From d4b446bab68f46710a10e71e2006754b451cb2e1 Mon Sep 17 00:00:00 2001
From: Marcin Rataj <lidel@lidel.org>
Date: Fri, 19 Sep 2025 20:23:09 +0200
Subject: [PATCH 01/16] chore: release v0.38.0-rc1

---
 version.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.go b/version.go
index 751e790cc..1bbcec88d 100644
--- a/version.go
+++ b/version.go
@@ -11,7 +11,7 @@ import (
 var CurrentCommit string
 
 // CurrentVersionNumber is the current application's version literal.
-const CurrentVersionNumber = "0.38.0-dev"
+const CurrentVersionNumber = "0.38.0-rc1"
 
 const ApiVersion = "/kubo/" + CurrentVersionNumber + "/" //nolint
 

From cb6121855275a6c20e5d7dc9eb80655692247dc0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 23 Sep 2025 14:20:20 -0700
Subject: [PATCH 02/16] chore(deps): bump hadolint/hadolint-action from 3.2.0
 to 3.3.0 (#10984)

Bumps [hadolint/hadolint-action](https://github.com/hadolint/hadolint-action) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/hadolint/hadolint-action/releases)
- [Changelog](https://github.com/hadolint/hadolint-action/blob/master/.releaserc)
- [Commits](https://github.com/hadolint/hadolint-action/compare/v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: hadolint/hadolint-action
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 46d438f685aecb3aeca0b485d144b49fc01df90c)
---
 .github/workflows/docker-check.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-check.yml b/.github/workflows/docker-check.yml
index 73ced9928..1af049f9c 100644
--- a/.github/workflows/docker-check.yml
+++ b/.github/workflows/docker-check.yml
@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v5
-      - uses: hadolint/hadolint-action@v3.2.0
+      - uses: hadolint/hadolint-action@v3.3.0
         with:
           dockerfile: Dockerfile
           failure-threshold: warning

From fa033036d3026142507b458de4fcb4df8d9b98fe Mon Sep 17 00:00:00 2001
From: Guillaume Michel <guillaumemichel@users.noreply.github.com>
Date: Thu, 25 Sep 2025 17:11:58 +0200
Subject: [PATCH 03/16] fix: SweepingProvider slow start  (#10980)

* fix: SweepingProvider slow start #10979

* don't purge keystore

* feat: add INFO logging for provider keystore sync

log start/completion of async keystore sync with strategy

---------

Co-authored-by: Marcin Rataj <lidel@lidel.org>
(cherry picked from commit 1e9b6fb27e43fb181d28801fe4f5121c688a2d31)
---
 core/node/provider.go | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/core/node/provider.go b/core/node/provider.go
index 80d026f44..8cc6d3dc7 100644
--- a/core/node/provider.go
+++ b/core/node/provider.go
@@ -428,9 +428,18 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 				// replace them with the keys that needs to be reprovided, coming from
 				// the KeyChanFunc. So far, this is the less worse way to remove CIDs
 				// that shouldn't be reprovided from the provider's state.
-				if err := syncKeyStore(ctx); err != nil {
-					return err
-				}
+				go func() {
+					// Sync the keystore once at startup. This operation is async since
+					// we need to walk the DAG of objects matching the provide strategy,
+					// which can take a while.
+					strategy := cfg.Provide.Strategy.WithDefault(config.DefaultProvideStrategy)
+					logger.Infow("provider keystore sync started", "strategy", strategy)
+					if err := syncKeyStore(ctx); err != nil {
+						logger.Errorw("provider keystore sync failed", "err", err, "strategy", strategy)
+					} else {
+						logger.Infow("provider keystore sync completed", "strategy", strategy)
+					}
+				}()
 
 				gcCtx, c := context.WithCancel(context.Background())
 				cancel = c
@@ -462,10 +471,10 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 				case <-ctx.Done():
 					return ctx.Err()
 				}
-				// KeyStore state isn't be persisted across restarts.
-				if err := in.KeyStore.Empty(ctx); err != nil {
-					return err
-				}
+
+				// Keystore data isn't purged, on close, but it will be overwritten
+				// when the node starts again.
+
 				return in.KeyStore.Close()
 			},
 		})

From a2519b57be7678276fdeb4dc4057027f4ddbe588 Mon Sep 17 00:00:00 2001
From: Marcin Rataj <lidel@lidel.org>
Date: Thu, 25 Sep 2025 23:54:04 +0200
Subject: [PATCH 04/16] feat: limit pin names to 255 bytes (#10981)

adds validation to ensure pin names don't exceed 255 bytes across all
commands that accept pin names. this prevents issues with filesystem
limitations and improves compatibility.

affected commands:
- ipfs pin add --name
- ipfs add --pin-name
- ipfs pin ls --name (filter)
- ipfs pin remote add --name
- ipfs pin remote ls --name (filter)
- ipfs pin remote rm --name (filter)

(cherry picked from commit 1107ac42af4a6214a58927d00def3451988cab04)
---
 core/commands/add.go                 |   8 ++
 core/commands/cmdutils/utils.go      |  16 +++
 core/commands/pin/pin.go             |  10 ++
 core/commands/pin/remotepin.go       |   9 ++
 docs/changelogs/v0.38.md             |   3 +-
 test/cli/pin_name_validation_test.go | 184 +++++++++++++++++++++++++++
 6 files changed, 229 insertions(+), 1 deletion(-)
 create mode 100644 test/cli/pin_name_validation_test.go

diff --git a/core/commands/add.go b/core/commands/add.go
index 40702921c..f314bbf64 100644
--- a/core/commands/add.go
+++ b/core/commands/add.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/ipfs/kubo/config"
 	"github.com/ipfs/kubo/core/commands/cmdenv"
+	"github.com/ipfs/kubo/core/commands/cmdutils"
 
 	"github.com/cheggaaa/pb"
 	"github.com/ipfs/boxo/files"
@@ -269,6 +270,13 @@ https://github.com/ipfs/kubo/blob/master/docs/config.md#import
 			return fmt.Errorf("inline-limit %d exceeds maximum allowed size of %d bytes", inlineLimit, verifcid.DefaultMaxIdentityDigestSize)
 		}
 
+		// Validate pin name
+		if pinNameSet {
+			if err := cmdutils.ValidatePinName(pinName); err != nil {
+				return err
+			}
+		}
+
 		toFilesStr, toFilesSet := req.Options[toFilesOptionName].(string)
 		preserveMode, _ := req.Options[preserveModeOptionName].(bool)
 		preserveMtime, _ := req.Options[preserveMtimeOptionName].(bool)
diff --git a/core/commands/cmdutils/utils.go b/core/commands/cmdutils/utils.go
index be295f9e3..9ecfd1446 100644
--- a/core/commands/cmdutils/utils.go
+++ b/core/commands/cmdutils/utils.go
@@ -13,6 +13,7 @@ import (
 const (
 	AllowBigBlockOptionName = "allow-big-block"
 	SoftBlockLimit          = 1024 * 1024 // https://github.com/ipfs/kubo/issues/7421#issuecomment-910833499
+	MaxPinNameBytes         = 255         // Maximum number of bytes allowed for a pin name
 )
 
 var AllowBigBlockOption cmds.Option
@@ -50,6 +51,21 @@ func CheckBlockSize(req *cmds.Request, size uint64) error {
 	return nil
 }
 
+// ValidatePinName validates that a pin name does not exceed the maximum allowed byte length.
+// Returns an error if the name exceeds MaxPinNameBytes (255 bytes).
+func ValidatePinName(name string) error {
+	if name == "" {
+		// Empty names are allowed
+		return nil
+	}
+
+	nameBytes := len([]byte(name))
+	if nameBytes > MaxPinNameBytes {
+		return fmt.Errorf("pin name is %d bytes (max %d bytes)", nameBytes, MaxPinNameBytes)
+	}
+	return nil
+}
+
 // PathOrCidPath returns a path.Path built from the argument. It keeps the old
 // behaviour by building a path from a CID string.
 func PathOrCidPath(str string) (path.Path, error) {
diff --git a/core/commands/pin/pin.go b/core/commands/pin/pin.go
index 86fafa539..0934489d2 100644
--- a/core/commands/pin/pin.go
+++ b/core/commands/pin/pin.go
@@ -100,6 +100,11 @@ It may take some time. Pass '--progress' to track the progress.
 		name, _ := req.Options[pinNameOptionName].(string)
 		showProgress, _ := req.Options[pinProgressOptionName].(bool)
 
+		// Validate pin name
+		if err := cmdutils.ValidatePinName(name); err != nil {
+			return err
+		}
+
 		if err := req.ParseBodyArgs(); err != nil {
 			return err
 		}
@@ -385,6 +390,11 @@ Example:
 		displayNames, _ := req.Options[pinNamesOptionName].(bool)
 		name, _ := req.Options[pinNameOptionName].(string)
 
+		// Validate name filter
+		if err := cmdutils.ValidatePinName(name); err != nil {
+			return err
+		}
+
 		mode, ok := pin.StringToMode(typeStr)
 		if !ok {
 			return fmt.Errorf("invalid type '%s', must be one of {direct, indirect, recursive, all}", typeStr)
diff --git a/core/commands/pin/remotepin.go b/core/commands/pin/remotepin.go
index 068d15d0b..3936ce635 100644
--- a/core/commands/pin/remotepin.go
+++ b/core/commands/pin/remotepin.go
@@ -171,6 +171,10 @@ NOTE: a comma-separated notation is supported in CLI for convenience:
 		opts := []pinclient.AddOption{}
 		if name, nameFound := req.Options[pinNameOptionName]; nameFound {
 			nameStr := name.(string)
+			// Validate pin name
+			if err := cmdutils.ValidatePinName(nameStr); err != nil {
+				return err
+			}
 			opts = append(opts, pinclient.PinOpts.WithName(nameStr))
 		}
 
@@ -321,6 +325,11 @@ func lsRemote(ctx context.Context, req *cmds.Request, c *pinclient.Client, out c
 	opts := []pinclient.LsOption{}
 	if name, nameFound := req.Options[pinNameOptionName]; nameFound {
 		nameStr := name.(string)
+		// Validate name filter
+		if err := cmdutils.ValidatePinName(nameStr); err != nil {
+			close(out)
+			return err
+		}
 		opts = append(opts, pinclient.PinOpts.FilterName(nameStr))
 	}
 
diff --git a/docs/changelogs/v0.38.md b/docs/changelogs/v0.38.md
index 045715e68..7f50eab9b 100644
--- a/docs/changelogs/v0.38.md
+++ b/docs/changelogs/v0.38.md
@@ -15,6 +15,7 @@ This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
   - [📊 Exposed DHT metrics](#-exposed-dht-metrics)
   - [🚨 Improved gateway error pages with diagnostic tools](#-improved-gateway-error-pages-with-diagnostic-tools)
   - [🎨 Updated WebUI](#-updated-webui)
+  - [📌 Pin name improvements](#-pin-name-improvements)
   - [🛠️ Identity CID size enforcement and `ipfs files write` fixes](#️-identity-cid-size-enforcement-and-ipfs-files-write-fixes)
 - [📦️ Important dependency updates](#-important-dependency-updates)
 - [📝 Changelog](#-changelog)
@@ -91,7 +92,7 @@ Additional improvements include a close button in the file viewer, better error
 
 #### 📌 Pin name improvements
 
-`ipfs pin ls <cid> --names` now correctly returns pin names for specific CIDs ([#10649](https://github.com/ipfs/kubo/issues/10649), [boxo#1035](https://github.com/ipfs/boxo/pull/1035)), and RPC no longer incorrectly returns names from other pins ([#10966](https://github.com/ipfs/kubo/pull/10966)).
+`ipfs pin ls <cid> --names` now correctly returns pin names for specific CIDs ([#10649](https://github.com/ipfs/kubo/issues/10649), [boxo#1035](https://github.com/ipfs/boxo/pull/1035)), RPC no longer incorrectly returns names from other pins ([#10966](https://github.com/ipfs/kubo/pull/10966)), and pin names are now limited to 255 bytes for better cross-platform compatibility ([#10981](https://github.com/ipfs/kubo/pull/10981)).
 
 #### 🛠️ Identity CID size enforcement and `ipfs files write` fixes
 
diff --git a/test/cli/pin_name_validation_test.go b/test/cli/pin_name_validation_test.go
new file mode 100644
index 000000000..049118642
--- /dev/null
+++ b/test/cli/pin_name_validation_test.go
@@ -0,0 +1,184 @@
+package cli
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/ipfs/kubo/test/cli/harness"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPinNameValidation(t *testing.T) {
+	t.Parallel()
+
+	// Create a test node and add a test file
+	node := harness.NewT(t).NewNode().Init().StartDaemon("--offline")
+	defer node.StopDaemon()
+
+	// Add a test file to get a CID
+	testContent := "test content for pin name validation"
+	testCID := node.IPFSAddStr(testContent, "--pin=false")
+
+	t.Run("pin add accepts valid names", func(t *testing.T) {
+		testCases := []struct {
+			name        string
+			pinName     string
+			description string
+		}{
+			{
+				name:        "empty_name",
+				pinName:     "",
+				description: "Empty name should be allowed",
+			},
+			{
+				name:        "short_name",
+				pinName:     "test",
+				description: "Short ASCII name should be allowed",
+			},
+			{
+				name:        "max_255_bytes",
+				pinName:     strings.Repeat("a", 255),
+				description: "Exactly 255 bytes should be allowed",
+			},
+			{
+				name:        "unicode_within_limit",
+				pinName:     "测试名称🔥", // Chinese characters and emoji
+				description: "Unicode characters within 255 bytes should be allowed",
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				var args []string
+				if tc.pinName != "" {
+					args = []string{"pin", "add", "--name", tc.pinName, testCID}
+				} else {
+					args = []string{"pin", "add", testCID}
+				}
+
+				res := node.RunIPFS(args...)
+				require.Equal(t, 0, res.ExitCode(), tc.description)
+
+				// Clean up - unpin
+				node.RunIPFS("pin", "rm", testCID)
+			})
+		}
+	})
+
+	t.Run("pin add rejects names exceeding 255 bytes", func(t *testing.T) {
+		testCases := []struct {
+			name        string
+			pinName     string
+			description string
+		}{
+			{
+				name:        "256_bytes",
+				pinName:     strings.Repeat("a", 256),
+				description: "256 bytes should be rejected",
+			},
+			{
+				name:        "300_bytes",
+				pinName:     strings.Repeat("b", 300),
+				description: "300 bytes should be rejected",
+			},
+			{
+				name:        "unicode_exceeding_limit",
+				pinName:     strings.Repeat("测", 100), // Each Chinese character is 3 bytes, total 300 bytes
+				description: "Unicode string exceeding 255 bytes should be rejected",
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				res := node.RunIPFS("pin", "add", "--name", tc.pinName, testCID)
+				require.NotEqual(t, 0, res.ExitCode(), tc.description)
+				require.Contains(t, res.Stderr.String(), "max 255 bytes", "Error should mention the 255 byte limit")
+			})
+		}
+	})
+
+	t.Run("pin ls with name filter validates length", func(t *testing.T) {
+		// Test valid filter
+		res := node.RunIPFS("pin", "ls", "--name", strings.Repeat("a", 255))
+		require.Equal(t, 0, res.ExitCode(), "255-byte name filter should be accepted")
+
+		// Test invalid filter
+		res = node.RunIPFS("pin", "ls", "--name", strings.Repeat("a", 256))
+		require.NotEqual(t, 0, res.ExitCode(), "256-byte name filter should be rejected")
+		require.Contains(t, res.Stderr.String(), "max 255 bytes", "Error should mention the 255 byte limit")
+	})
+}
+
+func TestAddPinNameValidation(t *testing.T) {
+	t.Parallel()
+
+	node := harness.NewT(t).NewNode().Init().StartDaemon("--offline")
+	defer node.StopDaemon()
+
+	// Create a test file
+	testFile := "test.txt"
+	node.WriteBytes(testFile, []byte("test content for add command"))
+
+	t.Run("ipfs add with --pin-name accepts valid names", func(t *testing.T) {
+		testCases := []struct {
+			name        string
+			pinName     string
+			description string
+		}{
+			{
+				name:        "short_name",
+				pinName:     "test-add",
+				description: "Short ASCII name should be allowed",
+			},
+			{
+				name:        "max_255_bytes",
+				pinName:     strings.Repeat("x", 255),
+				description: "Exactly 255 bytes should be allowed",
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				res := node.RunIPFS("add", fmt.Sprintf("--pin-name=%s", tc.pinName), "-q", testFile)
+				require.Equal(t, 0, res.ExitCode(), tc.description)
+				cid := strings.TrimSpace(res.Stdout.String())
+
+				// Verify pin exists with name
+				lsRes := node.RunIPFS("pin", "ls", "--names", "--type=recursive", cid)
+				require.Equal(t, 0, lsRes.ExitCode())
+				require.Contains(t, lsRes.Stdout.String(), tc.pinName, "Pin should have the specified name")
+
+				// Clean up
+				node.RunIPFS("pin", "rm", cid)
+			})
+		}
+	})
+
+	t.Run("ipfs add with --pin-name rejects names exceeding 255 bytes", func(t *testing.T) {
+		testCases := []struct {
+			name        string
+			pinName     string
+			description string
+		}{
+			{
+				name:        "256_bytes",
+				pinName:     strings.Repeat("y", 256),
+				description: "256 bytes should be rejected",
+			},
+			{
+				name:        "500_bytes",
+				pinName:     strings.Repeat("z", 500),
+				description: "500 bytes should be rejected",
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				res := node.RunIPFS("add", fmt.Sprintf("--pin-name=%s", tc.pinName), testFile)
+				require.NotEqual(t, 0, res.ExitCode(), tc.description)
+				require.Contains(t, res.Stderr.String(), "max 255 bytes", "Error should mention the 255 byte limit")
+			})
+		}
+	})
+}

From 8f7b63009a6622435793f1c3981ab997837b3c40 Mon Sep 17 00:00:00 2001
From: Hector Sanjuan <code@hector.link>
Date: Thu, 25 Sep 2025 22:49:02 +0000
Subject: [PATCH 05/16] fix: provide Filestore nodes (#10990)

* Filestore: provide Filestore nodes

When strategy is set to "all" (the blockstore does all the providing when a
block is written), no providing was happening to Filestore blocks that were
not written to the underlying blockstore (so, the DAG leaves, as they live in
the filesystem directly). This fixes that.

* docs: clarify filestore and urlstore fix in changelog

both filestore (local file references) and urlstore (HTTP/HTTPS URL
references) blocks are now properly provided shortly after initial add

(cherry picked from commit f63887ae9674e682e90eab20d09db19bee81f7d4)
---
 core/node/storage.go                   | 4 ++--
 docs/changelogs/v0.38.md               | 5 +++++
 docs/examples/kubo-as-a-library/go.mod | 2 +-
 docs/examples/kubo-as-a-library/go.sum | 4 ++--
 go.mod                                 | 2 +-
 go.sum                                 | 4 ++--
 test/dependencies/go.mod               | 2 +-
 test/dependencies/go.sum               | 4 ++--
 8 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/core/node/storage.go b/core/node/storage.go
index 94237c885..e97a0db4a 100644
--- a/core/node/storage.go
+++ b/core/node/storage.go
@@ -77,11 +77,11 @@ func GcBlockstoreCtor(bb BaseBlocks) (gclocker blockstore.GCLocker, gcbs blockst
 }
 
 // FilestoreBlockstoreCtor wraps GcBlockstore and adds Filestore support
-func FilestoreBlockstoreCtor(repo repo.Repo, bb BaseBlocks) (gclocker blockstore.GCLocker, gcbs blockstore.GCBlockstore, bs blockstore.Blockstore, fstore *filestore.Filestore) {
+func FilestoreBlockstoreCtor(repo repo.Repo, bb BaseBlocks, prov DHTProvider) (gclocker blockstore.GCLocker, gcbs blockstore.GCBlockstore, bs blockstore.Blockstore, fstore *filestore.Filestore) {
 	gclocker = blockstore.NewGCLocker()
 
 	// hash security
-	fstore = filestore.NewFilestore(bb, repo.FileManager())
+	fstore = filestore.NewFilestore(bb, repo.FileManager(), prov)
 	gcbs = blockstore.NewGCBlockstore(fstore, gclocker)
 	gcbs = &verifbs.VerifBSGC{GCBlockstore: gcbs}
 
diff --git a/docs/changelogs/v0.38.md b/docs/changelogs/v0.38.md
index 7f50eab9b..649013da5 100644
--- a/docs/changelogs/v0.38.md
+++ b/docs/changelogs/v0.38.md
@@ -17,6 +17,7 @@ This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
   - [🎨 Updated WebUI](#-updated-webui)
   - [📌 Pin name improvements](#-pin-name-improvements)
   - [🛠️ Identity CID size enforcement and `ipfs files write` fixes](#️-identity-cid-size-enforcement-and-ipfs-files-write-fixes)
+  - [Fix: Provide Filestore and Urlstore blocks on write](#️-provide-filestore-and-urlstore-blocks-on-write)
 - [📦️ Important dependency updates](#-important-dependency-updates)
 - [📝 Changelog](#-changelog)
 - [👨‍👩‍👧‍👦 Contributors](#-contributors)
@@ -107,6 +108,10 @@ Identity CIDs use [multihash `0x00`](https://github.com/multiformats/multicodec/
 
 This release resolves several long-standing MFS issues: raw nodes now preserve their codec instead of being forced to dag-pb, append operations on raw nodes work correctly by converting to UnixFS when needed, and identity CIDs properly inherit the full CID prefix from parent directories.
 
+#### Provide Filestore and Urlstore blocks on write
+
+Improvements to the providing system in the last release (provide blocks according to the configured Strategy) left out [Filestore](https://github.com/ipfs/kubo/blob/master/docs/experimental-features.md#ipfs-filestore) and [Urlstore](https://github.com/ipfs/kubo/blob/master/docs/experimental-features.md#ipfs-urlstore) blocks when the "all" strategy was used. They would only be reprovided but not provided on write. This is now fixed, and both Filestore blocks (local file references) and Urlstore blocks (HTTP/HTTPS URL references) will be provided correctly shortly after initial add.
+
 #### MFS directory cache auto-flush
 
 The new [`Internal.MFSAutoflushThreshold`](https://github.com/ipfs/kubo/blob/master/docs/config.md#internalmfsautoflushthreshold) configuration option prevents unbounded memory growth when using `--flush=false` with `ipfs files` commands by automatically flushing directories when their cache exceeds the configured threshold (default: 256 entries).
diff --git a/docs/examples/kubo-as-a-library/go.mod b/docs/examples/kubo-as-a-library/go.mod
index d44a9977e..e13829789 100644
--- a/docs/examples/kubo-as-a-library/go.mod
+++ b/docs/examples/kubo-as-a-library/go.mod
@@ -7,7 +7,7 @@ go 1.25
 replace github.com/ipfs/kubo => ./../../..
 
 require (
-	github.com/ipfs/boxo v0.34.1-0.20250919000230-031df82b284f
+	github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7
 	github.com/ipfs/kubo v0.0.0-00010101000000-000000000000
 	github.com/libp2p/go-libp2p v0.43.0
 	github.com/multiformats/go-multiaddr v0.16.1
diff --git a/docs/examples/kubo-as-a-library/go.sum b/docs/examples/kubo-as-a-library/go.sum
index 822bfadfb..484171c37 100644
--- a/docs/examples/kubo-as-a-library/go.sum
+++ b/docs/examples/kubo-as-a-library/go.sum
@@ -289,8 +289,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250919000230-031df82b284f h1:In4WBnF9sysZwHV6bYTdnLtyRMOQTtvW1leZzxP4bbg=
-github.com/ipfs/boxo v0.34.1-0.20250919000230-031df82b284f/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7 h1:lMzsaKoUSiMmb7xdBbTG0e2Rm85jGlo7fWO/XRhEEDA=
+github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
diff --git a/go.mod b/go.mod
index a1d466549..76f06b5a7 100644
--- a/go.mod
+++ b/go.mod
@@ -22,7 +22,7 @@ require (
 	github.com/hashicorp/go-version v1.7.0
 	github.com/ipfs-shipyard/nopfs v0.0.14
 	github.com/ipfs-shipyard/nopfs/ipfs v0.25.0
-	github.com/ipfs/boxo v0.34.1-0.20250919000230-031df82b284f
+	github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7
 	github.com/ipfs/go-block-format v0.2.3
 	github.com/ipfs/go-cid v0.5.0
 	github.com/ipfs/go-cidutil v0.1.0
diff --git a/go.sum b/go.sum
index 9bf3c29df..c641a432d 100644
--- a/go.sum
+++ b/go.sum
@@ -356,8 +356,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250919000230-031df82b284f h1:In4WBnF9sysZwHV6bYTdnLtyRMOQTtvW1leZzxP4bbg=
-github.com/ipfs/boxo v0.34.1-0.20250919000230-031df82b284f/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7 h1:lMzsaKoUSiMmb7xdBbTG0e2Rm85jGlo7fWO/XRhEEDA=
+github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
diff --git a/test/dependencies/go.mod b/test/dependencies/go.mod
index ce363f5cf..8330249e8 100644
--- a/test/dependencies/go.mod
+++ b/test/dependencies/go.mod
@@ -135,7 +135,7 @@ require (
 	github.com/huin/goupnp v1.3.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
-	github.com/ipfs/boxo v0.34.1-0.20250919000230-031df82b284f // indirect
+	github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7 // indirect
 	github.com/ipfs/go-bitfield v1.1.0 // indirect
 	github.com/ipfs/go-block-format v0.2.3 // indirect
 	github.com/ipfs/go-cid v0.5.0 // indirect
diff --git a/test/dependencies/go.sum b/test/dependencies/go.sum
index 06c94c5a3..ae2606950 100644
--- a/test/dependencies/go.sum
+++ b/test/dependencies/go.sum
@@ -332,8 +332,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250919000230-031df82b284f h1:In4WBnF9sysZwHV6bYTdnLtyRMOQTtvW1leZzxP4bbg=
-github.com/ipfs/boxo v0.34.1-0.20250919000230-031df82b284f/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7 h1:lMzsaKoUSiMmb7xdBbTG0e2Rm85jGlo7fWO/XRhEEDA=
+github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.2.3 h1:mpCuDaNXJ4wrBJLrtEaGFGXkferrw5eqVvzaHhtFKQk=

From 904736c20e68aaae8d15d2d86dbab7f6e94f9174 Mon Sep 17 00:00:00 2001
From: Marcin Rataj <lidel@lidel.org>
Date: Fri, 26 Sep 2025 01:25:23 +0200
Subject: [PATCH 06/16] fix(mfs): add soft limit for `--flush=false` (#10985)

* fix: add MFS operation limit for --flush=false

adds a global counter that tracks consecutive MFS operations performed
with --flush=false and fails with clear error after limit is reached.

this prevents unbounded memory growth while avoiding the data corruption
risks of auto-flushing.

- adds Internal.MFSNoFlushLimit config
- operations fail with actionable error at limit
- counter resets on successful flush or any --flush=true operation
- operations with --flush=true reset and don't count

this commit removes automatic flush from https://github.com/ipfs/kubo/pull/10971
and instead errors to encourage users of --flush=false to develop a habit
of calling 'ipfs files flush' periodically.

boxo will no longer auto-flush (https://github.com/ipfs/boxo/pull/1041) to
avoid corruption issues, and kubo applies the limit to 'ipfs files' commands
instead.

closes #10842

* test: add tests for MFSNoFlushLimit

tests verify the new Internal.MFSNoFlushLimit config option:
- default limit of 256 operations
- custom limit configuration
- counter reset on flush=true
- counter reset on explicit flush command
- limit=0 disables the feature
- multiple MFS command types count towards limit

* docs: explain why MFS operations fail instead of auto-flushing

addresses feedback from https://github.com/ipfs/kubo/pull/10985#pullrequestreview-3256250970

- clarify that automatic flushing at limit was considered but rejected
- explain the data corruption risks of auto-flushing
- guide users who want auto-flush to use --flush=true (default)
- document benefits of explicit failure for batch operations

(cherry picked from commit a688b7eeac874f958097541058136e5b50ccd68a)
---
 config/internal.go                     |  16 ++-
 core/commands/files.go                 |  76 ++++++++++--
 core/node/core.go                      |   7 --
 docs/changelogs/v0.38.md               |  11 +-
 docs/config.md                         |  43 ++++---
 docs/examples/kubo-as-a-library/go.mod |   2 +-
 docs/examples/kubo-as-a-library/go.sum |   4 +-
 go.mod                                 |   2 +-
 go.sum                                 |   4 +-
 test/cli/files_test.go                 | 161 +++++++++++++++++++++++++
 test/dependencies/go.mod               |   2 +-
 test/dependencies/go.sum               |   4 +-
 12 files changed, 282 insertions(+), 50 deletions(-)

diff --git a/config/internal.go b/config/internal.go
index 8341a9149..f344e5252 100644
--- a/config/internal.go
+++ b/config/internal.go
@@ -1,19 +1,23 @@
 package config
 
+const (
+	// DefaultMFSNoFlushLimit is the default limit for consecutive unflushed MFS operations
+	DefaultMFSNoFlushLimit = 256
+)
+
 type Internal struct {
 	// All marked as omitempty since we are expecting to make changes to all subcomponents of Internal
 	Bitswap                     *InternalBitswap  `json:",omitempty"`
 	UnixFSShardingSizeThreshold *OptionalString   `json:",omitempty"` // moved to Import.UnixFSHAMTDirectorySizeThreshold
 	Libp2pForceReachability     *OptionalString   `json:",omitempty"`
 	BackupBootstrapInterval     *OptionalDuration `json:",omitempty"`
-	// MFSAutoflushThreshold controls the number of entries cached in memory
-	// for each MFS directory before auto-flush is triggered to prevent
-	// unbounded memory growth when using --flush=false.
-	// Default: 256 (matches HAMT shard size)
-	// Set to 0 to disable cache limiting (old behavior, may cause high memory usage)
+	// MFSNoFlushLimit controls the maximum number of consecutive
+	// MFS operations allowed with --flush=false before requiring a manual flush.
+	// This prevents unbounded memory growth and ensures data consistency.
+	// Set to 0 to disable limiting (old behavior, may cause high memory usage)
 	// This is an EXPERIMENTAL feature and may change or be removed in future releases.
 	// See https://github.com/ipfs/kubo/issues/10842
-	MFSAutoflushThreshold OptionalInteger `json:",omitempty"`
+	MFSNoFlushLimit *OptionalInteger `json:",omitempty"`
 }
 
 type InternalBitswap struct {
diff --git a/core/commands/files.go b/core/commands/files.go
index 35cdff6ee..86331cbaa 100644
--- a/core/commands/files.go
+++ b/core/commands/files.go
@@ -11,6 +11,8 @@ import (
 	"slices"
 	"strconv"
 	"strings"
+	"sync"
+	"sync/atomic"
 	"time"
 
 	humanize "github.com/dustin/go-humanize"
@@ -35,6 +37,43 @@ import (
 
 var flog = logging.Logger("cmds/files")
 
+// Global counter for unflushed MFS operations
+var noFlushOperationCounter atomic.Int64
+
+// Cached limit value (read once on first use)
+var (
+	noFlushLimit     int64
+	noFlushLimitInit sync.Once
+)
+
+// updateNoFlushCounter manages the counter for unflushed operations
+func updateNoFlushCounter(nd *core.IpfsNode, flush bool) error {
+	if flush {
+		// Reset counter when flushing
+		noFlushOperationCounter.Store(0)
+		return nil
+	}
+
+	// Cache the limit on first use (config doesn't change at runtime)
+	noFlushLimitInit.Do(func() {
+		noFlushLimit = int64(config.DefaultMFSNoFlushLimit)
+		if cfg, err := nd.Repo.Config(); err == nil && cfg.Internal.MFSNoFlushLimit != nil {
+			noFlushLimit = cfg.Internal.MFSNoFlushLimit.WithDefault(int64(config.DefaultMFSNoFlushLimit))
+		}
+	})
+
+	// Check if limit reached
+	if noFlushLimit > 0 && noFlushOperationCounter.Load() >= noFlushLimit {
+		return fmt.Errorf("reached limit of %d unflushed MFS operations. "+
+			"To resolve: 1) run 'ipfs files flush' to persist changes, "+
+			"2) use --flush=true (default), or "+
+			"3) increase Internal.MFSNoFlushLimit in config", noFlushLimit)
+	}
+
+	noFlushOperationCounter.Add(1)
+	return nil
+}
+
 // FilesCmd is the 'ipfs files' command
 var FilesCmd = &cmds.Command{
 	Helptext: cmds.HelpText{
@@ -68,12 +107,14 @@ of consistency guarantees. If the daemon is unexpectedly killed before running
 'ipfs files flush' on the files in question, then data may be lost. This also
 applies to run 'ipfs repo gc' concurrently with '--flush=false' operations.
 
-When using '--flush=false', directories will automatically flush when the
-number of cached entries exceeds the Internal.MFSAutoflushThreshold config.
-This prevents unbounded memory growth. We recommend flushing
-paths regularly with 'ipfs files flush', specially the folders on which many
-write operations are happening, as a way to clear the directory cache, free
-memory and speed up read operations.`,
+When using '--flush=false', operations are limited to prevent unbounded
+memory growth. After reaching Internal.MFSNoFlushLimit operations, further
+operations will fail until you run 'ipfs files flush'. This explicit failure
+(instead of auto-flushing) ensures you maintain control over when data is
+persisted, preventing unexpected partial states and making batch operations
+predictable. We recommend flushing paths regularly, especially folders with
+many write operations, to clear caches, free memory, and maintain good
+performance.`,
 	},
 	Options: []cmds.Option{
 		cmds.BoolOption(filesFlushOptionName, "f", "Flush target and ancestors after write.").WithDefault(true),
@@ -516,12 +557,16 @@ being GC'ed.
 			}
 		}
 
+		flush, _ := req.Options[filesFlushOptionName].(bool)
+
+		if err := updateNoFlushCounter(nd, flush); err != nil {
+			return err
+		}
+
 		err = mfs.PutNode(nd.FilesRoot, dst, node)
 		if err != nil {
 			return fmt.Errorf("cp: cannot put node in path %s: %s", dst, err)
 		}
-
-		flush, _ := req.Options[filesFlushOptionName].(bool)
 		if flush {
 			if _, err := mfs.FlushPath(req.Context, nd.FilesRoot, dst); err != nil {
 				return fmt.Errorf("cp: cannot flush the created file %s: %s", dst, err)
@@ -847,6 +892,10 @@ Example:
 
 		flush, _ := req.Options[filesFlushOptionName].(bool)
 
+		if err := updateNoFlushCounter(nd, flush); err != nil {
+			return err
+		}
+
 		src, err := checkPath(req.Arguments[0])
 		if err != nil {
 			return err
@@ -984,6 +1033,10 @@ See '--to-files' in 'ipfs add --help' for more information.
 		flush, _ := req.Options[filesFlushOptionName].(bool)
 		rawLeaves, rawLeavesDef := req.Options[filesRawLeavesOptionName].(bool)
 
+		if err := updateNoFlushCounter(nd, flush); err != nil {
+			return err
+		}
+
 		if !rawLeavesDef && cfg.Import.UnixFSRawLeaves != config.Default {
 			rawLeavesDef = true
 			rawLeaves = cfg.Import.UnixFSRawLeaves.WithDefault(config.DefaultUnixFSRawLeaves)
@@ -1112,6 +1165,10 @@ Examples:
 
 		flush, _ := req.Options[filesFlushOptionName].(bool)
 
+		if err := updateNoFlushCounter(n, flush); err != nil {
+			return err
+		}
+
 		prefix, err := getPrefix(req)
 		if err != nil {
 			return err
@@ -1164,6 +1221,9 @@ are run with the '--flush=false'.
 			return err
 		}
 
+		// Reset the counter (flush always resets)
+		noFlushOperationCounter.Store(0)
+
 		return cmds.EmitOnce(res, &flushRes{enc.Encode(n.Cid())})
 	},
 	Type: flushRes{},
diff --git a/core/node/core.go b/core/node/core.go
index 7cafe302e..a636a0c54 100644
--- a/core/node/core.go
+++ b/core/node/core.go
@@ -246,13 +246,6 @@ func Files(strategy string) func(mctx helpers.MetricsCtx, lc fx.Lifecycle, repo
 			return nil, err
 		}
 
-		// Configure MFS directory cache auto-flush threshold if specified (experimental)
-		cfg, err := repo.Config()
-		if err == nil && !cfg.Internal.MFSAutoflushThreshold.IsDefault() {
-			threshold := int(cfg.Internal.MFSAutoflushThreshold.WithDefault(int64(mfs.DefaultMaxCacheSize)))
-			root.SetMaxCacheSize(threshold)
-		}
-
 		lc.Append(fx.Hook{
 			OnStop: func(ctx context.Context) error {
 				return root.Close()
diff --git a/docs/changelogs/v0.38.md b/docs/changelogs/v0.38.md
index 649013da5..692217846 100644
--- a/docs/changelogs/v0.38.md
+++ b/docs/changelogs/v0.38.md
@@ -17,7 +17,8 @@ This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
   - [🎨 Updated WebUI](#-updated-webui)
   - [📌 Pin name improvements](#-pin-name-improvements)
   - [🛠️ Identity CID size enforcement and `ipfs files write` fixes](#️-identity-cid-size-enforcement-and-ipfs-files-write-fixes)
-  - [Fix: Provide Filestore and Urlstore blocks on write](#️-provide-filestore-and-urlstore-blocks-on-write)
+  - [📤 Provide Filestore and Urlstore blocks on write](#-provide-filestore-and-urlstore-blocks-on-write)
+  - [🚦 MFS operation limit for --flush=false](#-mfs-operation-limit-for---flush=false)
 - [📦️ Important dependency updates](#-important-dependency-updates)
 - [📝 Changelog](#-changelog)
 - [👨‍👩‍👧‍👦 Contributors](#-contributors)
@@ -108,13 +109,13 @@ Identity CIDs use [multihash `0x00`](https://github.com/multiformats/multicodec/
 
 This release resolves several long-standing MFS issues: raw nodes now preserve their codec instead of being forced to dag-pb, append operations on raw nodes work correctly by converting to UnixFS when needed, and identity CIDs properly inherit the full CID prefix from parent directories.
 
-#### Provide Filestore and Urlstore blocks on write
+#### 📤 Provide Filestore and Urlstore blocks on write
 
-Improvements to the providing system in the last release (provide blocks according to the configured Strategy) left out [Filestore](https://github.com/ipfs/kubo/blob/master/docs/experimental-features.md#ipfs-filestore) and [Urlstore](https://github.com/ipfs/kubo/blob/master/docs/experimental-features.md#ipfs-urlstore) blocks when the "all" strategy was used. They would only be reprovided but not provided on write. This is now fixed, and both Filestore blocks (local file references) and Urlstore blocks (HTTP/HTTPS URL references) will be provided correctly shortly after initial add.
+Improvements to the providing system in the last release (provide blocks according to the configured [Strategy](https://github.com/ipfs/kubo/blob/master/docs/config.md#providestrategy)) left out [Filestore](https://github.com/ipfs/kubo/blob/master/docs/experimental-features.md#ipfs-filestore) and [Urlstore](https://github.com/ipfs/kubo/blob/master/docs/experimental-features.md#ipfs-urlstore) blocks when the "all" strategy was used. They would only be reprovided but not provided on write. This is now fixed, and both Filestore blocks (local file references) and Urlstore blocks (HTTP/HTTPS URL references) will be provided correctly shortly after initial add.
 
-#### MFS directory cache auto-flush
+#### 🚦 MFS operation limit for --flush=false
 
-The new [`Internal.MFSAutoflushThreshold`](https://github.com/ipfs/kubo/blob/master/docs/config.md#internalmfsautoflushthreshold) configuration option prevents unbounded memory growth when using `--flush=false` with `ipfs files` commands by automatically flushing directories when their cache exceeds the configured threshold (default: 256 entries).
+The new [`Internal.MFSNoFlushLimit`](https://github.com/ipfs/kubo/blob/master/docs/config.md#internalmfsnoflushlimit) configuration option prevents unbounded memory growth when using `--flush=false` with `ipfs files` commands. After performing the configured number of operations without flushing (default: 256), further operations will fail with a clear error message instructing users to flush manually.
 
 ### 📦️ Important dependency updates
 
diff --git a/docs/config.md b/docs/config.md
index a69b045f7..e2029e432 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -1599,27 +1599,40 @@ Type: `flag`
 
 **MOVED:** see [`Import.UnixFSHAMTDirectorySizeThreshold`](#importunixfshamtdirectorysizethreshold)
 
-### `Internal.MFSAutoflushThreshold`
+### `Internal.MFSNoFlushLimit`
 
-Controls the number of entries cached in memory for each MFS directory before
-auto-flush is triggered to prevent unbounded memory growth when using `--flush=false`
-with `ipfs files` commands.
+Controls the maximum number of consecutive MFS operations allowed with `--flush=false`
+before requiring a manual flush. This prevents unbounded memory growth and ensures
+data consistency when using deferred flushing with `ipfs files` commands.
 
-When a directory's cache reaches this threshold, it will automatically flush to
-the blockstore even when `--flush=false` is specified. This prevents excessive
-memory usage while still allowing performance benefits of deferred flushing for
-smaller operations.
+When the limit is reached, further operations will fail with an error message
+instructing the user to run `ipfs files flush`, use `--flush=true`, or increase
+this limit in the configuration.
 
-**Examples:**
-* `256` - Default value. Provides a good balance between performance and memory usage.
-* `0` - Disables cache limiting (behavior before Kubo 0.38). May cause high memory
-  usage with `--flush=false` on large directories.
-* `1024` - Higher limit for systems with more available memory that need to perform
-  many operations before flushing.
+**Why operations fail instead of auto-flushing:** Automatic flushing once the limit
+is reached was considered but rejected because it can lead to data corruption issues
+that are difficult to debug. When the system decides to flush without user knowledge, it can:
+- Create partial states that violate user expectations about atomicity
+- Interfere with concurrent operations in unexpected ways
+- Make debugging and recovery much harder when issues occur
+
+By failing explicitly, users maintain control over when their data is persisted,
+allowing them to:
+- Batch related operations together before flushing
+- Handle errors predictably at natural transaction boundaries
+- Understand exactly when and why their data is written to disk
+
+If you expect automatic flushing behavior, simply use the default `--flush=true`
+(or omit the flag entirely) instead of `--flush=false`.
+
+**⚠️ WARNING:** Increasing this limit or disabling it (setting to 0) can lead to:
+- **Out-of-memory errors (OOM)** - Each unflushed operation consumes memory
+- **Data loss** - If the daemon crashes before flushing, all unflushed changes are lost
+- **Degraded performance** - Large unflushed caches slow down MFS operations
 
 Default: `256`
 
-Type: `optionalInteger` (0 disables the limit, risky, may lead to errors)
+Type: `optionalInteger` (0 disables the limit, strongly discouraged)
 
 **Note:** This is an EXPERIMENTAL feature and may change or be removed in future releases.
 See [#10842](https://github.com/ipfs/kubo/issues/10842) for more information.
diff --git a/docs/examples/kubo-as-a-library/go.mod b/docs/examples/kubo-as-a-library/go.mod
index e13829789..6d4ae40de 100644
--- a/docs/examples/kubo-as-a-library/go.mod
+++ b/docs/examples/kubo-as-a-library/go.mod
@@ -7,7 +7,7 @@ go 1.25
 replace github.com/ipfs/kubo => ./../../..
 
 require (
-	github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7
+	github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28
 	github.com/ipfs/kubo v0.0.0-00010101000000-000000000000
 	github.com/libp2p/go-libp2p v0.43.0
 	github.com/multiformats/go-multiaddr v0.16.1
diff --git a/docs/examples/kubo-as-a-library/go.sum b/docs/examples/kubo-as-a-library/go.sum
index 484171c37..9d28cad54 100644
--- a/docs/examples/kubo-as-a-library/go.sum
+++ b/docs/examples/kubo-as-a-library/go.sum
@@ -289,8 +289,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7 h1:lMzsaKoUSiMmb7xdBbTG0e2Rm85jGlo7fWO/XRhEEDA=
-github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28 h1:kDoj2V7ghhLdQeQUtzr605tb6NJ4AzwRYtXFJas+Wyc=
+github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
diff --git a/go.mod b/go.mod
index 76f06b5a7..5caa10cc5 100644
--- a/go.mod
+++ b/go.mod
@@ -22,7 +22,7 @@ require (
 	github.com/hashicorp/go-version v1.7.0
 	github.com/ipfs-shipyard/nopfs v0.0.14
 	github.com/ipfs-shipyard/nopfs/ipfs v0.25.0
-	github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7
+	github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28
 	github.com/ipfs/go-block-format v0.2.3
 	github.com/ipfs/go-cid v0.5.0
 	github.com/ipfs/go-cidutil v0.1.0
diff --git a/go.sum b/go.sum
index c641a432d..98b74da8c 100644
--- a/go.sum
+++ b/go.sum
@@ -356,8 +356,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7 h1:lMzsaKoUSiMmb7xdBbTG0e2Rm85jGlo7fWO/XRhEEDA=
-github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28 h1:kDoj2V7ghhLdQeQUtzr605tb6NJ4AzwRYtXFJas+Wyc=
+github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
diff --git a/test/cli/files_test.go b/test/cli/files_test.go
index 91589ea9c..ece87850e 100644
--- a/test/cli/files_test.go
+++ b/test/cli/files_test.go
@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/ipfs/kubo/config"
 	"github.com/ipfs/kubo/test/cli/harness"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -178,3 +179,163 @@ func TestFilesRm(t *testing.T) {
 		assert.NotContains(t, lsRes.Stdout.String(), "test-dir")
 	})
 }
+
+func TestFilesNoFlushLimit(t *testing.T) {
+	t.Parallel()
+
+	t.Run("reaches default limit of 256 operations", func(t *testing.T) {
+		t.Parallel()
+		node := harness.NewT(t).NewNode().Init().StartDaemon()
+
+		// Perform 256 operations with --flush=false (should succeed)
+		for i := 0; i < 256; i++ {
+			res := node.IPFS("files", "mkdir", "--flush=false", fmt.Sprintf("/dir%d", i))
+			assert.NoError(t, res.Err, "operation %d should succeed", i+1)
+		}
+
+		// 257th operation should fail
+		res := node.RunIPFS("files", "mkdir", "--flush=false", "/dir256")
+		require.NotNil(t, res.ExitErr, "command should have failed")
+		assert.NotEqual(t, 0, res.ExitErr.ExitCode())
+		assert.Contains(t, res.Stderr.String(), "reached limit of 256 unflushed MFS operations")
+		assert.Contains(t, res.Stderr.String(), "run 'ipfs files flush'")
+		assert.Contains(t, res.Stderr.String(), "use --flush=true")
+		assert.Contains(t, res.Stderr.String(), "increase Internal.MFSNoFlushLimit")
+	})
+
+	t.Run("custom limit via config", func(t *testing.T) {
+		t.Parallel()
+		node := harness.NewT(t).NewNode().Init()
+
+		// Set custom limit to 5
+		node.UpdateConfig(func(cfg *config.Config) {
+			limit := config.NewOptionalInteger(5)
+			cfg.Internal.MFSNoFlushLimit = limit
+		})
+
+		node.StartDaemon()
+
+		// Perform 5 operations (should succeed)
+		for i := 0; i < 5; i++ {
+			res := node.IPFS("files", "mkdir", "--flush=false", fmt.Sprintf("/dir%d", i))
+			assert.NoError(t, res.Err, "operation %d should succeed", i+1)
+		}
+
+		// 6th operation should fail
+		res := node.RunIPFS("files", "mkdir", "--flush=false", "/dir5")
+		require.NotNil(t, res.ExitErr, "command should have failed")
+		assert.NotEqual(t, 0, res.ExitErr.ExitCode())
+		assert.Contains(t, res.Stderr.String(), "reached limit of 5 unflushed MFS operations")
+	})
+
+	t.Run("flush=true resets counter", func(t *testing.T) {
+		t.Parallel()
+		node := harness.NewT(t).NewNode().Init()
+
+		// Set limit to 3 for faster testing
+		node.UpdateConfig(func(cfg *config.Config) {
+			limit := config.NewOptionalInteger(3)
+			cfg.Internal.MFSNoFlushLimit = limit
+		})
+
+		node.StartDaemon()
+
+		// Do 2 operations with --flush=false
+		node.IPFS("files", "mkdir", "--flush=false", "/dir1")
+		node.IPFS("files", "mkdir", "--flush=false", "/dir2")
+
+		// Operation with --flush=true should reset counter
+		node.IPFS("files", "mkdir", "--flush=true", "/dir3")
+
+		// Now we should be able to do 3 more operations with --flush=false
+		for i := 4; i <= 6; i++ {
+			res := node.IPFS("files", "mkdir", "--flush=false", fmt.Sprintf("/dir%d", i))
+			assert.NoError(t, res.Err, "operation after flush should succeed")
+		}
+
+		// 4th operation after reset should fail
+		res := node.RunIPFS("files", "mkdir", "--flush=false", "/dir7")
+		require.NotNil(t, res.ExitErr, "command should have failed")
+		assert.NotEqual(t, 0, res.ExitErr.ExitCode())
+		assert.Contains(t, res.Stderr.String(), "reached limit of 3 unflushed MFS operations")
+	})
+
+	t.Run("explicit flush command resets counter", func(t *testing.T) {
+		t.Parallel()
+		node := harness.NewT(t).NewNode().Init()
+
+		// Set limit to 3 for faster testing
+		node.UpdateConfig(func(cfg *config.Config) {
+			limit := config.NewOptionalInteger(3)
+			cfg.Internal.MFSNoFlushLimit = limit
+		})
+
+		node.StartDaemon()
+
+		// Do 2 operations with --flush=false
+		node.IPFS("files", "mkdir", "--flush=false", "/dir1")
+		node.IPFS("files", "mkdir", "--flush=false", "/dir2")
+
+		// Explicit flush should reset counter
+		node.IPFS("files", "flush")
+
+		// Now we should be able to do 3 more operations
+		for i := 3; i <= 5; i++ {
+			res := node.IPFS("files", "mkdir", "--flush=false", fmt.Sprintf("/dir%d", i))
+			assert.NoError(t, res.Err, "operation after flush should succeed")
+		}
+
+		// 4th operation should fail
+		res := node.RunIPFS("files", "mkdir", "--flush=false", "/dir6")
+		require.NotNil(t, res.ExitErr, "command should have failed")
+		assert.NotEqual(t, 0, res.ExitErr.ExitCode())
+		assert.Contains(t, res.Stderr.String(), "reached limit of 3 unflushed MFS operations")
+	})
+
+	t.Run("limit=0 disables the feature", func(t *testing.T) {
+		t.Parallel()
+		node := harness.NewT(t).NewNode().Init()
+
+		// Set limit to 0 (disabled)
+		node.UpdateConfig(func(cfg *config.Config) {
+			limit := config.NewOptionalInteger(0)
+			cfg.Internal.MFSNoFlushLimit = limit
+		})
+
+		node.StartDaemon()
+
+		// Should be able to do many operations without error
+		for i := 0; i < 300; i++ {
+			res := node.IPFS("files", "mkdir", "--flush=false", fmt.Sprintf("/dir%d", i))
+			assert.NoError(t, res.Err, "operation %d should succeed with limit disabled", i+1)
+		}
+	})
+
+	t.Run("different MFS commands count towards limit", func(t *testing.T) {
+		t.Parallel()
+		node := harness.NewT(t).NewNode().Init()
+
+		// Set limit to 5 for testing
+		node.UpdateConfig(func(cfg *config.Config) {
+			limit := config.NewOptionalInteger(5)
+			cfg.Internal.MFSNoFlushLimit = limit
+		})
+
+		node.StartDaemon()
+
+		// Mix of different MFS operations (5 operations to hit the limit)
+		node.IPFS("files", "mkdir", "--flush=false", "/testdir")
+		// Create a file first, then copy it
+		testCid := node.IPFSAddStr("test content")
+		node.IPFS("files", "cp", "--flush=false", fmt.Sprintf("/ipfs/%s", testCid), "/testfile")
+		node.IPFS("files", "cp", "--flush=false", "/testfile", "/testfile2")
+		node.IPFS("files", "mv", "--flush=false", "/testfile2", "/testfile3")
+		node.IPFS("files", "mkdir", "--flush=false", "/anotherdir")
+
+		// 6th operation should fail
+		res := node.RunIPFS("files", "mkdir", "--flush=false", "/another")
+		require.NotNil(t, res.ExitErr, "command should have failed")
+		assert.NotEqual(t, 0, res.ExitErr.ExitCode())
+		assert.Contains(t, res.Stderr.String(), "reached limit of 5 unflushed MFS operations")
+	})
+}
diff --git a/test/dependencies/go.mod b/test/dependencies/go.mod
index 8330249e8..bfbeb31a2 100644
--- a/test/dependencies/go.mod
+++ b/test/dependencies/go.mod
@@ -135,7 +135,7 @@ require (
 	github.com/huin/goupnp v1.3.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
-	github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7 // indirect
+	github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28 // indirect
 	github.com/ipfs/go-bitfield v1.1.0 // indirect
 	github.com/ipfs/go-block-format v0.2.3 // indirect
 	github.com/ipfs/go-cid v0.5.0 // indirect
diff --git a/test/dependencies/go.sum b/test/dependencies/go.sum
index ae2606950..444ecd5eb 100644
--- a/test/dependencies/go.sum
+++ b/test/dependencies/go.sum
@@ -332,8 +332,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7 h1:lMzsaKoUSiMmb7xdBbTG0e2Rm85jGlo7fWO/XRhEEDA=
-github.com/ipfs/boxo v0.34.1-0.20250925094323-608486081da7/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28 h1:kDoj2V7ghhLdQeQUtzr605tb6NJ4AzwRYtXFJas+Wyc=
+github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.2.3 h1:mpCuDaNXJ4wrBJLrtEaGFGXkferrw5eqVvzaHhtFKQk=

From 4614cd7317ecc635768f2d8d6786112c4c097e31 Mon Sep 17 00:00:00 2001
From: Guillaume Michel <guillaumemichel@users.noreply.github.com>
Date: Fri, 26 Sep 2025 03:22:37 +0200
Subject: [PATCH 07/16] fix: provider merge conflicts (#10989)

Co-authored-by: Marcin Rataj <lidel@lidel.org>
(cherry picked from commit 776c21a6d61592f91121980b772bc89cd7c58096)
---
 config/provide.go     |  16 +--
 core/node/provider.go |  68 +++++++----
 docs/config.md        | 261 ++++++++++++++++++++++++------------------
 3 files changed, 206 insertions(+), 139 deletions(-)

diff --git a/config/provide.go b/config/provide.go
index 5f900aaa8..9fc378a32 100644
--- a/config/provide.go
+++ b/config/provide.go
@@ -19,7 +19,7 @@ const (
 	DefaultProvideDHTDedicatedPeriodicWorkers = 2
 	DefaultProvideDHTDedicatedBurstWorkers    = 1
 	DefaultProvideDHTMaxProvideConnsPerWorker = 16
-	DefaultProvideDHTKeyStoreBatchSize        = 1 << 14 // ~544 KiB per batch (1 multihash = 34 bytes)
+	DefaultProvideDHTKeystoreBatchSize        = 1 << 14 // ~544 KiB per batch (1 multihash = 34 bytes)
 	DefaultProvideDHTOfflineDelay             = 2 * time.Hour
 )
 
@@ -79,9 +79,9 @@ type ProvideDHT struct {
 	// Default: DefaultProvideDHTMaxProvideConnsPerWorker
 	MaxProvideConnsPerWorker *OptionalInteger `json:",omitempty"`
 
-	// KeyStoreBatchSize sets the batch size for keystore operations during reprovide refresh (sweep mode only).
-	// Default: DefaultProvideDHTKeyStoreBatchSize
-	KeyStoreBatchSize *OptionalInteger `json:",omitempty"`
+	// KeystoreBatchSize sets the batch size for keystore operations during reprovide refresh (sweep mode only).
+	// Default: DefaultProvideDHTKeystoreBatchSize
+	KeystoreBatchSize *OptionalInteger `json:",omitempty"`
 
 	// OfflineDelay sets the delay after which the provider switches from Disconnected to Offline state (sweep mode only).
 	// Default: DefaultProvideDHTOfflineDelay
@@ -150,11 +150,11 @@ func ValidateProvideConfig(cfg *Provide) error {
 		}
 	}
 
-	// Validate KeyStoreBatchSize
-	if !cfg.DHT.KeyStoreBatchSize.IsDefault() {
-		batchSize := cfg.DHT.KeyStoreBatchSize.WithDefault(DefaultProvideDHTKeyStoreBatchSize)
+	// Validate KeystoreBatchSize
+	if !cfg.DHT.KeystoreBatchSize.IsDefault() {
+		batchSize := cfg.DHT.KeystoreBatchSize.WithDefault(DefaultProvideDHTKeystoreBatchSize)
 		if batchSize <= 0 {
-			return fmt.Errorf("Provide.DHT.KeyStoreBatchSize must be positive, got %d", batchSize)
+			return fmt.Errorf("Provide.DHT.KeystoreBatchSize must be positive, got %d", batchSize)
 		}
 	}
 
diff --git a/core/node/provider.go b/core/node/provider.go
index 8cc6d3dc7..2c77e580c 100644
--- a/core/node/provider.go
+++ b/core/node/provider.go
@@ -24,6 +24,7 @@ import (
 	"github.com/libp2p/go-libp2p-kad-dht/fullrt"
 	dht_pb "github.com/libp2p/go-libp2p-kad-dht/pb"
 	dhtprovider "github.com/libp2p/go-libp2p-kad-dht/provider"
+	"github.com/libp2p/go-libp2p-kad-dht/provider/buffered"
 	ddhtprovider "github.com/libp2p/go-libp2p-kad-dht/provider/dual"
 	"github.com/libp2p/go-libp2p-kad-dht/provider/keystore"
 	routinghelpers "github.com/libp2p/go-libp2p-routing-helpers"
@@ -84,7 +85,7 @@ type DHTProvider interface {
 	// The keys are not deleted from the keystore, so they will continue to be
 	// reprovided as scheduled.
 	Clear() int
-	// RefreshSchedule scans the KeyStore for any keys that are not currently
+	// RefreshSchedule scans the Keystore for any keys that are not currently
 	// scheduled for reproviding. If such keys are found, it schedules their
 	// associated keyspace region to be reprovided.
 	//
@@ -314,13 +315,40 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 	}
 	sweepingReprovider := fx.Provide(func(in providerInput) (DHTProvider, *keystore.ResettableKeystore, error) {
 		ds := in.Repo.Datastore()
-		keyStore, err := keystore.NewResettableKeystore(ds,
+		ks, err := keystore.NewResettableKeystore(ds,
 			keystore.WithPrefixBits(16),
 			keystore.WithDatastorePath("/provider/keystore"),
-			keystore.WithBatchSize(int(cfg.Provide.DHT.KeyStoreBatchSize.WithDefault(config.DefaultProvideDHTKeyStoreBatchSize))),
+			keystore.WithBatchSize(int(cfg.Provide.DHT.KeystoreBatchSize.WithDefault(config.DefaultProvideDHTKeystoreBatchSize))),
 		)
 		if err != nil {
-			return &NoopProvider{}, nil, err
+			return nil, nil, err
+		}
+		// Constants for buffered provider configuration
+		// These values match the upstream defaults from go-libp2p-kad-dht and have been battle-tested
+		const (
+			// bufferedDsName is the datastore namespace used by the buffered provider.
+			// The dsqueue persists operations here to handle large data additions without
+			// being memory-bound, allowing operations on hardware with limited RAM and
+			// enabling core operations to return instantly while processing happens async.
+			bufferedDsName = "bprov"
+
+			// bufferedBatchSize controls how many operations are dequeued and processed
+			// together from the datastore queue. The worker processes up to this many
+			// operations at once, grouping them by type for efficiency.
+			bufferedBatchSize = 1 << 10 // 1024 items
+
+			// bufferedIdleWriteTime is an implementation detail of go-dsqueue that controls
+			// how long the datastore buffer waits for new multihashes to arrive before
+			// flushing in-memory items to the datastore. This does NOT affect providing speed -
+			// provides happen as fast as possible via a dedicated worker that continuously
+			// processes the queue regardless of this timing.
+			bufferedIdleWriteTime = time.Minute
+		)
+
+		bufferedProviderOpts := []buffered.Option{
+			buffered.WithBatchSize(bufferedBatchSize),
+			buffered.WithDsName(bufferedDsName),
+			buffered.WithIdleWriteTime(bufferedIdleWriteTime),
 		}
 		var impl dhtImpl
 		switch inDht := in.DHT.(type) {
@@ -331,7 +359,7 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 		case *dual.DHT:
 			if inDht != nil {
 				prov, err := ddhtprovider.New(inDht,
-					ddhtprovider.WithKeystore(keyStore),
+					ddhtprovider.WithKeystore(ks),
 
 					ddhtprovider.WithReprovideInterval(reprovideInterval),
 					ddhtprovider.WithMaxReprovideDelay(time.Hour),
@@ -346,8 +374,7 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 				if err != nil {
 					return nil, nil, err
 				}
-				_ = prov
-				return prov, keyStore, nil
+				return buffered.New(prov, ds, bufferedProviderOpts...), ks, nil
 			}
 		case *fullrt.FullRT:
 			if inDht != nil {
@@ -365,7 +392,7 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 			selfAddrsFunc = func() []ma.Multiaddr { return impl.Host().Addrs() }
 		}
 		opts := []dhtprovider.Option{
-			dhtprovider.WithKeystore(keyStore),
+			dhtprovider.WithKeystore(ks),
 			dhtprovider.WithPeerID(impl.Host().ID()),
 			dhtprovider.WithRouter(impl),
 			dhtprovider.WithMessageSender(impl.MessageSender()),
@@ -387,16 +414,19 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 		}
 
 		prov, err := dhtprovider.New(opts...)
-		return prov, keyStore, err
+		if err != nil {
+			return nil, nil, err
+		}
+		return buffered.New(prov, ds, bufferedProviderOpts...), ks, nil
 	})
 
 	type keystoreInput struct {
 		fx.In
 		Provider    DHTProvider
-		KeyStore    *keystore.ResettableKeystore
+		Keystore    *keystore.ResettableKeystore
 		KeyProvider provider.KeyChanFunc
 	}
-	initKeyStore := fx.Invoke(func(lc fx.Lifecycle, in keystoreInput) {
+	initKeystore := fx.Invoke(func(lc fx.Lifecycle, in keystoreInput) {
 		// Skip keystore initialization for NoopProvider
 		if _, ok := in.Provider.(*NoopProvider); ok {
 			return
@@ -407,12 +437,12 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 			done   = make(chan struct{})
 		)
 
-		syncKeyStore := func(ctx context.Context) error {
+		syncKeystore := func(ctx context.Context) error {
 			kcf, err := in.KeyProvider(ctx)
 			if err != nil {
 				return err
 			}
-			if err := in.KeyStore.ResetCids(ctx, kcf); err != nil {
+			if err := in.Keystore.ResetCids(ctx, kcf); err != nil {
 				return err
 			}
 			if err := in.Provider.RefreshSchedule(); err != nil {
@@ -424,7 +454,7 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 		lc.Append(fx.Hook{
 			OnStart: func(ctx context.Context) error {
 				// Set the KeyProvider as a garbage collection function for the
-				// keystore. Periodically purge the KeyStore from all its keys and
+				// keystore. Periodically purge the Keystore from all its keys and
 				// replace them with the keys that needs to be reprovided, coming from
 				// the KeyChanFunc. So far, this is the less worse way to remove CIDs
 				// that shouldn't be reprovided from the provider's state.
@@ -434,7 +464,7 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 					// which can take a while.
 					strategy := cfg.Provide.Strategy.WithDefault(config.DefaultProvideStrategy)
 					logger.Infow("provider keystore sync started", "strategy", strategy)
-					if err := syncKeyStore(ctx); err != nil {
+					if err := syncKeystore(ctx); err != nil {
 						logger.Errorw("provider keystore sync failed", "err", err, "strategy", strategy)
 					} else {
 						logger.Infow("provider keystore sync completed", "strategy", strategy)
@@ -454,7 +484,7 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 						case <-gcCtx.Done():
 							return
 						case <-ticker.C:
-							if err := syncKeyStore(gcCtx); err != nil {
+							if err := syncKeystore(gcCtx); err != nil {
 								logger.Errorw("provider keystore sync", "err", err)
 							}
 						}
@@ -471,18 +501,16 @@ func SweepingProviderOpt(cfg *config.Config) fx.Option {
 				case <-ctx.Done():
 					return ctx.Err()
 				}
-
 				// Keystore data isn't purged, on close, but it will be overwritten
 				// when the node starts again.
-
-				return in.KeyStore.Close()
+				return in.Keystore.Close()
 			},
 		})
 	})
 
 	return fx.Options(
 		sweepingReprovider,
-		initKeyStore,
+		initKeystore,
 	)
 }
 
diff --git a/docs/config.md b/docs/config.md
index e2029e432..58131b52e 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -135,7 +135,7 @@ config file at runtime.
       - [`Provide.DHT.DedicatedPeriodicWorkers`](#providedhtdedicatedperiodicworkers)
       - [`Provide.DHT.DedicatedBurstWorkers`](#providedhtdedicatedburstworkers)
       - [`Provide.DHT.MaxProvideConnsPerWorker`](#providedhtmaxprovideconnsperworker)
-      - [`Provide.DHT.KeyStoreBatchSize`](#providedhtkeystorebatchsize)
+      - [`Provide.DHT.KeystoreBatchSize`](#providedhtkeystorebatchsize)
       - [`Provide.DHT.OfflineDelay`](#providedhtofflinedelay)
   - [`Provider`](#provider)
     - [`Provider.Enabled`](#providerenabled)
@@ -282,8 +282,8 @@ the local [Kubo RPC API](https://docs.ipfs.tech/reference/kubo/rpc/) (`/api/v0`)
 
 Supported Transports:
 
-* tcp/ip{4,6} - `/ipN/.../tcp/...`
-* unix - `/unix/path/to/socket`
+- tcp/ip{4,6} - `/ipN/.../tcp/...`
+- unix - `/unix/path/to/socket`
 
 > [!CAUTION]
 > **NEVER EXPOSE UNPROTECTED ADMIN RPC TO LAN OR THE PUBLIC INTERNET**
@@ -310,8 +310,8 @@ the local [HTTP gateway](https://specs.ipfs.tech/http-gateways/) (`/ipfs`, `/ipn
 
 Supported Transports:
 
-* tcp/ip{4,6} - `/ipN/.../tcp/...`
-* unix - `/unix/path/to/socket`
+- tcp/ip{4,6} - `/ipN/.../tcp/...`
+- unix - `/unix/path/to/socket`
 
 > [!CAUTION]
 > **SECURITY CONSIDERATIONS FOR GATEWAY EXPOSURE**
@@ -334,10 +334,10 @@ connections.
 
 Supported Transports:
 
-* tcp/ip{4,6} - `/ipN/.../tcp/...`
-* websocket - `/ipN/.../tcp/.../ws`
-* quicv1 (RFC9000) - `/ipN/.../udp/.../quic-v1` - can share the same two tuple with `/quic-v1/webtransport`
-* webtransport `/ipN/.../udp/.../quic-v1/webtransport` - can share the same two tuple with `/quic-v1`
+- tcp/ip{4,6} - `/ipN/.../tcp/...`
+- websocket - `/ipN/.../tcp/.../ws`
+- quicv1 (RFC9000) - `/ipN/.../udp/.../quic-v1` - can share the same two tuple with `/quic-v1/webtransport`
+- webtransport `/ipN/.../udp/.../quic-v1/webtransport` - can share the same two tuple with `/quic-v1`
 
 > [!IMPORTANT]
 > Make sure your firewall rules allow incoming connections on both TCP and UDP ports defined here.
@@ -346,6 +346,7 @@ Supported Transports:
 Note that quic (Draft-29) used to be supported with the format `/ipN/.../udp/.../quic`, but has since been [removed](https://github.com/libp2p/go-libp2p/releases/tag/v0.30.0).
 
 Default:
+
 ```json
 [
   "/ip4/0.0.0.0/tcp/4001",
@@ -401,6 +402,7 @@ Contains information used by the [Kubo RPC API](https://docs.ipfs.tech/reference
 Map of HTTP headers to set on responses from the RPC (`/api/v0`) HTTP server.
 
 Example:
+
 ```json
 {
   "Foo": ["bar"]
@@ -512,11 +514,11 @@ the rest of the internet.
 When unset (default), the AutoNAT service defaults to _enabled_. Otherwise, this
 field can take one of two values:
 
-* `enabled` - Enable the V1+V2 service (unless the node determines that it,
+- `enabled` - Enable the V1+V2 service (unless the node determines that it,
   itself, isn't reachable by the public internet).
-* `legacy-v1` - **DEPRECATED** Same as `enabled` but only V1 service is enabled. Used for testing
+- `legacy-v1` - **DEPRECATED** Same as `enabled` but only V1 service is enabled. Used for testing
   during as few releases as we [transition to V2](https://github.com/ipfs/kubo/issues/10091), will be removed in the future.
-* `disabled` - Disable the service.
+- `disabled` - Disable the service.
 
 Additional modes may be added in the future.
 
@@ -620,6 +622,7 @@ AutoConf can resolve `"auto"` placeholders in the following configuration fields
 AutoConf supports path-based routing URLs that automatically enable specific routing operations based on the URL path. This allows precise control over which HTTP Routing V1 endpoints are used for different operations:
 
 **Supported paths:**
+
 - `/routing/v1/providers` - Enables provider record lookups only
 - `/routing/v1/peers` - Enables peer routing lookups only  
 - `/routing/v1/ipns` - Enables IPNS record operations only
@@ -648,6 +651,7 @@ AutoConf supports path-based routing URLs that automatically enable specific rou
 ```
 
 **Node type categories:**
+
 - `mainnet-for-nodes-with-dht`: Mainnet nodes with DHT enabled (typically only need additional provider lookups)
 - `mainnet-for-nodes-without-dht`: Mainnet nodes without DHT (need comprehensive routing services)
 - `mainnet-for-ipns-publishers-with-http`: Mainnet nodes that publish IPNS records via HTTP
@@ -822,7 +826,6 @@ Default: [certmagic.LetsEncryptProductionCA](https://pkg.go.dev/github.com/caddy
 
 Type: `optionalString`
 
-
 ## `Bitswap`
 
 High level client and server configuration of the [Bitswap Protocol](https://specs.ipfs.tech/bitswap-protocol/) over libp2p.
@@ -861,6 +864,7 @@ Bootstrap peers help your node discover and connect to the IPFS network when sta
 The special value `"auto"` automatically uses curated, up-to-date bootstrap peers from [AutoConf](#autoconf), ensuring your node can always connect to the healthy network without manual maintenance.
 
 **What this gives you:**
+
 - **Reliable startup**: Your node can always find the network, even if some bootstrap peers go offline
 - **Automatic updates**: New bootstrap peers are added as the network evolves
 - **Custom control**: Add your own trusted peers alongside or instead of the defaults
@@ -963,7 +967,7 @@ cache, which caches block-cids and their block-sizes. Use `0` to disable.
 
 This cache, once primed, can greatly speed up operations like `ipfs repo stat`
 as there is no need to read full blocks to know their sizes. Size should be
-adjusted depending on the number of CIDs on disk (`NumObjects in `ipfs repo stat`).
+adjusted depending on the number of CIDs on disk (`NumObjects in`ipfs repo stat`).
 
 Default: `65536` (64KiB)
 
@@ -979,6 +983,7 @@ datastores to provide extra functionality (eg metrics, logging, or caching).
 > For more information on possible values for this configuration option, see [`kubo/docs/datastores.md`](datastores.md)
 
 Default:
+
 ```
 {
   "mounts": [
@@ -1003,6 +1008,7 @@ Default:
 ```
 
 With `flatfs-measure` profile:
+
 ```
 {
   "mounts": [
@@ -1063,7 +1069,7 @@ Toggle and configure experimental features of Kubo. Experimental features are li
 
 Options for the HTTP gateway.
 
-**NOTE:** support for `/api/v0` under the gateway path is now deprecated. It will be removed in future versions: https://github.com/ipfs/kubo/issues/10312.
+**NOTE:** support for `/api/v0` under the gateway path is now deprecated. It will be removed in future versions: <https://github.com/ipfs/kubo/issues/10312>.
 
 ### `Gateway.NoFetch`
 
@@ -1088,7 +1094,7 @@ Type: `bool`
 
 An optional flag to explicitly configure whether this gateway responds to deserialized
 requests, or not. By default, it is enabled. When disabling this option, the gateway
-operates as a Trustless Gateway only: https://specs.ipfs.tech/http-gateways/trustless-gateway/.
+operates as a Trustless Gateway only: <https://specs.ipfs.tech/http-gateways/trustless-gateway/>.
 
 Default: `true`
 
@@ -1127,10 +1133,12 @@ Type: `flag`
 Maximum duration Kubo will wait for content retrieval (new bytes to arrive).
 
 **Timeout behavior:**
+
 - **Time to first byte**: Returns 504 Gateway Timeout if the gateway cannot start writing within this duration (e.g., stuck searching for providers)
 - **Time between writes**: After first byte, timeout resets with each write. Response terminates if no new data can be written within this duration
 
 **Truncation handling:** When timeout occurs after HTTP 200 headers are sent (e.g., during CAR streams), the gateway:
+
 - Appends error message to indicate truncation
 - Forces TCP reset (RST) to prevent caching incomplete responses
 - Records in metrics with original status code and `truncated=true` flag
@@ -1138,9 +1146,10 @@ Maximum duration Kubo will wait for content retrieval (new bytes to arrive).
 **Monitoring:** Track `ipfs_http_gw_retrieval_timeouts_total` by status code and truncation status.
 
 **Tuning guidance:**
+
 - Compare timeout rates (`ipfs_http_gw_retrieval_timeouts_total`) with success rates (`ipfs_http_gw_responses_total{status="200"}`)
 - High timeout rate: consider increasing timeout or scaling horizontally if hardware is constrained
-- Many 504s may indicate routing problems - check requested CIDs and provider availability using https://check.ipfs.network/
+- Many 504s may indicate routing problems - check requested CIDs and provider availability using <https://check.ipfs.network/>
 - `truncated=true` timeouts indicate retrieval stalled mid-file with no new bytes for the timeout duration
 
 A value of 0 disables this timeout.
@@ -1158,6 +1167,7 @@ Protects nodes from traffic spikes and resource exhaustion, especially behind re
 **Monitoring:** `ipfs_http_gw_concurrent_requests` tracks current requests in flight.
 
 **Tuning guidance:**
+
 - Monitor `ipfs_http_gw_concurrent_requests` gauge for usage patterns
 - Track 429s (`ipfs_http_gw_responses_total{status="429"}`) and success rate (`{status="200"}`)
 - Near limit with low resource usage → increase value
@@ -1229,6 +1239,7 @@ or limit `verifiable.example.net` to response types defined in [Trustless Gatewa
 Hostnames can optionally be defined with one or more wildcards.
 
 Examples:
+
 - `*.example.com` will match requests to `http://foo.example.com/ipfs/*` or `http://{cid}.ipfs.bar.example.com/*`.
 - `foo-*.example.com` will match requests to `http://foo-bar.example.com/ipfs/*` or `http://{cid}.ipfs.foo-xyz.example.com/*`.
 
@@ -1237,6 +1248,7 @@ Examples:
 An array of paths that should be exposed on the hostname.
 
 Example:
+
 ```json
 {
   "Gateway": {
@@ -1263,8 +1275,9 @@ and provide [Origin isolation](https://developer.mozilla.org/en-US/docs/Web/Secu
 between content roots.
 
 - `true` - enables [subdomain gateway](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#subdomain-gateway) at `http://*.{hostname}/`
-    - **Requires whitelist:** make sure respective `Paths` are set.
+  - **Requires whitelist:** make sure respective `Paths` are set.
       For example, `Paths: ["/ipfs", "/ipns"]` are required for `http://{cid}.ipfs.{hostname}` and `http://{foo}.ipns.{hostname}` to work:
+
         ```json
         "Gateway": {
             "PublicGateways": {
@@ -1275,10 +1288,12 @@ between content roots.
             }
         }
         ```
-    - **Backward-compatible:** requests for content paths such as `http://{hostname}/ipfs/{cid}` produce redirect to `http://{cid}.ipfs.{hostname}`
+
+  - **Backward-compatible:** requests for content paths such as `http://{hostname}/ipfs/{cid}` produce redirect to `http://{cid}.ipfs.{hostname}`
 
 - `false` - enables [path gateway](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#path-gateway) at `http://{hostname}/*`
   - Example:
+
     ```json
     "Gateway": {
         "PublicGateways": {
@@ -1317,7 +1332,7 @@ into a single DNS label ([specification](https://specs.ipfs.tech/http-gateways/s
 DNSLink name inlining allows for HTTPS on public subdomain gateways with single
 label wildcard TLS certs (also enabled when passing `X-Forwarded-Proto: https`),
 and provides disjoint Origin per root CID when special rules like
-https://publicsuffix.org, or a custom localhost logic in browsers like Brave
+<https://publicsuffix.org>, or a custom localhost logic in browsers like Brave
 has to be applied.
 
 Default: `false`
@@ -1344,6 +1359,7 @@ Type: `flag`
 
 Default entries for `localhost` hostname and loopback IPs are always present.
 If additional config is provided for those hostnames, it will be merged on top of implicit values:
+
 ```json
 {
   "Gateway": {
@@ -1363,14 +1379,15 @@ For example, to disable subdomain gateway on `localhost`
 and make that hostname act the same as `127.0.0.1`:
 
 ```console
-$ ipfs config --json Gateway.PublicGateways '{"localhost": null }'
+ipfs config --json Gateway.PublicGateways '{"localhost": null }'
 ```
 
 ### `Gateway` recipes
 
 Below is a list of the most common gateway setups.
 
-* Public [subdomain gateway](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#subdomain-gateway) at `http://{cid}.ipfs.dweb.link` (each content root gets its own Origin)
+- Public [subdomain gateway](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#subdomain-gateway) at `http://{cid}.ipfs.dweb.link` (each content root gets its own Origin)
+
    ```console
    $ ipfs config --json Gateway.PublicGateways '{
        "dweb.link": {
@@ -1379,23 +1396,24 @@ Below is a list of the most common gateway setups.
        }
      }'
    ```
-   - **Performance:** Consider enabling `Routing.AcceleratedDHTClient=true` to improve content routing lookups. Separately, gateway operators should decide if the gateway node should also co-host and provide (announce) fetched content to the DHT. If providing content, enable `Provide.DHT.SweepEnabled=true` for efficient announcements. If announcements are still not fast enough, adjust `Provide.DHT.MaxWorkers`. For a read-only gateway that doesn't announce content, use `Provide.Enabled=false`.
-   - **Backward-compatible:** this feature enables automatic redirects from content paths to subdomains:
+
+  - **Performance:** Consider enabling `Routing.AcceleratedDHTClient=true` to improve content routing lookups. Separately, gateway operators should decide if the gateway node should also co-host and provide (announce) fetched content to the DHT. If providing content, enable `Provide.DHT.SweepEnabled=true` for efficient announcements. If announcements are still not fast enough, adjust `Provide.DHT.MaxWorkers`. For a read-only gateway that doesn't announce content, use `Provide.Enabled=false`.
+  - **Backward-compatible:** this feature enables automatic redirects from content paths to subdomains:
 
      `http://dweb.link/ipfs/{cid}` → `http://{cid}.ipfs.dweb.link`
 
-   - **X-Forwarded-Proto:** if you run Kubo behind a reverse proxy that provides TLS, make it add a `X-Forwarded-Proto: https` HTTP header to ensure users are redirected to `https://`, not `http://`. It will also ensure DNSLink names are inlined to fit in a single DNS label, so they work fine with a wildcard TLS cert ([details](https://github.com/ipfs/in-web-browsers/issues/169)). The NGINX directive is `proxy_set_header X-Forwarded-Proto "https";`.:
+  - **X-Forwarded-Proto:** if you run Kubo behind a reverse proxy that provides TLS, make it add a `X-Forwarded-Proto: https` HTTP header to ensure users are redirected to `https://`, not `http://`. It will also ensure DNSLink names are inlined to fit in a single DNS label, so they work fine with a wildcard TLS cert ([details](https://github.com/ipfs/in-web-browsers/issues/169)). The NGINX directive is `proxy_set_header X-Forwarded-Proto "https";`.:
 
      `http://dweb.link/ipfs/{cid}` → `https://{cid}.ipfs.dweb.link`
 
      `http://dweb.link/ipns/your-dnslink.site.example.com` → `https://your--dnslink-site-example-com.ipfs.dweb.link`
 
-   - **X-Forwarded-Host:** we also support `X-Forwarded-Host: example.com` if you want to override subdomain gateway host from the original request:
+  - **X-Forwarded-Host:** we also support `X-Forwarded-Host: example.com` if you want to override subdomain gateway host from the original request:
 
      `http://dweb.link/ipfs/{cid}` → `http://{cid}.ipfs.example.com`
 
+- Public [path gateway](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#path-gateway) at `http://ipfs.io/ipfs/{cid}` (no Origin separation)
 
-* Public [path gateway](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#path-gateway) at `http://ipfs.io/ipfs/{cid}` (no Origin separation)
    ```console
    $ ipfs config --json Gateway.PublicGateways '{
        "ipfs.io": {
@@ -1404,15 +1422,18 @@ Below is a list of the most common gateway setups.
        }
      }'
    ```
-   - **Performance:** Consider enabling `Routing.AcceleratedDHTClient=true` to improve content routing lookups. When running an open, recursive gateway, decide if the gateway should also co-host and provide (announce) fetched content to the DHT. If providing content, enable `Provide.DHT.SweepEnabled=true` for efficient announcements. If announcements are still not fast enough, adjust `Provide.DHT.MaxWorkers`. For a read-only gateway that doesn't announce content, use `Provide.Enabled=false`.
 
-* Public [DNSLink](https://dnslink.io/) gateway resolving every hostname passed in `Host` header.
+  - **Performance:** Consider enabling `Routing.AcceleratedDHTClient=true` to improve content routing lookups. When running an open, recursive gateway, decide if the gateway should also co-host and provide (announce) fetched content to the DHT. If providing content, enable `Provide.DHT.SweepEnabled=true` for efficient announcements. If announcements are still not fast enough, adjust `Provide.DHT.MaxWorkers`. For a read-only gateway that doesn't announce content, use `Provide.Enabled=false`.
+
+- Public [DNSLink](https://dnslink.io/) gateway resolving every hostname passed in `Host` header.
+
   ```console
-  $ ipfs config --json Gateway.NoDNSLink false
+  ipfs config --json Gateway.NoDNSLink false
   ```
-  * Note that `NoDNSLink: false` is the default (it works out of the box unless set to `true` manually)
 
-* Hardened, site-specific [DNSLink gateway](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#dnslink-gateway).
+  - Note that `NoDNSLink: false` is the default (it works out of the box unless set to `true` manually)
+
+- Hardened, site-specific [DNSLink gateway](https://docs.ipfs.tech/how-to/address-ipfs-on-web/#dnslink-gateway).
 
   Disable fetching of remote data (`NoFetch: true`) and resolving DNSLink at unknown hostnames (`NoDNSLink: true`).
   Then, enable DNSLink gateway only for the specific hostname (for which data
@@ -1680,9 +1701,10 @@ When `Ipns.MaxCacheTTL` is set, it defines the upper bound limit of how long a
 will be cached and read from cache before checking for updates.
 
 **Examples:**
-* `"1m"` IPNS results are cached 1m or less (good compromise for system where
+
+- `"1m"` IPNS results are cached 1m or less (good compromise for system where
   faster updates are desired).
-* `"0s"` IPNS caching is effectively turned off (useful for testing, bad for production use)
+- `"0s"` IPNS caching is effectively turned off (useful for testing, bad for production use)
   - **Note:** setting this to `0` will turn off TTL-based caching entirely.
     This is discouraged in production environments. It will make IPNS websites
     artificially slow because IPNS resolution results will expire as soon as
@@ -1692,7 +1714,6 @@ will be cached and read from cache before checking for updates.
 
 Default: No upper bound, [TTL from IPNS Record](https://specs.ipfs.tech/ipns/ipns-record/#ttl-uint64)  (see `ipns name publish --help`) is always respected.
 
-
 Type: `optionalDuration`
 
 ### `Ipns.UsePubsub`
@@ -1782,6 +1803,7 @@ Type: `string` (filesystem path)
 Mountpoint for Mutable File System (MFS) behind the `ipfs files` API.
 
 > [!CAUTION]
+>
 > - Write support is highly experimental and not recommended for mission-critical deployments.
 > - Avoid storing lazy-loaded datasets in MFS. Exposing a partially local, lazy-loaded DAG risks operating system search indexers crawling it, which may trigger unintended network prefetching of non-local DAG components.
 
@@ -1806,13 +1828,14 @@ A remote pinning service is a remote service that exposes an API for managing
 that service's interest in long-term data storage.
 
 The exposed API conforms to the specification defined at
-https://ipfs.github.io/pinning-services-api-spec/
+<https://ipfs.github.io/pinning-services-api-spec/>
 
 #### `Pinning.RemoteServices: API`
 
 Contains information relevant to utilizing the remote pinning service
 
 Example:
+
 ```json
 {
   "Pinning": {
@@ -1832,7 +1855,7 @@ Example:
 
 The HTTP(S) endpoint through which to access the pinning service
 
-Example: "https://pinningservice.tld:1234/my/api/path"
+Example: "<https://pinningservice.tld:1234/my/api/path>"
 
 Type: `string`
 
@@ -1884,9 +1907,9 @@ Type: `duration`
 
 ## `Provide`
 
-Configures CID announcements to the routing system, including both immediate 
-announcements for new content (provide) and periodic re-announcements 
-(reprovide) on systems that require it, like Amino DHT. While designed to support 
+Configures CID announcements to the routing system, including both immediate
+announcements for new content (provide) and periodic re-announcements
+(reprovide) on systems that require it, like Amino DHT. While designed to support
 multiple routing systems in the future, the current default configuration only supports providing to the Amino DHT.
 
 ### `Provide.Enabled`
@@ -1918,7 +1941,7 @@ Tells the provide system what should be announced. Valid strategies are:
     happens to already be connected to a provider and asks for child CID over
     bitswap.
 - `"mfs"` - announce only the local CIDs that are part of the MFS (`ipfs files`)
-   - Note: MFS is lazy-loaded. Only the MFS blocks present in local datastore are announced.
+  - Note: MFS is lazy-loaded. Only the MFS blocks present in local datastore are announced.
 - `"pinned+mfs"` - a combination of the `pinned` and `mfs` strategies.
   - **ℹ️ NOTE:** This is the suggested strategy for users who run without GC and don't want to provide everything in cache.
   - Order: first `pinned` and then the locally available part of `mfs`.
@@ -1945,9 +1968,11 @@ You can monitor the effectiveness of your provide configuration through metrics
 Different metrics are available depending on whether you use legacy mode (`SweepEnabled=false`) or sweep mode (`SweepEnabled=true`). See [Provide metrics documentation](https://github.com/ipfs/kubo/blob/master/docs/metrics.md#provide) for details.
 
 To enable detailed debug logging for both providers, set:
+
 ```sh
 GOLOG_LOG_LEVEL=error,provider=debug,dht/provider=debug
 ```
+
 - `provider=debug` enables generic logging (legacy provider and any non-dht operations)
 - `dht/provider=debug` enables logging for the sweep provider
 
@@ -1980,11 +2005,13 @@ Type: `optionalDuration` (unset for the default)
 Sets the maximum number of _concurrent_ DHT provide operations.
 
 **When `Provide.DHT.SweepEnabled` is false (legacy mode):**
+
 - Controls NEW CID announcements only
 - Reprovide operations do **not** count against this limit
 - A value of `0` allows unlimited provide workers
 
 **When `Provide.DHT.SweepEnabled` is true:**
+
 - Controls the total worker pool for both provide and reprovide operations
 - Workers are split between periodic reprovides and burst provides
 - Use a positive value to control resource usage
@@ -2000,7 +2027,7 @@ connections this setting can generate.
 > [!CAUTION]
 > For nodes without strict connection limits that need to provide large volumes
 > of content, we recommend first trying `Provide.DHT.SweepEnabled=true` for efficient
-> announcements. If announcements are still not fast enough, adjust `Provide.DHT.MaxWorkers`. 
+> announcements. If announcements are still not fast enough, adjust `Provide.DHT.MaxWorkers`.
 > As a last resort, consider enabling `Routing.AcceleratedDHTClient=true` but be aware that it is very resource hungry.
 >
 > At the same time, mind that raising this value too high may lead to increased load.
@@ -2018,7 +2045,7 @@ both provides and reprovides.
 
 Provide Sweep is a resource efficient technique for advertising content to
 the Amino DHT swarm. The Provide Sweep module tracks the keys that should be periodically reprovided in
-the `KeyStore`. It splits the keys into DHT keyspace regions by proximity (XOR
+the `Keystore`. It splits the keys into DHT keyspace regions by proximity (XOR
 distance), and schedules when reprovides should happen in order to spread the
 reprovide operation over time to avoid a spike in resource utilization. It
 basically sweeps the keyspace _from left to right_ over the
@@ -2030,11 +2057,11 @@ module, and is currently opt-in. You can compare the effectiveness of sweep mode
 
 Whenever new keys should be advertised to the Amino DHT, `kubo` calls
 `StartProviding()`, triggering an initial `provide` operation for the given
-keys. The keys will be added to the `KeyStore` tracking which keys should be
+keys. The keys will be added to the `Keystore` tracking which keys should be
 reprovided and when they should be reprovided. Calling `StopProviding()`
-removes the keys from the `KeyStore`. However, it is currently tricky for
+removes the keys from the `Keystore`. However, it is currently tricky for
 `kubo` to detect when a key should stop being advertised. Hence, `kubo` will
-periodically refresh the `KeyStore` at each [`Provide.DHT.Interval`](#providedhtinterval)
+periodically refresh the `Keystore` at each [`Provide.DHT.Interval`](#providedhtinterval)
 by providing it a channel of all the keys it is expected to contain according
 to the [`Provide.Strategy`](#providestrategy). During this operation,
 all keys in the `Keystore` are purged, and only the given ones remain scheduled.
@@ -2053,7 +2080,6 @@ all keys in the `Keystore` are purged, and only the given ones remain scheduled.
 >
 > Sweep mode provides similar effectiveness to Accelerated DHT but with steady resource usage - better for machines with limited CPU, memory, or network bandwidth.
 
-
 > [!NOTE]
 > This feature is opt-in for now, but will become the default in a future release.
 > Eventually, this configuration flag will be removed once the feature is stable.
@@ -2062,15 +2088,14 @@ Default: `false`
 
 Type: `flag`
 
-
 #### `Provide.DHT.DedicatedPeriodicWorkers`
 
 Number of workers dedicated to periodic keyspace region reprovides. Only applies when `Provide.DHT.SweepEnabled` is true.
 
 Among the [`Provide.DHT.MaxWorkers`](#providedhtmaxworkers), this
-number of workers will be dedicated to the periodic region reprovide only. The sum of 
-`DedicatedPeriodicWorkers` and `DedicatedBurstWorkers` should not exceed `MaxWorkers`. 
-Any remaining workers (MaxWorkers - DedicatedPeriodicWorkers - DedicatedBurstWorkers) 
+number of workers will be dedicated to the periodic region reprovide only. The sum of
+`DedicatedPeriodicWorkers` and `DedicatedBurstWorkers` should not exceed `MaxWorkers`.
+Any remaining workers (MaxWorkers - DedicatedPeriodicWorkers - DedicatedBurstWorkers)
 form a shared pool that can be used for either type of work as needed.
 
 Default: `2`
@@ -2083,6 +2108,7 @@ operation can be performed by free non-dedicated workers)
 Number of workers dedicated to burst provides. Only applies when `Provide.DHT.SweepEnabled` is true.
 
 Burst provides are triggered by:
+
 - Manual provide commands (`ipfs routing provide`)
 - New content matching your `Provide.Strategy` (blocks from `ipfs add`, bitswap, or trustless gateway requests)
 - Catch-up reprovides after being disconnected/offline for a while
@@ -2120,10 +2146,10 @@ Default: `16`
 
 Type: `optionalInteger` (non-negative)
 
-#### `Provide.DHT.KeyStoreBatchSize`
+#### `Provide.DHT.KeystoreBatchSize`
 
-During the garbage collection, all keys stored in the KeyStore are removed, and
-the keys are streamed from a channel to fill the KeyStore again with up-to-date
+During the garbage collection, all keys stored in the Keystore are removed, and
+the keys are streamed from a channel to fill the Keystore again with up-to-date
 keys. Since a high number of CIDs to reprovide can easily fill up the memory,
 keys are read and written in batches to optimize for memory usage.
 
@@ -2173,6 +2199,7 @@ This field was unused. Use [`Provide.Strategy`](#providestrategy) instead.
 **REMOVED**
 
 Replaced with [`Provide.DHT.MaxWorkers`](#providedhtmaxworkers).
+
 ## `Pubsub`
 
 **DEPRECATED**: See [#9717](https://github.com/ipfs/kubo/issues/9717)
@@ -2197,9 +2224,9 @@ Type: `flag`
 
 Sets the default router used by pubsub to route messages to peers. This can be one of:
 
-* `"floodsub"` - floodsub is a basic router that simply _floods_ messages to all
+- `"floodsub"` - floodsub is a basic router that simply _floods_ messages to all
   connected peers. This router is extremely inefficient but _very_ reliable.
-* `"gossipsub"` - [gossipsub][] is a more advanced routing algorithm that will
+- `"gossipsub"` - [gossipsub][] is a more advanced routing algorithm that will
   build an overlay mesh from a subset of the links in the network.
 
 Default: `"gossipsub"`
@@ -2278,11 +2305,11 @@ improve reliability.
 
 Use-cases:
 
-* An IPFS gateway connected to an IPFS cluster should peer to ensure that the
+- An IPFS gateway connected to an IPFS cluster should peer to ensure that the
   gateway can always fetch content from the cluster.
-* A dapp may peer embedded Kubo nodes with a set of pinning services or
+- A dapp may peer embedded Kubo nodes with a set of pinning services or
   textile cafes/hubs.
-* A set of friends may peer to ensure that they can always fetch each other's
+- A set of friends may peer to ensure that they can always fetch each other's
   content.
 
 When a node is added to the set of peered nodes, Kubo will:
@@ -2298,9 +2325,9 @@ When a node is added to the set of peered nodes, Kubo will:
 
 Peering can be asymmetric or symmetric:
 
-* When symmetric, the connection will be protected by both nodes and will likely
+- When symmetric, the connection will be protected by both nodes and will likely
   be very stable.
-* When asymmetric, only one node (the node that configured peering) will protect
+- When asymmetric, only one node (the node that configured peering) will protect
   the connection and attempt to re-connect to the peered node on disconnect. If
   the peered node is under heavy load and/or has a low connection limit, the
   connection may flap repeatedly. Be careful when asymmetrically peering to not
@@ -2349,6 +2376,7 @@ Replaced with [`Provide.DHT.Interval`](#providedhtinterval).
 **REMOVED**
 
 Replaced with [`Provide.Strategy`](#providestrategy).
+
 ## `Routing`
 
 Contains options for content, peer, and IPNS routing mechanisms.
@@ -2357,25 +2385,25 @@ Contains options for content, peer, and IPNS routing mechanisms.
 
 There are multiple routing options: "auto", "autoclient", "none", "dht", "dhtclient", "delegated", and "custom".
 
-* **DEFAULT:** If unset, or set to "auto", your node will use the public IPFS DHT (aka "Amino")
+- **DEFAULT:** If unset, or set to "auto", your node will use the public IPFS DHT (aka "Amino")
   and parallel [`Routing.DelegatedRouters`](#routingdelegatedrouters) for additional speed.
 
-* If set to "autoclient", your node will behave as in "auto" but without running a DHT server.
+- If set to "autoclient", your node will behave as in "auto" but without running a DHT server.
 
-* If set to "none", your node will use _no_ routing system. You'll have to
+- If set to "none", your node will use _no_ routing system. You'll have to
   explicitly connect to peers that have the content you're looking for.
 
-* If set to "dht" (or "dhtclient"/"dhtserver"), your node will ONLY use the Amino DHT (no HTTP routers).
+- If set to "dht" (or "dhtclient"/"dhtserver"), your node will ONLY use the Amino DHT (no HTTP routers).
 
-* If set to "custom", all default routers are disabled, and only ones defined in `Routing.Routers` will be used.
+- If set to "custom", all default routers are disabled, and only ones defined in `Routing.Routers` will be used.
 
 When the DHT is enabled, it can operate in two modes: client and server.
 
-* In server mode, your node will query other peers for DHT records, and will
+- In server mode, your node will query other peers for DHT records, and will
   respond to requests from other peers (both requests to store records and
   requests to retrieve records).
 
-* In client mode, your node will query the DHT as a client but will not respond
+- In client mode, your node will query the DHT as a client but will not respond
   to requests from other peers. This mode is less resource-intensive than server
   mode.
 
@@ -2395,7 +2423,7 @@ in addition to the Amino DHT.
 When `Routing.Type` is set to `delegated`, your node will use **only** HTTP delegated routers and IPNS publishers,
 without initializing the Amino DHT at all. This mode is useful for environments where peer-to-peer DHT connectivity
 is not available or desired, while still enabling content routing and IPNS publishing via HTTP APIs.
-This mode requires configuring [`Routing.DelegatedRouters`](#routingdelegatedrouters) for content routing and 
+This mode requires configuring [`Routing.DelegatedRouters`](#routingdelegatedrouters) for content routing and
 [`Ipns.DelegatedPublishers`](#ipnsdelegatedpublishers) for IPNS publishing.
 
 **Note:** `delegated` mode operates as read-only for content providing - your node cannot announce content to the network
@@ -2407,7 +2435,6 @@ Default: `auto` (DHT + [`Routing.DelegatedRouters`](#routingdelegatedrouters))
 
 Type: `optionalString` (`null`/missing means the default)
 
-
 ### `Routing.AcceleratedDHTClient`
 
 This alternative Amino DHT client with a Full-Routing-Table strategy will
@@ -2424,6 +2451,7 @@ This is not compatible with `Routing.Type` `custom`. If you are using composable
 you can configure this individually on each router.
 
 When it is enabled:
+
 - Client DHT operations (reads and writes) should complete much faster
 - The provider will now use a keyspace sweeping mode allowing to keep alive
   CID sets that are multiple orders of magnitude larger.
@@ -2437,6 +2465,7 @@ When it is enabled:
 - The operations `ipfs stats dht` will default to showing information about the accelerated DHT client
 
 **Caveats:**
+
 1. Running the accelerated client likely will result in more resource consumption (connections, RAM, CPU, bandwidth)
    - Users that are limited in the number of parallel connections their machines/networks can perform will likely suffer
    - The resource usage is not smooth as the client crawls the network in rounds and reproviding is similarly done in rounds
@@ -2540,29 +2569,33 @@ Type: `string`
 Parameters needed to create the specified router. Supported params per router type:
 
 HTTP:
-  - `Endpoint` (mandatory): URL that will be used to connect to a specified router.
-  - `MaxProvideBatchSize`: This number determines the maximum amount of CIDs sent per batch. Servers might not accept more than 100 elements per batch. 100 elements by default.
-  - `MaxProvideConcurrency`: It determines the number of threads used when providing content. GOMAXPROCS by default.
+
+- `Endpoint` (mandatory): URL that will be used to connect to a specified router.
+- `MaxProvideBatchSize`: This number determines the maximum amount of CIDs sent per batch. Servers might not accept more than 100 elements per batch. 100 elements by default.
+- `MaxProvideConcurrency`: It determines the number of threads used when providing content. GOMAXPROCS by default.
 
 DHT:
-  - `"Mode"`: Mode used by the Amino DHT. Possible values: "server", "client", "auto"
-  - `"AcceleratedDHTClient"`: Set to `true` if you want to use the acceleratedDHT.
-  - `"PublicIPNetwork"`: Set to `true` to create a `WAN` DHT. Set to `false` to create a `LAN` DHT.
+
+- `"Mode"`: Mode used by the Amino DHT. Possible values: "server", "client", "auto"
+- `"AcceleratedDHTClient"`: Set to `true` if you want to use the acceleratedDHT.
+- `"PublicIPNetwork"`: Set to `true` to create a `WAN` DHT. Set to `false` to create a `LAN` DHT.
 
 Parallel:
-  - `Routers`: A list of routers that will be executed in parallel:
-    - `Name:string`: Name of the router. It should be one of the previously added to `Routers` list.
-    - `Timeout:duration`: Local timeout. It accepts strings compatible with Go `time.ParseDuration(string)` (`10s`, `1m`, `2h`). Time will start counting when this specific router is called, and it will stop when the router returns, or we reach the specified timeout.
-    - `ExecuteAfter:duration`: Providing this param will delay the execution of that router at the specified time. It accepts strings compatible with Go `time.ParseDuration(string)` (`10s`, `1m`, `2h`).
-    - `IgnoreErrors:bool`: It will specify if that router should be ignored if an error occurred.
-  - `Timeout:duration`: Global timeout.  It accepts strings compatible with Go `time.ParseDuration(string)` (`10s`, `1m`, `2h`).
+
+- `Routers`: A list of routers that will be executed in parallel:
+  - `Name:string`: Name of the router. It should be one of the previously added to `Routers` list.
+  - `Timeout:duration`: Local timeout. It accepts strings compatible with Go `time.ParseDuration(string)` (`10s`, `1m`, `2h`). Time will start counting when this specific router is called, and it will stop when the router returns, or we reach the specified timeout.
+  - `ExecuteAfter:duration`: Providing this param will delay the execution of that router at the specified time. It accepts strings compatible with Go `time.ParseDuration(string)` (`10s`, `1m`, `2h`).
+  - `IgnoreErrors:bool`: It will specify if that router should be ignored if an error occurred.
+- `Timeout:duration`: Global timeout.  It accepts strings compatible with Go `time.ParseDuration(string)` (`10s`, `1m`, `2h`).
 
 Sequential:
-  - `Routers`: A list of routers that will be executed in order:
-    - `Name:string`: Name of the router. It should be one of the previously added to `Routers` list.
-    - `Timeout:duration`: Local timeout. It accepts strings compatible with Go `time.ParseDuration(string)`. Time will start counting when this specific router is called, and it will stop when the router returns, or we reach the specified timeout.
-    - `IgnoreErrors:bool`: It will specify if that router should be ignored if an error occurred.
-  - `Timeout:duration`: Global timeout.  It accepts strings compatible with Go `time.ParseDuration(string)`.
+
+- `Routers`: A list of routers that will be executed in order:
+  - `Name:string`: Name of the router. It should be one of the previously added to `Routers` list.
+  - `Timeout:duration`: Local timeout. It accepts strings compatible with Go `time.ParseDuration(string)`. Time will start counting when this specific router is called, and it will stop when the router returns, or we reach the specified timeout.
+  - `IgnoreErrors:bool`: It will specify if that router should be ignored if an error occurred.
+- `Timeout:duration`: Global timeout.  It accepts strings compatible with Go `time.ParseDuration(string)`.
 
 Default: `{}` (use the safe implicit defaults)
 
@@ -2580,6 +2613,7 @@ Type: `object[string->string]`
 The key will be the name of the method: `"provide"`, `"find-providers"`, `"find-peers"`, `"put-ipns"`, `"get-ipns"`. All methods must be added to the list.
 
 The value will contain:
+
 - `RouterName:string`: Name of the router. It should be one of the previously added to `Routing.Routers` list.
 
 Type: `object[string->object]`
@@ -2789,7 +2823,6 @@ Default: `131072` (128 kb)
 
 Type: `optionalInteger`
 
-
 #### `Swarm.RelayService.ReservationTTL`
 
 Duration of a new or refreshed reservation.
@@ -2798,7 +2831,6 @@ Default: `"1h"`
 
 Type: `duration`
 
-
 #### `Swarm.RelayService.MaxReservations`
 
 Maximum number of active relay slots.
@@ -2807,7 +2839,6 @@ Default: `128`
 
 Type: `optionalInteger`
 
-
 #### `Swarm.RelayService.MaxCircuits`
 
 Maximum number of open relay connections for each peer.
@@ -2816,7 +2847,6 @@ Default: `16`
 
 Type: `optionalInteger`
 
-
 #### `Swarm.RelayService.BufferSize`
 
 Size of the relayed connection buffers.
@@ -2825,7 +2855,6 @@ Default: `2048`
 
 Type: `optionalInteger`
 
-
 #### `Swarm.RelayService.MaxReservationsPerPeer`
 
 **REMOVED in kubo 0.32 due to [go-libp2p#2974](https://github.com/libp2p/go-libp2p/pull/2974)**
@@ -2869,8 +2898,8 @@ Please use [`AutoNAT.ServiceMode`](#autonatservicemode).
 The connection manager determines which and how many connections to keep and can
 be configured to keep. Kubo currently supports two connection managers:
 
-* none: never close idle connections.
-* basic: the default connection manager.
+- none: never close idle connections.
+- basic: the default connection manager.
 
 By default, this section is empty and the implicit defaults defined below
 are used.
@@ -2894,11 +2923,11 @@ connections. The process of closing connections happens every `SilencePeriod`.
 
 The connection manager considers a connection idle if:
 
-* It has not been explicitly _protected_ by some subsystem. For example, Bitswap
+- It has not been explicitly _protected_ by some subsystem. For example, Bitswap
   will protect connections to peers from which it is actively downloading data,
   the DHT will protect some peers for routing, and the peering subsystem will
   protect all "peered" nodes.
-* It has existed for longer than the `GracePeriod`.
+- It has existed for longer than the `GracePeriod`.
 
 **Example:**
 
@@ -3037,8 +3066,9 @@ Default: Enabled
 Type: `flag`
 
 Listen Addresses:
-* /ip4/0.0.0.0/tcp/4001 (default)
-* /ip6/::/tcp/4001 (default)
+
+- /ip4/0.0.0.0/tcp/4001 (default)
+- /ip6/::/tcp/4001 (default)
 
 #### `Swarm.Transports.Network.Websocket`
 
@@ -3053,8 +3083,9 @@ Default: Enabled
 Type: `flag`
 
 Listen Addresses:
-* /ip4/0.0.0.0/tcp/4001/ws
-* /ip6/::/tcp/4001/ws
+
+- /ip4/0.0.0.0/tcp/4001/ws
+- /ip6/::/tcp/4001/ws
 
 #### `Swarm.Transports.Network.QUIC`
 
@@ -3072,6 +3103,7 @@ Default: Enabled
 Type: `flag`
 
 Listen Addresses:
+
 - `/ip4/0.0.0.0/udp/4001/quic-v1` (default)
 - `/ip6/::/udp/4001/quic-v1` (default)
 
@@ -3084,10 +3116,11 @@ Allows IPFS node to connect to other peers using their `/p2p-circuit`
 NATs.
 
 See also:
+
 - Docs: [Libp2p Circuit Relay](https://docs.libp2p.io/concepts/circuit-relay/)
 - [`Swarm.RelayClient.Enabled`](#swarmrelayclientenabled) for getting a public
--  `/p2p-circuit` address when behind a firewall.
-  - [`Swarm.EnableHolePunching`](#swarmenableholepunching) for direct connection upgrade through relay
+- `/p2p-circuit` address when behind a firewall.
+- [`Swarm.EnableHolePunching`](#swarmenableholepunching) for direct connection upgrade through relay
 - [`Swarm.RelayService.Enabled`](#swarmrelayserviceenabled) for becoming a
   limited relay for other peers
 
@@ -3096,9 +3129,9 @@ Default: Enabled
 Type: `flag`
 
 Listen Addresses:
-* This transport is special. Any node that enables this transport can receive
-  inbound connections on this transport, without specifying a listen address.
 
+- This transport is special. Any node that enables this transport can receive
+  inbound connections on this transport, without specifying a listen address.
 
 #### `Swarm.Transports.Network.WebTransport`
 
@@ -3121,6 +3154,7 @@ Default: Enabled
 Type: `flag`
 
 Listen Addresses:
+
 - `/ip4/0.0.0.0/udp/4001/quic-v1/webtransport` (default)
 - `/ip6/::/udp/4001/quic-v1/webtransport` (default)
 
@@ -3151,6 +3185,7 @@ Default: Enabled
 Type: `flag`
 
 Listen Addresses:
+
 - `/ip4/0.0.0.0/udp/4001/webrtc-direct` (default)
 - `/ip6/::/udp/4001/webrtc-direct` (default)
 
@@ -3223,7 +3258,7 @@ Type: `priority`
 
 ### `Swarm.Transports.Multiplexers.Mplex`
 
-**REMOVED**: See https://github.com/ipfs/kubo/issues/9958
+**REMOVED**: See <https://github.com/ipfs/kubo/issues/9958>
 
 Support for Mplex has been [removed from Kubo and go-libp2p](https://github.com/libp2p/specs/issues/553).
 Please remove this option from your config.
@@ -3240,6 +3275,7 @@ This allows for overriding the default DNS resolver provided by the operating sy
 and using different resolvers per domain or TLD (including ones from alternative, non-ICANN naming systems).
 
 Example:
+
 ```json
 {
   "DNS": {
@@ -3254,9 +3290,10 @@ Example:
 ```
 
 Be mindful that:
+
 - Currently only `https://` URLs for [DNS over HTTPS (DoH)](https://en.wikipedia.org/wiki/DNS_over_HTTPS) endpoints are supported as values.
 - The default catch-all resolver is the cleartext one provided by your operating system. It can be overridden by adding a DoH entry for the DNS root indicated by  `.` as illustrated above.
-- Out-of-the-box support for selected non-ICANN TLDs relies on third-party centralized services provided by respective communities on best-effort basis. 
+- Out-of-the-box support for selected non-ICANN TLDs relies on third-party centralized services provided by respective communities on best-effort basis.
 - The special value `"auto"` uses DNS resolvers from [AutoConf](#autoconf) when enabled. For example: `{".": "auto"}` uses any custom DoH resolver (global or per TLD) provided by AutoConf system.
 
 Default: `{".": "auto"}`
@@ -3273,8 +3310,9 @@ If present, the upper bound is applied to DoH resolvers in [`DNS.Resolvers`](#dn
 Note: this does NOT work with Go's default DNS resolver. To make this a global setting, add a `.` entry to `DNS.Resolvers` first.
 
 **Examples:**
-* `"1m"` DNS entries are kept for 1 minute or less.
-* `"0s"` DNS entries expire as soon as they are retrieved.
+
+- `"1m"` DNS entries are kept for 1 minute or less.
+- `"0s"` DNS entries expire as soon as they are retrieved.
 
 Default: Respect DNS Response TTL
 
@@ -3306,6 +3344,7 @@ and the HTTPS server returns HTTP 200 for the [probe path](https://specs.ipfs.te
 > This feature is relatively new. Please report any issues via [Github](https://github.com/ipfs/kubo/issues/new).
 >
 > Important notes:
+>
 > - TLS and HTTP/2 are required. For privacy reasons, and to maintain feature-parity with browsers, unencrypted `http://` providers are ignored and not used.
 > - This feature works in the same way as Bitswap: connected HTTP-peers receive optimistic block requests even for content that they are not announcing.
 > - For performance reasons, and to avoid loops, the HTTP client does not follow redirects. Providers should keep announcements up to date.
@@ -3332,7 +3371,6 @@ Type: `array[string]`
 Optional list of hostnames for which HTTP retrieval is not allowed.
 Denylist entries take precedence over Allowlist entries.
 
-
 > [!TIP]
 > This denylist operates on HTTP endpoint hostnames.
 > To deny specific PeerID, use [`Routing.IgnoreProviders`](#routingignoreproviders) instead.
@@ -3404,6 +3442,7 @@ Type: `flag`
 The default UnixFS chunker. Commands affected: `ipfs add`.
 
 Valid formats:
+
 - `size-<bytes>` - fixed size chunker
 - `rabin-<min>-<avg>-<max>` - rabin fingerprint chunker  
 - `buzhash` - buzhash chunker
@@ -3515,7 +3554,7 @@ networking stack. At the time of writing this, IPFS peers on the public swarm
 tend to ignore requests for blocks bigger than 2MiB.
 
 Uses implementation from `boxo/ipld/unixfs/io/directory`, where the size is not
-the *exact* block size of the encoded directory but just the estimated size
+the _exact_ block size of the encoded directory but just the estimated size
 based byte length of DAG-PB Links names and CIDs.
 
 Setting to `1B` is functionally equivalent to always using HAMT (useful in testing).
@@ -3538,7 +3577,7 @@ Optional suffix to the AgentVersion presented by `ipfs id` and exposed via [libp
 The value from config takes precedence over value passed via `ipfs daemon --agent-version-suffix`.
 
 > [!NOTE]
-> Setting a custom version suffix helps with ecosystem analysis, such as Amino DHT reports published at https://stats.ipfs.network
+> Setting a custom version suffix helps with ecosystem analysis, such as Amino DHT reports published at <https://stats.ipfs.network>
 
 Default: `""` (no suffix, or value from `ipfs daemon --agent-version-suffix=`)
 

From dcbb1e99f2d8932d69172b511bfd5049d1dbd170 Mon Sep 17 00:00:00 2001
From: Marcin Rataj <lidel@lidel.org>
Date: Sat, 27 Sep 2025 02:05:18 +0200
Subject: [PATCH 08/16] fix: update webui to v4.9.1 (#10994)

https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.1
(cherry picked from commit 1dffcb892f85fd7138bd8fa808427c98de9eb654)
---
 core/corehttp/webui.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/corehttp/webui.go b/core/corehttp/webui.go
index 717c8ae1a..18c455b16 100644
--- a/core/corehttp/webui.go
+++ b/core/corehttp/webui.go
@@ -12,7 +12,7 @@ import (
 )
 
 // WebUI version confirmed to work with this Kubo version
-const WebUIPath = "/ipfs/bafybeietkqxghs3hm56e3w64s4papqlvvzqzjigs4eyuy24plkpz652fee" // v4.9.0
+const WebUIPath = "/ipfs/bafybeicg7e6o2eszkfdzxg5233gmuip2a7kfzoloh7voyvt2r6ivdet54u" // v4.9.1
 
 // WebUIPaths is a list of all past webUI paths.
 var WebUIPaths = []string{

From b8715251e9b7bd5e3512cf9be18b3b574cd3ca11 Mon Sep 17 00:00:00 2001
From: Marcin Rataj <lidel@lidel.org>
Date: Sat, 27 Sep 2025 02:42:00 +0200
Subject: [PATCH 09/16] chore: update boxo and kad-dht dependencies (#10995)

- update boxo to v0.34.1-0.20250926171300-4c0aa3a121fb
- update go-libp2p-kad-dht to v0.34.1-0.20250926161957-861573b39723
- update changelog to reference webui v4.9.1

(cherry picked from commit 13fbb76de4dd0ba89b573371f7b3cf8a9c0b07fd)
---
 docs/changelogs/v0.38.md               | 8 ++++----
 docs/examples/kubo-as-a-library/go.mod | 4 ++--
 docs/examples/kubo-as-a-library/go.sum | 8 ++++----
 go.mod                                 | 4 ++--
 go.sum                                 | 8 ++++----
 test/dependencies/go.mod               | 4 ++--
 test/dependencies/go.sum               | 8 ++++----
 7 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/docs/changelogs/v0.38.md b/docs/changelogs/v0.38.md
index 692217846..1510e78b4 100644
--- a/docs/changelogs/v0.38.md
+++ b/docs/changelogs/v0.38.md
@@ -78,7 +78,7 @@ Gateway error pages now provide more actionable information during content retri
 
 #### 🎨 Updated WebUI
 
-The Web UI has been updated to [v4.9.0](https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.0) with a new **Diagnostics** screen for troubleshooting and system monitoring. Access it at `http://127.0.0.1:5001/webui` when running your local IPFS node.
+The Web UI has been updated to [v4.9](https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.0) with a new **Diagnostics** screen for troubleshooting and system monitoring. Access it at `http://127.0.0.1:5001/webui` when running your local IPFS node.
 
 | Diagnostics: Logs | Files: Check Retrieval | Diagnostics: Retrieval Results |
 |:---:|:---:|:---:|
@@ -119,9 +119,9 @@ The new [`Internal.MFSNoFlushLimit`](https://github.com/ipfs/kubo/blob/master/do
 
 ### 📦️ Important dependency updates
 
-- update `boxo` to [v0.34.1-0.20250919000230-031df82b284f](https://github.com/ipfs/boxo/commit/031df82b284f)
-- update `go-libp2p-kad-dht` to [v0.34.1-0.20250918150625-2e3cea182b63](https://github.com/libp2p/go-libp2p-kad-dht/commit/2e3cea182b63)
-- update `ipfs-webui` to [v4.9.0](https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.0)
+- update `boxo` to [v0.34.1-0.20250926171300-4c0aa3a121fb](https://github.com/ipfs/boxo/commit/4c0aa3a121fb)
+- update `go-libp2p-kad-dht` to [v0.34.1-0.20250926161957-861573b39723](https://github.com/libp2p/go-libp2p-kad-dht/commit/861573b39723)
+- update `ipfs-webui` to [v4.9.1](https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.1) (incl. [v4.9.0](https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.0))
 
 ### 📝 Changelog
 
diff --git a/docs/examples/kubo-as-a-library/go.mod b/docs/examples/kubo-as-a-library/go.mod
index 6d4ae40de..4b6c93df6 100644
--- a/docs/examples/kubo-as-a-library/go.mod
+++ b/docs/examples/kubo-as-a-library/go.mod
@@ -7,7 +7,7 @@ go 1.25
 replace github.com/ipfs/kubo => ./../../..
 
 require (
-	github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28
+	github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb
 	github.com/ipfs/kubo v0.0.0-00010101000000-000000000000
 	github.com/libp2p/go-libp2p v0.43.0
 	github.com/multiformats/go-multiaddr v0.16.1
@@ -114,7 +114,7 @@ require (
 	github.com/libp2p/go-doh-resolver v0.5.0 // indirect
 	github.com/libp2p/go-flow-metrics v0.3.0 // indirect
 	github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
-	github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250918150625-2e3cea182b63 // indirect
+	github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 // indirect
 	github.com/libp2p/go-libp2p-kbucket v0.8.0 // indirect
 	github.com/libp2p/go-libp2p-pubsub v0.14.2 // indirect
 	github.com/libp2p/go-libp2p-pubsub-router v0.6.0 // indirect
diff --git a/docs/examples/kubo-as-a-library/go.sum b/docs/examples/kubo-as-a-library/go.sum
index 9d28cad54..3b0e2cf77 100644
--- a/docs/examples/kubo-as-a-library/go.sum
+++ b/docs/examples/kubo-as-a-library/go.sum
@@ -289,8 +289,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28 h1:kDoj2V7ghhLdQeQUtzr605tb6NJ4AzwRYtXFJas+Wyc=
-github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb h1:6d2KcZ49XfEoCPfV0MF6g9YGulccUkfjWB1mtRpV/+o=
+github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
@@ -432,8 +432,8 @@ github.com/libp2p/go-libp2p-asn-util v0.4.1 h1:xqL7++IKD9TBFMgnLPZR6/6iYhawHKHl9
 github.com/libp2p/go-libp2p-asn-util v0.4.1/go.mod h1:d/NI6XZ9qxw67b4e+NgpQexCIiFYJjErASrYW4PFDN8=
 github.com/libp2p/go-libp2p-core v0.2.4/go.mod h1:STh4fdfa5vDYr0/SzYYeqnt+E6KfEV5VxfIrm0bcI0g=
 github.com/libp2p/go-libp2p-core v0.3.0/go.mod h1:ACp3DmS3/N64c2jDzcV429ukDpicbL6+TrrxANBjPGw=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250918150625-2e3cea182b63 h1:XQSASQ9N5haD/uYmop/633tYMZNsM+lKKI8/Is30w4o=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250918150625-2e3cea182b63/go.mod h1:HbI1rUTFF87WHklzKTGZC8Oys9+1rkKyqvmSZcAW55Y=
+github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 h1:5t+1NZ8ZZPl7c6+Rpa5KaSZ9NbF7wQB3BFklaZ3yk0g=
+github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723/go.mod h1:HbI1rUTFF87WHklzKTGZC8Oys9+1rkKyqvmSZcAW55Y=
 github.com/libp2p/go-libp2p-kbucket v0.3.1/go.mod h1:oyjT5O7tS9CQurok++ERgc46YLwEpuGoFq9ubvoUOio=
 github.com/libp2p/go-libp2p-kbucket v0.8.0 h1:QAK7RzKJpYe+EuSEATAaaHYMYLkPDGC18m9jxPLnU8s=
 github.com/libp2p/go-libp2p-kbucket v0.8.0/go.mod h1:JMlxqcEyKwO6ox716eyC0hmiduSWZZl6JY93mGaaqc4=
diff --git a/go.mod b/go.mod
index 5caa10cc5..d75bd27eb 100644
--- a/go.mod
+++ b/go.mod
@@ -22,7 +22,7 @@ require (
 	github.com/hashicorp/go-version v1.7.0
 	github.com/ipfs-shipyard/nopfs v0.0.14
 	github.com/ipfs-shipyard/nopfs/ipfs v0.25.0
-	github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28
+	github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb
 	github.com/ipfs/go-block-format v0.2.3
 	github.com/ipfs/go-cid v0.5.0
 	github.com/ipfs/go-cidutil v0.1.0
@@ -53,7 +53,7 @@ require (
 	github.com/libp2p/go-doh-resolver v0.5.0
 	github.com/libp2p/go-libp2p v0.43.0
 	github.com/libp2p/go-libp2p-http v0.5.0
-	github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250918150625-2e3cea182b63
+	github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723
 	github.com/libp2p/go-libp2p-kbucket v0.8.0
 	github.com/libp2p/go-libp2p-pubsub v0.14.2
 	github.com/libp2p/go-libp2p-pubsub-router v0.6.0
diff --git a/go.sum b/go.sum
index 98b74da8c..db3b2f06f 100644
--- a/go.sum
+++ b/go.sum
@@ -356,8 +356,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28 h1:kDoj2V7ghhLdQeQUtzr605tb6NJ4AzwRYtXFJas+Wyc=
-github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb h1:6d2KcZ49XfEoCPfV0MF6g9YGulccUkfjWB1mtRpV/+o=
+github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
@@ -516,8 +516,8 @@ github.com/libp2p/go-libp2p-gostream v0.6.0 h1:QfAiWeQRce6pqnYfmIVWJFXNdDyfiR/qk
 github.com/libp2p/go-libp2p-gostream v0.6.0/go.mod h1:Nywu0gYZwfj7Jc91PQvbGU8dIpqbQQkjWgDuOrFaRdA=
 github.com/libp2p/go-libp2p-http v0.5.0 h1:+x0AbLaUuLBArHubbbNRTsgWz0RjNTy6DJLOxQ3/QBc=
 github.com/libp2p/go-libp2p-http v0.5.0/go.mod h1:glh87nZ35XCQyFsdzZps6+F4HYI6DctVFY5u1fehwSg=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250918150625-2e3cea182b63 h1:XQSASQ9N5haD/uYmop/633tYMZNsM+lKKI8/Is30w4o=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250918150625-2e3cea182b63/go.mod h1:HbI1rUTFF87WHklzKTGZC8Oys9+1rkKyqvmSZcAW55Y=
+github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 h1:5t+1NZ8ZZPl7c6+Rpa5KaSZ9NbF7wQB3BFklaZ3yk0g=
+github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723/go.mod h1:HbI1rUTFF87WHklzKTGZC8Oys9+1rkKyqvmSZcAW55Y=
 github.com/libp2p/go-libp2p-kbucket v0.3.1/go.mod h1:oyjT5O7tS9CQurok++ERgc46YLwEpuGoFq9ubvoUOio=
 github.com/libp2p/go-libp2p-kbucket v0.8.0 h1:QAK7RzKJpYe+EuSEATAaaHYMYLkPDGC18m9jxPLnU8s=
 github.com/libp2p/go-libp2p-kbucket v0.8.0/go.mod h1:JMlxqcEyKwO6ox716eyC0hmiduSWZZl6JY93mGaaqc4=
diff --git a/test/dependencies/go.mod b/test/dependencies/go.mod
index bfbeb31a2..9df3b0a5c 100644
--- a/test/dependencies/go.mod
+++ b/test/dependencies/go.mod
@@ -135,7 +135,7 @@ require (
 	github.com/huin/goupnp v1.3.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
-	github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28 // indirect
+	github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb // indirect
 	github.com/ipfs/go-bitfield v1.1.0 // indirect
 	github.com/ipfs/go-block-format v0.2.3 // indirect
 	github.com/ipfs/go-cid v0.5.0 // indirect
@@ -183,7 +183,7 @@ require (
 	github.com/libp2p/go-flow-metrics v0.3.0 // indirect
 	github.com/libp2p/go-libp2p v0.43.0 // indirect
 	github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
-	github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250918150625-2e3cea182b63 // indirect
+	github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 // indirect
 	github.com/libp2p/go-libp2p-kbucket v0.8.0 // indirect
 	github.com/libp2p/go-libp2p-record v0.3.1 // indirect
 	github.com/libp2p/go-libp2p-routing-helpers v0.7.5 // indirect
diff --git a/test/dependencies/go.sum b/test/dependencies/go.sum
index 444ecd5eb..5fa685fc4 100644
--- a/test/dependencies/go.sum
+++ b/test/dependencies/go.sum
@@ -332,8 +332,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28 h1:kDoj2V7ghhLdQeQUtzr605tb6NJ4AzwRYtXFJas+Wyc=
-github.com/ipfs/boxo v0.34.1-0.20250925224331-260f4b387f28/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb h1:6d2KcZ49XfEoCPfV0MF6g9YGulccUkfjWB1mtRpV/+o=
+github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.2.3 h1:mpCuDaNXJ4wrBJLrtEaGFGXkferrw5eqVvzaHhtFKQk=
@@ -466,8 +466,8 @@ github.com/libp2p/go-libp2p v0.43.0 h1:b2bg2cRNmY4HpLK8VHYQXLX2d3iND95OjodLFymvq
 github.com/libp2p/go-libp2p v0.43.0/go.mod h1:IiSqAXDyP2sWH+J2gs43pNmB/y4FOi2XQPbsb+8qvzc=
 github.com/libp2p/go-libp2p-asn-util v0.4.1 h1:xqL7++IKD9TBFMgnLPZR6/6iYhawHKHl950SO9L6n94=
 github.com/libp2p/go-libp2p-asn-util v0.4.1/go.mod h1:d/NI6XZ9qxw67b4e+NgpQexCIiFYJjErASrYW4PFDN8=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250918150625-2e3cea182b63 h1:XQSASQ9N5haD/uYmop/633tYMZNsM+lKKI8/Is30w4o=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250918150625-2e3cea182b63/go.mod h1:HbI1rUTFF87WHklzKTGZC8Oys9+1rkKyqvmSZcAW55Y=
+github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 h1:5t+1NZ8ZZPl7c6+Rpa5KaSZ9NbF7wQB3BFklaZ3yk0g=
+github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723/go.mod h1:HbI1rUTFF87WHklzKTGZC8Oys9+1rkKyqvmSZcAW55Y=
 github.com/libp2p/go-libp2p-kbucket v0.8.0 h1:QAK7RzKJpYe+EuSEATAaaHYMYLkPDGC18m9jxPLnU8s=
 github.com/libp2p/go-libp2p-kbucket v0.8.0/go.mod h1:JMlxqcEyKwO6ox716eyC0hmiduSWZZl6JY93mGaaqc4=
 github.com/libp2p/go-libp2p-record v0.3.1 h1:cly48Xi5GjNw5Wq+7gmjfBiG9HCzQVkiZOUZ8kUl+Fg=

From 070177be45be77ccf06ebd0025d91f9f5be675cd Mon Sep 17 00:00:00 2001
From: Marcin Rataj <lidel@lidel.org>
Date: Sat, 27 Sep 2025 03:50:26 +0200
Subject: [PATCH 10/16] chore: 0.38.0-rc2

---
 version.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.go b/version.go
index 1bbcec88d..425d3c229 100644
--- a/version.go
+++ b/version.go
@@ -11,7 +11,7 @@ import (
 var CurrentCommit string
 
 // CurrentVersionNumber is the current application's version literal.
-const CurrentVersionNumber = "0.38.0-rc1"
+const CurrentVersionNumber = "0.38.0-rc2"
 
 const ApiVersion = "/kubo/" + CurrentVersionNumber + "/" //nolint
 

From a633b579cde42ab43d6bd4fa70280ae0e0b34cc6 Mon Sep 17 00:00:00 2001
From: gammazero <11790789+gammazero@users.noreply.github.com>
Date: Tue, 30 Sep 2025 14:12:57 -1000
Subject: [PATCH 11/16] Upgrade to Boxo v0.35.0

(cherry picked from commit a86df5feef94964408c9ec1c76d59e7863c2e380)
---
 docs/examples/kubo-as-a-library/go.mod | 2 +-
 docs/examples/kubo-as-a-library/go.sum | 4 ++--
 go.mod                                 | 2 +-
 go.sum                                 | 4 ++--
 test/dependencies/go.mod               | 2 +-
 test/dependencies/go.sum               | 4 ++--
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/docs/examples/kubo-as-a-library/go.mod b/docs/examples/kubo-as-a-library/go.mod
index 4b6c93df6..ffa5d1ec5 100644
--- a/docs/examples/kubo-as-a-library/go.mod
+++ b/docs/examples/kubo-as-a-library/go.mod
@@ -7,7 +7,7 @@ go 1.25
 replace github.com/ipfs/kubo => ./../../..
 
 require (
-	github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb
+	github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa
 	github.com/ipfs/kubo v0.0.0-00010101000000-000000000000
 	github.com/libp2p/go-libp2p v0.43.0
 	github.com/multiformats/go-multiaddr v0.16.1
diff --git a/docs/examples/kubo-as-a-library/go.sum b/docs/examples/kubo-as-a-library/go.sum
index 3b0e2cf77..76757fdb8 100644
--- a/docs/examples/kubo-as-a-library/go.sum
+++ b/docs/examples/kubo-as-a-library/go.sum
@@ -289,8 +289,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb h1:6d2KcZ49XfEoCPfV0MF6g9YGulccUkfjWB1mtRpV/+o=
-github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa h1:K6O1CYHR5WKt/77QwKONwxHFl5eg0zadz8Jk7fguFKw=
+github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
diff --git a/go.mod b/go.mod
index d75bd27eb..0a17ae98f 100644
--- a/go.mod
+++ b/go.mod
@@ -22,7 +22,7 @@ require (
 	github.com/hashicorp/go-version v1.7.0
 	github.com/ipfs-shipyard/nopfs v0.0.14
 	github.com/ipfs-shipyard/nopfs/ipfs v0.25.0
-	github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb
+	github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa
 	github.com/ipfs/go-block-format v0.2.3
 	github.com/ipfs/go-cid v0.5.0
 	github.com/ipfs/go-cidutil v0.1.0
diff --git a/go.sum b/go.sum
index db3b2f06f..0af0106cc 100644
--- a/go.sum
+++ b/go.sum
@@ -356,8 +356,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb h1:6d2KcZ49XfEoCPfV0MF6g9YGulccUkfjWB1mtRpV/+o=
-github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa h1:K6O1CYHR5WKt/77QwKONwxHFl5eg0zadz8Jk7fguFKw=
+github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
diff --git a/test/dependencies/go.mod b/test/dependencies/go.mod
index 9df3b0a5c..e97b52586 100644
--- a/test/dependencies/go.mod
+++ b/test/dependencies/go.mod
@@ -135,7 +135,7 @@ require (
 	github.com/huin/goupnp v1.3.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
-	github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb // indirect
+	github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa // indirect
 	github.com/ipfs/go-bitfield v1.1.0 // indirect
 	github.com/ipfs/go-block-format v0.2.3 // indirect
 	github.com/ipfs/go-cid v0.5.0 // indirect
diff --git a/test/dependencies/go.sum b/test/dependencies/go.sum
index 5fa685fc4..91b725d30 100644
--- a/test/dependencies/go.sum
+++ b/test/dependencies/go.sum
@@ -332,8 +332,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb h1:6d2KcZ49XfEoCPfV0MF6g9YGulccUkfjWB1mtRpV/+o=
-github.com/ipfs/boxo v0.34.1-0.20250926171300-4c0aa3a121fb/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa h1:K6O1CYHR5WKt/77QwKONwxHFl5eg0zadz8Jk7fguFKw=
+github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.2.3 h1:mpCuDaNXJ4wrBJLrtEaGFGXkferrw5eqVvzaHhtFKQk=

From 97a51fb7c1a2f92fa81559c547c0aca49defed46 Mon Sep 17 00:00:00 2001
From: Andrew Gillis <11790789+gammazero@users.noreply.github.com>
Date: Tue, 30 Sep 2025 18:32:36 -0700
Subject: [PATCH 12/16] Upgrade to Boxo v0.35.0 (#10999)

* Upgrade to Boxo v0.35.0

(cherry picked from commit a7ce33c722837e74b6104343cab42e17d66588ea)
---
 docs/changelogs/v0.38.md               | 2 +-
 docs/examples/kubo-as-a-library/go.mod | 2 +-
 docs/examples/kubo-as-a-library/go.sum | 4 ++--
 go.mod                                 | 2 +-
 go.sum                                 | 4 ++--
 test/dependencies/go.mod               | 2 +-
 test/dependencies/go.sum               | 4 ++--
 7 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/docs/changelogs/v0.38.md b/docs/changelogs/v0.38.md
index 1510e78b4..edef762c6 100644
--- a/docs/changelogs/v0.38.md
+++ b/docs/changelogs/v0.38.md
@@ -119,7 +119,7 @@ The new [`Internal.MFSNoFlushLimit`](https://github.com/ipfs/kubo/blob/master/do
 
 ### 📦️ Important dependency updates
 
-- update `boxo` to [v0.34.1-0.20250926171300-4c0aa3a121fb](https://github.com/ipfs/boxo/commit/4c0aa3a121fb)
+- update `boxo` to [v0.35.0](https://github.com/ipfs/boxo/releases/tag/v0.35.0)
 - update `go-libp2p-kad-dht` to [v0.34.1-0.20250926161957-861573b39723](https://github.com/libp2p/go-libp2p-kad-dht/commit/861573b39723)
 - update `ipfs-webui` to [v4.9.1](https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.1) (incl. [v4.9.0](https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.0))
 
diff --git a/docs/examples/kubo-as-a-library/go.mod b/docs/examples/kubo-as-a-library/go.mod
index ffa5d1ec5..51f79d20a 100644
--- a/docs/examples/kubo-as-a-library/go.mod
+++ b/docs/examples/kubo-as-a-library/go.mod
@@ -7,7 +7,7 @@ go 1.25
 replace github.com/ipfs/kubo => ./../../..
 
 require (
-	github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa
+	github.com/ipfs/boxo v0.35.0
 	github.com/ipfs/kubo v0.0.0-00010101000000-000000000000
 	github.com/libp2p/go-libp2p v0.43.0
 	github.com/multiformats/go-multiaddr v0.16.1
diff --git a/docs/examples/kubo-as-a-library/go.sum b/docs/examples/kubo-as-a-library/go.sum
index 76757fdb8..d9100f521 100644
--- a/docs/examples/kubo-as-a-library/go.sum
+++ b/docs/examples/kubo-as-a-library/go.sum
@@ -289,8 +289,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa h1:K6O1CYHR5WKt/77QwKONwxHFl5eg0zadz8Jk7fguFKw=
-github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.35.0 h1:3Mku5arSbAZz0dvb4goXRsQuZkFkPrGr5yYdu0YM1pY=
+github.com/ipfs/boxo v0.35.0/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
diff --git a/go.mod b/go.mod
index 0a17ae98f..74dfbc5c3 100644
--- a/go.mod
+++ b/go.mod
@@ -22,7 +22,7 @@ require (
 	github.com/hashicorp/go-version v1.7.0
 	github.com/ipfs-shipyard/nopfs v0.0.14
 	github.com/ipfs-shipyard/nopfs/ipfs v0.25.0
-	github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa
+	github.com/ipfs/boxo v0.35.0
 	github.com/ipfs/go-block-format v0.2.3
 	github.com/ipfs/go-cid v0.5.0
 	github.com/ipfs/go-cidutil v0.1.0
diff --git a/go.sum b/go.sum
index 0af0106cc..12d593d86 100644
--- a/go.sum
+++ b/go.sum
@@ -356,8 +356,8 @@ github.com/ipfs-shipyard/nopfs/ipfs v0.25.0 h1:OqNqsGZPX8zh3eFMO8Lf8EHRRnSGBMqcd
 github.com/ipfs-shipyard/nopfs/ipfs v0.25.0/go.mod h1:BxhUdtBgOXg1B+gAPEplkg/GpyTZY+kCMSfsJvvydqU=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa h1:K6O1CYHR5WKt/77QwKONwxHFl5eg0zadz8Jk7fguFKw=
-github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.35.0 h1:3Mku5arSbAZz0dvb4goXRsQuZkFkPrGr5yYdu0YM1pY=
+github.com/ipfs/boxo v0.35.0/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
diff --git a/test/dependencies/go.mod b/test/dependencies/go.mod
index e97b52586..2f558793a 100644
--- a/test/dependencies/go.mod
+++ b/test/dependencies/go.mod
@@ -135,7 +135,7 @@ require (
 	github.com/huin/goupnp v1.3.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
-	github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa // indirect
+	github.com/ipfs/boxo v0.35.0 // indirect
 	github.com/ipfs/go-bitfield v1.1.0 // indirect
 	github.com/ipfs/go-block-format v0.2.3 // indirect
 	github.com/ipfs/go-cid v0.5.0 // indirect
diff --git a/test/dependencies/go.sum b/test/dependencies/go.sum
index 91b725d30..c4ad11634 100644
--- a/test/dependencies/go.sum
+++ b/test/dependencies/go.sum
@@ -332,8 +332,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa h1:K6O1CYHR5WKt/77QwKONwxHFl5eg0zadz8Jk7fguFKw=
-github.com/ipfs/boxo v0.34.1-0.20250930234347-2efefff9e1fa/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
+github.com/ipfs/boxo v0.35.0 h1:3Mku5arSbAZz0dvb4goXRsQuZkFkPrGr5yYdu0YM1pY=
+github.com/ipfs/boxo v0.35.0/go.mod h1:uhaF0DGnbgEiXDTmD249jCGbxVkMm6+Ew85q6Uub7lo=
 github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
 github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
 github.com/ipfs/go-block-format v0.2.3 h1:mpCuDaNXJ4wrBJLrtEaGFGXkferrw5eqVvzaHhtFKQk=

From 48cb03c3f435e7b6a53f3db79747119fe0e7f932 Mon Sep 17 00:00:00 2001
From: Guillaume Michel <guillaumemichel@users.noreply.github.com>
Date: Wed, 1 Oct 2025 16:01:27 +0200
Subject: [PATCH 13/16] docs: add sweeping provide worker count recommendation
 (#11001)

Add recommentation for worker count for the sweeping provide system for
users with millions of CIDs.

(cherry picked from commit cf8194a8d169fdc07eae3386a27bd3b7fc3f4864)
---
 docs/config.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/docs/config.md b/docs/config.md
index 58131b52e..7982cf7f8 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -1633,12 +1633,14 @@ this limit in the configuration.
 **Why operations fail instead of auto-flushing:** Automatic flushing once the limit
 is reached was considered but rejected because it can lead to data corruption issues
 that are difficult to debug. When the system decides to flush without user knowledge, it can:
+
 - Create partial states that violate user expectations about atomicity
 - Interfere with concurrent operations in unexpected ways
 - Make debugging and recovery much harder when issues occur
 
 By failing explicitly, users maintain control over when their data is persisted,
 allowing them to:
+
 - Batch related operations together before flushing
 - Handle errors predictably at natural transaction boundaries
 - Understand exactly when and why their data is written to disk
@@ -1647,6 +1649,7 @@ If you expect automatic flushing behavior, simply use the default `--flush=true`
 (or omit the flag entirely) instead of `--flush=false`.
 
 **⚠️ WARNING:** Increasing this limit or disabling it (setting to 0) can lead to:
+
 - **Out-of-memory errors (OOM)** - Each unflushed operation consumes memory
 - **Data loss** - If the daemon crashes before flushing, all unflushed changes are lost
 - **Degraded performance** - Large unflushed caches slow down MFS operations
@@ -2033,6 +2036,19 @@ connections this setting can generate.
 > At the same time, mind that raising this value too high may lead to increased load.
 > Proceed with caution, ensure proper hardware and networking are in place.
 
+> [!TIP]
+> **When `SweepEnabled` is true:** Users providing millions of CIDs or more
+> should increase the worker count accordingly. Underprovisioning can lead to
+> slow provides (burst workers) and inability to keep up with content
+> reproviding (periodic workers). For nodes with sufficient resources (CPU,
+> bandwidth, number of connections), dedicating `1024` for [periodic
+> workers](#providedhtdedicatedperiodicworkers) and `512` for [burst
+> workers](#providedhtdedicatedburstworkers), and `2048` [max
+> workers](#providedhtmaxworkers) should be adequate even for the largest
+> users. The system will only use workers as needed - unused resources won't be
+> consumed. Ensure you adjust the swarm [connection manager](#swarmconnmgr) and
+> [resource manager](#swarmresourcemgr) configuration accordingly.
+
 Default: `16`
 
 Type: `optionalInteger` (non-negative; `0` means unlimited number of workers)
@@ -2098,6 +2114,11 @@ number of workers will be dedicated to the periodic region reprovide only. The s
 Any remaining workers (MaxWorkers - DedicatedPeriodicWorkers - DedicatedBurstWorkers)
 form a shared pool that can be used for either type of work as needed.
 
+> [!NOTE]
+> If the provider system isn't able to keep up with reproviding all your
+> content within the [Provide.DHT.Interval](#providedhtinterval), consider
+> increasing this value.
+
 Default: `2`
 
 Type: `optionalInteger` (`0` means there are no dedicated workers, but the
@@ -2121,6 +2142,10 @@ number of workers will be dedicated to burst provides only. In addition to
 these, if there are available workers in the pool, they can also be used for
 burst provides.
 
+> [!NOTE]
+> If CIDs aren't provided quickly enough to your taste, and you can afford more
+> CPU and bandwidth, consider increasing this value.
+
 Default: `1`
 
 Type: `optionalInteger` (`0` means there are no dedicated workers, but the

From b9683a4fa0514f8c308f482775905e4c94615440 Mon Sep 17 00:00:00 2001
From: Guillaume Michel <guillaumemichel@users.noreply.github.com>
Date: Wed, 1 Oct 2025 15:53:36 +0200
Subject: [PATCH 14/16] chore: bump go-libp2p-kad-dht to v0.35.0 (#11002)

* chore: bump go-libp2p-kad-dht

* docs: update dependency versions in changelogs

- update go-libp2p-kad-dht to v0.35.0 release link in v0.38
- move go-ds-pebble v0.5.2 entry to v0.39 changelog

---------

Co-authored-by: Marcin Rataj <lidel@lidel.org>
(cherry picked from commit 42a4935abfe38a1d095af00d8d3ec5c21a1c6d1a)
---
 docs/changelogs/v0.38.md               |  2 +-
 docs/examples/kubo-as-a-library/go.mod | 12 ++++++------
 docs/examples/kubo-as-a-library/go.sum | 24 ++++++++++++------------
 go.mod                                 | 12 ++++++------
 go.sum                                 | 24 ++++++++++++------------
 test/dependencies/go.mod               |  8 ++++----
 test/dependencies/go.sum               | 16 ++++++++--------
 7 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/docs/changelogs/v0.38.md b/docs/changelogs/v0.38.md
index edef762c6..61868dc9a 100644
--- a/docs/changelogs/v0.38.md
+++ b/docs/changelogs/v0.38.md
@@ -120,7 +120,7 @@ The new [`Internal.MFSNoFlushLimit`](https://github.com/ipfs/kubo/blob/master/do
 ### 📦️ Important dependency updates
 
 - update `boxo` to [v0.35.0](https://github.com/ipfs/boxo/releases/tag/v0.35.0)
-- update `go-libp2p-kad-dht` to [v0.34.1-0.20250926161957-861573b39723](https://github.com/libp2p/go-libp2p-kad-dht/commit/861573b39723)
+- update `go-libp2p-kad-dht` to [v0.35.0](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.35.0)
 - update `ipfs-webui` to [v4.9.1](https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.1) (incl. [v4.9.0](https://github.com/ipfs/ipfs-webui/releases/tag/v4.9.0))
 
 ### 📝 Changelog
diff --git a/docs/examples/kubo-as-a-library/go.mod b/docs/examples/kubo-as-a-library/go.mod
index 51f79d20a..81c2a147b 100644
--- a/docs/examples/kubo-as-a-library/go.mod
+++ b/docs/examples/kubo-as-a-library/go.mod
@@ -65,7 +65,7 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
-	github.com/guillaumemichel/reservedpool v0.2.0 // indirect
+	github.com/guillaumemichel/reservedpool v0.3.0 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/huin/goupnp v1.3.0 // indirect
@@ -114,7 +114,7 @@ require (
 	github.com/libp2p/go-doh-resolver v0.5.0 // indirect
 	github.com/libp2p/go-flow-metrics v0.3.0 // indirect
 	github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
-	github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 // indirect
+	github.com/libp2p/go-libp2p-kad-dht v0.35.0 // indirect
 	github.com/libp2p/go-libp2p-kbucket v0.8.0 // indirect
 	github.com/libp2p/go-libp2p-pubsub v0.14.2 // indirect
 	github.com/libp2p/go-libp2p-pubsub-router v0.6.0 // indirect
@@ -142,7 +142,7 @@ require (
 	github.com/multiformats/go-multicodec v0.9.2 // indirect
 	github.com/multiformats/go-multihash v0.2.3 // indirect
 	github.com/multiformats/go-multistream v0.6.1 // indirect
-	github.com/multiformats/go-varint v0.0.7 // indirect
+	github.com/multiformats/go-varint v0.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/openzipkin/zipkin-go v0.4.3 // indirect
@@ -177,7 +177,7 @@ require (
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/quic-go/quic-go v0.54.0 // indirect
 	github.com/quic-go/webtransport-go v0.9.0 // indirect
-	github.com/rogpeppe/go-internal v1.13.1 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/ucarion/urlpath v0.0.0-20200424170820-7ccc79b76bbb // indirect
@@ -190,7 +190,7 @@ require (
 	github.com/wlynxg/anet v0.0.5 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
 	go.opentelemetry.io/otel v1.38.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
@@ -208,7 +208,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
 	golang.org/x/crypto v0.42.0 // indirect
 	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
diff --git a/docs/examples/kubo-as-a-library/go.sum b/docs/examples/kubo-as-a-library/go.sum
index d9100f521..eb90aa12a 100644
--- a/docs/examples/kubo-as-a-library/go.sum
+++ b/docs/examples/kubo-as-a-library/go.sum
@@ -266,8 +266,8 @@ github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:Fecb
 github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
-github.com/guillaumemichel/reservedpool v0.2.0 h1:q73gtdMFJHtW+dDJ/fwtk34p7JprQv8fJSK7dEjf8Sw=
-github.com/guillaumemichel/reservedpool v0.2.0/go.mod h1:sXSDIaef81TFdAJglsCFCMfgF5E5Z5xK1tFhjDhvbUc=
+github.com/guillaumemichel/reservedpool v0.3.0 h1:eqqO/QvTllLBrit7LVtVJBqw4cD0WdV9ajUe7WNTajw=
+github.com/guillaumemichel/reservedpool v0.3.0/go.mod h1:sXSDIaef81TFdAJglsCFCMfgF5E5Z5xK1tFhjDhvbUc=
 github.com/gxed/hashland/keccakpg v0.0.1/go.mod h1:kRzw3HkwxFU1mpmPP8v1WyQzwdGfmKFJ6tItnhQ67kU=
 github.com/gxed/hashland/murmur3 v0.0.1/go.mod h1:KjXop02n4/ckmZSnY2+HKcLud/tcmvhST0bie/0lS48=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
@@ -432,8 +432,8 @@ github.com/libp2p/go-libp2p-asn-util v0.4.1 h1:xqL7++IKD9TBFMgnLPZR6/6iYhawHKHl9
 github.com/libp2p/go-libp2p-asn-util v0.4.1/go.mod h1:d/NI6XZ9qxw67b4e+NgpQexCIiFYJjErASrYW4PFDN8=
 github.com/libp2p/go-libp2p-core v0.2.4/go.mod h1:STh4fdfa5vDYr0/SzYYeqnt+E6KfEV5VxfIrm0bcI0g=
 github.com/libp2p/go-libp2p-core v0.3.0/go.mod h1:ACp3DmS3/N64c2jDzcV429ukDpicbL6+TrrxANBjPGw=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 h1:5t+1NZ8ZZPl7c6+Rpa5KaSZ9NbF7wQB3BFklaZ3yk0g=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723/go.mod h1:HbI1rUTFF87WHklzKTGZC8Oys9+1rkKyqvmSZcAW55Y=
+github.com/libp2p/go-libp2p-kad-dht v0.35.0 h1:pWRC4FKR9ptQjA9DuMSrAn2D3vABE8r58iAeoLoK1Ig=
+github.com/libp2p/go-libp2p-kad-dht v0.35.0/go.mod h1:s70f017NjhsBx+SVl0/w+x//uyglrFpKLfvuQJj4QAU=
 github.com/libp2p/go-libp2p-kbucket v0.3.1/go.mod h1:oyjT5O7tS9CQurok++ERgc46YLwEpuGoFq9ubvoUOio=
 github.com/libp2p/go-libp2p-kbucket v0.8.0 h1:QAK7RzKJpYe+EuSEATAaaHYMYLkPDGC18m9jxPLnU8s=
 github.com/libp2p/go-libp2p-kbucket v0.8.0/go.mod h1:JMlxqcEyKwO6ox716eyC0hmiduSWZZl6JY93mGaaqc4=
@@ -540,8 +540,8 @@ github.com/multiformats/go-multistream v0.6.1/go.mod h1:ksQf6kqHAb6zIsyw7Zm+gAuV
 github.com/multiformats/go-varint v0.0.1/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.5/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.6/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
-github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
-github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
+github.com/multiformats/go-varint v0.1.0 h1:i2wqFp4sdl3IcIxfAonHQV9qU5OsZ4Ts9IOoETFs5dI=
+github.com/multiformats/go-varint v0.1.0/go.mod h1:5KVAVXegtfmNQQm/lCY+ATvDzvJJhSkUlGQV9wgObdI=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
@@ -651,8 +651,8 @@ github.com/quic-go/webtransport-go v0.9.0 h1:jgys+7/wm6JarGDrW+lD/r9BGqBAmqY/ssk
 github.com/quic-go/webtransport-go v0.9.0/go.mod h1:4FUYIiUc75XSsF6HShcLeXXYZJ9AGwo/xh3L8M/P1ao=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
@@ -775,8 +775,8 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
 go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
@@ -817,8 +817,8 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
 go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
-go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
-go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc=
 go4.org v0.0.0-20230225012048-214862532bf5/go.mod h1:F57wTi5Lrj6WLyswp5EYV1ncrEbFGHD4hhz6S1ZYeaU=
diff --git a/go.mod b/go.mod
index 74dfbc5c3..a1a2a3ab1 100644
--- a/go.mod
+++ b/go.mod
@@ -53,7 +53,7 @@ require (
 	github.com/libp2p/go-doh-resolver v0.5.0
 	github.com/libp2p/go-libp2p v0.43.0
 	github.com/libp2p/go-libp2p-http v0.5.0
-	github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723
+	github.com/libp2p/go-libp2p-kad-dht v0.35.0
 	github.com/libp2p/go-libp2p-kbucket v0.8.0
 	github.com/libp2p/go-libp2p-pubsub v0.14.2
 	github.com/libp2p/go-libp2p-pubsub-router v0.6.0
@@ -143,7 +143,7 @@ require (
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
-	github.com/guillaumemichel/reservedpool v0.2.0 // indirect
+	github.com/guillaumemichel/reservedpool v0.3.0 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/huin/goupnp v1.3.0 // indirect
@@ -186,7 +186,7 @@ require (
 	github.com/multiformats/go-base36 v0.2.0 // indirect
 	github.com/multiformats/go-multiaddr-fmt v0.1.0 // indirect
 	github.com/multiformats/go-multistream v0.6.1 // indirect
-	github.com/multiformats/go-varint v0.0.7 // indirect
+	github.com/multiformats/go-varint v0.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/onsi/gomega v1.36.3 // indirect
 	github.com/openzipkin/zipkin-go v0.4.3 // indirect
@@ -222,7 +222,7 @@ require (
 	github.com/quic-go/quic-go v0.54.0 // indirect
 	github.com/quic-go/webtransport-go v0.9.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/rogpeppe/go-internal v1.13.1 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/rs/cors v1.11.1 // indirect
 	github.com/slok/go-http-metrics v0.13.0 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
@@ -237,7 +237,7 @@ require (
 	github.com/whyrusleeping/go-keyspace v0.0.0-20160322163242-5b898ac5add1 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/propagators/aws v1.21.1 // indirect
 	go.opentelemetry.io/contrib/propagators/b3 v1.21.1 // indirect
 	go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 // indirect
@@ -252,7 +252,7 @@ require (
 	go.uber.org/mock v0.5.2 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
 	golang.org/x/net v0.44.0 // indirect
 	golang.org/x/oauth2 v0.31.0 // indirect
diff --git a/go.sum b/go.sum
index 12d593d86..5dd61e2dc 100644
--- a/go.sum
+++ b/go.sum
@@ -331,8 +331,8 @@ github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:Fecb
 github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
-github.com/guillaumemichel/reservedpool v0.2.0 h1:q73gtdMFJHtW+dDJ/fwtk34p7JprQv8fJSK7dEjf8Sw=
-github.com/guillaumemichel/reservedpool v0.2.0/go.mod h1:sXSDIaef81TFdAJglsCFCMfgF5E5Z5xK1tFhjDhvbUc=
+github.com/guillaumemichel/reservedpool v0.3.0 h1:eqqO/QvTllLBrit7LVtVJBqw4cD0WdV9ajUe7WNTajw=
+github.com/guillaumemichel/reservedpool v0.3.0/go.mod h1:sXSDIaef81TFdAJglsCFCMfgF5E5Z5xK1tFhjDhvbUc=
 github.com/gxed/hashland/keccakpg v0.0.1/go.mod h1:kRzw3HkwxFU1mpmPP8v1WyQzwdGfmKFJ6tItnhQ67kU=
 github.com/gxed/hashland/murmur3 v0.0.1/go.mod h1:KjXop02n4/ckmZSnY2+HKcLud/tcmvhST0bie/0lS48=
 github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
@@ -516,8 +516,8 @@ github.com/libp2p/go-libp2p-gostream v0.6.0 h1:QfAiWeQRce6pqnYfmIVWJFXNdDyfiR/qk
 github.com/libp2p/go-libp2p-gostream v0.6.0/go.mod h1:Nywu0gYZwfj7Jc91PQvbGU8dIpqbQQkjWgDuOrFaRdA=
 github.com/libp2p/go-libp2p-http v0.5.0 h1:+x0AbLaUuLBArHubbbNRTsgWz0RjNTy6DJLOxQ3/QBc=
 github.com/libp2p/go-libp2p-http v0.5.0/go.mod h1:glh87nZ35XCQyFsdzZps6+F4HYI6DctVFY5u1fehwSg=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 h1:5t+1NZ8ZZPl7c6+Rpa5KaSZ9NbF7wQB3BFklaZ3yk0g=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723/go.mod h1:HbI1rUTFF87WHklzKTGZC8Oys9+1rkKyqvmSZcAW55Y=
+github.com/libp2p/go-libp2p-kad-dht v0.35.0 h1:pWRC4FKR9ptQjA9DuMSrAn2D3vABE8r58iAeoLoK1Ig=
+github.com/libp2p/go-libp2p-kad-dht v0.35.0/go.mod h1:s70f017NjhsBx+SVl0/w+x//uyglrFpKLfvuQJj4QAU=
 github.com/libp2p/go-libp2p-kbucket v0.3.1/go.mod h1:oyjT5O7tS9CQurok++ERgc46YLwEpuGoFq9ubvoUOio=
 github.com/libp2p/go-libp2p-kbucket v0.8.0 h1:QAK7RzKJpYe+EuSEATAaaHYMYLkPDGC18m9jxPLnU8s=
 github.com/libp2p/go-libp2p-kbucket v0.8.0/go.mod h1:JMlxqcEyKwO6ox716eyC0hmiduSWZZl6JY93mGaaqc4=
@@ -639,8 +639,8 @@ github.com/multiformats/go-multistream v0.6.1/go.mod h1:ksQf6kqHAb6zIsyw7Zm+gAuV
 github.com/multiformats/go-varint v0.0.1/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.5/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.6/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
-github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
-github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
+github.com/multiformats/go-varint v0.1.0 h1:i2wqFp4sdl3IcIxfAonHQV9qU5OsZ4Ts9IOoETFs5dI=
+github.com/multiformats/go-varint v0.1.0/go.mod h1:5KVAVXegtfmNQQm/lCY+ATvDzvJJhSkUlGQV9wgObdI=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
@@ -780,8 +780,8 @@ github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
 github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
 github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
@@ -928,8 +928,8 @@ go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
 go.opentelemetry.io/contrib/propagators/autoprop v0.46.1 h1:cXTYcMjY0dsYokAuo8LbNBQxpF8VgTHdiHJJ1zlIXl4=
@@ -982,8 +982,8 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
 go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
-go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
-go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc=
 go4.org v0.0.0-20230225012048-214862532bf5/go.mod h1:F57wTi5Lrj6WLyswp5EYV1ncrEbFGHD4hhz6S1ZYeaU=
diff --git a/test/dependencies/go.mod b/test/dependencies/go.mod
index 2f558793a..65d3151aa 100644
--- a/test/dependencies/go.mod
+++ b/test/dependencies/go.mod
@@ -183,7 +183,7 @@ require (
 	github.com/libp2p/go-flow-metrics v0.3.0 // indirect
 	github.com/libp2p/go-libp2p v0.43.0 // indirect
 	github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
-	github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 // indirect
+	github.com/libp2p/go-libp2p-kad-dht v0.35.0 // indirect
 	github.com/libp2p/go-libp2p-kbucket v0.8.0 // indirect
 	github.com/libp2p/go-libp2p-record v0.3.1 // indirect
 	github.com/libp2p/go-libp2p-routing-helpers v0.7.5 // indirect
@@ -214,7 +214,7 @@ require (
 	github.com/multiformats/go-multibase v0.2.0 // indirect
 	github.com/multiformats/go-multicodec v0.9.2 // indirect
 	github.com/multiformats/go-multistream v0.6.1 // indirect
-	github.com/multiformats/go-varint v0.0.7 // indirect
+	github.com/multiformats/go-varint v0.1.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
 	github.com/nishanths/exhaustive v0.12.0 // indirect
@@ -315,7 +315,7 @@ require (
 	gitlab.com/bosi/decorder v0.4.2 // indirect
 	go-simpler.org/musttag v0.13.0 // indirect
 	go-simpler.org/sloglint v0.9.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
 	go.opentelemetry.io/otel v1.38.0 // indirect
 	go.opentelemetry.io/otel/metric v1.38.0 // indirect
@@ -327,7 +327,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/crypto v0.42.0 // indirect
 	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
diff --git a/test/dependencies/go.sum b/test/dependencies/go.sum
index c4ad11634..aec72c23d 100644
--- a/test/dependencies/go.sum
+++ b/test/dependencies/go.sum
@@ -466,8 +466,8 @@ github.com/libp2p/go-libp2p v0.43.0 h1:b2bg2cRNmY4HpLK8VHYQXLX2d3iND95OjodLFymvq
 github.com/libp2p/go-libp2p v0.43.0/go.mod h1:IiSqAXDyP2sWH+J2gs43pNmB/y4FOi2XQPbsb+8qvzc=
 github.com/libp2p/go-libp2p-asn-util v0.4.1 h1:xqL7++IKD9TBFMgnLPZR6/6iYhawHKHl950SO9L6n94=
 github.com/libp2p/go-libp2p-asn-util v0.4.1/go.mod h1:d/NI6XZ9qxw67b4e+NgpQexCIiFYJjErASrYW4PFDN8=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723 h1:5t+1NZ8ZZPl7c6+Rpa5KaSZ9NbF7wQB3BFklaZ3yk0g=
-github.com/libp2p/go-libp2p-kad-dht v0.34.1-0.20250926161957-861573b39723/go.mod h1:HbI1rUTFF87WHklzKTGZC8Oys9+1rkKyqvmSZcAW55Y=
+github.com/libp2p/go-libp2p-kad-dht v0.35.0 h1:pWRC4FKR9ptQjA9DuMSrAn2D3vABE8r58iAeoLoK1Ig=
+github.com/libp2p/go-libp2p-kad-dht v0.35.0/go.mod h1:s70f017NjhsBx+SVl0/w+x//uyglrFpKLfvuQJj4QAU=
 github.com/libp2p/go-libp2p-kbucket v0.8.0 h1:QAK7RzKJpYe+EuSEATAaaHYMYLkPDGC18m9jxPLnU8s=
 github.com/libp2p/go-libp2p-kbucket v0.8.0/go.mod h1:JMlxqcEyKwO6ox716eyC0hmiduSWZZl6JY93mGaaqc4=
 github.com/libp2p/go-libp2p-record v0.3.1 h1:cly48Xi5GjNw5Wq+7gmjfBiG9HCzQVkiZOUZ8kUl+Fg=
@@ -556,8 +556,8 @@ github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7B
 github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
 github.com/multiformats/go-multistream v0.6.1 h1:4aoX5v6T+yWmc2raBHsTvzmFhOI8WVOer28DeBBEYdQ=
 github.com/multiformats/go-multistream v0.6.1/go.mod h1:ksQf6kqHAb6zIsyw7Zm+gAuVo57Qbq84E27YlYqavqw=
-github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
-github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
+github.com/multiformats/go-varint v0.1.0 h1:i2wqFp4sdl3IcIxfAonHQV9qU5OsZ4Ts9IOoETFs5dI=
+github.com/multiformats/go-varint v0.1.0/go.mod h1:5KVAVXegtfmNQQm/lCY+ATvDzvJJhSkUlGQV9wgObdI=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81U=
@@ -865,8 +865,8 @@ go-simpler.org/musttag v0.13.0/go.mod h1:FTzIGeK6OkKlUDVpj0iQUXZLUO1Js9+mvykDQy9
 go-simpler.org/sloglint v0.9.0 h1:/40NQtjRx9txvsB/RN022KsUJU+zaaSb/9q9BSefSrE=
 go-simpler.org/sloglint v0.9.0/go.mod h1:G/OrAF6uxj48sHahCzrbarVMptL2kjWTaUeC8+fOGww=
 go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
 go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
@@ -897,8 +897,8 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
 go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
-go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
-go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw=
 golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=

From 0261a2183e6c1d5c1c57190cb34ed06e71c839e3 Mon Sep 17 00:00:00 2001
From: Marcin Rataj <lidel@lidel.org>
Date: Wed, 1 Oct 2025 19:12:57 +0200
Subject: [PATCH 15/16] chore: v0.38.0

---
 version.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/version.go b/version.go
index 425d3c229..eb1dd3850 100644
--- a/version.go
+++ b/version.go
@@ -11,7 +11,7 @@ import (
 var CurrentCommit string
 
 // CurrentVersionNumber is the current application's version literal.
-const CurrentVersionNumber = "0.38.0-rc2"
+const CurrentVersionNumber = "0.38.0"
 
 const ApiVersion = "/kubo/" + CurrentVersionNumber + "/" //nolint
 

From d361964852fb07af4978dd4b91435990aa6d3170 Mon Sep 17 00:00:00 2001
From: Marcin Rataj <lidel@lidel.org>
Date: Wed, 1 Oct 2025 19:22:18 +0200
Subject: [PATCH 16/16] docs: update changelog for v0.38.0

---
 docs/changelogs/v0.38.md | 164 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 162 insertions(+), 2 deletions(-)

diff --git a/docs/changelogs/v0.38.md b/docs/changelogs/v0.38.md
index 61868dc9a..2edb31adf 100644
--- a/docs/changelogs/v0.38.md
+++ b/docs/changelogs/v0.38.md
@@ -64,7 +64,7 @@ For configuration details, see [`Provide.DHT`](https://github.com/ipfs/kubo/blob
 
 #### 📊 Exposed DHT metrics
 
-Kubo now exposes DHT metrics from go-libp2p-kad-dht, including `total_provide_count_total` for sweep provider operations and RPC metrics prefixed with `rpc_inbound_` and `rpc_outbound_` for DHT message traffic. See [Kubo metrics documentation](https://github.com/ipfs/kubo/blob/master/docs/metrics.md) for details.
+Kubo now exposes DHT metrics from [go-libp2p-kad-dht](https://github.com/libp2p/go-libp2p-kad-dht/), including `total_provide_count_total` for sweep provider operations and RPC metrics prefixed with `rpc_inbound_` and `rpc_outbound_` for DHT message traffic. See [Kubo metrics documentation](https://github.com/ipfs/kubo/blob/master/docs/metrics.md) for details.
 
 #### 🚨 Improved gateway error pages with diagnostic tools
 
@@ -100,7 +100,9 @@ Additional improvements include a close button in the file viewer, better error
 
 **Identity CID size limits are now enforced**
 
-Identity CIDs use [multihash `0x00`](https://github.com/multiformats/multicodec/blob/master/table.csv#L2) to embed data directly in the CID without hashing. This experimental optimization was designed for tiny data where a CID reference would be larger than the data itself, but without size limits it was easy to misuse and could turn into an anti-pattern that wastes resources and enables abuse. This release enforces a maximum of 128 bytes for identity CIDs - attempting to exceed this limit will return a clear error message.
+This release enforces a maximum of 128 bytes for identity CIDs ([IPIP-512](https://github.com/ipfs/specs/pull/512)) - attempting to exceed this limit will return a clear error message.
+
+Identity CIDs use [multihash `0x00`](https://github.com/multiformats/multicodec/blob/master/table.csv#L2) to embed data directly in the CID without hashing. This experimental optimization was designed for tiny data where a CID reference would be larger than the data itself, but without size limits it was easy to misuse and could turn into an anti-pattern that wastes resources and enables abuse.
 
 - `ipfs add --inline-limit` and `--hash=identity` now enforce the 128-byte maximum (error when exceeded)
 - `ipfs files write` prevents creation of oversized identity CIDs
@@ -127,6 +129,164 @@ The new [`Internal.MFSNoFlushLimit`](https://github.com/ipfs/kubo/blob/master/do
 
 <details><summary>Full Changelog</summary>
 
+- github.com/ipfs/kubo:
+  - chore: v0.38.0
+  - chore: bump go-libp2p-kad-dht to v0.35.0 (#11002) ([ipfs/kubo#11002](https://github.com/ipfs/kubo/pull/11002))
+  - docs: add sweeping provide worker count recommendation (#11001) ([ipfs/kubo#11001](https://github.com/ipfs/kubo/pull/11001))
+  - Upgrade to Boxo v0.35.0 (#10999) ([ipfs/kubo#10999](https://github.com/ipfs/kubo/pull/10999))
+  - chore: 0.38.0-rc2
+  - chore: update boxo and kad-dht dependencies (#10995) ([ipfs/kubo#10995](https://github.com/ipfs/kubo/pull/10995))
+  - fix: update webui to v4.9.1 (#10994) ([ipfs/kubo#10994](https://github.com/ipfs/kubo/pull/10994))
+  - fix: provider merge conflicts (#10989) ([ipfs/kubo#10989](https://github.com/ipfs/kubo/pull/10989))
+  - fix(mfs): add soft limit for `--flush=false` (#10985) ([ipfs/kubo#10985](https://github.com/ipfs/kubo/pull/10985))
+  - fix: provide Filestore nodes (#10990) ([ipfs/kubo#10990](https://github.com/ipfs/kubo/pull/10990))
+  - feat: limit pin names to 255 bytes (#10981) ([ipfs/kubo#10981](https://github.com/ipfs/kubo/pull/10981))
+  - fix: SweepingProvider slow start  (#10980) ([ipfs/kubo#10980](https://github.com/ipfs/kubo/pull/10980))
+  - chore: release v0.38.0-rc1
+  - fix: SweepingProvider shouldn't error when missing DHT (#10975) ([ipfs/kubo#10975](https://github.com/ipfs/kubo/pull/10975))
+  - fix: allow custom http provide when libp2p node is offline (#10974) ([ipfs/kubo#10974](https://github.com/ipfs/kubo/pull/10974))
+  - docs(provide): validation and reprovide cycle visualization (#10977) ([ipfs/kubo#10977](https://github.com/ipfs/kubo/pull/10977))
+  - refactor(ci): optimize build workflows (#10973) ([ipfs/kubo#10973](https://github.com/ipfs/kubo/pull/10973))
+  - fix(cmds): cleanup unicode identify strings (#9465) ([ipfs/kubo#9465](https://github.com/ipfs/kubo/pull/9465))
+  - feat: ipfs-webui v4.9.0 with retrieval diagnostics (#10969) ([ipfs/kubo#10969](https://github.com/ipfs/kubo/pull/10969))
+  - fix(mfs): unbound cache growth with `flush=false` (#10971) ([ipfs/kubo#10971](https://github.com/ipfs/kubo/pull/10971))
+  - fix: `ipfs pin ls <cid> --names` (#10970) ([ipfs/kubo#10970](https://github.com/ipfs/kubo/pull/10970))
+  - refactor(config): migration 17-to-18 to unify Provider/Reprovider into Provide.DHT (#10951) ([ipfs/kubo#10951](https://github.com/ipfs/kubo/pull/10951))
+  - feat: opt-in new Sweep provide system (#10834) ([ipfs/kubo#10834](https://github.com/ipfs/kubo/pull/10834))
+  - rpc: retrieve pin names when Detailed option provided (#10966) ([ipfs/kubo#10966](https://github.com/ipfs/kubo/pull/10966))
+  - fix: enforce identity CID size limits (#10949) ([ipfs/kubo#10949](https://github.com/ipfs/kubo/pull/10949))
+  - docs: kubo logo sources (#10964) ([ipfs/kubo#10964](https://github.com/ipfs/kubo/pull/10964))
+  - feat(config): validate Import config at daemon startup (#10957) ([ipfs/kubo#10957](https://github.com/ipfs/kubo/pull/10957))
+  - fix(telemetry): improve vm/container detection (#10944) ([ipfs/kubo#10944](https://github.com/ipfs/kubo/pull/10944))
+  - feat(gateway):  improved error page with retrieval state details (#10950) ([ipfs/kubo#10950](https://github.com/ipfs/kubo/pull/10950))
+  - close files opened during migration (#10956) ([ipfs/kubo#10956](https://github.com/ipfs/kubo/pull/10956))
+  - fix ctrl-c prompt during run migrations prompt (#10947) ([ipfs/kubo#10947](https://github.com/ipfs/kubo/pull/10947))
+  - repo: use config api to get node root path (#10934) ([ipfs/kubo#10934](https://github.com/ipfs/kubo/pull/10934))
+  - docs: simplify release process (#10870) ([ipfs/kubo#10870](https://github.com/ipfs/kubo/pull/10870))
+  - Merge release v0.37.0 ([ipfs/kubo#10943](https://github.com/ipfs/kubo/pull/10943))
+  - feat(ci): docker linting (#10927) ([ipfs/kubo#10927](https://github.com/ipfs/kubo/pull/10927))
+  - fix: disable telemetry in test profile (#10931) ([ipfs/kubo#10931](https://github.com/ipfs/kubo/pull/10931))
+  - fix: harness tests random panic (#10933) ([ipfs/kubo#10933](https://github.com/ipfs/kubo/pull/10933))
+  - chore: 0.38.0-dev
+- github.com/ipfs/boxo (v0.34.0 -> v0.35.0):
+  - Release v0.35.0 ([ipfs/boxo#1046](https://github.com/ipfs/boxo/pull/1046))
+  - feat(gateway): add `MaxRangeRequestFileSize` protection (#1043) ([ipfs/boxo#1043](https://github.com/ipfs/boxo/pull/1043))
+  - revert: remove MFS auto-flush mechanism (#1041) ([ipfs/boxo#1041](https://github.com/ipfs/boxo/pull/1041))
+  - Filestore: add Provider option to provide filestore blocks. (#1042) ([ipfs/boxo#1042](https://github.com/ipfs/boxo/pull/1042))
+  - fix(pinner): restore indirect pin detection and add context cancellation (#1039) ([ipfs/boxo#1039](https://github.com/ipfs/boxo/pull/1039))
+  - fix(mfs): limit cache growth by default (#1037) ([ipfs/boxo#1037](https://github.com/ipfs/boxo/pull/1037))
+  - update dependencies (#1038) ([ipfs/boxo#1038](https://github.com/ipfs/boxo/pull/1038))
+  - feat(pinner): add `CheckIfPinnedWithType` for efficient checks with names (#1035) ([ipfs/boxo#1035](https://github.com/ipfs/boxo/pull/1035))
+  - fix(routing/http): don't cancel batch prematurely (#1036) ([ipfs/boxo#1036](https://github.com/ipfs/boxo/pull/1036))
+  - refactor: use the new Reprovide Sweep interface (#995) ([ipfs/boxo#995](https://github.com/ipfs/boxo/pull/995))
+  - Update go-dsqueue to latest (#1034) ([ipfs/boxo#1034](https://github.com/ipfs/boxo/pull/1034))
+  - feat(routing/http): return 200 for empty results per IPIP-513 (#1032) ([ipfs/boxo#1032](https://github.com/ipfs/boxo/pull/1032))
+  - replace provider queue with go-dsqueue (#1033) ([ipfs/boxo#1033](https://github.com/ipfs/boxo/pull/1033))
+  - refactor: use slices package to simplify slice manipulation (#1031) ([ipfs/boxo#1031](https://github.com/ipfs/boxo/pull/1031))
+  - bitswap/network: fix read/write data race in bitswap network test (#1030) ([ipfs/boxo#1030](https://github.com/ipfs/boxo/pull/1030))
+  - fix(verifcid): enforce size limit for identity CIDs (#1018) ([ipfs/boxo#1018](https://github.com/ipfs/boxo/pull/1018))
+  - docs: boxo logo source files (#1028) ([ipfs/boxo#1028](https://github.com/ipfs/boxo/pull/1028))
+  - feat(gateway): enhance 504 timeout errors with diagnostic UX (#1023) ([ipfs/boxo#1023](https://github.com/ipfs/boxo/pull/1023))
+  - Use `time.Duration` for rebroadcast delay (#1027) ([ipfs/boxo#1027](https://github.com/ipfs/boxo/pull/1027))
+  - refactor(bitswap/client/internal): close session with Close method instead of context (#1011) ([ipfs/boxo#1011](https://github.com/ipfs/boxo/pull/1011))
+  - fix: use %q for logging routing keys with binary data (#1025) ([ipfs/boxo#1025](https://github.com/ipfs/boxo/pull/1025))
+  - rename `retrieval.RetrievalState` to `retrieval.State` (#1026) ([ipfs/boxo#1026](https://github.com/ipfs/boxo/pull/1026))
+  - feat(gateway): add retrieval state tracking for timeout diagnostics (#1015) ([ipfs/boxo#1015](https://github.com/ipfs/boxo/pull/1015))
+  - Nonfunctional changes (#1017) ([ipfs/boxo#1017](https://github.com/ipfs/boxo/pull/1017))
+  - fix: flaky TestCancelOverridesPendingWants (#1016) ([ipfs/boxo#1016](https://github.com/ipfs/boxo/pull/1016))
+  - bitswap/client: GetBlocks cancels session when finished (#1007) ([ipfs/boxo#1007](https://github.com/ipfs/boxo/pull/1007))
+  - Remove unused context ([ipfs/boxo#1006](https://github.com/ipfs/boxo/pull/1006))
+- github.com/ipfs/go-block-format (v0.2.2 -> v0.2.3):
+  - new version (#66) ([ipfs/go-block-format#66](https://github.com/ipfs/go-block-format/pull/66))
+  - Replace CI badge and add GoDoc link in README (#65) ([ipfs/go-block-format#65](https://github.com/ipfs/go-block-format/pull/65))
+- github.com/ipfs/go-datastore (v0.8.3 -> v0.9.0):
+  - new version (#255) ([ipfs/go-datastore#255](https://github.com/ipfs/go-datastore/pull/255))
+  - feat(keytransform): support transaction feature (#239) ([ipfs/go-datastore#239](https://github.com/ipfs/go-datastore/pull/239))
+  - feat: context datastore (#238) ([ipfs/go-datastore#238](https://github.com/ipfs/go-datastore/pull/238))
+  - new version (#254) ([ipfs/go-datastore#254](https://github.com/ipfs/go-datastore/pull/254))
+  - fix comment (#253) ([ipfs/go-datastore#253](https://github.com/ipfs/go-datastore/pull/253))
+  - feat: query iterator (#244) ([ipfs/go-datastore#244](https://github.com/ipfs/go-datastore/pull/244))
+  - Update readme links (#246) ([ipfs/go-datastore#246](https://github.com/ipfs/go-datastore/pull/246))
+- github.com/ipfs/go-ipld-format (v0.6.2 -> v0.6.3):
+  - new version (#100) ([ipfs/go-ipld-format#100](https://github.com/ipfs/go-ipld-format/pull/100))
+  - avoid unnecessary slice allocation (#99) ([ipfs/go-ipld-format#99](https://github.com/ipfs/go-ipld-format/pull/99))
+- github.com/ipfs/go-unixfsnode (v1.10.1 -> v1.10.2):
+  - new version ([ipfs/go-unixfsnode#88](https://github.com/ipfs/go-unixfsnode/pull/88))
+- github.com/ipld/go-car/v2 (v2.14.3 -> v2.15.0):
+  - v2.15.0 bump (#606) ([ipld/go-car#606](https://github.com/ipld/go-car/pull/606))
+  - feat: add NextReader to BlockReader (#603) ([ipld/go-car#603](https://github.com/ipld/go-car/pull/603))
+  - Remove `@masih` form CODEOWNERS ([ipld/go-car#605](https://github.com/ipld/go-car/pull/605))
+- github.com/libp2p/go-libp2p-kad-dht (v0.34.0 -> v0.35.0):
+  - chore: release v0.35.0 (#1162) ([libp2p/go-libp2p-kad-dht#1162](https://github.com/libp2p/go-libp2p-kad-dht/pull/1162))
+  - refactor: adjust FIND_NODE response exceptions (#1158) ([libp2p/go-libp2p-kad-dht#1158](https://github.com/libp2p/go-libp2p-kad-dht/pull/1158))
+  - refactor: remove provider status command (#1157) ([libp2p/go-libp2p-kad-dht#1157](https://github.com/libp2p/go-libp2p-kad-dht/pull/1157))
+  - refactor(provider): closestPeerToPrefix coverage trie (#1156) ([libp2p/go-libp2p-kad-dht#1156](https://github.com/libp2p/go-libp2p-kad-dht/pull/1156))
+  - fix: don't empty mapdatastore keystore on close (#1155) ([libp2p/go-libp2p-kad-dht#1155](https://github.com/libp2p/go-libp2p-kad-dht/pull/1155))
+  - provider: default options (#1153) ([libp2p/go-libp2p-kad-dht#1153](https://github.com/libp2p/go-libp2p-kad-dht/pull/1153))
+  - fix(keystore): use new batch after commit (#1154) ([libp2p/go-libp2p-kad-dht#1154](https://github.com/libp2p/go-libp2p-kad-dht/pull/1154))
+  - provider: more minor fixes (#1152) ([libp2p/go-libp2p-kad-dht#1152](https://github.com/libp2p/go-libp2p-kad-dht/pull/1152))
+  - rename KeyStore -> Keystore (#1151) ([libp2p/go-libp2p-kad-dht#1151](https://github.com/libp2p/go-libp2p-kad-dht/pull/1151))
+  - provider: minor fixes (#1150) ([libp2p/go-libp2p-kad-dht#1150](https://github.com/libp2p/go-libp2p-kad-dht/pull/1150))
+  - buffered provider (#1149) ([libp2p/go-libp2p-kad-dht#1149](https://github.com/libp2p/go-libp2p-kad-dht/pull/1149))
+  - keystore: remove mutex (#1147) ([libp2p/go-libp2p-kad-dht#1147](https://github.com/libp2p/go-libp2p-kad-dht/pull/1147))
+  - provider: ResettableKeyStore (#1146) ([libp2p/go-libp2p-kad-dht#1146](https://github.com/libp2p/go-libp2p-kad-dht/pull/1146))
+  - keystore: revamp (#1142) ([libp2p/go-libp2p-kad-dht#1142](https://github.com/libp2p/go-libp2p-kad-dht/pull/1142))
+  - provider: use synctest for testing time (#1136) ([libp2p/go-libp2p-kad-dht#1136](https://github.com/libp2p/go-libp2p-kad-dht/pull/1136))
+  - provider: connectivity state machine (#1135) ([libp2p/go-libp2p-kad-dht#1135](https://github.com/libp2p/go-libp2p-kad-dht/pull/1135))
+  - provider: minor fixes (#1133) ([libp2p/go-libp2p-kad-dht#1133](https://github.com/libp2p/go-libp2p-kad-dht/pull/1133))
+  - dual: provider (#1132) ([libp2p/go-libp2p-kad-dht#1132](https://github.com/libp2p/go-libp2p-kad-dht/pull/1132))
+  - provider: refresh schedule (#1131) ([libp2p/go-libp2p-kad-dht#1131](https://github.com/libp2p/go-libp2p-kad-dht/pull/1131))
+  - provider: integration tests (#1127) ([libp2p/go-libp2p-kad-dht#1127](https://github.com/libp2p/go-libp2p-kad-dht/pull/1127))
+  - provider: daemon (#1126) ([libp2p/go-libp2p-kad-dht#1126](https://github.com/libp2p/go-libp2p-kad-dht/pull/1126))
+  - provide: handle reprovide (#1125) ([libp2p/go-libp2p-kad-dht#1125](https://github.com/libp2p/go-libp2p-kad-dht/pull/1125))
+  - provider: options (#1124) ([libp2p/go-libp2p-kad-dht#1124](https://github.com/libp2p/go-libp2p-kad-dht/pull/1124))
+  - provider: catchup pending work (#1123) ([libp2p/go-libp2p-kad-dht#1123](https://github.com/libp2p/go-libp2p-kad-dht/pull/1123))
+  - provider: batch reprovide (#1122) ([libp2p/go-libp2p-kad-dht#1122](https://github.com/libp2p/go-libp2p-kad-dht/pull/1122))
+  - provider: batch provide (#1121) ([libp2p/go-libp2p-kad-dht#1121](https://github.com/libp2p/go-libp2p-kad-dht/pull/1121))
+  - provider: swarm exploration (#1120) ([libp2p/go-libp2p-kad-dht#1120](https://github.com/libp2p/go-libp2p-kad-dht/pull/1120))
+  - provider: handleProvide (#1118) ([libp2p/go-libp2p-kad-dht#1118](https://github.com/libp2p/go-libp2p-kad-dht/pull/1118))
+  - provider: schedule (#1117) ([libp2p/go-libp2p-kad-dht#1117](https://github.com/libp2p/go-libp2p-kad-dht/pull/1117))
+  - provider: schedule prefix length (#1116) ([libp2p/go-libp2p-kad-dht#1116](https://github.com/libp2p/go-libp2p-kad-dht/pull/1116))
+  - provider: ProvideStatus interface (#1110) ([libp2p/go-libp2p-kad-dht#1110](https://github.com/libp2p/go-libp2p-kad-dht/pull/1110))
+  - provider: network operations (#1115) ([libp2p/go-libp2p-kad-dht#1115](https://github.com/libp2p/go-libp2p-kad-dht/pull/1115))
+  - provider: adding provide and reprovide queue (#1114) ([libp2p/go-libp2p-kad-dht#1114](https://github.com/libp2p/go-libp2p-kad-dht/pull/1114))
+  - provider: trie allocation helper (#1108) ([libp2p/go-libp2p-kad-dht#1108](https://github.com/libp2p/go-libp2p-kad-dht/pull/1108))
+  - add missing ShortestCoveredPrefix ([libp2p/go-libp2p-kad-dht@d0b110d](https://github.com/libp2p/go-libp2p-kad-dht/commit/d0b110d))
+  - provider: keyspace helpers ([libp2p/go-libp2p-kad-dht@af3ce09](https://github.com/libp2p/go-libp2p-kad-dht/commit/af3ce09))
+  - provider: helpers package rename (#1111) ([libp2p/go-libp2p-kad-dht#1111](https://github.com/libp2p/go-libp2p-kad-dht/pull/1111))
+  - provider: trie region helpers (#1109) ([libp2p/go-libp2p-kad-dht#1109](https://github.com/libp2p/go-libp2p-kad-dht/pull/1109))
+  - provider: PruneSubtrie helper (#1107) ([libp2p/go-libp2p-kad-dht#1107](https://github.com/libp2p/go-libp2p-kad-dht/pull/1107))
+  - provider: NextNonEmptyLeaf trie helper (#1106) ([libp2p/go-libp2p-kad-dht#1106](https://github.com/libp2p/go-libp2p-kad-dht/pull/1106))
+  - provider: find subtrie helper (#1105) ([libp2p/go-libp2p-kad-dht#1105](https://github.com/libp2p/go-libp2p-kad-dht/pull/1105))
+  - provider: helpers trie find prefix (#1104) ([libp2p/go-libp2p-kad-dht#1104](https://github.com/libp2p/go-libp2p-kad-dht/pull/1104))
+  - provider: trie items listing helpers (#1103) ([libp2p/go-libp2p-kad-dht#1103](https://github.com/libp2p/go-libp2p-kad-dht/pull/1103))
+  - provider: add ShortestCoveredPrefix helper (#1102) ([libp2p/go-libp2p-kad-dht#1102](https://github.com/libp2p/go-libp2p-kad-dht/pull/1102))
+  - provider: key helpers (#1101) ([libp2p/go-libp2p-kad-dht#1101](https://github.com/libp2p/go-libp2p-kad-dht/pull/1101))
+  - provider: Connectivity Checker (#1099) ([libp2p/go-libp2p-kad-dht#1099](https://github.com/libp2p/go-libp2p-kad-dht/pull/1099))
+  - provider: SweepingProvider interface (#1098) ([libp2p/go-libp2p-kad-dht#1098](https://github.com/libp2p/go-libp2p-kad-dht/pull/1098))
+  - provider: keystore (#1096) ([libp2p/go-libp2p-kad-dht#1096](https://github.com/libp2p/go-libp2p-kad-dht/pull/1096))
+  - provider initial commit ([libp2p/go-libp2p-kad-dht@70d21a8](https://github.com/libp2p/go-libp2p-kad-dht/commit/70d21a8))
+  - test GCP result order (#1097) ([libp2p/go-libp2p-kad-dht#1097](https://github.com/libp2p/go-libp2p-kad-dht/pull/1097))
+  - refactor: apply suggestions in records (#1113) ([libp2p/go-libp2p-kad-dht#1113](https://github.com/libp2p/go-libp2p-kad-dht/pull/1113))
+- github.com/libp2p/go-libp2p-kbucket (v0.7.0 -> v0.8.0):
+  - chore: release v0.8.0 (#147) ([libp2p/go-libp2p-kbucket#147](https://github.com/libp2p/go-libp2p-kbucket/pull/147))
+  - feat: generic find PeerID with CPL (#145) ([libp2p/go-libp2p-kbucket#145](https://github.com/libp2p/go-libp2p-kbucket/pull/145))
+- github.com/multiformats/go-varint (v0.0.7 -> v0.1.0):
+  - v0.1.0 bump (#29) ([multiformats/go-varint#29](https://github.com/multiformats/go-varint/pull/29))
+  - chore: optimise UvarintSize (#28) ([multiformats/go-varint#28](https://github.com/multiformats/go-varint/pull/28))
+
 </details>
 
 ### 👨‍👩‍👧‍👦 Contributors
+
+| Contributor | Commits | Lines ± | Files Changed |
+|-------------|---------|---------|---------------|
+| Guillaume Michel | 62 | +15401/-5657 | 209 |
+| Marcin Rataj | 33 | +9540/-1734 | 215 |
+| Andrew Gillis | 29 | +771/-1093 | 70 |
+| Hlib Kanunnikov | 2 | +350/-0 | 5 |
+| Rod Vagg | 3 | +260/-9 | 4 |
+| Hector Sanjuan | 4 | +188/-33 | 11 |
+| Jakub Sztandera | 1 | +67/-15 | 3 |
+| Masih H. Derkani | 1 | +1/-2 | 2 |
+| Dominic Della Valle | 1 | +2/-1 | 1 |