chore(deps): bump github.com/ipfs/boxo from 0.33.1 to 0.34.0

[dependabot]

Bumps github.com/ipfs/boxo from 0.33.1 to 0.34.0.

Release notes

Sourced from github.com/ipfs/boxo's releases.

v0.34.0

What's Changed

Added

• autoconf: Client library for fetching, caching and expanding IPFS network configurations using "auto" placeholders
• gateway: Added configurable limits for gateway resource protection:
  • Config.RetrievalTimeout: Maximum duration between writes of non-empty data to HTTP response body (default: 30s). Returns 504 Gateway Timeout when gateway cannot retrieve content within this period.
  • Config.MaxConcurrentRequests: Limits concurrent HTTP requests (default: 4096, suitable for most deployments). Returns 429 Too Many Requests with 60s Retry-After header when exceeded. To restore previous unlimited behavior set both RetrievalTimeout and MaxConcurrentRequests to 0.

    [!IMPORTANT] If your gateway returns many HTTP 429 responses while having available resources (CPU, memory), increase MaxConcurrentRequests. If experiencing high load or resource exhaustion, decrease it. See the MaxConcurrentRequests godoc for detailed tuning guidance.

  • Config.MetricsRegistry: Optional Prometheus registry for metrics isolation. When nil, uses the default global registry. Useful for testing and deployments with multiple gateway instances.
  • New middleware with Prometheus metrics:
    • ipfs_http_gw_concurrent_requests: Gauge tracking number of concurrent requests
    • ipfs_http_gw_responses_total{code}: Counter for all HTTP responses by status code
    • ipfs_http_gw_retrieval_timeouts_total{code,truncated}: Counter for retrieval timeout events with details on truncation
• namesys/IPNSPublisher: option to PublishOptions that allows for setting a custom sequence number for the IPNS record with proper validation to prevent unintentional replay attacks. #962
• blockstore: Added ValidatingBlockstore wrapper. This replaces the HashOnRead blockstore API.

Changed

• bitswap/network: The connection event manager now has a SetListeners method. Both bsnet and httpnet now have options to provide the ConnectionEventManager during New(...). This allows sharing the connection event manager when using both. The connection manager SHOULD be shared when using both networks with the network.Router utility.
• provider: Distribute the responsability of providing new blocks to the places that play a role in the different providing strategies #976. Refactor the logic to perform Provides, when the component has been given a provider:
  • Remove providing.Exchange
  • Provide directly from Blockstore when provider is set (via Option).
  • Provide directly from pinner/merkledag on dag traversal when provider is set (via Option).
  • Provide from MFS whenever there is a call to DAGService.Add and provider is set (via constructor param).
• upgrade to go-libp2p v0.43.0
• replace uber-go/multierr with errors.Join #996
• updated Go in go.mod to 1.24.0 #999

Removed

• blockstore: Removed HashOnRead API. This is a potentially BREAKING CHANGE for any users of the HashOnRead API. Use the ValidatingBlocksore instead.
  • The HashOnRead function was also removed from Filestore. To use this functionality, provide a ValidatingBlockstore when creating a new Filestore.

Full Changelog: ipfs/boxo@v0.33.1...v0.34.0

This release was brought to you by the Shipyard team.

Changelog

Sourced from github.com/ipfs/boxo's changelog.

[v0.34.0]

Added

• autoconf: Client library for fetching, caching and expanding IPFS network configurations using "auto" placeholders
• gateway: Added configurable limits for gateway resource protection:
  • Config.RetrievalTimeout: Maximum duration between writes of non-empty data to HTTP response body (default: 30s). Returns 504 Gateway Timeout when gateway cannot retrieve content within this period.
  • Config.MaxConcurrentRequests: Limits concurrent HTTP requests (default: 4096, suitable for most deployments). Returns 429 Too Many Requests with 60s Retry-After header when exceeded. To restore previous unlimited behavior set both RetrievalTimeout and MaxConcurrentRequests to 0.

    [!IMPORTANT] If your gateway returns many HTTP 429 responses while having available resources (CPU, memory), increase MaxConcurrentRequests. If experiencing high load or resource exhaustion, decrease it. See the MaxConcurrentRequests godoc for detailed tuning guidance.

  • Config.MetricsRegistry: Optional Prometheus registry for metrics isolation. When nil, uses the default global registry. Useful for testing and deployments with multiple gateway instances.
  • New middleware with Prometheus metrics:
    • ipfs_http_gw_concurrent_requests: Gauge tracking number of concurrent requests
    • ipfs_http_gw_responses_total{code}: Counter for all HTTP responses by status code
    • ipfs_http_gw_retrieval_timeouts_total{code,truncated}: Counter for retrieval timeout events with details on truncation
• namesys/IPNSPublisher: option to PublishOptions that allows for setting a custom sequence number for the IPNS record with proper validation to prevent unintentional replay attacks. #962
• blockstore: Added ValidatingBlockstore wrapper. This replaces the HashOnRead blockstore API.

Changed

• bitswap/network: The connection event manager now has a SetListeners method. Both bsnet and httpnet now have options to provide the ConnectionEventManager during New(...). This allows sharing the connection event manager when using both. The connection manager SHOULD be shared when using both networks with the network.Router utility.
• provider: Distribute the responsability of providing new blocks to the places that play a role in the different providing strategies #976. Refactor the logic to perform Provides, when the component has been given a provider:
  • Remove providing.Exchange
  • Provide directly from Blockstore when provider is set (via Option).
  • Provide directly from pinner/merkledag on dag traversal when provider is set (via Option).
  • Provide from MFS whenever there is a call to DAGService.Add and provider is set (via constructor param).
• upgrade to go-libp2p v0.43.0
• replace uber-go/multierr with errors.Join #996
• updated Go in go.mod to 1.24.0 #999

Removed

• blockstore: Removed HashOnRead API. This is a potentially BREAKING CHANGE for any users of the HashOnRead API. Use the ValidatingBlocksore instead.
  • The HashOnRead function was also removed from Filestore. To use this functionality, provide a ValidatingBlockstore when creating a new Filestore.

Commits

• d96d57d Merge pull request #1003 from ipfs/release-v0.34.0
• a5e00ca update version
• eb7db65 Release v0.34.0
• d704762 Merge pull request #1001 from ipfs/no-bs-hashonread
• 75dd3fd Merge branch 'main' into no-bs-hashonread
• 7554aaa Merge pull request #998 from ipfs/update-go-log
• 4e4b1a0 Remove HashOnRead from Filestore
• 0348d14 fix: remove HashOnRead
• 08f788c Merge branch 'main' into update-go-log
• fe649ee feat: autoconf client library (#997)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)