address set. Disabled by default; pass WithFindPeerFallback(myDHT) to enable.

Changed

• upgrade to go-libp2p-kad-dht v0.40.0

• 🛠 files: the File interface no longer embeds io.Seeker. Seekability is now explicit in the type system instead of implied by an always-present Seek method that returned ErrNotSupported at runtime for non-seekable inputs. Callers that need to seek type-assert to io.Seeker; the assertion is an honest capability check rather than a guess. Seekable implementations (ReaderFile wrapping a seekable reader, Symlink, UnixFS files returned from the gateway and importer) still satisfy the assertion. Non-seekable implementations (HTTP multipart streams, WebFile) now fail the assertion at compile-aware sites instead of producing runtime errors deep in third-party code. The previous behavior forced downstream workarounds: e.g. ipfs/kubo#11253 had to wrap files.File in a plain io.Reader/io.Closer to strip Seek and force go-car's forward-only fallback, because go-car's NewBlockReader trusted the interface and called Seek, which failed with "operation not supported" on CARv2 imports over the HTTP API. With this change the trap stops existing.

  Action required. Replace direct Seek calls on files.File with a type assertion:

  // before
  n, err := f.Seek(offset, io.SeekStart)
  
  // after
  seeker, ok := f.(io.Seeker)
  if !ok {
      return fmt.Errorf("file does not support seeking")
  }
  n, err := seeker.Seek(offset, io.SeekStart)

  See ipfs/kubo#11254 for a worked example of the call-site update. #​1128

• ✨ routing/http/server: the Delegated Routing server now passes limit=0 (unbounded) to DelegatedRouter.FindProviders/FindPeers and applies the configured records limit itself, after filtering. Filtered requests now return a full page of results instead of fewer than requested. The server reads the delegate's iterator lazily and closes it once it has enough records. Action required: delegate implementations should return results lazily and stop work on Close. A delegate that previously used the limit argument to end its walk early should now end the walk on Close instead. #​1157

• path/resolver: ResolveToLastNode, ResolvePath, and ResolvePathComponents now populate retrieval.State on the request context when one is attached. They advance the state to PhasePathResolution, record the root CID from the input path, and record the terminal CID once resolution completes. Until now only the gateway backends populated these fields, leaving non-gateway callers (CLIs, custom tools) without phase or CID diagnostics on retrieval errors. The new calls are idempotent with the existing gateway-side ones, so behavior on the gateway path is unchanged.

Fixed

• files: now builds under GOOS=js GOARCH=wasm and GOOS=wasip1 GOARCH=wasm. #​935
• routing/http/server: filtered /routing/v1/providers and /routing/v1/peers requests now return up to the configured records limit. Previously the limit was applied before filter-addrs/filter-protocols ran, so records dropped by the filters shrank the response below the limit. The limit now applies after filtering. #​1157
• routing/http/types/iter: Filter.Next now iterates instead of recursing on rejected values, so the goroutine stack stays flat even when a long run of records is filtered out. This matters now that the server pulls unbounded results from the delegate. #​1157

v0.39.0

Compare Source

Added

• gateway: Config.MaxDeserializedResponseSize allows setting a maximum file/directory size for deserialized gateway responses. Content exceeding this limit returns 410 Gone, directing users to run their own IPFS node. Trustless response formats (application/vnd.ipld.raw, application/vnd.ipld.car) are not affected. The size is read from the UnixFS root block, so no extra block fetches are needed for the check. #​1138
• gateway: Config.MaxUnixFSDAGResponseSize allows setting a maximum content size applied to all response formats (deserialized, raw blocks, CAR, TAR). Content exceeding this limit returns 410 Gone. For most handlers the check reuses size information already available in the request path; for CAR responses a lightweight Head call is made only when the limit is configured. #​1138

Changed

• bitswap/server: the default peer comparator now schedules peers fairly. A peer that has never been served, or has waited longer than 10s, outranks non-starved peers. Pending counts cap at 16 for ordering purposes, so peers with small wantlists no longer wait behind peers with large ones. The final tiebreak uses a per-process salted hash of peer.ID, so no peer can craft an ID that permanently outranks everyone. Engines built with WithTaskComparator keep their existing behavior. #​1141
• upgrade to go-libp2p-kad-dht v0.39.1

Fixed

• bitswap/network/bsnet: SendMessage and handleNewStream now close streams in a background goroutine. Previously, stream.Close could hold the caller for up to DefaultNegotiationTimeout (10s) while lazyClientConn.Close waited for the remote peer to complete the multistream handshake. This saturated the bitswap TaskWorkerCount pool when peers were unresponsive and stopped bitswap from serving blocks to other peers. As a side effect, SendMessage no longer returns errors from stream.Close; close failures are logged at Debug. #​1142
• bitswap/server: a peer with a single pending want no longer waits behind peers with large wantlists. #​1141
• pinner/dspinner: RecursiveKeys and DirectKeys now snapshot the pin index under the read lock and release it before emitting pins, so a slow consumer (e.g. the reprovider draining the channel at DHT speed under Provide.Strategy=pinned*) can no longer starve Pin/Unpin/Flush writers. #​1140

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 18 additional dependencies were updated

Details:

Package	Change
github.com/libp2p/go-libp2p-kad-dht	v0.39.0 -> v0.40.0
github.com/ipfs/go-log/v2	v2.9.1 -> v2.9.2
github.com/ipfs/go-unixfsnode	v1.10.3 -> v1.10.4
github.com/ipld/go-ipld-prime	v0.22.0 -> v0.23.0
github.com/mattn/go-isatty	v0.0.20 -> v0.0.22
github.com/wlynxg/anet	v0.0.5 -> v0.0.5
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.67.0 -> v0.68.0
go.opentelemetry.io/otel	v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/metric	v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/trace	v1.42.0 -> v1.43.0
go.uber.org/zap	v1.27.1 -> v1.28.0
golang.org/x/exp	v0.0.0-20260312153236-7ab1446f8b90 -> v0.0.0-20260508232706-74f9aab9d74a
golang.org/x/mod	v0.34.0 -> v0.36.0
golang.org/x/net	v0.52.0 -> v0.54.0
golang.org/x/sys	v0.43.0 -> v0.45.0
golang.org/x/telemetry	v0.0.0-20260311193753-579e4da9a98c -> v0.0.0-20260508192327-42602be52be6
golang.org/x/text	v0.36.0 -> v0.37.0
golang.org/x/tools	v0.43.0 -> v0.45.0