v0.14.0

Note

This bugfix release was brought to you by the Shipyard team.

Important

This is the last release with new features from the Shipyard team. Our IPFS work ends on September 30, 2026. Until then we will ship security and bug fix releases only if any are needed. After that date, no one at Shipyard maintains this repository. If you depend on these tests, read the announcement and send us your transition questions before the end of September

Added

• New TestGatewayIpfsUri* tests for the Ipfs-Uri response header introduced by IPIP-548, one request per failure class: canonical percent-encoded path segments (delimiters, platform-encoder gaps like !'()*~, 4-byte UTF-8), request-spelling independence over the existing dir-with-percent-encoded-filename.car (raw sub-delims, lowercase hex escapes), decode-once normalization (%2F, %2E, dot segments), nested-directory trailing slashes, query exclusion on alternate formats, redirects, and CIDv0 / legacy base58 peer ID authority normalization. Backed by the new dir-with-tricky-filenames.car and dir-with-tricky-nested-filenames.car fixtures, plus a hand-built dir-with-slash-in-filename.car proving that a dag-pb link with / in its name is not addressable by any content path (%2F always decodes to a separator); the full byte-level vectors live in the IPIP-0548 test fixtures table. TestDNSLinkGatewayUnixFSDirectoryListing also asserts the ipns:// value for DNSLink hosts, and TestDNSLinkGatewayIpfsUriAuthority checks that only dotted DNSLink names appear as ipns:// authorities.

Changed

• Updated github.com/ipfs/boxo to v0.42.2 and github.com/libp2p/go-libp2p to v0.49.0.
• BREAKING: IPIP-548 deprecates X-Ipfs-Path in favor of Ipfs-Uri. Existing X-Ipfs-Path expectations on deserialized responses (TestGatewayCache, TestGatewayCacheWithIPNS, TestNativeDag, TestGatewayJSONCborAndIPNS) now assert Ipfs-Uri instead, and TestCors expects Ipfs-Uri in Access-Control-Expose-Headers. On raw block responses (TestTrustlessRaw, TestGatewayBlock) the X-Ipfs-Path expectation was dropped without a replacement, because gateways MAY omit both headers with trustless response types (application/vnd.ipld.raw and application/vnd.ipld.car). The TestGatewayIpfsUri* tests also fail gateways that return X-Ipfs-Path for content paths containing bytes invalid in HTTP field values (outside HTAB, SP, and visible ASCII per RFC 9110 section 5.5): such gateways must omit the header, since the raw legacy value would be corrupted in transit. When the header is returned for an ASCII-safe path, its value must be the decoded legacy content path, unchanged.

Fixed

• Header().Has() checked only its last argument, so all but one value in each list were silently ignored. It now checks every value, which tightens TestCors: the full Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Expose-Headers lists are enforced. The kubo-specific X-Chunked-Output and X-Stream-Output entries, which no spec mandates, were removed from the Access-Control-Expose-Headers expectation instead of becoming newly enforced.