What's Changed

Added

• gateway: added WithMaxTraversalDepth. It limits how deep BlocksBackend descends into a DAG while it serves a CAR response. Traversal keeps per-level state, so its cost grows with depth. The limit is on by default at DefaultMaxTraversalDepth (1024), well above anything UnixFS produces. A file reaches terabytes by depth 4, and a HAMT adds about 4 levels per million directory entries. Pass a positive value to set your own limit, or WithMaxTraversalDepth(0) to remove the limit. #1197

Changed

• gateway: a CAR response that fails partway through now ends with [Gateway Error: CAR stream truncated, response is incomplete]. withRetrievalTimeout already uses the same marker when it cuts a response short. The gateway sets X-Stream-Error only once the body is streaming, so that header rarely reaches the client. A truncated CAR was otherwise indistinguishable from a complete one. The marker makes the trailing bytes invalid CAR, so a reader stops with an error instead of accepting a short DAG. This mostly helps operators. Gateways usually sit behind reverse proxies and third-party CDNs, so a short response leaves you guessing which hop cut it. Now the response says so itself. #1197
• routing/http/server: /routing/v1 responses no longer let a cache serve a two-day-old answer while the origin is healthy. Peer addresses in routing results come from short-lived sources such as relay reservations. A stale window measured in days handed clients addresses that had stopped working long ago. stale-while-revalidate is now 10 minutes for responses with results, and 1 minute for empty ones. That covers a background refresh. stale-if-error applies only when the origin is failing, so responses with results keep the 48h Amino DHT expiration window. For empty responses it is 1 hour. max-age is unchanged. #1195
• upgrade to go-libp2p v0.49.0

Fixed

• bitswap/network: ExtractHTTPAddress now brackets an IPv6 literal when it builds the provider URL. A peer that announces /ip6/<addr>/tcp/443/tls/http is now usable as an HTTP provider. Without brackets, url.Parse rejected the address under Go 1.26 and later, and the peer was skipped. On earlier versions it parsed, but the authority split at the last colon, so the client dialed a host and port that do not exist. #1196

Security

• The upgrade to go-libp2p v0.49.0 includes a security fix for CVE-2026-57497: GHSA-g35j-m5xg-vh3q

Full Changelog: v0.42.0...v0.42.1

What's Changed

Added

• namesys: DNSLink lookups now return the DNS TXT record's TTL, and the gateway uses it as Cache-Control: max-age for /ipns/<dnslink-host> responses. Clients cache a DNSLink website for exactly as long as its DNS record allows and fetch updates once it expires, instead of relying on a static default. #329
  • Requires a resolver that reports TTLs, such as DNS-over-HTTPS via go-doh-resolver v0.6.0. The OS resolver cannot report TTLs: Go's standard library net.Resolver returns only record values, and libp2p's default DNS wiring (madns.DefaultResolver) wraps it, so domains it serves keep the old behavior. In Kubo, a DNS.Resolvers entry for . covers all domains.
  • WithDNSResolver detects TTL support automatically. NewDNSResolverWithTTL, WithDNSResolverWithTTL, and LookupTXTWithTTLFunc take a TTL-aware lookup directly. NewDNSResolver and LookupTXTFunc are unchanged and report an unknown TTL (0).
• gateway: GET/HEAD /ipfs/bafkqaaa?format=raw now always returns 200 with an empty body, so probing clients keep marking the gateway as functional even when its backend cannot serve identity CIDs. bitswap/network/httpnet sends this trustless gateway probe to check providers, and a failed probe drops the provider. Exported as gateway.EmptyIdentityCID. #1179
• path: added NewPathFromURI, which accepts native IPFS URIs (ipfs://cid, ipns://name, ipld://cid, and the schemeless ipfs:/ipns:/ipld: forms) and rewrites them to canonical content paths, so values copied from browsers and other tools parse as-is. NewPath stays strict and still rejects URI-shaped input, leaving untrusted parsing such as DNSLink records unchanged. #1182
• blockstore: CachedBlockstore now returns a value implementing the exported BloomCacheStatus interface (Wait/BloomActive/Rebuild) when a Bloom filter is configured, so callers can wait for and observe the result of the asynchronous filter build (previously these methods were unreachable on the unexported cache type), and retry a failed build with Rebuild. While a rebuild runs the filter is inactive (lookups fall through to the underlying blockstore, so results stay correct but unaccelerated) and it is activated again only on a complete enumeration. A new optional AllKeysChanWithErrer capability lets a Blockstore report an error that truncates AllKeysChan enumeration. #1184
• mfs: added WithFetchTimeout, a time limit on how long MFS waits when it has to fetch part of a tree from the network. MFS can hold a tree whose contents are pulled in on demand, for example a reference made with ipfs files cp /ipfs/<cid>. If a needed part is unavailable, MFS would otherwise wait for it forever, freezing every MFS operation and blocking a clean shutdown; with a timeout the wait ends in an error instead. On by default at a generous DefaultFetchTimeout (5 minutes) that only affects unreachable data; pass WithFetchTimeout(0) to disable. #1185

Changed

• namesys: a name that resolves through several hops (a DNSLink pointing at an IPNS name, or an IPNS chain) now uses the shortest TTL among them, so an update to any link in the chain reaches clients on time. Hops with an unknown TTL (0) are ignored; single-hop results are unchanged. #329
• namesys: TTLs in results now respect the operator's cap. WithMaxCacheTTL (in Kubo: Ipns.MaxCacheTTL) bounds the reported TTL, so Cache-Control: max-age never promises freshness past it. Cached results report their remaining lifetime instead of the original TTL, so a late cache hit no longer restarts the full caching period on clients. A cap of 0 still means "no local cache" and leaves the reported TTL alone. #329
• upgrade to go-multiaddr-dns v0.6.0 and go-doh-resolver v0.6.0, which add DNS TXT TTL reporting and turn on the DNSLink Cache-Control behavior above for DoH-backed setups.
• 🛠 mfs: File.Open now takes a context.Context. Writing to a file whose data has to be fetched from the network (for example, a lazy reference created with ipfs files cp) now uses that context, so the write stops when the context is cancelled, such as on a client timeout or when MFS shuts down, instead of waiting forever for a block that never arrives. Callers must add a context argument; pass the request's context to let a timeout cancel the write. #1185
• 🧪 testing: tests now use go-test v0.4.0 and math/rand/v2. go-test/random no longer has a global seed or a global sequence, so one test can no longer change the values another test expects to generate deterministically, a class of failure that showed up as an intermittent break in an unrelated test. A generator can also be reused now, instead of being rebuilt for every value. #1187
• 🛠 routing/offline: the offline router now stores value records in the same datastore layout as the go-libp2p-kad-dht value store (v0.42.0+), so a node sharing one datastore between the offline router and a DHT resolves records offline that were published online and vice versa. That interop previously relied on both sides coincidentally using the same key derivation, which the kad-dht v0.42.0 layout change broke. Records written in the old layout (root-level base32 keys) are no longer read; GetValue also returns routing.ErrNotFound instead of leaking datastore.ErrNotFound for missing records, and re-validates stored records on read so expired records (e.g. IPNS past its EOL) are no longer returned. By default a stored record is served until it stops being valid (for IPNS, its EOL), unchanged from before; the new WithMaxRecordAge option adds an optional store-age cap. Retention also depends on what else uses the datastore: when a go-libp2p-kad-dht instance shares it (via dht.ValueDatastore), that DHT's value store drops records older than amino.DefaultMaxRecordAge on read and sweeps them in the background, regardless of this router's setting. So a node that also runs a DHT follows the DHT's age cap, while an offline-only node keeps records until their EOL. #1189
• upgrade to go-libp2p-kad-dht v0.42.1, which includes a local record validation fix #1189
• upgrade to go-unixfsnode v1.10.5
• upgrade to go-cid v0.6.2
• upgrade to go-libp2p v0.48.1-0.20260709142922-ec408fcc60c9 to get security and other fixes.

Removed

• 🛠 util: removed the deprecated NewSeededRand and NewTimeSeededRand. Use go-test/random instead. #1187
• Remove dependency on whyrusleeping/base32 so that boxo only depends on one base32 package, multiformats/go-base32.

Fixed

• namesys: a custom sequence number of 0 is now rejected with ErrInvalidSequence also when the name has no existing record, matching the documented behavior that an explicitly supplied sequence must be at least 1.
• gateway: 304 Not Modified responses to If-None-Match and If-Modified-Since now carry Etag and the Cache-Control their 200 counterpart sends, so a client cache renews its freshness window when it revalidates. A bare 304 left the stored response expired, forcing a revalidation round-trip on every request after the first expiry even when the gateway had just confirmed the content is unchanged. Together with the DNSLink TTL work above, this addresses #329 for web content; CAR and IPNS-record downloads keep their format-specific Etag handling.
• gateway: fixed a data race in the remote blockstore, CAR fetcher, and value store. Each picked a gateway URL out of its list using a per-instance *rand.Rand, which is not safe to use from more than one goroutine, so a gateway serving requests in parallel was racing on every request. They now use the top-level math/rand/v2 functions, which are safe to share. #1187
• blockstore: the Bloom filter cache no longer activates after an incomplete build. Previously, if AllKeysChan enumeration was truncated by a mid-iteration datastore error (which was only logged, never propagated) or by a cancelled context, the cache treated the closed channel as a complete build and activated a Bloom filter holding only a subset of the stored CIDs. It then answered "not present" conclusively for blocks that exist but were never indexed, reporting present blocks as missing (Has returns false, Get/GetSize/View return not-found, DeleteBlock becomes a silent no-op). The build now activates the filter only when enumeration is known to have completed; otherwise it records the error (observable ...

What's Changed

Added

• ipld/merkledag/traverse: added the Visited interface and Options.Visited field, so callers can plug in their own set for skipping duplicates when SkipDuplicates is on. *go-cid.Set already works as one; a bounded or disk-backed set keeps memory low on very large DAGs.

Changed

• upgrade to go-ipld-prime v0.24.0
• upgrade to polydawn/refmt v0.90.0
• upgrade to go-car/v2 v2.17.0
• upgrade to go.opentelemetry.io to v1.44.0(includes v1.43.0)

Fixed

• routing/http/server: GET /routing/v1/ipns/{name} no longer gives a cache a window that outlasts the record. It caps max-age to the record's remaining validity and sizes the stale window (stale-while-revalidate/stale-if-error) to the time left after it, so the two never cross the record's EOL. An expired record, or one whose ValidityType is not EOL (unknown expiration), returns Cache-Control: no-store, and a negative TTL no longer yields a negative max-age. #1166
• gateway: serving a raw IPNS record (GET /ipns/{name}?format=ipns-record) now caps max-age to the record's remaining validity and never lets it go negative, so a cache cannot reuse the record past its EOL. #1166
• namesys: the IPNS resolver now floors a negative record TTL at zero, so a malformed record can no longer surface a negative TTL through Result.TTL. #1166
• namesys: a cache hit now reports the TTL remaining in the cache entry rather than the record's original TTL, so a late hit near a record's EOL can no longer advertise a freshness lifetime that outlives the record. #1166
• ipns: NewRecord floors a negative TTL at zero and Validate rejects records carrying one. #1166
• bitswap/network/bsnet: stop marking a peer unresponsive on a single failed send attempt. send() is retried by multiAttempt(), which already marks the peer once all retries are exhausted; marking on the first failure could permanently sideline a peer that had just reconnected (the disconnect notification being suppressed), hanging fetches from it until it fully disconnected. #1164

Security

• tracing: bumped OpenTelemetry OTLP exporters to v1.43.0, which caps the HTTP exporter's response body at 4 MiB. A hostile or man-in-the-middle collector could otherwise exhaust its memory (CVE-2026-39882). The gRPC exporter is unaffected.

Full Changelog: v0.40.0...v0.41.0

What's Changed

Added

• retrieval: added State.Snapshot, State.Apply, and State.Notify so consumers can stream State across a process boundary, e.g. to drive a live progress bar in Kubo's cat, get, or dag export. #1153
• 🛠 pinning/pinner: added Pinner.Close() error. Close cancels every in-flight operation's context, including streaming goroutines from RecursiveKeys, DirectKeys, and InternalPins, and waits for them to return. A scalar method that observes the cancellation may return context.Canceled; a stream interrupted by Close may surface ErrClosed on the channel before it closes. After Close returns, every other method returns the new ErrClosed sentinel; streaming methods deliver it as StreamedPin.Err on a single entry, then close the channel. Close is idempotent and goroutine-safe. Action required: downstream Pinner implementations must add Close. #1150
• pinning/pinner/dspinner: implements Close. Close cancels the contexts of in-flight operations, so snapshot iteration in RecursiveKeys/DirectKeys and DAG fetches in Pin bail out promptly instead of draining to completion. Close returns as soon as those operations honor their ctx. Hosts owning the datastore should call Close on the pinner before closing the datastore to avoid the use-after-close panic path in stores such as pebble. #1150
• routing/http/types/iter: added Limit, an iterator that caps another iterator at a fixed number of values. #1157
• routing/providerquerymanager: new WithFindPeerFallback option. When set, a one-shot FindPeer fallback runs if the first dial to a provider fails; the manager retries the dial with the fresh AddrInfo, but only if FindPeer surfaced at least one address that wasn't already in the routing-record set just tried. Rescues providers whose routing-record snapshot is thin or stale but whose actual addresses are still reachable, without wasting a retry on a duplicate address set. Disabled by default; pass WithFindPeerFallback(myDHT) to enable.

Changed

• upgrade to go-libp2p-kad-dht v0.40.0

• 🛠 files: the File interface no longer embeds io.Seeker. Seekability is now explicit in the type system instead of implied by an always-present Seek method that returned ErrNotSupported at runtime for non-seekable inputs. Callers that need to seek type-assert to io.Seeker; the assertion is an honest capability check rather than a guess. Seekable implementations (ReaderFile wrapping a seekable reader, Symlink, UnixFS files returned from the gateway and importer) still satisfy the assertion. Non-seekable implementations (HTTP multipart streams, WebFile) now fail the assertion at compile-aware sites instead of producing runtime errors deep in third-party code. The previous behavior forced downstream workarounds: e.g. ipfs/kubo#11253 had to wrap files.File in a plain io.Reader/io.Closer to strip Seek and force go-car's forward-only fallback, because go-car's NewBlockReader trusted the interface and called Seek, which failed with "operation not supported" on CARv2 imports over the HTTP API. With this change the trap stops existing.

  Action required. Replace direct Seek calls on files.File with a type assertion:

  // before
  n, err := f.Seek(offset, io.SeekStart)
  
  // after
  seeker, ok := f.(io.Seeker)
  if !ok {
      return fmt.Errorf("file does not support seeking")
  }
  n, err := seeker.Seek(offset, io.SeekStart)

  See ipfs/kubo#11254 for a worked example of the call-site update. #1128

• ✨ routing/http/server: the Delegated Routing server now passes limit=0 (unbounded) to DelegatedRouter.FindProviders/FindPeers and applies the configured records limit itself, after filtering. Filtered requests now return a full page of results instead of fewer than requested. The server reads the delegate's iterator lazily and closes it once it has enough records. Action required: delegate implementations should return results lazily and stop work on Close. A delegate that previously used the limit argument to end its walk early should now end the walk on Close instead. #1157

• path/resolver: ResolveToLastNode, ResolvePath, and ResolvePathComponents now populate retrieval.State on the request context when one is attached. They advance the state to PhasePathResolution, record the root CID from the input path, and record the terminal CID once resolution completes. Until now only the gateway backends populated these fields, leaving non-gateway callers (CLIs, custom tools) without phase or CID diagnostics on retrieval errors. The new calls are idempotent with the existing gateway-side ones, so behavior on the gateway path is unchanged.

Fixed

• files: now builds under GOOS=js GOARCH=wasm and GOOS=wasip1 GOARCH=wasm. #935
• routing/http/server: filtered /routing/v1/providers and /routing/v1/peers requests now return up to the configured records limit. Previously the limit was applied before filter-addrs/filter-protocols ran, so records dropped by the filters shrank the response below the limit. The limit now applies after filtering. #1157
• routing/http/types/iter: Filter.Next now iterates instead of recursing on rejected values, so the goroutine stack stays flat even when a long run of records is filtered out. This matters now that the server pulls unbounded results from the delegate. #1157

Full Changelog: v0.39.0...v0.40.0

What's Changed

Added

• gateway: Config.MaxDeserializedResponseSize allows setting a maximum file/directory size for deserialized gateway responses. Content exceeding this limit returns 410 Gone, directing users to run their own IPFS node. Trustless response formats (application/vnd.ipld.raw, application/vnd.ipld.car) are not affected. The size is read from the UnixFS root block, so no extra block fetches are needed for the check. #1138
• gateway: Config.MaxUnixFSDAGResponseSize allows setting a maximum content size applied to all response formats (deserialized, raw blocks, CAR, TAR). Content exceeding this limit returns 410 Gone. For most handlers the check reuses size information already available in the request path; for CAR responses a lightweight Head call is made only when the limit is configured. #1138

Changed

• bitswap/server: the default peer comparator now schedules peers fairly. A peer that has never been served, or has waited longer than 10s, outranks non-starved peers. Pending counts cap at 16 for ordering purposes, so peers with small wantlists no longer wait behind peers with large ones. The final tiebreak uses a per-process salted hash of peer.ID, so no peer can craft an ID that permanently outranks everyone. Engines built with WithTaskComparator keep their existing behavior. #1141
• upgrade to go-libp2p-kad-dht v0.39.1

Fixed

• bitswap/network/bsnet: SendMessage and handleNewStream now close streams in a background goroutine. Previously, stream.Close could hold the caller for up to DefaultNegotiationTimeout (10s) while lazyClientConn.Close waited for the remote peer to complete the multistream handshake. This saturated the bitswap TaskWorkerCount pool when peers were unresponsive and stopped bitswap from serving blocks to other peers. As a side effect, SendMessage no longer returns errors from stream.Close; close failures are logged at Debug. #1142
• bitswap/server: a peer with a single pending want no longer waits behind peers with large wantlists. #1141
• pinner/dspinner: RecursiveKeys and DirectKeys now snapshot the pin index under the read lock and release it before emitting pins, so a slow consumer (e.g. the reprovider draining the channel at DHT speed under Provide.Strategy=pinned*) can no longer starve Pin/Unpin/Flush writers. #1140

Full Changelog: v0.38.0...v0.39.0

What's Changed

Added

• ipns: NewRecord accepts WithMetadata(map[string]any) option for storing custom scalar key-value pairs (string, []byte, int64, int, bool) in the signed DAG-CBOR data of IPNS records. Metadata can be read back via Record.Metadata (returns typed MetadataValue with Kind() discriminator) and iterated with Record.MetadataEntries. Reserved IPNS field names, empty keys, and unsupported value types are rejected. #1085
• dag/walker: new package for memory-efficient DAG traversal with deduplication. VisitedTracker interface with BloomTracker (scalable bloom filter chain, ~4 bytes/CID vs ~75 bytes for a map) and MapTracker (exact, for tests). WalkDAG provides iterative DFS traversal with integrated dedup, supporting dag-pb, dag-cbor, raw, and other registered codecs. ~2x faster than the legacy go-ipld-prime selector-based traversal. WalkEntityRoots emits only entity roots (files, directories, HAMT shards) instead of every block, skipping internal file chunks. #1124
• pinner: NewUniquePinnedProvider and NewPinnedEntityRootsProvider log and skip corrupted pin entries instead of aborting the provide cycle, allowing remaining pins to still be provided. #1124
• routing/http/client: WithProviderInfoFunc option resolves provider addresses at provide-time instead of client construction time. This only impacts legacy HTTP-only custom routing setups that depend on IPIP-526 and were sending unresolved 0.0.0.0 addresses in provider records instead of actual interface addresses. #1115
• chunker: added Register function to allow custom chunkers to be registered for use with FromString.
• mfs: added Directory.Mode() and Directory.ModTime() getters to match the existing File.Mode() and File.ModTime() API. #1131

Changed

• provider: NewPrioritizedProvider now continues to the next stream when one fails instead of stopping all streams. NewConcatProvider added for pre-deduplicated streams. #1124
• chunker: FromString now rejects malformed size- strings with extra parameters (e.g. size-123-extra was previously silently accepted).
• gateway: compliance with gateway-conformance v0.13
• upgrade to go-libp2p v0.48.0
• 🛠 mfs: replaced RootOption with a unified Option functional options pattern (e.g. WithCidBuilder, WithChunker, WithMaxLinks). NewRoot, NewEmptyRoot, MkdirWithOpts, and NewEmptyDirectory now accept ...Option. Mkdir takes a MkdirOpts struct (narrowed to Mkparents and Flush flags) followed by ...Option for directory configuration. #1125

Removed

• gateway: removed dead DoH resolver for .crypto TLD (Unstoppable Domains) #772
• cmd/boxo-migrate: removed code for go-ipfs migration -- no longer needed.
• cmd/deprecator: removed code to deprecare relocated ipfs packages -- no longer needed.

Fixed

• bitswap/server: incoming identity CIDs in wantlist messages are now silently ignored instead of killing the connection to the remote peer. Some IPFS implementations naively send identity CIDs, and disconnecting them for it caused unnecessary churn. #1117
• bitswap/network: ExtractHTTPAddress now infers default ports for portless HTTP multiaddrs (e.g. /dns/host/https without /tcp/443). #1123
• mfs: FileDescriptor operations are serialized with a mutex, preventing data races on the underlying DagModifier when FUSE mounts or Kubo RPC commands dispatch concurrent Read, Write, Seek, Truncate, Flush, or Close calls. Flush after Close returns ErrClosed. #1131 #1133
• mfs: preserve CidBuilder and SizeEstimationMode across setNodeData(), Mkdir() and NewRoot(). #1125
• mfs: closing a file descriptor after its directory entry was removed (e.g. FUSE RELEASE racing with RENAME) no longer re-adds the stale entry to the parent directory. #1134
• mfs: SetMode and SetModTime no longer drop file content links when updating UnixFS metadata. #1134

Full Changelog: v0.37.0...v0.38.0

What's Changed

Added

• ipld/unixfs/io: added SizeEstimationMode for configurable HAMT sharding threshold decisions. Supports legacy link-based estimation (SizeEstimationLinks), accurate block-based estimation (SizeEstimationBlock), or disabling size-based thresholds (SizeEstimationDisabled). #1088, IPIP-499
• ipld/unixfs/io: added UnixFSProfile with UnixFS_v0_2015 and UnixFS_v1_2025 presets for CID-deterministic file and directory DAG construction. #1088, IPIP-499
• files: NewSerialFileWithOptions now supports controlling whether symlinks are preserved or dereferenced before being added to IPFS. See SerialFileOptions.DereferenceSymlinks. #1088, IPIP-499

Changed

• 🛠 chunker, ipld/unixfs/importer/helpers: block size limits raised from 1MiB to 2MiB to match the bitswap spec. Max chunker size is 2MiB - 256 bytes to leave room for protobuf framing when --raw-leaves=false. IPIP-499 profiles use lower chunk sizes (256KiB and 1MiB) and are not affected.
• 🛠 chunker: DefaultBlockSize changed from const to var to allow runtime configuration via global profiles. #1088, IPIP-499
• gateway: 🛠 ✨ IPIP-523 ?format= URL query parameter now takes precedence over Accept HTTP header, ensuring deterministic HTTP cache behavior and allowing browsers to use ?format= even when they send Accept headers with specific content types. #1074
• gateway: 🛠 ✨ IPIP-524 codec conversions (e.g., dag-pb to dag-json, dag-json to dag-cbor) are no longer performed by default. Requesting a format that differs from the block's codec now returns HTTP 406 Not Acceptable with a hint to fetch raw blocks (?format=raw) and convert client-side. Set Config.AllowCodecConversion to true to restore the old behavior. #1077
• gateway: compliance with gateway-conformance v0.10.0 (since v0.8: relaxed DAG-CBOR HTML preview cache headers, relaxed CAR 200/404 for missing paths, IPIP-523 format query precedence, IPIP-524 codec mismatch returns 406)
• upgrade to go-ipld-prime v0.22.0
• upgrade to go-libp2p-kad-dht v0.38.0

Removed

• tracing: opentelemetry zipkin exporter (go.opentelemetry.io/otel/exporters/zipkin) is deprecated and has been removed. It is recommended to switch to OTLP. Configure your application to send traces using OTLP and enable Zipkin’s OTLP ingestion support.

Fixed

• 🛠 ipld/unixfs/io: fixed HAMT sharding threshold comparison to use > instead of >=. A directory exactly at the threshold now stays as a basic (flat) directory, aligning behavior with code documentation and the JS implementation. This is a theoretical breaking change, but unlikely to impact real-world users as it requires a directory to be exactly at the threshold boundary. If you depend on the old behavior, adjust HAMTShardingSize to be 1 byte lower. #1088, IPIP-499
• ipld/unixfs/mod: fixed sparse file writes in MFS. Writing past the end of a file (e.g., ipfs files write --offset 1000 /file on a smaller file) would lose data because expandSparse created the zero-padding node but didn't update the internal pointer. Subsequent writes went to the old unexpanded node.
• ipld/unixfs/io: fixed mode/mtime metadata loss during Basic<->HAMT directory conversions. Previously, directories with WithStat(mode, mtime) would lose this metadata when converting between basic and sharded formats, or when reloading a HAMT directory from disk.

Full Changelog: v0.36.0...v0.37.0

What's Changed

Added

• routing/http: GET /routing/v1/dht/closest/peers/{key} per IPIP-476
• ipld/merkledag: Added fetched node size reporting to the progress tracker. See kubo#8915
• gateway: Added a configurable fallback timeout for the gateway handler, defaulting to 1 hour. Configurable via MaxRequestDuration in the gateway config.

Changed

• keystore: improve error messages and include key file name #1080
• upgrade to go-libp2p-kad-dht v0.37.1
• upgrade to go-libp2p v0.47.0

Fixed

• bitswap/network: Fixed goroutine leak that could cause bitswap to stop serving blocks after extended uptime. The root cause is stream.Close() blocking indefinitely when remote peers are unresponsive during multistream handshake (go-libp2p#3448). This PR (#1083) adds a localized fix specific to bitswap's SendMessage by setting a read deadline before closing streams.

Full Changelog: v0.35.2...v0.36.0

What's Changed

• upgrade to go-libp2p v0.45.0
• upgrade to go-log/v2 v2.9.0
  • Applications using go-log (>=2.9)+go-libp2p(>=0.45) may need to initialize their application to bridge slog-based libraries to into go-log. See documentation for go-log release and slog integration.

Full Changelog: v0.35.1...v0.35.2

What's Changed

Added

• new span for the handleIncoming bitswap client getter plus events when blocks are received.
• mark opentelemetry spans, span attributes, and span events as being used by ProbeLab's analysis scripts

Changed

• upgrade to go-dsqueue v0.1.0 - Fixes batch reuse that could cause panic.

Fixed

• gateway: Fixed duplicate peer IDs appearing in retrieval timeout error messages
• bitswap/client: fix tracing by using context to pass trace and retrieval state to session #1059
  • bitswap/client: propagate trace state when calling GetBlocks #1060
• bitswap/network/httpnet: improved error detection on HTTP and block fetches:
  • Do not attempt to GET a test CID if the endpoint returns 429 to the test HEAD request.
  • Unify error parsing and handling of http statues and content.

Full Changelog: v0.35.0...v0.35.1