Release v0.41.0

.github/FUNDING.yml

@@ -1 +1 @@
-custom: [ipshipyard.gitwallet.co]
+github: [ipshipyard]

.github/workflows/docker-check.yml

@@ -30,6 +30,20 @@ jobs:
           verbose: true
           format: tty
 
+      # Guard rail: the Dockerfile ARG default is what `docker build .` uses
+      # locally without --build-arg. CI overrides it from go.mod, but the
+      # default must stay in sync so local builds and the published image use
+      # the same Go toolchain.
+      - name: Verify Dockerfile GO_VERSION default matches go.mod
+        run: |
+          GO_MOD_VERSION=$(awk '/^go [0-9]/ {print $2; exit}' go.mod)
+          DOCKERFILE_VERSION=$(awk -F= '/^ARG GO_VERSION=/ {print $2; exit}' Dockerfile)
+          if [ "$GO_MOD_VERSION" != "$DOCKERFILE_VERSION" ]; then
+            echo "::error file=Dockerfile::go.mod has 'go ${GO_MOD_VERSION}' but Dockerfile default ARG GO_VERSION=${DOCKERFILE_VERSION}. Update the Dockerfile default to match go.mod."
+            exit 1
+          fi
+          echo "OK: both pinned to ${GO_MOD_VERSION}"
+
   build:
     if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
@@ -42,17 +56,25 @@ jobs:
         shell: bash
     steps:
       - uses: actions/checkout@v6
-      
+
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
+        uses: docker/setup-buildx-action@v4
+
+      # Mirror the publish workflow: pull the Go version from go.mod so the
+      # PR check builds with the same toolchain that the published image uses.
+      - name: Read Go version from go.mod
+        id: go
+        run: echo "version=$(awk '/^go [0-9]/ {print $2; exit}' go.mod)" >> "$GITHUB_OUTPUT"
+
       - name: Build Docker image with BuildKit
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: false
           load: true
           tags: ${{ env.IMAGE_NAME }}:${{ env.WIP_IMAGE_TAG }}
+          build-args: |
+            GO_VERSION=${{ steps.go.outputs.version }}
           cache-from: |
             type=gha
             type=registry,ref=${{ env.IMAGE_NAME }}:buildcache

.github/workflows/docker-image.yml

@@ -46,13 +46,13 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ vars.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -66,46 +66,58 @@ jobs:
           echo "EOF" >> $GITHUB_OUTPUT
         shell: bash
 
+      # Read the Go version from go.mod so the Docker image is built with the
+      # exact same toolchain that setup-go installs in the rest of CI.
+      - name: Read Go version from go.mod
+        id: go
+        run: echo "version=$(awk '/^go [0-9]/ {print $2; exit}' go.mod)" >> "$GITHUB_OUTPUT"
+
       # We have to build each platform separately because when using multi-arch
       # builds, only one platform is being loaded into the cache. This would
       # prevent us from testing the other platforms.
       - name: Build Docker image (linux/amd64)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           platforms: linux/amd64
           context: .
           push: false
           load: true
           file: ./Dockerfile
           tags: ${{ env.IMAGE_NAME }}:linux-amd64
+          build-args: |
+            GO_VERSION=${{ steps.go.outputs.version }}
           cache-from: |
             type=gha
             type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
           cache-to: type=gha,mode=max
 
       - name: Build Docker image (linux/arm/v7)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           platforms: linux/arm/v7
           context: .
           push: false
           load: true
           file: ./Dockerfile
           tags: ${{ env.IMAGE_NAME }}:linux-arm-v7
+          build-args: |
+            GO_VERSION=${{ steps.go.outputs.version }}
           cache-from: |
             type=gha
             type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
           cache-to: type=gha,mode=max
 
       - name: Build Docker image (linux/arm64/v8)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           platforms: linux/arm64/v8
           context: .
           push: false
           load: true
           file: ./Dockerfile
           tags: ${{ env.IMAGE_NAME }}:linux-arm64-v8
+          build-args: |
+            GO_VERSION=${{ steps.go.outputs.version }}
           cache-from: |
             type=gha
             type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
@@ -128,13 +140,15 @@ jobs:
       # This will only push the previously built images.
       - if: github.event_name != 'workflow_dispatch' || github.event.inputs.push == 'true'
         name: Publish to Docker Hub
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           platforms: linux/amd64,linux/arm/v7,linux/arm64/v8
           context: .
           push: true
           file: ./Dockerfile
           tags: "${{ github.event.inputs.tags || steps.tags.outputs.value }}"
+          build-args: |
+            GO_VERSION=${{ steps.go.outputs.version }}
           cache-from: |
             type=gha
             type=registry,ref=${{ env.IMAGE_NAME }}:buildcache

.github/workflows/gateway-conformance.yml

@@ -41,7 +41,7 @@ jobs:
     steps:
       # 1. Download the gateway-conformance fixtures
       - name: Download gateway-conformance fixtures
-        uses: ipfs/gateway-conformance/.github/actions/extract-fixtures@v0.10
+        uses: ipfs/gateway-conformance/.github/actions/extract-fixtures@v0.13
         with:
           output: fixtures
 
@@ -93,7 +93,7 @@ jobs:
 
       # 6. Run the gateway-conformance tests
       - name: Run gateway-conformance tests
-        uses: ipfs/gateway-conformance/.github/actions/test@v0.10
+        uses: ipfs/gateway-conformance/.github/actions/test@v0.13
         with:
           gateway-url: http://127.0.0.1:8080
           subdomain-url: http://localhost:8080
@@ -109,13 +109,13 @@ jobs:
         run: cat output.md >> $GITHUB_STEP_SUMMARY
       - name: Upload HTML report
         if: failure() || success()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: gateway-conformance.html
           path: output.html
       - name: Upload JSON report
         if: failure() || success()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: gateway-conformance.json
           path: output.json
@@ -127,7 +127,7 @@ jobs:
     steps:
       # 1. Download the gateway-conformance fixtures
       - name: Download gateway-conformance fixtures
-        uses: ipfs/gateway-conformance/.github/actions/extract-fixtures@v0.10
+        uses: ipfs/gateway-conformance/.github/actions/extract-fixtures@v0.13
         with:
           output: fixtures
 
@@ -199,7 +199,7 @@ jobs:
 
       # 9. Run the gateway-conformance tests over libp2p
       - name: Run gateway-conformance tests over libp2p
-        uses: ipfs/gateway-conformance/.github/actions/test@v0.10
+        uses: ipfs/gateway-conformance/.github/actions/test@v0.13
         with:
           gateway-url: http://127.0.0.1:8092
           args: --specs "trustless-gateway,-trustless-ipns-gateway" -skip 'TestGatewayCar/GET_response_for_application/vnd.ipld.car/Header_Content-Length'
@@ -214,13 +214,13 @@ jobs:
         run: cat output.md >> $GITHUB_STEP_SUMMARY
       - name: Upload HTML report
         if: failure() || success()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: gateway-conformance-libp2p.html
           path: output.html
       - name: Upload JSON report
         if: failure() || success()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: gateway-conformance-libp2p.json
           path: output.json

.github/workflows/gotest.yml

@@ -43,7 +43,7 @@ jobs:
           make test_unit &&
             [[ ! $(jq -s -c 'map(select(.Action == "fail")) | .[]' test/unit/gotest.json) ]]
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         if: failure() || success()
         with:
           name: unittests
@@ -57,7 +57,7 @@ jobs:
           output: test/unit/gotest.junit.xml
         if: failure() || success()
       - name: Archive the JUnit XML report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: unit-tests-junit
           path: test/unit/gotest.junit.xml
@@ -70,7 +70,7 @@ jobs:
           output: test/unit/gotest.html
         if: failure() || success()
       - name: Archive the HTML report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: unit-tests-html
           path: test/unit/gotest.html
@@ -120,7 +120,7 @@ jobs:
           output: test/cli/cli-tests.junit.xml
         if: failure() || success()
       - name: Archive JUnit XML report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: cli-tests-junit
           path: test/cli/cli-tests.junit.xml
@@ -133,7 +133,7 @@ jobs:
           output: test/cli/cli-tests.html
         if: failure() || success()
       - name: Archive HTML report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: cli-tests-html
           path: test/cli/cli-tests.html
@@ -149,6 +149,59 @@ jobs:
         run: cat test/cli/cli-tests.md >> $GITHUB_STEP_SUMMARY
         if: failure() || success()
 
+  # FUSE filesystem tests (require /dev/fuse and fusermount)
+  # Runs both FUSE unit tests (./fuse/...) and CLI integration tests (./test/cli/fuse/...)
+  fuse-tests:
+    if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch'
+    runs-on: ${{ fromJSON(github.repository == 'ipfs/kubo' && '["self-hosted", "linux", "x64", "2xlarge"]' || '"ubuntu-latest"') }}
+    concurrency:
+      group: fuse-tests-${{ github.repository }}
+      cancel-in-progress: false
+    # A normal run takes ~3min. 6min gives roughly 2x and lets Go's 4min
+    # test timeout fire first (printing a stack trace) on a hang, instead
+    # of GitHub silently cancelling the job.
+    timeout-minutes: 6
+    env:
+      # Dump all goroutines on a test panic, not just the panicking one,
+      # so we can see which test is actually hung.
+      GOTRACEBACK: all
+      TEST_FUSE: 1
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out Kubo
+        uses: actions/checkout@v6
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+      - name: Install FUSE
+        run: |
+          if ! command -v fusermount3 &>/dev/null && ! command -v fusermount &>/dev/null; then
+            sudo apt-get update
+            sudo apt-get install -y fuse3
+          fi
+      - name: Clean up stale FUSE mounts
+        run: |
+          # On shared self-hosted runners, leftover mounts from previous
+          # runs can exhaust the kernel FUSE mount limit (mount_max).
+          # Unit tests mount with FsName "kubo-test"; CLI tests mount
+          # under the harness temp dir (ipfs/ipns/mfs subdirectories).
+          awk '$1 == "kubo-test" || $2 ~ /\/tmp\/.*\/(ipfs|ipns|mfs)$/ { print $2 }' /proc/mounts 2>/dev/null \
+            | while read -r mp; do
+                fusermount3 -uz "$mp" 2>/dev/null || fusermount -uz "$mp" 2>/dev/null || true
+              done
+      - name: Run FUSE tests
+        run: make test_fuse
+      - name: Clean up FUSE mounts
+        if: always()
+        run: |
+          awk '$1 == "kubo-test" || $2 ~ /\/tmp\/.*\/(ipfs|ipns|mfs)$/ { print $2 }' /proc/mounts 2>/dev/null \
+            | while read -r mp; do
+                fusermount3 -uz "$mp" 2>/dev/null || fusermount -uz "$mp" 2>/dev/null || true
+              done
+
   # Example tests (kubo-as-a-library)
   example-tests:
     if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch'

.github/workflows/interop.yml

@@ -51,7 +51,7 @@ jobs:
         with:
           go-version-file: 'go.mod'
       - run: make build
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: kubo
           path: cmd/ipfs/ipfs
@@ -66,7 +66,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: lts/*
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: kubo
           path: cmd/ipfs
@@ -122,7 +122,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: kubo
           path: cmd/ipfs
@@ -196,7 +196,7 @@ jobs:
         working-directory: ipfs-webui
       - name: Upload test artifacts on failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: webui-test-results
           path: ipfs-webui/test-results/

.github/workflows/sharness.yml

@@ -55,7 +55,7 @@ jobs:
           # increasing parallelism beyond 10 doesn't speed up the tests much
           PARALLEL: ${{ github.repository == 'ipfs/kubo' && 10 || 3 }}
       - name: Upload coverage report
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         if: failure() || success()
         with:
           name: sharness
@@ -90,7 +90,7 @@ jobs:
           destination: sharness.html
       - name: Upload one-page HTML report
         if: github.repository != 'ipfs/kubo' && (failure() || success())
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: sharness.html
           path: kubo/test/sharness/test-results/sharness.html
@@ -110,7 +110,7 @@ jobs:
           destination: sharness-html/
       - name: Upload full HTML report
         if: github.repository != 'ipfs/kubo' && (failure() || success())
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: sharness-html
           path: kubo/test/sharness/test-results/sharness-html