Release 0.43

[lidel]

Note

Part of remaining Q3 maintenance commitment of key libraries and services the Shipyard team does for IPFS Foundation:

• Ongoing maintenance of key libraries and services — 2026-Q2 ipshipyard/roadmaps#50

Meta

• Release owner: @lidel
• Release reviewer/backup: @gammazero
• Expected RC1 date: Jun 23rd
• Expected RC1 date: Jul 29th?
• 🚢 Expected final release date: TBD
• Release PR: Release v0.43.0 #11402
• Accompanying PR for improving the release process: TBD
• Internal Staging tests by Shipyard: TBD
• Changelog: https://github.com/ipfs/kubo/blob/master/docs/changelogs/v0.43.md

Items In Scope

Required for v0.43.1

• docs: clearer datastore layouts and init errors #11449
• fix: daemon exit on RPC shutdown with --enable-gc #11447
• test(unixfs): lock in CID profile behavior (IPIP-550) #11439
• fix: Ipfs-Uri gateway header (IPIP-548) #11437
• chore: bump go-libp2p-kad-dht to v0.42.2 #11436 (with fix(records): batch provider datastore writes and GC deletes libp2p/go-libp2p-kad-dht#1293 (fix for Constant writes of DHT provider records to datastore/*.log #11432))
• boxo https://github.com/ipfs/boxo/releases/tag/v0.42.2 or later
• cherry pick any things from master + move them to changelog v0.43.1
• https://github.com/quic-go/quic-go/releases/tag/v0.62.0 (or 0.60.x backport)
• remove shipyard telemetry endpoint
• any opportunistic deps bumps

Required for RC2

• fix: harden CAR streaming and truncation #11409
• docs: go-libp2p v0.49.0 + boxo v0.42.1 #11410
• fix(http-routing): keep browser transports in provider records #11394
• test: fix flakes that force CI re-runs #11413
• chore: update p2p-forge to v0.10.1 #11414
• chore: restore default telemetry for now #11415

Required

• fix(gateway): renew cache freshness on 304 boxo#1188
• DNSLink TTL wiring with feat(namesys): propagate DNSLink TXT TTL boxo#1167 and:
  • feat: add LookupTXTWithTTL to Resolver multiformats/go-multiaddr-dns#75
  • feat: add LookupTXTWithTTL to expose TXT record TTL libp2p/go-doh-resolver#33
• feat(autotls): skip issuance when broker is down #11397
• feat(cli): accept native ipfs:// and ipns:// URIs #11375
• NPM >=v12 fix: fix: fetch binary on demand from github releases npm-kubo#83
• feat: make telemetry opt-in #11374
• cleanup redundant in-memory cidsets and allow passing alternatives
  • fix: cut reprovide peak memory with key count libp2p/go-libp2p-kad-dht#1259
  • feat(dag): injectable visited-set in dag traverse boxo#1168
  • fix: avoid redundant cidset in dag stat #11353
• chore(deps): bump go-libp2p-kad-dht to v0.41.0 #11377
• chore(deps): bump go-libp2p and go-libp2p-pubsub #11389
  • go-libp2p-pubsub with
    • Clean up empty topic state maps libp2p/go-libp2p-pubsub#708
  • libp2p with fixed /webrtc-direct feat(webrtc): support webrtc-direct v2 libp2p/go-libp2p#3520 (context: WebRTC-Direct: Chrome may be removing ICE credential munging libp2p/specs#672 (comment))
• boxo with
  • chore: improve reprovider with batch queue reads boxo#1173
• feat(ux): warn when behind CGNAT #11352 - warn when behind CGNAT
• fix: bound ipns caching and validate lifetimes #11349 - bound IPNS caching, validate lifetimes ⚠️ daemon now refuses to start when Ipns.RecordLifetime < Ipns.RepublishPeriod
• fix(daemon): return config errors instead of calling log.Fatal #11373 + fix: return error instead of log.Fatal in HolePunching #11365 - config errors instead of log.Fatal
• fix(config): protect and derive PeerID during JSON replace #11344 - config replace keeps PeerID and private key in sync
• fix(libp2p): quieter dead-listener check #11342 - quieter dead-listener check, adds Internal.DeadListenerCheck
• feat: derive AgentSuffix from build origin #11341 - derive AgentSuffix from build origin
• fix: correct test for opt-in and opt-out messages #11383 - fix opt-in/opt-out message check (follow-up to feat: make telemetry opt-in #11374)
• pin boxo to tagged release
• chore: update webui to v4.13.0 #11396

Nice To Have (Optional)

• pin go-libp2p to tagged release (not a blocker)
• go-libp2p with
  • https://github.com/quic-go/quic-go/releases/tag/v0.60.0
• secp256k1 key support is missing pem-pkcs8-cleartext import/export #9912
• deps: drop gogo protobuf from libp2p stack #11384
• (tbd, needs triage first) webrtc-direct and AutoTLS /tls/ws missing from provider records announced to delegated HTTP routers on AutoNAT-confirmed-public nodes #11369
• feat: add experimental on-demand pinning #11252
• Unified Provide Interface for Content Routers #10097 ?
• denylist: ?format=car does not skip directly blocked CIDs #10361
• MFS bug: ipfs files rm hanging #10842
• fix(cli): deduplicate dag stat blocks by multihash #11098
• Support consuming https://badbits.dwebops.pub/badbits.deny rainbow#126 (same applies to Kubo)
  • fix(gateway): prevent blocked CIDs in CAR responses #10948
    • ipfs blockservice is incompatible with sessions ipfs-shipyard/nopfs#34 (re-triage once kubo#10948 is done)
  • HTTPSubscriber: check with If-None-Match or If-Modified-Since ipfs-shipyard/nopfs#38
  • HTTPSubscriber: detect when list is not append-only ipfs-shipyard/nopfs#39
• feat(client/rpc): add provide stat and dag import support #11069 / feat(client/rpc): auto-generate RPC GO client #11210
• TBD

[lidel]

✅ Release Checklist (v0.43.0-rc1)

Release types: RC (Release Candidate)

1. Prepare Release Branch

• Fetch latest changes: git fetch origin master release
• Create branch release-vX.Y.Z (base from: master if Z=0 for new minor/major, release if Z>0 for patch)
• RC1 only: Switch to master branch and prepare for next release cycle:
  • Update version.go to vX.Y+1.0-dev (⚠️ double-check Y+1 is correct) (example PR)
  • Create ./docs/changelogs/vX.Y+1.md and add link in CHANGELOG.md
• Switch to release-vX.Y.Z branch and update version.go to vX.Y.Z(-rcN) (⚠️ double-check Y matches release) (example)
• Create draft PR: release-vX.Y.Z → release (example)
• Cherry-pick commits from master into release-vX.Y.Z: git cherry-pick -x <commit> (example)
  • ⚠️ NOTE: -x flag records original commit SHA for traceability and cleaner merge history
• Verify all CI checks on the PR are passing
• FINAL only: Replace Changelog and Contributors sections in release-vX.Y.Z with ./bin/mkreleaselog stdout (do NOT copy stderr)
• FINAL only: Merge PR (release-vX.Y.Z → release) using Create a merge commit
  • ⚠️ do NOT use Squash and merge nor Rebase and merge; we want the releaser's GPG signature on the merge commit
  • ⚠️ do NOT delete the release-vX.Y.Z branch (needed for future patch releases and git history)

2. Tag & Publish

Create Tag

⚠️ POINT OF NO RETURN: once pushed, tags trigger automatic Docker/NPM publishing that cannot be undone!
If you're making a release for the first time, do pair programming and have the release reviewer verify all commands.

• RC: From release-vX.Y.Z branch: git tag -s vX.Y.Z-rcN -m 'Prerelease X.Y.Z-rcN'
• FINAL: After PR merge, from release branch: git tag -s vX.Y.Z -m 'Release X.Y.Z'
• ⚠️ Verify tag is signed and correct: git show vX.Y.Z(-rcN)
• Push tag: git push origin vX.Y.Z(-rcN)
  • ⚠️ do NOT use git push --tags (pushes every local tag, cluttering the repo)
• STOP: Wait for Docker build to complete before proceeding

Publish Artifacts

Parallelism: Docker and dist.ipfs.tech only depend on the pushed tag and can be started in parallel.
NPM and GitHub Release both depend on dist.ipfs.tech completing first.

• Docker: Verify docker-image CI passed and image is available on Docker Hub → tags
• dist.ipfs.tech: Publish to dist.ipfs.tech
  • Check out ipfs/distributions
  • Create branch: git checkout -b release-kubo-X.Y.Z(-rcN)
  • Verify .tool-versions golang matches Kubo's CI go-version: (update if needed)
  • Run: ./dist.sh add-version kubo vX.Y.Z(-rcN) (usage)
  • Create and merge PR (updates dists/kubo/versions, FINAL also updates dists/kubo/current - example)
  • Wait for CI workflow triggered by merge
  • Verify release on dist.ipfs.tech
• NPM: Publish to NPM
  • Manually dispatch Release to npm workflow if not auto-triggered
  • Verify release on NPM
• GitHub Release: Publish to GitHub
  • Create release (RC example, FINAL example)
  • Use tag vX.Y.Z(-rcN)
  • Link to release issue
  • RC: Link to changelog, check This is a pre-release
  • FINAL: Copy changelog content (without header), do NOT check pre-release
  • Run sync-release-assets workflow (requires dist.ipfs.tech)
  • Verify assets are attached to the GitHub release

3. Post-Release

Technical Tasks

• FINAL only: Merge release → master
  • Create branch merge-release-vX.Y.Z from release
  • Merge master to merge-release-vX.Y.Z first, and resolve conflict in version.go
    • ⚠️ NOTE: keep the -dev version from master in version.go, discard version from release
  • Create and merge PR from merge-release-vX.Y.Z to master using Create a merge commit
    • ⚠️ do NOT use Squash and merge nor Rebase and merge; only Create a merge commit preserves commit history and the audit trail of what was merged where
• Update ipshipyard/waterworks-infra
  • Update Kubo staging environment (Running Kubo tests on staging)
    • RC: Test last release against current RC
    • FINAL: Latest release on both boxes
  • FINAL: Update collab cluster boxes to the tagged release
  • FINAL: Update libp2p bootstrappers to the tagged release
• Update ipfs-desktop
  • Create PR updating kubo version in package.json and package-lock.json
  • Smoke test with IPFS Companion Browser Extension against the PR build
  • FINAL: Merge PR and ship new ipfs-desktop release
• FINAL only: Update docs.ipfs.tech: run update-on-new-ipfs-tag.yml workflow and merge the PR

Promotion

• Create IPFS Discourse topic (RC example, FINAL example)
  • Title: Kubo vX.Y.Z(-rcN) is out!, tag: kubo
  • Use title as heading (##) in description
  • Include: GitHub release link, IPNS binaries, docker pull command, release notes
  • Pin topic globally (make banner if no existing banner)
• Verify bot posted to #ipfs-chatter (Discord) or #ipfs-chatter:ipfs.io (Matrix)
• RC only: Comment on release issue mentioning early testers (example)
• FINAL only: Comment on release issue with link (example)
• FINAL only: Create blog.ipfs.tech entry (example)
• FINAL non-PATCH: (optional) Post on social media (bsky, x.com, Reddit)

Final Steps

• FINAL non-PATCH: Create dependency update PR
  • Review direct dependencies from root go.mod (⚠️ do NOT run go get -u as it will upgrade indirect dependencies which may cause problems)
  • Run make mod_tidy
  • Create PR with go.mod and go.sum updates
  • Add PR to next release milestone
• FINAL non-PATCH: Create next release issue (example)
• FINAL only: Close release issue

[lidel]

Early testers ping for v0.43.0-rc1 👋

• Charity Engine (@Rytiss, @tristanolive)
• Fission (@bmann)
• Infura (@MichaelMure)
• OrbitDB (@haydenyoung)
• Pinata (@obo20)
• Siderus (@koalalorenzo)
• Textile (@sanderpick)
• @RubenKelevra

v0.43.0-rc1 is out: https://github.com/ipfs/kubo/releases/tag/v0.43.0-rc1 (announcement: https://discuss.ipfs.tech/t/kubo-v0-43-0-rc1-is-out/20288). Please give it a spin and report anything you hit.

You're getting this message because you're listed here. Please update that list if you no longer want to be included.

[lidel]

✅ Release Checklist (v0.43.0-rc2)

Release types: RC (Release Candidate)

1. Prepare Release Branch

• Fetch latest changes: git fetch origin master release
• Create branch release-vX.Y.Z (base from: master if Z=0 for new minor/major, release if Z>0 for patch)
• RC1 only: Switch to master branch and prepare for next release cycle:
  • Update version.go to vX.Y+1.0-dev (⚠️ double-check Y+1 is correct) (example PR)
  • Create ./docs/changelogs/vX.Y+1.md and add link in CHANGELOG.md
• Switch to release-vX.Y.Z branch and update version.go to vX.Y.Z(-rcN) (⚠️ double-check Y matches release) (example)
• Create draft PR: release-vX.Y.Z → release (example)
• Cherry-pick commits from master into release-vX.Y.Z: git cherry-pick -x <commit> (example)
  • ⚠️ NOTE: -x flag records original commit SHA for traceability and cleaner merge history
• Verify all CI checks on the PR are passing
• FINAL only: Replace Changelog and Contributors sections in release-vX.Y.Z with ./bin/mkreleaselog stdout (do NOT copy stderr)
• FINAL only: Merge PR (release-vX.Y.Z → release) using Create a merge commit
  • ⚠️ do NOT use Squash and merge nor Rebase and merge; we want the releaser's GPG signature on the merge commit
  • ⚠️ do NOT delete the release-vX.Y.Z branch (needed for future patch releases and git history)

2. Tag & Publish

Create Tag

⚠️ POINT OF NO RETURN: once pushed, tags trigger automatic Docker/NPM publishing that cannot be undone!
If you're making a release for the first time, do pair programming and have the release reviewer verify all commands.

• RC: From release-vX.Y.Z branch: git tag -s vX.Y.Z-rcN -m 'Prerelease X.Y.Z-rcN'
• FINAL: After PR merge, from release branch: git tag -s vX.Y.Z -m 'Release X.Y.Z'
• ⚠️ Verify tag is signed and correct: git show vX.Y.Z(-rcN)
• Push tag: git push origin vX.Y.Z(-rcN)
  • ⚠️ do NOT use git push --tags (pushes every local tag, cluttering the repo)
• STOP: Wait for Docker build to complete before proceeding

Publish Artifacts

Parallelism: Docker and dist.ipfs.tech only depend on the pushed tag and can be started in parallel.
NPM and GitHub Release both depend on dist.ipfs.tech completing first.

• Docker: Verify docker-image CI passed and image is available on Docker Hub → tags
• dist.ipfs.tech: Publish to dist.ipfs.tech
  • Check out ipfs/distributions
  • Create branch: git checkout -b release-kubo-X.Y.Z(-rcN)
  • Verify .tool-versions golang matches Kubo's CI go-version: (update if needed)
  • Run: ./dist.sh add-version kubo vX.Y.Z(-rcN) (usage)
  • Create and merge PR (updates dists/kubo/versions, FINAL also updates dists/kubo/current - example)
  • Wait for CI workflow triggered by merge
  • Verify release on dist.ipfs.tech
• NPM: Publish to NPM
  • Manually dispatch Release to npm workflow if not auto-triggered
  • Verify release on NPM
• GitHub Release: Publish to GitHub
  • Create release (RC example, FINAL example)
  • Use tag vX.Y.Z(-rcN)
  • Link to release issue
  • RC: Link to changelog, check This is a pre-release
  • FINAL: Copy changelog content (without header), do NOT check pre-release
  • Run sync-release-assets workflow (requires dist.ipfs.tech)
  • Verify assets are attached to the GitHub release

3. Post-Release

Technical Tasks

• FINAL only: Merge release → master
  • Create branch merge-release-vX.Y.Z from release
  • Merge master to merge-release-vX.Y.Z first, and resolve conflict in version.go
    • ⚠️ NOTE: keep the -dev version from master in version.go, discard version from release
  • Create and merge PR from merge-release-vX.Y.Z to master using Create a merge commit
    • ⚠️ do NOT use Squash and merge nor Rebase and merge; only Create a merge commit preserves commit history and the audit trail of what was merged where
• Update ipshipyard/waterworks-infra
  • Update Kubo staging environment (Running Kubo tests on staging)
    • RC: Test last release against current RC
    • FINAL: Latest release on both boxes
  • FINAL: Update collab cluster boxes to the tagged release
  • FINAL: Update libp2p bootstrappers to the tagged release
• Update ipfs-desktop
  • Create PR updating kubo version in package.json and package-lock.json
  • Smoke test with IPFS Companion Browser Extension against the PR build
  • FINAL: Merge PR and ship new ipfs-desktop release
• FINAL only: Update docs.ipfs.tech: run update-on-new-ipfs-tag.yml workflow and merge the PR

Promotion

• Create IPFS Discourse topic (RC example, FINAL example)
  • Title: Kubo vX.Y.Z(-rcN) is out!, tag: kubo
  • Use title as heading (##) in description
  • Include: GitHub release link, IPNS binaries, docker pull command, release notes
  • Pin topic globally (make banner if no existing banner)
• Verify bot posted to #ipfs-chatter (Discord) or #ipfs-chatter:ipfs.io (Matrix)
• RC only: Comment on release issue mentioning early testers (example)
• FINAL only: Comment on release issue with link (example)
• FINAL only: Create blog.ipfs.tech entry (example)
• FINAL non-PATCH: (optional) Post on social media (bsky, x.com, Reddit)

Final Steps

• FINAL non-PATCH: Create dependency update PR
  • Review direct dependencies from root go.mod (⚠️ do NOT run go get -u as it will upgrade indirect dependencies which may cause problems)
  • Run make mod_tidy
  • Create PR with go.mod and go.sum updates
  • Add PR to next release milestone
• FINAL non-PATCH: Create next release issue (example)
• FINAL only: Close release issue

[lidel]

Early testers ping for v0.43.0-rc2 👋

• Charity Engine (@Rytiss, @tristanolive)
• Fission (@bmann)
• Infura (@MichaelMure)
• OrbitDB (@haydenyoung)
• Pinata (@obo20)
• Siderus (@koalalorenzo)
• @RubenKelevra

v0.43.0-rc2 is out: https://github.com/ipfs/kubo/releases/tag/v0.43.0-rc2 (announcement: https://discuss.ipfs.tech/t/kubo-v0-43-0-rc2-is-out/20288). Please give it a spin and report anything you hit.

You're getting this message because you're listed here. Please update that list if you no longer want to be included.

[sanderpick]

Hey guys, Textile is no longer... can you remove me from this list? Thanks!