kubo/docs/changelogs/v0.40.md

Kubo changelog v0.40

This release was brought to you by the Shipyard team.

• v0.40.0

v0.40.0

• Overview
• 🔦 Highlights
  • 🧹 Automatic cleanup of interrupted imports
  • Routing V1 HTTP API now exposed by default
  • Track total size when adding pins
  • Improved IPNS over PubSub validation
  • New ipfs diag datastore commands
  • 🚇 Improved ipfs p2p tunnels with foreground mode
  • Improved ipfs dag stat output
  • 🔑 ipfs key improvements
  • Accelerated DHT Client and Provide Sweep now work together
  • 🌐 No unnecessary DNS lookups for AutoTLS addresses
  • ⏱️ Configurable gateway request duration limit
  • 🔧 Recovery from corrupted MFS root
  • 📡 RPC Content-Type headers for binary responses
  • 🔖 New ipfs name get|put commands
  • 📋 Long listing format for ipfs ls
  • 📦️ Dependency updates
• 📝 Changelog
• 👨‍👩‍👧‍👦 Contributors

Overview

🔦 Highlights

🧹 Automatic cleanup of interrupted imports

If you cancel ipfs add or ipfs dag import mid-operation, Kubo now automatically cleans up incomplete data on the next daemon start. Previously, interrupted imports would leave orphan blocks in your repository that were difficult to identify and remove without pins and running explicit garbage collection.

Batch operations also use less memory now. Block data is written to disk immediately rather than held in RAM until the batch commits.

Under the hood, the block storage layer (flatfs) was rewritten to use atomic batch operations via a temporary staging directory. See go-ds-flatfs#142 for details.

Routing V1 HTTP API now exposed by default

The Routing V1 HTTP API is now exposed by default at http://127.0.0.1:8080/routing/v1. This allows light clients in browsers to use Kubo Gateway as a delegated routing backend instead of running a full DHT client. Support for IPIP-476: Delegated Routing DHT Closest Peers API is included. Can be disabled via Gateway.ExposeRoutingAPI.

Track total size when adding pins

Adds total size progress tracking of pinned nodes during ipfs pin add --progress. The output now shows the total size of the pinned dag.

Example output:

Fetched/Processed 336 nodes (83 MB)

Improved IPNS over PubSub validation

IPNS over PubSub implementation in Kubo is now more reliable. Duplicate messages are rejected even in large networks where messages may cycle back after the in-memory cache expires.

Kubo now persists the maximum seen sequence number per peer to the datastore (go-libp2p-pubsub#BasicSeqnoValidator), providing stronger duplicate detection that survives node restarts. This addresses message flooding issues reported in #9665.

Kubo's pubsub is optimized for IPNS use case. For custom pubsub applications requiring different validation logic, use go-libp2p-pubsub directly in a dedicated binary.

New ipfs diag datastore commands

New experimental commands for low-level datastore inspection:

• ipfs diag datastore get <key> - Read raw value at a datastore key (use --hex for hex dump)
• ipfs diag datastore count <prefix> - Count entries matching a datastore prefix

The daemon must not be running when using these commands. Run ipfs diag datastore --help for usage examples.

🚇 Improved ipfs p2p tunnels with foreground mode

P2P tunnels can now run like SSH port forwarding: start a tunnel, use it, and it cleans up automatically when you're done.

The new --foreground (-f) flag for ipfs p2p listen and ipfs p2p forward keeps the command running until interrupted. When you Ctrl+C, send SIGTERM, or stop the service, the tunnel is removed automatically:

$ ipfs p2p listen /x/ssh /ip4/127.0.0.1/tcp/22 --foreground
Listening on /x/ssh, forwarding to /ip4/127.0.0.1/tcp/22, waiting for interrupt...
^C
Received interrupt, removing listener for /x/ssh

Without --foreground, commands return immediately and tunnels persist until explicitly closed (existing behavior).

See docs/p2p-tunnels.md for usage examples.

Improved ipfs dag stat output

The ipfs dag stat command has been improved for better terminal UX:

• Progress output now uses a single line with carriage return, avoiding terminal flooding
• Progress is auto-detected: shown only in interactive terminals by default
• Human-readable sizes are now displayed alongside raw byte counts

Example progress (interactive terminal):

Fetched/Processed 84 blocks, 2097152 bytes (2.1 MB)

Example summary output:

Summary
Total Size: 2097152 (2.1 MB)
Unique Blocks: 42
Shared Size: 1048576 (1.0 MB)
Ratio: 1.500000

Use --progress=true to force progress even when piped, or --progress=false to disable it.

🔑 ipfs key improvements

ipfs key ls is now the canonical command for listing keys, matching ipfs pin ls and ipfs files ls. The old ipfs key list still works but is deprecated.

Listing also became more resilient: bad keys are now skipped with an error log instead of failing the entire operation.

Accelerated DHT Client and Provide Sweep now work together

Previously, provide operations could start before the Accelerated DHT Client discovered enough peers, causing sweep mode to lose its efficiency benefits. Now, providing waits for the initial network crawl (about 10 minutes). Your content will be properly distributed across DHT regions after initial DHT map is created. Check ipfs provide stat to see when providing begins.

🌐 No unnecessary DNS lookups for AutoTLS addresses

Kubo no longer makes DNS queries for AutoTLS addresses like 1-2-3-4.peerid.libp2p.direct. Since the IP is encoded in the hostname (1-2-3-4 means 1.2.3.4), Kubo extracts it locally. This reduces load on the public good DNS servers at libp2p.direct run by Shipyard, reserving them for web browsers which lack direct DNS access and must rely on the browser's resolver.

To disable, set AutoTLS.SkipDNSLookup to false.

⏱️ Configurable gateway request duration limit

Gateway.MaxRequestDuration sets an absolute deadline for gateway requests. Unlike RetrievalTimeout (which resets on each data write and catches stalled transfers), this is a hard limit on the total time a request can take.

The default 1 hour limit (previously hardcoded) can now be adjusted to fit your deployment needs. This is a fallback that prevents requests from hanging indefinitely when subsystem timeouts are misconfigured or fail to trigger. Returns 504 Gateway Timeout when exceeded.

🔧 Recovery from corrupted MFS root

If your daemon fails to start because the MFS root is not a directory (due to misconfiguration, operational error, or disk corruption), you can now recover without deleting and recreating your repository in a new IPFS_PATH.

The new ipfs files chroot command lets you reset the MFS (Mutable File System) root or restore it to a known valid CID:

# Reset MFS to an empty directory
$ ipfs files chroot --confirm

# Or restore from a previously saved directory CID
$ ipfs files chroot --confirm QmYourBackupCID

See ipfs files chroot --help for details.

📡 RPC Content-Type headers for binary responses

HTTP RPC endpoints that return binary data now set appropriate Content-Type headers, making it easier to integrate with HTTP clients and tooling that rely on MIME types. On CLI these commands behave the same as before, but over HTTP RPC you now get proper headers:

Endpoint	Content-Type
/api/v0/get	application/x-tar or application/gzip
/api/v0/dag/export	application/vnd.ipld.car
/api/v0/block/get	application/vnd.ipld.raw
/api/v0/name/get	application/vnd.ipfs.ipns-record
/api/v0/diag/profile	application/zip

🔖 New ipfs name get|put commands

You can now backup, restore, and share IPNS records without needing the private key.

$ ipfs name get /ipns/k51... > record.bin
$ ipfs name get /ipns/k51... | ipfs name inspect
$ ipfs name put k51... record.bin

These are low-level tools primarily for debugging and testing IPNS.

The put command validates records by default. Use --force to skip validation and test how routing systems handle malformed or outdated records. Note that --force only bypasses this command's checks; the routing system may still reject invalid records.

📋 Long listing format for ipfs ls

The ipfs ls command now supports --long (-l) flag for displaying Unix-style file permissions and modification times. This works with files added using --preserve-mode and --preserve-mtime. See ipfs ls --help for format details and examples.

📦️ Dependency updates

• update go-libp2p to v0.47.0 (incl. v0.46.0)
  • Reduced WebRTC log noise by using debug level for pion errors (go-libp2p#3426).
  • Fixed mDNS discovery on Windows and macOS by filtering addresses to reduce packet size (go-libp2p#3434).
  • AutoTLS addresses no longer get marked unreachable when peers lack WebSockets support. Swarm heals over time (go-libp2p#3435).
  • Fixed stream.Close() blocking indefinitely on unresponsive peers (go-libp2p#3448).
• update quic-go to v0.59.0 (incl. v0.58.0 + v0.57.0)
• update p2p-forge to v0.7.0
• update go-ds-pebble to v0.5.9
  • updates github.com/cockroachdb/pebble to v2.1.4 to enable Go 1.26 support
• update go-libp2p-pubsub to v0.15.0
• update boxo to v0.36.0
• update go-libp2p-kad-dht to v0.37.1 (includes v0.37.0)

📝 Changelog

👨‍👩‍👧‍👦 Contributors