Release v0.43.0

.github/workflows/codeql-analysis.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Setup Go
       uses: actions/setup-go@v6

.github/workflows/dependabot-tidy.yml

@@ -36,7 +36,7 @@ jobs:
           echo "number=$pr_number" >> $GITHUB_OUTPUT
           branch=$(gh pr view "$pr_number" --repo "${{ github.repository }}" --json headRefName -q '.headRefName')
           echo "branch=$branch" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ steps.pr.outputs.branch }}
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docker-check.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: hadolint/hadolint-action@v3.3.0
         with:
           dockerfile: Dockerfile
@@ -55,7 +55,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4

.github/workflows/docker-image.yml

@@ -43,7 +43,7 @@ jobs:
       tags: ${{ steps.tags.outputs.value }}
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4

.github/workflows/gateway-conformance.yml

@@ -47,7 +47,7 @@ jobs:
 
       # 2. Build the kubo-gateway
       - name: Checkout kubo-gateway
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: kubo-gateway
       - name: Setup Go
@@ -133,7 +133,7 @@ jobs:
 
       # 2. Build the kubo-gateway
       - name: Checkout kubo-gateway
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: kubo-gateway
       - name: Setup Go

.github/workflows/gobuild.yml

@@ -27,7 +27,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'

.github/workflows/golang-analysis.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
       - uses: actions/setup-go@v6

.github/workflows/golint.yml

@@ -28,7 +28,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'

.github/workflows/gotest.yml

@@ -31,7 +31,7 @@ jobs:
         shell: bash
     steps:
       - name: Check out Kubo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -43,7 +43,7 @@ jobs:
           make test_unit &&
             [[ ! $(jq -s -c 'map(select(.Action == "fail")) | .[]' test/unit/gotest.json) ]]
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         if: failure() || success()
         with:
           name: unittests
@@ -102,7 +102,7 @@ jobs:
         shell: bash
     steps:
       - name: Check out Kubo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -171,7 +171,7 @@ jobs:
         shell: bash
     steps:
       - name: Check out Kubo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -214,7 +214,7 @@ jobs:
         shell: bash
     steps:
       - name: Check out Kubo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
         uses: actions/setup-go@v6
         with:

.github/workflows/interop.yml

@@ -46,7 +46,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
@@ -63,7 +63,7 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: lts/*
       - uses: actions/download-artifact@v8
@@ -80,30 +80,54 @@ jobs:
         id: helia-version
         run: echo "version=$(npm view @helia/interop version)" >> $GITHUB_OUTPUT
       - name: Cache helia-interop node_modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         id: helia-cache
         with:
           path: node_modules
           key: ${{ runner.os }}-helia-interop-${{ steps.helia-version.outputs.version }}
       - name: Install @helia/interop
         if: steps.helia-cache.outputs.cache-hit != 'true'
         run: npm install @helia/interop
-      # TODO(IPIP-499): Remove --grep --invert workaround once helia implements IPIP-499
-      # Tracking issue: https://github.com/ipfs/helia/issues/941
+      # Recurring @helia/interop regression: the published .aegir.js is unusable
+      # from inside node_modules, in one of two ways.
       #
-      # PROVISIONAL HACK: Skip '@helia/mfs - should have the same CID after
-      # creating a file' test due to IPIP-499 changes in kubo.
+      # 1. Missing: the package ships without .aegir.js in its "files", so
+      #    `aegir test` has no config and discovers no spec files. Happened around
+      #    ipfs/helia#1001 (fixed by ipfs/helia#1003), and again in ipfs/helia#1049
+      #    ("feat!: make libp2p optional"), which dropped it from 11.0.0-11.0.2.
+      # 2. Present but broken: the shipped config globs the TypeScript sources
+      #    (./src/*.spec.ts), written for running tests inside the helia monorepo.
+      #    Node refuses to type-strip .ts files under node_modules
+      #    (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING, no tsconfig is shipped),
+      #    so mocha dies on the first spec. This is what ipfs/helia#1066 restored
+      #    in 11.0.3.
       #
-      # WHY IT FAILS: The test creates a 5-byte file in MFS on both kubo and helia,
-      # then compares the root directory CID. With kubo PR #11148, `ipfs files write`
-      # now produces raw CIDs for single-block files (matching `ipfs add --raw-leaves`),
-      # while helia uses `reduceSingleLeafToSelf: false` which keeps the dag-pb wrapper.
-      # Different file CIDs lead to different directory CIDs.
-      #
-      # We run aegir directly (instead of helia-interop binary) because only aegir
-      # supports the --grep/--invert flags needed to exclude specific tests.
-      - name: Run helia-interop tests (excluding IPIP-499 incompatible test)
-        run: npx aegir test -t node --bail -- --grep 'should have the same CID after creating a file' --invert
+      # In both cases we write a minimal config pointing at the prebuilt
+      # ./dist/src, which is all a `-t node` run needs; the rest of helia's own
+      # config is browser-only setup skipped under node. A shipped config that
+      # does not glob .ts files is left untouched, so this step self-heals once
+      # helia publishes a node_modules-safe config. It writes into node_modules
+      # and is fragile if helia's dist layout shifts.
+      - name: Work around unusable @helia/interop/.aegir.js (ipfs/helia#1049, ipfs/helia#1066)
+        run: |
+          config=node_modules/@helia/interop/.aegir.js
+          if [ ! -f "$config" ]; then
+            echo "export default { test: { files: './dist/src/*.spec.js' } }" > "$config"
+            echo "injected minimal $config: file missing from published package"
+          elif grep -qE "files:.*\.spec\.ts" "$config"; then
+            echo "export default { test: { files: './dist/src/*.spec.js' } }" > "$config"
+            echo "replaced $config: shipped config globs .ts sources, which node cannot run from node_modules"
+          else
+            echo "$config is usable as shipped, no workaround needed"
+          fi
+      # We run aegir directly (instead of the helia-interop binary) because the
+      # bin spawns a bare `aegir test` with no way to pass the flags below.
+      # --exit: the node interop specs spawn kubo daemons (via ipfsd-ctl +
+      # KUBO_BINARY) whose libp2p/RPC handles keep Node's event loop alive after
+      # the run, so mocha prints its summary and then hangs until the job timeout.
+      # Force exit once the run completes.
+      - name: Run helia-interop tests
+        run: npx aegir test -t node --bail -- --exit
         env:
           KUBO_BINARY: ${{ github.workspace }}/cmd/ipfs/ipfs
         working-directory: node_modules/@helia/interop
@@ -127,11 +151,11 @@ jobs:
           name: kubo
           path: cmd/ipfs
       - run: chmod +x cmd/ipfs/ipfs
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           repository: ipfs/ipfs-webui
           path: ipfs-webui
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version-file: 'ipfs-webui/.tool-versions'
       - id: webui-ref
@@ -146,7 +170,7 @@ jobs:
         run: gh api "$ENDPOINT" --jq "$SELECTOR" | xargs -I{} echo "$KEY={}" | tee -a $GITHUB_OUTPUT
       # Cache node_modules based on package-lock.json
       - name: Cache node_modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         id: node-modules-cache
         with:
           path: ipfs-webui/node_modules
@@ -159,7 +183,7 @@ jobs:
         working-directory: ipfs-webui
       # Cache Playwright browsers
       - name: Cache Playwright browsers
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         id: playwright-cache
         with:
           path: ~/.cache/ms-playwright
@@ -178,7 +202,7 @@ jobs:
         working-directory: ipfs-webui
       # Cache test build output
       - name: Cache test build
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         id: test-build-cache
         with:
           path: ipfs-webui/build

.github/workflows/sharness.yml

@@ -23,7 +23,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout Kubo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           path: kubo
       - name: Setup Go
@@ -32,7 +32,7 @@ jobs:
           go-version-file: 'kubo/go.mod'
       - name: Install missing tools
         run: sudo apt update && sudo apt install -y socat net-tools fish libxml2-utils
-      - uses: actions/cache@v5
+      - uses: actions/cache@v6
         with:
           path: test/sharness/lib/dependencies
           key: ${{ runner.os }}-test-generate-junit-html-${{ hashFiles('test/sharness/lib/test-generate-junit-html.sh') }}
@@ -55,7 +55,7 @@ jobs:
           # increasing parallelism beyond 10 doesn't speed up the tests much
           PARALLEL: ${{ github.repository == 'ipfs/kubo' && 10 || 3 }}
       - name: Upload coverage report
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         if: failure() || success()
         with:
           name: sharness

.github/workflows/sync-release-assets.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: ipfs/start-ipfs-daemon-action@v1
         with:
           args: --init --init-profile=flatfs,server --enable-gc=false
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 14
       - name: Sync the latest 5 github releases

.github/workflows/test-migrations.yml

@@ -46,7 +46,7 @@ jobs:
         shell: bash
     steps:
       - name: Check out Kubo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Go
         uses: actions/setup-go@v6