Release 0.36

[lidel]

Part of ongoing maintenance of key libraries and services ipshipyard/roadmaps#1 and ipshipyard/roadmaps#6

Meta

• Release owner: @lidel
• Release reviewer/backup: @gammazero
• Expected RC1 date: ~ Jun 11 or 18th
• Expected RC2 date: ~ Jul 9th
• 🚢 Expected final release date: July 16th
• Release PR: Release v0.36.0 #10841
• Accompanying PR for improving the release process: docs: release checklist fixes from 0.36 #10861
• Internal Staging tests by Shipyard: Notes: 0.35 vs 0.36
• Changelog: https://github.com/ipfs/kubo/blob/master/docs/changelogs/v0.36.md

Items In Scope

Required

This release continues focus on HTTP retrieval, provider system improvements, and reducing cost of running bitswap's libp2p client/server.

• go-libp2p with quic-go >= 0.52
• panic on daemon shutdown fix: boxo with fix(bitswap/httpnet): idempotent Stop() boxo#920
• HTTP
  • boxo with bitswap/httpnet: Disconnect peers after client errors boxo#919
  • feat: HTTP retrieval enabled by default #10836
• fix(gateway): gateway-conformance v0.8 #10818 to fix Negative range requests are not implemented correctly #10808
• bitswap/client: configurable broadcast reduction #10825
• p2p-forge/client@main with feat: AutoTLS with AutoNATv2 client #10835
• switch to final go-libp2p release
• switch to final p2p-forge/client release

Issues found ~RC1

• boxo with bitswap/httpnet: adjust error logging boxo#958
  • httpnet: move disconnect spam to DEBUG level boxo#954
  • httpnet: logs every HTTP 5XX as ERROR boxo#955
• (cherry-pick) Replace use of go-car v1 with go-car/v2 #10845
• boxo with bitswap/httpnet: limit metric cardinality boxo#957
• (cherry-pick) chore: p2p-forge v0.6.0 + go-libp2p 0.42.0 #10840
• boxo with bitswap/httpnet: Sanitize allow/denylist inputs boxo#964
• DelegatedRouters produces requests for /routing/v1/routing/v1/ #10853
  • boxo with fix: normalize delegated /routing/v1 urls boxo#971
• understand why test-cid-v1-wide produces different CID than Singularity: https://discuss.ipfs.tech/t/should-we-profile-cids/18507/41
• boxo with bitswap/client: Set DontHaveTimeout MinTimeout to 50ms boxo#965
• fix: handling of EDITOR env var #10855 + TestEditorParsing

Nice To Have (Optional)

• ERROR in fullrt/dht.go: key not found in map libp2p/go-libp2p-kad-dht#1001
• fix: support --flush=false in files rm #10848
• config/swarm/connmgr: expose silence period #10827
• other kad-dht provider/reprovider improvements
  • feat: opt-in new Sweep provide system #10834 (wip, likely 0.37+)
    • feat: Reprovide Sweep libp2p/go-libp2p-kad-dht#1082
    • (parked until reprovider refactor) provider: duplicated CIDs sent to provide queue boxo#901
    • (parked until reprovider refactor) Command to clean reprovider queue #10829
• boxo/gateway with configurable limits (and sane limit enabled by default)
  • feat(gateway): implement request concurrency limit boxo#887
  • feat(gateway): add configurable response write timeout boxo#812
• feat(mfs): chroot command to change the root #8648
• bug: failed to establish port mapping: goupnp: error performing SOAP HTTP request after LAN (upnp) router restart #9759
• chore: use go-log/v2 #10801
• feat(mfs): chroot command to change the root #8648 as fix for Ipfs daemon hangs when MFS root is not available locally #7183 (comment)
• Deployment plan for AutoNAT v2 #10091
  • AutoTLS: attempts to get cert when not publicly diallable #10570 (depends on autonatv2 client)
• Denylist support fixes and improvements
  • ipfs blockservice is incompatible with sessions ipfs-shipyard/nopfs#34 (NOfs content filtering is not applied to bitswap)
  • Support consuming https://badbits.dwebops.pub/badbits.deny rainbow#126 (same applies to Kubo)
    • denylist: ?format=car does not skip directly blocked CIDs #10361
    • HTTPSubscriber: detect when list is not append-only ipfs-shipyard/nopfs#39
    • HTTPSubscriber: check with If-None-Match or If-Modified-Since ipfs-shipyard/nopfs#38
• Update pubsub and add default validator #9684
• Add Routing.Type=delegated to only use Routing.DelegatedRouters #10824
• refactor: support percent-encoded /unix paths #10833

[lidel]

Perfored internal smoke-test with ipfs/kubo:master-2025-06-17-eb6cc02 on Shipyar's staging gateway and collab cluster boxes (internal notes).

Found cosmetic ERROR logs:

• httpnet: move disconnect spam to DEBUG level boxo#954
• httpnet: logs every HTTP 5XX as ERROR boxo#955
• ERROR in fullrt/dht.go: key not found in map libp2p/go-libp2p-kad-dht#1001

but no red flags since 2025-06-17 16:25 UTC.

We will start 0.36.0-rc1 release dance.

[lidel]

✅ Release Checklist (v0.36.0-rc1)

1. Prepare release branch

• Prepare the release branch and update version numbers accordingly
  • create a new branch release-vX.Y.Z
    • use master as base if Z == 0
    • use release as base if Z > 0
  • update the CurrentVersionNumber in version.go in the master branch to vX.Y+1.0-dev (example)
  • update the CurrentVersionNumber in version.go in the release-vX.Y.Z branch to vX.Y.Z(-rcN) (example)
  • create a draft PR from release-vX.Y.Z to release (example)
  • Cherry-pick commits from master to the release-vX.Y.Z using git cherry-pick -x <commit> (example)
    • NOTE: cherry-picking with -x is important
  • Replace the Changelog and Contributors sections of the changelog with the stdout (do NOT copy the stderr) of ./bin/mkreleaselog.
    • NOTE: mkreleaselog expects your $GOPATH/src/github.com/ipfs/kubo to include latest commits from release-vX.Y.Z
  • verify all CI checks on the PR from release-vX.Y.Z to release are passing
  • Merge the PR from release-vX.Y.Z to release using the Create a merge commit
    • do NOT use Squash and merge nor Rebase and merge because we need to be able to sign the merge commit
    • do NOT delete the release-vX.Y.Z branch

2. Tag release

• Create the release tag
  • ⚠️ NOTE: This is a dangerous operation! Go and Docker publishing are difficult to reverse! Have the release reviewer verify all the commands marked with !
  • tag the HEAD commit using git tag -s vX.Y.Z(-rcN) -m 'Prerelease X.Y.Z(-rcN)'
  • tag the HEAD commit of the release branch using git tag -s vX.Y.Z -m 'Release X.Y.Z'
  • ⚠️ verify the tag is signed and tied to the correct commit using git show vX.Y.Z(-rcN)
  • push the tag to GitHub using git push origin vX.Y.Z(-rcN)
    • ⚠️ do NOT use git push --tags because it pushes all your local tags

3. Publish

• Publish Docker image to DockerHub
  • Wait for Publish docker image workflow run initiated by the tag push to finish
  • verify the image is available on Docker Hub → tags
• Publish the release to dist.ipfs.tech
  • check out ipfs/distributions
  • create new branch: run git checkout -b release-kubo-X.Y.Z(-rcN)
  • run ./dist.sh add-version kubo vX.Y.Z(-rcN) to add the new version to the versions file (usage)
  • Verify ipfs/distributions's .tool-versions's golang entry is set to the latest go release on the major go branch Kubo is being tested on (see go-version:). If not, update .tool-versions to match the latest golang.
  • create and merge the PR which updates dists/kubo/versions and dists/go-ipfs/versions (NOTE: will also have dists/kubo/current and dists/go-ipfs/current – example)
  • wait for the CI workflow run initiated by the merge to master to finish
  • verify the release is available on dist.ipfs.tech
• Publish the release to NPM
  • manually dispatch the Release to npm workflow
  • check Release to npm workflow run logs to verify it discovered the new release
  • verify the release is available on NPM
• Publish the release to GitHub kubo/releases
  • create a new release on github.com/ipfs/kubo/releases
    • RC example
    • FINAL example
    • use the vX.Y.Z(-rcN) tag
    • link to the release issue
    • link to the changelog in the description
    • check the This is a pre-release checkbox
    • copy the changelog (without the header) in the description
    • do NOT check the This is a pre-release checkbox
  • run the sync-release-assets workflow
  • wait for the sync-release-assets workflow run to finish
  • verify the release assets are present in the GitHub release

4. After Publishing

• Merge the release branch back into master
  • Create a new branch merge-release-vX.Y.Z from release
  • Create the next ./docs/changelogs/vA.B.md and link to the new changelog from the ./CHANGELOG.md file
  • Create and merge a PR from merge-release-vX.Y.Z to master
    • ⚠️ do NOT use Squash and merge nor Rebase and merge because we need to be able to sign the merge commit
    • ⚠️ NOTE: make sure to ignore the changes to version.go (keep the -dev in master)
• Update Kubo staging environment, see the Running Kubo tests on staging for details.
  • Test last release against the current RC
  • Test last release against the current one
• Promote the release
  • create an IPFS Discourse topic (prerelease example, release example)
    • use Kubo vX.Y.Z(-rcN) is out! as the title and kubo and go-ipfs as tags
    • repeat the title as a heading (##) in the description
    • link to the GitHub Release, binaries on IPNS, docker pull command and release notes in the description
    • pin the IPFS Discourse topic globally, you can make the topic a banner if there is no banner already
  • verify the IPFS Discourse topic was copied to:
    • #ipfs-chatter in IPFS Discord
    • #ipfs-chatter in FIL Slack
    • #ipfs-chatter:ipfs.io in Matrix
  • Add the link to the IPFS Discourse topic to the GitHub Release description (example)
  • create an issue comment mentioning early testers on the release issue (example)
  • create an issue comment linking to the release on the release issue (example)
  • promote on bsky.app (example)
  • promote on x.com (example)
  • post the link to the GitHub Release to Reddit (example)
• Manually smoke-test the new version with IPFS Companion Browser Extension
• Update Kubo in ipfs-desktop
  • check out ipfs/ipfs-desktop
  • run npm install
  • create a PR which updates package.json and package-lock.json

Skipped for RC1:

• Update Kubo docs at docs.ipfs.tech:
  • run the update-on-new-ipfs-tag.yml workflow
  • merge the PR created by the update-on-new-ipfs-tag.yml workflow run
• Create a blog entry on blog.ipfs.tech
  • create a PR which adds a release note for the new Kubo version (example)
  • merge the PR
  • verify the blog entry was published
• Create a dependency update PR
  • check out ipfs/kubo
  • go over direct dependencies from go.mod in the root directory (NOTE: do not run go get -u as it will upgrade indirect dependencies which may cause problems)
  • run make mod_tidy
  • create a PR which updates go.mod and go.sum
  • add the PR to the next release milestone
• Create the next release issue
• Close the release issue

[lidel]

Kubo v0.36.0-rc2 is out!

Early testers ping for RC1 testing:

• Charity Engine (@Rytiss, @tristanolive)
• Fission (@bmann)
• Infura (@MichaelMure)
• OrbitDB (@haydenyoung)
• Pinata (@obo20)
• Shipyard (@cewood, @ns4plabs)
• Siderus (@koalalorenzo)
• Textile (@sanderpick)
• @RubenKelevra

You're getting this message because you're listed here. Open PR to update that list if you no longer want to be included in these pings.