fix(windows): revert update to Go 1.26 (#11215)

* Revert "feat: update to Go 1.26 (#11189)"

This reverts commit 36c29c55f0.

* chore: go mod tidy

* fix: keep go 1.25-compatible modernizations, add v0.40.1 changelog

- config/autoconf.go: restore math/rand/v2 (available since go 1.22)
- core/corehttp/p2p_proxy.go: restore httputil.ReverseProxy.Rewrite (available since go 1.21)
- core/commands/name/name.go: restore %d format for ValidityType int64
- docs/changelogs/v0.40.md: keep shipped v0.40.0 notes intact, add v0.40.1 section

---------

Co-authored-by: Marcin Rataj <lidel@lidel.org>
(cherry picked from commit 550d3b6077)

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 # Enables BuildKit with cache mounts for faster builds
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.26 AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.25 AS builder
 
 ARG TARGETOS TARGETARCH
 

docs/changelogs/v0.40.md

@@ -5,6 +5,7 @@
 This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
 
 - [v0.40.0](#v0400)
+- [v0.40.1](#v0401)
 
 ## v0.40.0
 
@@ -341,6 +342,8 @@ This release is built with [Go 1.26](https://go.dev/doc/go1.26).
 
 You should see lower memory usage and reduced GC pauses thanks to the new Green Tea garbage collector (10-40% less GC overhead). Reading block data and API responses is faster due to `io.ReadAll` improvements (~2x faster, ~50% less memory). On 64-bit platforms, heap base address randomization adds a layer of security hardening.
 
+> **Note:** [v0.40.1](#v0401) downgrades to Go 1.25 due to a Windows stability issue. If you run Kubo on Linux or macOS, staying on v0.40.0 is fine and you benefit from Go 1.26's GC improvements.
+
 #### 📦️ Dependency updates
 
 - update `go-libp2p` to [v0.47.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.47.0) (incl. [v0.46.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.46.0))
@@ -620,3 +623,22 @@ You should see lower memory usage and reduced GC pauses thanks to the new Green
 | [@willscott](https://github.com/willscott) | 1 | +1/-1 | 1 |
 | [@lbarrettanderson](https://github.com/lbarrettanderson) | 1 | +1/-1 | 1 |
 | [@filipremb](https://github.com/filipremb) | 1 | +1/-1 | 1 |
+
+## v0.40.1
+
+### 🔦 Highlights
+
+#### Windows stability fix
+
+If you run Kubo on Windows, v0.40.0 can crash after running for a while. The daemon starts fine and works normally at first, but eventually hits a memory corruption in Go's network I/O layer and dies. This is likely caused by an upstream Go 1.26 regression in overlapped I/O handling that has known issues ([go#77142](https://github.com/golang/go/issues/77142), [#11214](https://github.com/ipfs/kubo/issues/11214)).
+
+This patch release downgrades the Go toolchain from 1.26 to 1.25, which does not have this bug. If you are running Kubo on Windows, upgrade to v0.40.1. We will switch back to Go 1.26.x once the upstream fix lands.
+
+### 📝 Changelog
+
+<details><summary>Full Changelog v0.40.1</summary>
+
+- github.com/ipfs/kubo:
+  - chore: downgrade to Go 1.25 to fix Windows crash ([ipfs/kubo#11215](https://github.com/ipfs/kubo/pull/11215))
+
+</details>

docs/examples/kubo-as-a-library/go.mod

@@ -1,6 +1,6 @@
 module github.com/ipfs/kubo/examples/kubo-as-a-library
 
-go 1.26
+go 1.25.0
 
 // Used to keep this in sync with the current version of kubo. You should remove
 // this if you copy this example.

go.mod

@@ -1,6 +1,6 @@
 module github.com/ipfs/kubo
 
-go 1.26
+go 1.25.0
 
 require (
 	bazil.org/fuse v0.0.0-20200117225306-7b5117fecadc

test/dependencies/go.mod

@@ -1,6 +1,6 @@
 module github.com/ipfs/kubo/test/dependencies
 
-go 1.26
+go 1.25.0
 
 replace github.com/ipfs/kubo => ../../