docs: go-libp2p v0.49.0 + boxo v0.42.1

docs/changelogs/v0.43.md

@@ -19,8 +19,10 @@ This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
   - [🔑 `ipfs config replace` keeps PeerID and private key in sync](#-ipfs-config-replace-keeps-peerid-and-private-key-in-sync)
   - [🔐 secp256k1 key generation, export, and import](#-secp256k1-key-generation-export-and-import)
   - [🔄 Sturdier DHT reprovides on large nodes](#-sturdier-dht-reprovides-on-large-nodes)
-  - [📡 Future-proofing `webrtc-direct` with v2 support](#-future-proofing-webrtc-direct-with-v2-support)
+  - [📡 Future-proofing browser retrieval: `webrtc-direct` v2](#-future-proofing-browser-retrieval-webrtc-direct-v2)
+  - [🌐 Future-proofing browser retrieval: WebTransport draft-15](#-future-proofing-browser-retrieval-webtransport-draft-15)
   - [🗺️ Fewer stale addresses in the peerstore](#-fewer-stale-addresses-in-the-peerstore)
+  - [🕳️ Behind NAT: faster relay recovery, dependable shutdown](#-behind-nat-faster-relay-recovery-dependable-shutdown)
   - [📊 Telemetry is now opt-in](#-telemetry-is-now-opt-in)
   - [🚮 `ipfs init` no longer creates an IPNS record](#-ipfs-init-no-longer-creates-an-ipns-record)
   - [📛 Unified IPNS record storage](#-unified-ipns-record-storage)
@@ -115,11 +117,27 @@ ed25519 and secp256k1 keys are always 256 bits, so `--size` (`--bits` for `ipfs
 
 [go-libp2p-kad-dht v0.41.0](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.41.0) lowers peak memory during reprovides on nodes that announce many CIDs, so low-memory consumer devices are less likely to be out-of-memory killed. More in [kad-dht#1259](https://github.com/libp2p/go-libp2p-kad-dht/pull/1259).
 
-#### 📡 Future-proofing `webrtc-direct` with v2 support
+#### 📡 Future-proofing browser retrieval: `webrtc-direct` v2
 
-Kubo listens on `/webrtc-direct` by default, the transport that lets a browser dial your node with no signalling server and no CA-issued certificate. Google Chrome [plans](https://issues.webrtc.org/issues/411871813) to remove the browser behavior that transport's original handshake relies on. Kubo now also accepts the replacement [(v2) handshake](https://github.com/libp2p/specs/pull/715), so your node is ready before that change reaches browsers. Nothing to do today, and old clients keep working. More in [go-libp2p#3520](https://github.com/libp2p/go-libp2p/pull/3520), and [libp2p/specs#672](https://github.com/libp2p/specs/issues/672#issuecomment-4297060067) tracks progress across the other libp2p implementations.
+`/webrtc-direct` and `/quic-v1/webtransport`, both on by default, are the two transports that let a web browser fetch content straight from your node: no gateway in the middle, no signalling server, no CA-issued certificate. Browsers are moving underneath both. Chrome and Firefox have breaking changes in flight, and Safari requires a setting servers were not sending. The [go-libp2p v0.49.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.49.0) in this release keeps your node ready for browsers on both sides of those changes, with nothing to configure.
 
-One more `webrtc-direct` fix ships in the same bump: your node's `/certhash` address now survives a restart. It used to change on every start, so every cached copy of your address, in other peers' address books and in DHT records, went stale. More in [go-libp2p#3512](https://github.com/libp2p/go-libp2p/pull/3512).
+For `webrtc-direct`, Chrome has [already merged](https://webrtc-review.googlesource.com/c/src/+/385721) the removal of the SDP-rewriting behavior the original (v1) handshake relies on, gated for now behind the `WebRTC-NoSdpMangleUfrag` field trial. Once that reaches stable, Chrome can no longer dial a v1-only server. Kubo now also accepts the replacement [(v2) handshake](https://github.com/libp2p/specs/pull/715) on the same port, so your node is ready before browsers switch, and old clients keep working. More in [go-libp2p#3520](https://github.com/libp2p/go-libp2p/pull/3520), and [libp2p/specs#672](https://github.com/libp2p/specs/issues/672#issuecomment-4297060067) tracks progress across the other libp2p implementations.
+
+Two more `webrtc-direct` fixes ship in the same bump:
+
+- Your node's `/certhash` address now survives restarts. It used to change on every start (the certificate behind it was minted at random each time), so every cached copy of your address in other peers' address books and in DHT records kept going stale. The certificate is now derived from your node's identity key: the certhash changes one final time when you upgrade, then stays put for as long as you keep the same key. More in [go-libp2p#3512](https://github.com/libp2p/go-libp2p/pull/3512).
+- On a node AutoNAT had confirmed publicly reachable, `/webrtc-direct` silently went missing from the confirmed-address list, a side effect of sharing UDP port 4001 with `/quic-v1` in the default config. `ipfs swarm addrs autonat` did not report it. On nodes configured to publish provider records to a delegated HTTP router, the records went out without the `/webrtc-direct` address, so a browser that discovered your node that way could not dial it over this transport. Regular DHT announcements were unaffected. Fixed in [go-libp2p#3526](https://github.com/libp2p/go-libp2p/pull/3526), and confirmed addresses also stop periodically flapping back to `unknown` ([go-libp2p#3528](https://github.com/libp2p/go-libp2p/pull/3528)).
+
+#### 🌐 Future-proofing browser retrieval: WebTransport draft-15
+
+WebTransport is the other transport a browser can use to dial your node directly. It is still an IETF draft, and browsers implement different draft versions. The `/quic-v1/webtransport` listener now answers them all:
+
+- [draft-15](https://www.ietf.org/archive/id/draft-ietf-webtrans-http3-15.html) renamed the two values that identify a WebTransport session on the wire. Every shipping browser still sends the old names, but Firefox is [already implementing](https://github.com/mozilla/neqo/pull/3646) the new ones, and a server that only knows the old pair would stop answering Firefox the day that ships. Your node now answers to both.
+- Safari (26.4 and later) does not complete the WebTransport handshake unless the server sends the `WT_MAX_SESSIONS` session limit from an [earlier draft](https://www.ietf.org/archive/id/draft-ietf-webtrans-http3-14.html). Your node now sends it, so Safari can open sessions it previously could not.
+
+Nothing to do today. More in [go-libp2p#3532](https://github.com/libp2p/go-libp2p/pull/3532). The same update closes a memory-exhaustion hole in the WebTransport server, covered in [Security fixes](#-security-fixes-update-recommended) below.
+
+One regression, and it is go-to-go only: when dialing out over WebTransport, Kubo now speaks only draft-15, so it can no longer dial peers running older go-libp2p over this transport. Those peers can still dial your node, and go-to-go connections prefer plain `/quic-v1` on the same UDP port anyway. WebTransport is there for browsers, and browsers are unaffected.
 
 #### 🗺️ Fewer stale addresses in the peerstore
 
@@ -130,6 +148,12 @@ Your node remembers addresses for peers it hears about, and dead ones pile up an
 
 The new [`Internal.NonPublicAddrPublishing`](https://github.com/ipfs/kubo/blob/master/docs/config.md#internalnonpublicaddrpublishing) flag controls whether your node publishes addresses the wider internet cannot reach, such as private, CGNAT, and loopback ranges. Set it to `false` to keep them out of the signed peer record and the DHT, or `true` to publish them, which is what a LAN-only node wants. Leave it unset to follow go-libp2p's defaults, which [are known to change](https://github.com/libp2p/go-libp2p/issues/3460).
 
+#### 🕳️ Behind NAT: faster relay recovery, dependable shutdown
+
+A node behind NAT depends on circuit relays to stay reachable and to hole punch direct connections. When such a node lost its relay (a relay restart, a dropped connection), it put that same known-good relay on a penalty list for up to an hour before trying it again, and could sit without a relayed address, invisible to inbound peers, for that long. Only failed attempts to reserve a slot count against a relay now, so your node reconnects to a lost relay right away. More in [go-libp2p#3482](https://github.com/libp2p/go-libp2p/pull/3482).
+
+Two rare shutdown races in the same machinery are fixed as well: hole punching discovering the node's first public address at the moment of shutdown could leave `ipfs daemon` hanging on exit until force-killed ([go-libp2p#3504](https://github.com/libp2p/go-libp2p/pull/3504)), and stopping the daemon mid-reachability-check could crash it ([go-libp2p#3528](https://github.com/libp2p/go-libp2p/pull/3528)).
+
 #### 📊 Telemetry is now opt-in
 
 The telemetry plugin is now opt-in and ships with no built-in endpoint: a node sends nothing until you set `Plugins.Plugins.telemetry.Config.Mode` to `on` and `Endpoint` to a collector you run, documented along with the payload schema in [telemetry.md](https://github.com/ipfs/kubo/blob/master/docs/telemetry.md).
@@ -169,22 +193,26 @@ Removing files through the selection toolbar left their pins behind. It now offe
 
 A CAR response that stopped partway through used to look exactly like a complete one, so a client could accept a short DAG as the whole thing. Such a response now ends with `[Gateway Error: CAR stream truncated, response is incomplete]`, which makes the trailing bytes invalid CAR: a reader stops with an error instead of trusting what it got. If you run a gateway behind a reverse proxy or a CDN, a short response now identifies itself instead of leaving you to guess which hop dropped it.
 
+The gateway also caps how deep a CAR response descends into a DAG at 1024 levels, far beyond anything UnixFS produces: traversal cost grows with depth, and the cap stops an adversarially nested DAG from eating memory. A response cut at the limit ends with the same marker ([boxo#1197](https://github.com/ipfs/boxo/pull/1197)).
+
 #### 🔒 Security fixes: update recommended
 
 This release closes several memory-exhaustion and crash issues, some of them already public. Update when you can.
 
 - **Pubsub memory exhaustion** ([CVE-2026-46679](https://github.com/advisories/GHSA-4f8r-922h-2vgv)): a remote peer could subscribe to an endless stream of unique topic names, disconnect, and leave your node holding every one of them, with memory growing each round until a restart. Kubo now frees a topic's state once the last peer leaves it and limits how much a peer can pack into a single control message. Only nodes that turn pubsub on are affected, through [`Pubsub.Enabled`](https://github.com/ipfs/kubo/blob/master/docs/config.md#pubsubenabled) or [`Ipns.UsePubsub`](https://github.com/ipfs/kubo/blob/master/docs/config.md#ipnsusepubsub); if you set either, update as soon as you can. The Go and Python libp2p ports track the same pattern in [go-libp2p-pubsub#705](https://github.com/libp2p/go-libp2p-pubsub/issues/705) and [py-libp2p#1349](https://github.com/libp2p/py-libp2p/issues/1349).
+- **WebTransport memory exhaustion** ([CVE-2026-57497](https://github.com/advisories/GHSA-g35j-m5xg-vh3q)): a peer could send a WebTransport message of a type your node did not recognise, and your node would hold the whole body in memory while skipping past it. A big enough message, or enough of them, exhausts memory. Affects any node listening on `/quic-v1/webtransport`, which is the default.
+- **HTTP/3 trailer decompression memory exhaustion** ([CVE-2026-40898](https://github.com/advisories/GHSA-vvgj-x9jq-8cj9)): quic-go limited the compressed size of incoming HTTP/3 trailers but not their decoded size, so a crafted message could expand to about fifty times its wire size in memory. Kubo runs quic-go's HTTP/3 server as part of the default WebTransport listener; the quic-go v0.60.0 in this release includes the fix.
 - **libp2p resource caps**: a hostile peer could flood your peerstore with unconnected addresses ([go-libp2p#3486](https://github.com/libp2p/go-libp2p/pull/3486)), plant more than 1,800 protocol entries through chunked identify messages ([go-libp2p#3501](https://github.com/libp2p/go-libp2p/pull/3501)), or attach an unbounded number of addresses to one `webrtc-direct` connection ([go-libp2p#3500](https://github.com/libp2p/go-libp2p/pull/3500)). Each is now bounded.
 - **Daemon crash on routing queries** ([go-libp2p#3490](https://github.com/libp2p/go-libp2p/pull/3490)): a data race could corrupt the results streamed by `ipfs routing findprovs`, `ipfs routing findpeer`, and `ipfs dht query`, taking the whole daemon down mid-response.
 - **Tracing exporter memory** ([CVE-2026-39882](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58)): a hostile or man-in-the-middle collector could exhaust memory through the OpenTelemetry OTLP HTTP exporter. Affects nodes that export traces over OTLP HTTP.
 
 #### 📦️ Dependency updates
 
 - update `ipfs-webui` to [v4.13.0](https://github.com/ipfs/ipfs-webui/releases/tag/v4.13.0)
-- update `go-libp2p` to [v0.49.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.49.0), includes a security fix for CVE-2026-57497: https://github.com/advisories/GHSA-g35j-m5xg-vh3q
+- update `go-libp2p` to [v0.49.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.49.0)
 - update `go-libp2p-pubsub` to [v0.17.0](https://github.com/libp2p/go-libp2p-pubsub/releases/tag/v0.17.0)
 - update `go-libp2p-kad-dht` to [v0.42.1](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.42.1) (incl. [v0.42.0](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.42.0), [v0.41.0](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.41.0) and the [local record validation fix](https://github.com/libp2p/go-libp2p-kad-dht/pull/1285)); see [Unified IPNS record storage](#-unified-ipns-record-storage) above
-- update `boxo` to [v0.42.1](https://github.com/ipfs/boxo/releases/tag/v0.42.1) (incl. [v0.42.0](https://github.com/ipfs/boxo/releases/tag/v0.42.0), [v0.41.0](https://github.com/ipfs/boxo/releases/tag/v0.41.0)); see [Revamped TTL and expiration handling for IPNS and DNSLink](#-revamped-ttl-and-expiration-handling-for-ipns-and-dnslink) and [Unified IPNS record storage](#-unified-ipns-record-storage) above, plus a bitswap fix so fetches from a just-reconnected peer no longer stall ([boxo#1164](https://github.com/ipfs/boxo/pull/1164)); also pulls in `go-doh-resolver` [v0.6.0](https://github.com/libp2p/go-doh-resolver/releases/tag/v0.6.0) and `go-multiaddr-dns` [v0.6.0](https://github.com/multiformats/go-multiaddr-dns/releases/tag/v0.6.0)
+- update `boxo` to [v0.42.1](https://github.com/ipfs/boxo/releases/tag/v0.42.1) (incl. [v0.42.0](https://github.com/ipfs/boxo/releases/tag/v0.42.0), [v0.41.0](https://github.com/ipfs/boxo/releases/tag/v0.41.0)); see [Revamped TTL and expiration handling for IPNS and DNSLink](#-revamped-ttl-and-expiration-handling-for-ipns-and-dnslink) and [Unified IPNS record storage](#-unified-ipns-record-storage) above, plus a bitswap fix so fetches from a just-reconnected peer no longer stall ([boxo#1164](https://github.com/ipfs/boxo/pull/1164)), a fix so HTTP providers on IPv6 addresses are dialed correctly ([boxo#1196](https://github.com/ipfs/boxo/pull/1196)), and shorter stale windows on cached `/routing/v1` responses so clients stop getting long-dead peer addresses ([boxo#1195](https://github.com/ipfs/boxo/pull/1195)); also pulls in `go-doh-resolver` [v0.6.0](https://github.com/libp2p/go-doh-resolver/releases/tag/v0.6.0) and `go-multiaddr-dns` [v0.6.0](https://github.com/multiformats/go-multiaddr-dns/releases/tag/v0.6.0)
 - update `p2p-forge/client` to [v0.10.0](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.10.0) (incl. [v0.9.1](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.9.1), [v0.9.0](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.9.0), [v0.8.1](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.8.1))
 - update `go-ds-pebble` to [v0.5.12](https://github.com/ipfs/go-ds-pebble/releases/tag/v0.5.12)
 - updates `github.com/cockroachdb/pebble` to [v2.1.6](https://github.com/cockroachdb/pebble/releases/tag/v2.1.6)

docs/examples/kubo-as-a-library/go.mod

@@ -151,7 +151,7 @@ require (
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
 	github.com/petar/GoLLRB v0.0.0-20210522233825-ae3b015fd3e9 // indirect
 	github.com/pion/datachannel v1.5.10 // indirect
-	github.com/pion/dtls/v3 v3.1.2 // indirect
+	github.com/pion/dtls/v3 v3.1.5 // indirect
 	github.com/pion/ice/v4 v4.0.10 // indirect
 	github.com/pion/interceptor v0.1.40 // indirect
 	github.com/pion/logging v0.2.4 // indirect
@@ -164,7 +164,7 @@ require (
 	github.com/pion/srtp/v3 v3.0.6 // indirect
 	github.com/pion/stun/v3 v3.1.1 // indirect
 	github.com/pion/transport/v3 v3.0.7 // indirect
-	github.com/pion/transport/v4 v4.0.1 // indirect
+	github.com/pion/transport/v4 v4.0.2 // indirect
 	github.com/pion/turn/v4 v4.0.2 // indirect
 	github.com/pion/webrtc/v4 v4.1.2 // indirect
 	github.com/pkg/errors v0.9.1 // indirect

docs/examples/kubo-as-a-library/go.sum

@@ -541,8 +541,8 @@ github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4
 github.com/pingcap/errors v0.11.4/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8=
 github.com/pion/datachannel v1.5.10 h1:ly0Q26K1i6ZkGf42W7D4hQYR90pZwzFOjTq5AuCKk4o=
 github.com/pion/datachannel v1.5.10/go.mod h1:p/jJfC9arb29W7WrxyKbepTU20CFgyx5oLo8Rs4Py/M=
-github.com/pion/dtls/v3 v3.1.2 h1:gqEdOUXLtCGW+afsBLO0LtDD8GnuBBjEy6HRtyofZTc=
-github.com/pion/dtls/v3 v3.1.2/go.mod h1:Hw/igcX4pdY69z1Hgv5x7wJFrUkdgHwAn/Q/uo7YHRo=
+github.com/pion/dtls/v3 v3.1.5 h1:9xJtVsHwMYeSjPp5Hh1FTis4DchnQWtnOa5o+6ygqfc=
+github.com/pion/dtls/v3 v3.1.5/go.mod h1:gz1K4jg6c+fq86oQMH4pilpCEOEPwmEr2jY+VcF/mkU=
 github.com/pion/ice/v4 v4.0.10 h1:P59w1iauC/wPk9PdY8Vjl4fOFL5B+USq1+xbDcN6gT4=
 github.com/pion/ice/v4 v4.0.10/go.mod h1:y3M18aPhIxLlcO/4dn9X8LzLLSma84cx6emMSu14FGw=
 github.com/pion/interceptor v0.1.40 h1:e0BjnPcGpr2CFQgKhrQisBU7V3GXK6wrfYrGYaU6Jq4=
@@ -567,8 +567,8 @@ github.com/pion/stun/v3 v3.1.1 h1:CkQxveJ4xGQjulGSROXbXq94TAWu8gIX2dT+ePhUkqw=
 github.com/pion/stun/v3 v3.1.1/go.mod h1:qC1DfmcCTQjl9PBaMa5wSn3x9IPmKxSdcCsxBcDBndM=
 github.com/pion/transport/v3 v3.0.7 h1:iRbMH05BzSNwhILHoBoAPxoB9xQgOaJk+591KC9P1o0=
 github.com/pion/transport/v3 v3.0.7/go.mod h1:YleKiTZ4vqNxVwh77Z0zytYi7rXHl7j6uPLGhhz9rwo=
-github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o=
-github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM=
+github.com/pion/transport/v4 v4.0.2 h1:ifYlPqNwsy6aKQ9y8yzxXlHae5431ZrH2avkD/Rn6Tk=
+github.com/pion/transport/v4 v4.0.2/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM=
 github.com/pion/turn/v4 v4.0.2 h1:ZqgQ3+MjP32ug30xAbD6Mn+/K4Sxi3SdNOTFf+7mpps=
 github.com/pion/turn/v4 v4.0.2/go.mod h1:pMMKP/ieNAG/fN5cZiN4SDuyKsXtNTr0ccN7IToA1zs=
 github.com/pion/webrtc/v4 v4.1.2 h1:mpuUo/EJ1zMNKGE79fAdYNFZBX790KE7kQQpLMjjR54=

go.mod

@@ -51,7 +51,7 @@ require (
 	github.com/jbenet/go-temp-err-catcher v0.1.0
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/libp2p/go-doh-resolver v0.6.0
-	github.com/libp2p/go-libp2p v0.49.0 // TODO: switch to a tagged release once one ships past v0.48.0
+	github.com/libp2p/go-libp2p v0.49.0
 	github.com/libp2p/go-libp2p-http v0.5.0
 	github.com/libp2p/go-libp2p-kad-dht v0.42.1
 	github.com/libp2p/go-libp2p-kbucket v0.9.0
@@ -197,7 +197,7 @@ require (
 	github.com/onsi/gomega v1.36.3 // indirect
 	github.com/petar/GoLLRB v0.0.0-20210522233825-ae3b015fd3e9 // indirect
 	github.com/pion/datachannel v1.5.10 // indirect
-	github.com/pion/dtls/v3 v3.1.2 // indirect
+	github.com/pion/dtls/v3 v3.1.5 // indirect
 	github.com/pion/ice/v4 v4.0.10 // indirect
 	github.com/pion/interceptor v0.1.40 // indirect
 	github.com/pion/logging v0.2.4 // indirect
@@ -210,7 +210,7 @@ require (
 	github.com/pion/srtp/v3 v3.0.6 // indirect
 	github.com/pion/stun/v3 v3.1.1 // indirect
 	github.com/pion/transport/v3 v3.0.7 // indirect
-	github.com/pion/transport/v4 v4.0.1 // indirect
+	github.com/pion/transport/v4 v4.0.2 // indirect
 	github.com/pion/turn/v4 v4.0.2 // indirect
 	github.com/pion/webrtc/v4 v4.1.2 // indirect
 	github.com/pkg/errors v0.9.1 // indirect