Update module github.com/ipfs/boxo to v0.40.0 by renovate[bot] · Pull Request #6 · chenjia404/meshserver

renovate · 2026-03-23T13:14:19Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/ipfs/boxo	`v0.36.0` → `v0.40.0`

Release Notes

ipfs/boxo (github.com/ipfs/boxo)

`v0.40.0`

Compare Source

Added

retrieval: added State.Snapshot, State.Apply, and State.Notify so consumers can stream State across a process boundary, e.g. to drive a live progress bar in Kubo's cat, get, or dag export. #1153
🛠 pinning/pinner: added Pinner.Close() error. Close cancels every in-flight operation's context, including streaming goroutines from RecursiveKeys, DirectKeys, and InternalPins, and waits for them to return. A scalar method that observes the cancellation may return context.Canceled; a stream interrupted by Close may surface ErrClosed on the channel before it closes. After Close returns, every other method returns the new ErrClosed sentinel; streaming methods deliver it as StreamedPin.Err on a single entry, then close the channel. Close is idempotent and goroutine-safe. Action required: downstream Pinner implementations must add Close. #1150
pinning/pinner/dspinner: implements Close. Close cancels the contexts of in-flight operations, so snapshot iteration in RecursiveKeys/DirectKeys and DAG fetches in Pin bail out promptly instead of draining to completion. Close returns as soon as those operations honor their ctx. Hosts owning the datastore should call Close on the pinner before closing the datastore to avoid the use-after-close panic path in stores such as pebble. #1150
routing/http/types/iter: added Limit, an iterator that caps another iterator at a fixed number of values. #1157
routing/providerquerymanager: new WithFindPeerFallback option. When set, a one-shot FindPeer fallback runs if the first dial to a provider fails; the manager retries the dial with the fresh AddrInfo, but only if FindPeer surfaced at least one address that wasn't already in the routing-record set just tried. Rescues providers whose routing-record snapshot is thin or stale but whose actual addresses are still reachable, without wasting a retry on a duplicate address set. Disabled by default; pass WithFindPeerFallback(myDHT) to enable.

Changed

upgrade to go-libp2p-kad-dht v0.40.0
🛠 files: the File interface no longer embeds io.Seeker. Seekability is now explicit in the type system instead of implied by an always-present Seek method that returned ErrNotSupported at runtime for non-seekable inputs. Callers that need to seek type-assert to io.Seeker; the assertion is an honest capability check rather than a guess. Seekable implementations (ReaderFile wrapping a seekable reader, Symlink, UnixFS files returned from the gateway and importer) still satisfy the assertion. Non-seekable implementations (HTTP multipart streams, WebFile) now fail the assertion at compile-aware sites instead of producing runtime errors deep in third-party code. The previous behavior forced downstream workarounds: e.g. ipfs/kubo#11253 had to wrap files.File in a plain io.Reader/io.Closer to strip Seek and force go-car's forward-only fallback, because go-car's NewBlockReader trusted the interface and called Seek, which failed with "operation not supported" on CARv2 imports over the HTTP API. With this change the trap stops existing.

Action required. Replace direct Seek calls on files.File with a type assertion:
```
// before
n, err := f.Seek(offset, io.SeekStart)

// after
seeker, ok := f.(io.Seeker)
if !ok {
    return fmt.Errorf("file does not support seeking")
}
n, err := seeker.Seek(offset, io.SeekStart)
```
See ipfs/kubo#11254 for a worked example of the call-site update. #1128
✨ routing/http/server: the Delegated Routing server now passes limit=0 (unbounded) to DelegatedRouter.FindProviders/FindPeers and applies the configured records limit itself, after filtering. Filtered requests now return a full page of results instead of fewer than requested. The server reads the delegate's iterator lazily and closes it once it has enough records. Action required: delegate implementations should return results lazily and stop work on Close. A delegate that previously used the limit argument to end its walk early should now end the walk on Close instead. #1157
path/resolver: ResolveToLastNode, ResolvePath, and ResolvePathComponents now populate retrieval.State on the request context when one is attached. They advance the state to PhasePathResolution, record the root CID from the input path, and record the terminal CID once resolution completes. Until now only the gateway backends populated these fields, leaving non-gateway callers (CLIs, custom tools) without phase or CID diagnostics on retrieval errors. The new calls are idempotent with the existing gateway-side ones, so behavior on the gateway path is unchanged.

Fixed

files: now builds under GOOS=js GOARCH=wasm and GOOS=wasip1 GOARCH=wasm. #935
routing/http/server: filtered /routing/v1/providers and /routing/v1/peers requests now return up to the configured records limit. Previously the limit was applied before filter-addrs/filter-protocols ran, so records dropped by the filters shrank the response below the limit. The limit now applies after filtering. #1157
routing/http/types/iter: Filter.Next now iterates instead of recursing on rejected values, so the goroutine stack stays flat even when a long run of records is filtered out. This matters now that the server pulls unbounded results from the delegate. #1157

`v0.39.0`

Compare Source

Added

gateway: Config.MaxDeserializedResponseSize allows setting a maximum file/directory size for deserialized gateway responses. Content exceeding this limit returns 410 Gone, directing users to run their own IPFS node. Trustless response formats (application/vnd.ipld.raw, application/vnd.ipld.car) are not affected. The size is read from the UnixFS root block, so no extra block fetches are needed for the check. #1138
gateway: Config.MaxUnixFSDAGResponseSize allows setting a maximum content size applied to all response formats (deserialized, raw blocks, CAR, TAR). Content exceeding this limit returns 410 Gone. For most handlers the check reuses size information already available in the request path; for CAR responses a lightweight Head call is made only when the limit is configured. #1138

Changed

bitswap/server: the default peer comparator now schedules peers fairly. A peer that has never been served, or has waited longer than 10s, outranks non-starved peers. Pending counts cap at 16 for ordering purposes, so peers with small wantlists no longer wait behind peers with large ones. The final tiebreak uses a per-process salted hash of peer.ID, so no peer can craft an ID that permanently outranks everyone. Engines built with WithTaskComparator keep their existing behavior. #1141
upgrade to go-libp2p-kad-dht v0.39.1

Fixed

bitswap/network/bsnet: SendMessage and handleNewStream now close streams in a background goroutine. Previously, stream.Close could hold the caller for up to DefaultNegotiationTimeout (10s) while lazyClientConn.Close waited for the remote peer to complete the multistream handshake. This saturated the bitswap TaskWorkerCount pool when peers were unresponsive and stopped bitswap from serving blocks to other peers. As a side effect, SendMessage no longer returns errors from stream.Close; close failures are logged at Debug. #1142
bitswap/server: a peer with a single pending want no longer waits behind peers with large wantlists. #1141
pinner/dspinner: RecursiveKeys and DirectKeys now snapshot the pin index under the read lock and release it before emitting pins, so a slow consumer (e.g. the reprovider draining the channel at DHT speed under Provide.Strategy=pinned*) can no longer starve Pin/Unpin/Flush writers. #1140

`v0.38.0`

Compare Source

Added

ipns: NewRecord accepts WithMetadata(map[string]any) option for storing custom scalar key-value pairs (string, []byte, int64, int, bool) in the signed DAG-CBOR data of IPNS records. Metadata can be read back via Record.Metadata (returns typed MetadataValue with Kind() discriminator) and iterated with Record.MetadataEntries. Reserved IPNS field names, empty keys, and unsupported value types are rejected. #1085
dag/walker: new package for memory-efficient DAG traversal with deduplication. VisitedTracker interface with BloomTracker (scalable bloom filter chain, ~4 bytes/CID vs ~75 bytes for a map) and MapTracker (exact, for tests). WalkDAG provides iterative DFS traversal with integrated dedup, supporting dag-pb, dag-cbor, raw, and other registered codecs. ~2x faster than the legacy go-ipld-prime selector-based traversal. WalkEntityRoots emits only entity roots (files, directories, HAMT shards) instead of every block, skipping internal file chunks. #1124
pinner: NewUniquePinnedProvider and NewPinnedEntityRootsProvider log and skip corrupted pin entries instead of aborting the provide cycle, allowing remaining pins to still be provided. #1124
routing/http/client: WithProviderInfoFunc option resolves provider addresses at provide-time instead of client construction time. This only impacts legacy HTTP-only custom routing setups that depend on IPIP-526 and were sending unresolved 0.0.0.0 addresses in provider records instead of actual interface addresses. #1115
chunker: added Register function to allow custom chunkers to be registered for use with FromString.
mfs: added Directory.Mode() and Directory.ModTime() getters to match the existing File.Mode() and File.ModTime() API. #1131

Changed

provider: NewPrioritizedProvider now continues to the next stream when one fails instead of stopping all streams. NewConcatProvider added for pre-deduplicated streams. #1124
chunker: FromString now rejects malformed size- strings with extra parameters (e.g. size-123-extra was previously silently accepted).
gateway: compliance with gateway-conformance v0.13
upgrade to go-libp2p v0.48.0
🛠 mfs: replaced RootOption with a unified Option functional options pattern (e.g. WithCidBuilder, WithChunker, WithMaxLinks). NewRoot, NewEmptyRoot, MkdirWithOpts, and NewEmptyDirectory now accept ...Option. Mkdir takes a MkdirOpts struct (narrowed to Mkparents and Flush flags) followed by ...Option for directory configuration. #1125

Removed

gateway: removed dead DoH resolver for .crypto TLD (Unstoppable Domains) #772
cmd/boxo-migrate: removed code for go-ipfs migration -- no longer needed.
cmd/deprecator: removed code to deprecare relocated ipfs packages -- no longer needed.

Fixed

bitswap/server: incoming identity CIDs in wantlist messages are now silently ignored instead of killing the connection to the remote peer. Some IPFS implementations naively send identity CIDs, and disconnecting them for it caused unnecessary churn. #1117
bitswap/network: ExtractHTTPAddress now infers default ports for portless HTTP multiaddrs (e.g. /dns/host/https without /tcp/443). #1123
mfs: FileDescriptor operations are serialized with a mutex, preventing data races on the underlying DagModifier when FUSE mounts or Kubo RPC commands dispatch concurrent Read, Write, Seek, Truncate, Flush, or Close calls. Flush after Close returns ErrClosed. #1131 #1133
mfs: preserve CidBuilder and SizeEstimationMode across setNodeData(), Mkdir() and NewRoot(). #1125
mfs: closing a file descriptor after its directory entry was removed (e.g. FUSE RELEASE racing with RENAME) no longer re-adds the stale entry to the parent directory. #1134
mfs: SetMode and SetModTime no longer drop file content links when updating UnixFS metadata. #1134

`v0.37.0`

Compare Source

Added

ipld/unixfs/io: added SizeEstimationMode for configurable HAMT sharding threshold decisions. Supports legacy link-based estimation (SizeEstimationLinks), accurate block-based estimation (SizeEstimationBlock), or disabling size-based thresholds (SizeEstimationDisabled). #1088, IPIP-499
ipld/unixfs/io: added UnixFSProfile with UnixFS_v0_2015 and UnixFS_v1_2025 presets for CID-deterministic file and directory DAG construction. #1088, IPIP-499
files: NewSerialFileWithOptions now supports controlling whether symlinks are preserved or dereferenced before being added to IPFS. See SerialFileOptions.DereferenceSymlinks. #1088, IPIP-499

Changed

🛠 chunker, ipld/unixfs/importer/helpers: block size limits raised from 1MiB to 2MiB to match the bitswap spec. Max chunker size is 2MiB - 256 bytes to leave room for protobuf framing when --raw-leaves=false. IPIP-499 profiles use lower chunk sizes (256KiB and 1MiB) and are not affected.
🛠 chunker: DefaultBlockSize changed from const to var to allow runtime configuration via global profiles. #1088, IPIP-499
gateway: 🛠 ✨ IPIP-523 ?format= URL query parameter now takes precedence over Accept HTTP header, ensuring deterministic HTTP cache behavior and allowing browsers to use ?format= even when they send Accept headers with specific content types. #1074
gateway: 🛠 ✨ IPIP-524 codec conversions (e.g., dag-pb to dag-json, dag-json to dag-cbor) are no longer performed by default. Requesting a format that differs from the block's codec now returns HTTP 406 Not Acceptable with a hint to fetch raw blocks (?format=raw) and convert client-side. Set Config.AllowCodecConversion to true to restore the old behavior. #1077
gateway: compliance with gateway-conformance v0.10.0 (since v0.8: relaxed DAG-CBOR HTML preview cache headers, relaxed CAR 200/404 for missing paths, IPIP-523 format query precedence, IPIP-524 codec mismatch returns 406)
upgrade to go-ipld-prime v0.22.0
upgrade to go-libp2p-kad-dht v0.38.0

Removed

tracing: opentelemetry zipkin exporter (go.opentelemetry.io/otel/exporters/zipkin) is deprecated and has been removed. It is recommended to switch to OTLP. Configure your application to send traces using OTLP and enable Zipkin’s OTLP ingestion support.

Fixed

🛠 ipld/unixfs/io: fixed HAMT sharding threshold comparison to use > instead of >=. A directory exactly at the threshold now stays as a basic (flat) directory, aligning behavior with code documentation and the JS implementation. This is a theoretical breaking change, but unlikely to impact real-world users as it requires a directory to be exactly at the threshold boundary. If you depend on the old behavior, adjust HAMTShardingSize to be 1 byte lower. #1088, IPIP-499
ipld/unixfs/mod: fixed sparse file writes in MFS. Writing past the end of a file (e.g., ipfs files write --offset 1000 /file on a smaller file) would lose data because expandSparse created the zero-padding node but didn't update the internal pointer. Subsequent writes went to the old unexpanded node.
ipld/unixfs/io: fixed mode/mtime metadata loss during Basic<->HAMT directory conversions. Previously, directories with WithStat(mode, mtime) would lose this metadata when converting between basic and sharded formats, or when reloading a HAMT directory from disk.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-03-23T13:14:20Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

34 additional dependencies were updated

Details:

Package	Change
`github.com/golang-jwt/jwt/v5`	`v5.2.1` -> `v5.3.0`
`github.com/libp2p/go-libp2p-kad-dht`	`v0.38.0` -> `v0.40.0`
`github.com/decred/dcrd/dcrec/secp256k1/v4`	`v4.4.0` -> `v4.4.1`
`github.com/gabriel-vasile/mimetype`	`v1.4.12` -> `v1.4.13`
`github.com/gammazero/chanqueue`	`v1.1.1` -> `v1.1.2`
`github.com/ipfs/bbloom`	`v0.0.4` -> `v0.1.0`
`github.com/ipfs/go-block-format`	`v0.2.3` -> `v0.2.3`
`github.com/ipfs/go-cidutil`	`v0.1.0` -> `v0.1.1`
`github.com/ipfs/go-ipld-legacy`	`v0.2.2` -> `v0.3.0`
`github.com/ipfs/go-log/v2`	`v2.9.1` -> `v2.9.2`
`github.com/ipfs/go-unixfsnode`	`v1.10.2` -> `v1.10.4`
`github.com/ipld/go-ipld-prime`	`v0.21.0` -> `v0.23.0`
`github.com/mattn/go-isatty`	`v0.0.20` -> `v0.0.22`
`github.com/mr-tron/base58`	`v1.2.0` -> `v1.3.0`
`github.com/multiformats/go-multiaddr-dns`	`v0.4.1` -> `v0.5.0`
`github.com/multiformats/go-multibase`	`v0.2.0` -> `v0.3.0`
`github.com/polydawn/refmt`	`v0.89.0` -> `v0.89.1-0.20231129105047-37766d95467a`
`github.com/prometheus/common`	`v0.66.1` -> `v0.67.5`
`github.com/prometheus/procfs`	`v0.17.0` -> `v0.20.1`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.63.0` -> `v0.68.0`
`go.opentelemetry.io/otel`	`v1.40.0` -> `v1.43.0`
`go.opentelemetry.io/otel/metric`	`v1.40.0` -> `v1.43.0`
`go.opentelemetry.io/otel/trace`	`v1.40.0` -> `v1.43.0`
`go.uber.org/zap`	`v1.27.1` -> `v1.28.0`
`go.yaml.in/yaml/v2`	`v2.4.3` -> `v2.4.4`
`golang.org/x/crypto`	`v0.48.0` -> `v0.51.0`
`golang.org/x/exp`	`v0.0.0-20260112195511-716be5621a96` -> `v0.0.0-20260508232706-74f9aab9d74a`
`golang.org/x/mod`	`v0.32.0` -> `v0.36.0`
`golang.org/x/net`	`v0.50.0` -> `v0.54.0`
`golang.org/x/sync`	`v0.19.0` -> `v0.20.0`
`golang.org/x/sys`	`v0.41.0` -> `v0.45.0`
`golang.org/x/telemetry`	`v0.0.0-20260109210033-bd525da824e2` -> `v0.0.0-20260508192327-42602be52be6`
`golang.org/x/text`	`v0.34.0` -> `v0.37.0`
`golang.org/x/tools`	`v0.41.0` -> `v0.45.0`

renovate Bot force-pushed the renovate/github.com-ipfs-boxo-0.x branch from 8e65723 to b22b7bc Compare April 15, 2026 13:20

renovate Bot changed the title ~~Update module github.com/ipfs/boxo to v0.37.0~~ Update module github.com/ipfs/boxo to v0.38.0 Apr 15, 2026

renovate Bot force-pushed the renovate/github.com-ipfs-boxo-0.x branch from b22b7bc to bf3e8f1 Compare April 30, 2026 02:38

renovate Bot changed the title ~~Update module github.com/ipfs/boxo to v0.38.0~~ Update module github.com/ipfs/boxo to v0.39.0 Apr 30, 2026

Update module github.com/ipfs/boxo to v0.40.0

5980e66

renovate Bot force-pushed the renovate/github.com-ipfs-boxo-0.x branch from bf3e8f1 to 5980e66 Compare May 30, 2026 08:10

renovate Bot changed the title ~~Update module github.com/ipfs/boxo to v0.39.0~~ Update module github.com/ipfs/boxo to v0.40.0 May 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update module github.com/ipfs/boxo to v0.40.0#6

Update module github.com/ipfs/boxo to v0.40.0#6
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/github.com-ipfs-boxo-0.x

renovate Bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.40.0

Added

Changed

Fixed

v0.39.0

Added

Changed

Fixed

v0.38.0

Added

Changed

Removed

Fixed

v0.37.0

Added

Changed

Removed

Fixed

Configuration

Uh oh!

renovate Bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Mar 23, 2026 •

edited

Loading

`v0.40.0`

`v0.39.0`

`v0.38.0`

`v0.37.0`

renovate Bot commented Mar 23, 2026 •

edited

Loading