chore(deps): bump github.com/ipfs/boxo from 0.42.2 to 0.43.0

[dependabot]

Bumps github.com/ipfs/boxo from 0.42.2 to 0.43.0.

Release notes

Sourced from github.com/ipfs/boxo's releases.

v0.43.0

[!NOTE] This release was brought to you by the Shipyard team.

[!IMPORTANT] Shipyard's IPFS work ends on September 30, 2026. Until then we ship security and bug fix releases if any are absolutely needed and still possible. After that date, no one at Shipyard maintains Boxo. If you depend on Boxo, read the announcement and bring your transition questions to the community forum.

What's Changed

[!IMPORTANT] This is a bug fix release. It carries a minor version bump because the gateway no longer sends the deprecated X-Ipfs-Path header by default, replaced by Ipfs-Uri (IPIP-548). If you still need X-Ipfs-Path, set Config.DeprecatedXIpfsPath and call Headers.WithDeprecatedXIpfsPath before Headers.ApplyCors, and plan a migration to Ipfs-Uri.

Added

• ✨ ipld/unixfs: reads of both PBNode field orders are now covered by tests, and a documented low-level opt-in (UnixFSProfile.PBNodeFieldOrder, applied via merkledag.DefaultPBNodeFieldOrder) lets writers that need streaming-friendly blocks encode the Data field before Links per IPIP-550. Off by default and selected by no named profile: UnixFS_v0_2015 and UnixFS_v1_2025 pin the canonical links-first order explicitly, so defaults and existing CIDs are unchanged. Enabling data-first changes the CID of every dag-pb node that has both fields (directories, HAMT shards, multi-chunk file roots), is process-wide (ApplyGlobals affects every merkledag.ProtoNode encoded in the process, not only UnixFS nodes), and re-encodes links-first directories in the new order the next time they are opened through the directory API and stored again (for example MFS directories on their next access). #1212
• ✨ gateway: responses now include the Ipfs-Uri header with a canonical ipfs:// or ipns:// URI for the requested content path, and expose it via the default Access-Control-Expose-Headers. The header carries the content root in canonical form (base32 CIDv1 for /ipfs/, base36 CIDv1 for cryptographic /ipns/ names, lowercase FQDN for DNSLink) with percent-encoded path segments, so clients get a value that is safe in HTTP field context regardless of bytes in the underlying path. IPIP-548 #1209

Changed

• 🛠 gateway: the deprecated X-Ipfs-Path response header is no longer sent by default; its value cannot represent all UnixFS file names and it is superseded by Ipfs-Uri. Action required: consumers that read X-Ipfs-Path should migrate to Ipfs-Uri; to restore the legacy header meanwhile, set Config.DeprecatedXIpfsPath and call Headers.WithDeprecatedXIpfsPath before Headers.ApplyCors so it is listed in Access-Control-Expose-Headers again. Even with the flag set, the header is omitted for content paths with bytes that cannot appear in an HTTP field value (Section 5.5 of RFC 9110), such as raw non-ASCII UnixFS file names: gateway-conformance fails a gateway that sends such values, and only Ipfs-Uri carries those paths. IPIP-548 #1209
• gateway: conformance CI runs gateway-conformance v0.14.0, the first release with the IPIP-548 Ipfs-Uri tests. #1209
• updated Go in go.mod to 1.26.0
• upgrade to go-libp2p-kad-dht v0.42.2
• upgrade to go.opentelemetry.io v1.46.0

Fixed

• gateway: X-Ipfs-Path values no longer carry bytes that are invalid in an HTTP field value (Section 5.5 of RFC 9110). The header used to echo raw UnixFS file names, so non-ASCII paths arrived garbled or broke strict clients; when the header is enabled, it is now omitted for such paths, which only the percent-encoded Ipfs-Uri can carry. #1209
• bootstrap: the saved backup peer list is no longer dialed when no bootstrap peers are configured. #1213

Changelog

Sourced from github.com/ipfs/boxo's changelog.

[v0.43.0]

[!IMPORTANT] This is a bug fix release. It carries a minor version bump because the gateway no longer sends the deprecated X-Ipfs-Path header by default, replaced by Ipfs-Uri (IPIP-548). If you still need X-Ipfs-Path, set Config.DeprecatedXIpfsPath and call Headers.WithDeprecatedXIpfsPath before Headers.ApplyCors, and plan a migration to Ipfs-Uri.

Shipyard's IPFS work ends on September 30, 2026. Until then we ship security and bug fix releases if any are absolutely needed and still possible. After that date, no one at Shipyard maintains Boxo. If you depend on Boxo, read the announcement and bring your transition questions to the community forum.

Added

• ✨ ipld/unixfs: reads of both PBNode field orders are now covered by tests, and a documented low-level opt-in (UnixFSProfile.PBNodeFieldOrder, applied via merkledag.DefaultPBNodeFieldOrder) lets writers that need streaming-friendly blocks encode the Data field before Links per IPIP-550. Off by default and selected by no named profile: UnixFS_v0_2015 and UnixFS_v1_2025 pin the canonical links-first order explicitly, so defaults and existing CIDs are unchanged. Enabling data-first changes the CID of every dag-pb node that has both fields (directories, HAMT shards, multi-chunk file roots), is process-wide (ApplyGlobals affects every merkledag.ProtoNode encoded in the process, not only UnixFS nodes), and re-encodes links-first directories in the new order the next time they are opened through the directory API and stored again (for example MFS directories on their next access). #1212
• ✨ gateway: responses now include the Ipfs-Uri header with a canonical ipfs:// or ipns:// URI for the requested content path, and expose it via the default Access-Control-Expose-Headers. The header carries the content root in canonical form (base32 CIDv1 for /ipfs/, base36 CIDv1 for cryptographic /ipns/ names, lowercase FQDN for DNSLink) with percent-encoded path segments, so clients get a value that is safe in HTTP field context regardless of bytes in the underlying path. IPIP-548 #1209

Changed

• 🛠 gateway: the deprecated X-Ipfs-Path response header is no longer sent by default; its value cannot represent all UnixFS file names and it is superseded by Ipfs-Uri. Action required: consumers that read X-Ipfs-Path should migrate to Ipfs-Uri; to restore the legacy header meanwhile, set Config.DeprecatedXIpfsPath and call Headers.WithDeprecatedXIpfsPath before Headers.ApplyCors so it is listed in Access-Control-Expose-Headers again. Even with the flag set, the header is omitted for content paths with bytes that cannot appear in an HTTP field value (Section 5.5 of RFC 9110), such as raw non-ASCII UnixFS file names: gateway-conformance fails a gateway that sends such values, and only Ipfs-Uri carries those paths. IPIP-548 #1209
• gateway: conformance CI runs gateway-conformance v0.14.0, the first release with the IPIP-548 Ipfs-Uri tests. #1209
• updated Go in go.mod to 1.26.0
• upgrade to go-libp2p-kad-dht v0.42.2
• upgrade to go.opentelemetry.io v1.46.0

Fixed

• gateway: X-Ipfs-Path values no longer carry bytes that are invalid in an HTTP field value (Section 5.5 of RFC 9110). The header used to echo raw UnixFS file names, so non-ASCII paths arrived garbled or broke strict clients; when the header is enabled, it is now omitted for such paths, which only the percent-encoded Ipfs-Uri can carry. #1209
• bootstrap: the saved backup peer list is no longer dialed when no bootstrap peers are configured. #1213

Commits

• d133242 Merge pull request #1218 from ipfs/release-v0.43.0
• 0cb7e0d chore: bump version
• aa79bbc Release v0.43.0
• 9b1f99d upgrade opentelemetry to v1.44 (#1216)
• d1918f0 Merge pull request #1215 from ipfs/update-deps
• 821c268 chore: upgrade minor dependencies
• 8be80f7 Merge pull request #1214 from ipfs/go-libp2p-kad-dht-v0.42.2
• f7cb1c6 chore: upgrade go-libp2p-kad-dht to v0.42.2
• 81f7257 Merge pull request #1211 from ipfs/go-v1.26-and-go-fix
• af70ed1 additional modernized update
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)