Added

Changed

Fixed

• Upgrade go-ds-pebble to v0.5.6 and pebble to v2.1.1
• Update to boxo v0.35.1 with fixes for QUIC, httpnet and block tracing.

Removed

Security

New Contributors

• @SAHU-01 made their first contribution in #295

Full Changelog: v1.20.0...v1.21.0

What's Changed

Added

• --diagnostic-service-url / RAINBOW_DIAGNOSTIC_SERVICE_URL: Configure URL for CID retrievability diagnostic service (default: https://check.ipfs.network). When gateway returns 504 timeout, users see "Inspect retrievability of CID" button linking to diagnostic service. Set to empty string to disable.

Changed

• Upgrade go-ds-pebble to v0.5.3

Full Changelog: v1.19.0...v1.20.0

What's Changed

• chore(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #293
• chore: boxo and go-libp2p-kad-dht v0.35.0 by @gammazero in #298
• feat: add max-range-request-file-size flag by @lidel in #296

Added

• --max-range-request-file-size / RAINBOW_MAX_RANGE_REQUEST_FILE_SIZE: Configurable limit for HTTP Range requests on large files (default: 5GiB). Range requests for files larger than this limit return HTTP 501 Not Implemented to protect against CDN issues. Specifically addresses Cloudflare's bug where range requests for files over 5GiB are silently ignored, causing the entire file to be returned instead of the requested range, leading to excess bandwidth consumption and billing.

Changed

• Update to Boxo v0.35.0
• Update to go-libp2p-kad-dht v0.35.0

Fixed

• Fixed bitswap client initialization to use time.Duration instead of delay.Fixed() for rebroadcast delay, matching the updated bitswap client API

Full Changelog: v1.18.0...v1.19.0

What's Changed

• Release v1.17.0 by @hsanjuan in #281
• feat: retrieval-timeout & max-concurrent-requests by @lidel in #285
• chore: boxo master with final boxo#994 by @lidel in #287
• Always upgrade pebble data format to latest by @gammazero in #288
• chore(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #290
• feat(config): AutoConf with "auto" placeholders by @lidel in #286

Added

• --bootstrap / RAINBOW_BOOTSTRAP: Configure bootstrap peer multiaddrs (default: auto)
• AutoConf support with auto placeholders for bootstrap peers, DNS resolvers, and HTTP routers (ipfs/boxo#997)
  • Configuration flags:
    • --autoconf / RAINBOW_AUTOCONF: Enable/disable automatic configuration expansion (default: true)
    • --autoconf-url / RAINBOW_AUTOCONF_URL: URL to fetch autoconf data from (default: https://conf.ipfs-mainnet.org/autoconf.json)
    • --autoconf-refresh / RAINBOW_AUTOCONF_REFRESH: Interval for refreshing autoconf data (default: 24h)
  • When autoconf is disabled, auto placeholders will cause an error, requiring explicit values
• Added configurable gateway rate limiting and timeout controls via new CLI flags:
  • --max-concurrent-requests (env: RAINBOW_MAX_CONCURRENT_REQUESTS): Limits concurrent HTTP requests to protect against resource exhaustion (default: 4096). Returns 429 Too Many Requests with Retry-After header when exceeded.
  • --retrieval-timeout (env: RAINBOW_RETRIEVAL_TIMEOUT): Enforces maximum duration for content retrieval (default: 30s). Returns 504 Gateway Timeout when content cannot be retrieved within this period - both for initial retrieval (time to first byte) and between subsequent writes.

Changed

• Default values now use auto placeholder that expands to IPFS Mainnet configuration via autoconf:
  • --http-routers default changed to auto (was https://cid.contact)
  • --dnslink-resolvers default changed to . : auto (was specific resolver list)
  • --bootstrap default is auto (new flag)
• Always upgrade pebble data format to latest #288
  • This ensures:
    • Get all the latest features and improvements offered by the latest data format
    • The next pebble update is compatible with, and can upgrade, you data format
  • Possible issues:
    • Startup of new pebble version may take longer the first time.
    • Unable to revert to the previous version of pebble if the newest data format is not supported by the previous pebble. Reverting will require removing the datastore and reinitializing.
• Update to boxo/v0.34.0

Full Changelog: v1.17.0...v1.18.0

Added

• Support for RAINBOW_HTTP_RETRIEVAL_MAX_DONT_HAVE_ERRORS, allows limiting
  the number of optimistic block requests performed against endpoints that
  fail to provide any of those blocks. See the Envirionment variables
  documentation for more details.
• Support for RAINBOW_HTTP_RETRIEVAL_METRICS_LABELS_FOR_ENDPOINTS which
  brings back the possiblity of tagging requests metrics with the endpoint the
  request is sent to. See the Envirionment variables documentation for more
  details.

Changed

• upgrade to Boxo v0.33.1

Fixed

• Fix an issue in HTTP retrievals: #283.
• Fix goroutine leak present in v1.16.0 (withdrawn) (#278).

Removed

Security

Full Changelog: v1.15.0...v1.17.0

[v1.15.0]

Added

Changed

• http-retrieval-enable is now enabled by default. HTTP Retrieval can be disabled with
  RAINBOW_HTTP_RETRIEVAL_ENABLE=false. #270
• upgrade to Boxo v0.33.1-0.20250716194104-2c5f80a98e46

Fixed

• Setting export RAINBOW_HTTP_RETRIEVAL_ALLOWLIST= allowed to enable HTTP
  retrieval with an empty allowlist, so no HTTP requests would be
  performed. This is a footgun, therefore from now on this is interpreted as
  no allowlist being set. HTTP Retrieval can be disabled with
  RAINBOW_HTTP_RETRIEVAL_ENABLE=false instead. #269
• Fix periodicGC that runs before the previous run has finished if the
  interval is too short #273.
• Fix issue where http retrievals silently stop (ipfs/boxo#979).

Removed

Security

Changed

• upgrade to Boxo v0.32.0

This release was brought to you by the Shipyard team.

What's Changed

Added

• New option --http-retrieval-denylist. It can be used to avoid connecting to disallowed hosts.

Changed

• upgrade to Boxo v0.30.0
• upgrade go-ds-xxx packages to support go-datastore v0.8.2 query API
• updated go-libp2p to v0.41.1

Fixed

• Fix exporting of routing http client metrics: the endpoint will now include ipfs_routing_http_client_* metrics routing clients are used. See docs/metrics.md for more details.

Security

• This release upgrades quic-go to v0.50.1. It contains a fix for a remote-triggered panic.

Full Changelog: v1.12.0...v1.13.0

This release was brought to you by the Shipyard team.

What's Changed

Added

• HTTP block retrieval support: rainbow can now use Trustless HTTP Gateways to perform block retrievals in parallel to Bitswap.
  • This takes advantage of peers with /tls + /http multiaddrs (HTTPS is required).
  • You can enable HTTP retrievals with --http-retrieval-enable, and limit it to urls of specific hostnames with --http-retrieval-allowlist <hostname>.
  • You can also ignore provider records from certain peer IDs with --routing-ignore-providers <peerID> (for example to ignore peer IDs from bitswap endpoints of providers that offer HTTP).
  • NOTE: this feature works in the same way as Bitswap: known HTTP-peers receive optimistic block requests even for content that they are not announcing. See Boxo's CHANGELOG for more information.

Full Changelog: v1.11.0...v1.12.0

This release was brought to you by the Shipyard team.

What's Changed

Changed

• The default DNSLink resolver for .eth TLD changed to https://dns.eth.limo/dns-query and .crypto one changed to https://resolver.unstoppable.io/dns-query #231
• Upgrade to Boxo v0.28.0
• Upgrade go-ds-pebble to v0.4.2 and pebble to v1.1.4
• updated go-libp2p to v0.40.0
• require minimum go version 1.24 in go.mod

Full Changelog: v1.10.1...v1.11.0

This release was brought to you by the Shipyard team.