chore(deps): bump ipfs/gateway-conformance from 0.13 to 0.14

[dependabot]

Bumps ipfs/gateway-conformance from 0.13 to 0.14.

Release notes

Sourced from ipfs/gateway-conformance's releases.

v0.14.0

[!NOTE] This bugfix release was brought to you by the Shipyard team.

[!IMPORTANT] This is the last release with new features from the Shipyard team. Our IPFS work ends on September 30, 2026. Until then we will ship security and bug fix releases only if any are needed. After that date, no one at Shipyard maintains this repository. If you depend on these tests, read the announcement and send us your transition questions before the end of September

Added

• New TestGatewayIpfsUri* tests for the Ipfs-Uri response header introduced by IPIP-548, one request per failure class: canonical percent-encoded path segments (delimiters, platform-encoder gaps like !'()*~, 4-byte UTF-8), request-spelling independence over the existing dir-with-percent-encoded-filename.car (raw sub-delims, lowercase hex escapes), decode-once normalization (%2F, %2E, dot segments), nested-directory trailing slashes, query exclusion on alternate formats, redirects, and CIDv0 / legacy base58 peer ID authority normalization. Backed by the new dir-with-tricky-filenames.car and dir-with-tricky-nested-filenames.car fixtures, plus a hand-built dir-with-slash-in-filename.car proving that a dag-pb link with / in its name is not addressable by any content path (%2F always decodes to a separator); the full byte-level vectors live in the IPIP-0548 test fixtures table. TestDNSLinkGatewayUnixFSDirectoryListing also asserts the ipns:// value for DNSLink hosts, and TestDNSLinkGatewayIpfsUriAuthority checks that only dotted DNSLink names appear as ipns:// authorities.

Changed

• Updated github.com/ipfs/boxo to v0.42.2 and github.com/libp2p/go-libp2p to v0.49.0.
• BREAKING: IPIP-548 deprecates X-Ipfs-Path in favor of Ipfs-Uri. Existing X-Ipfs-Path expectations on deserialized responses (TestGatewayCache, TestGatewayCacheWithIPNS, TestNativeDag, TestGatewayJSONCborAndIPNS) now assert Ipfs-Uri instead, and TestCors expects Ipfs-Uri in Access-Control-Expose-Headers. On raw block responses (TestTrustlessRaw, TestGatewayBlock) the X-Ipfs-Path expectation was dropped without a replacement, because gateways MAY omit both headers with trustless response types (application/vnd.ipld.raw and application/vnd.ipld.car). The TestGatewayIpfsUri* tests also fail gateways that return X-Ipfs-Path for content paths containing bytes invalid in HTTP field values (outside HTAB, SP, and visible ASCII per RFC 9110 section 5.5): such gateways must omit the header, since the raw legacy value would be corrupted in transit. When the header is returned for an ASCII-safe path, its value must be the decoded legacy content path, unchanged.

Fixed

• Header().Has() checked only its last argument, so all but one value in each list were silently ignored. It now checks every value, which tightens TestCors: the full Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Expose-Headers lists are enforced. The kubo-specific X-Chunked-Output and X-Stream-Output entries, which no spec mandates, were removed from the Access-Control-Expose-Headers expectation instead of becoming newly enforced.

v0.13.2

Fixed

• check.CheckIsJSONEqual.Check no longer panics when the gateway response body is not valid JSON (e.g. an HTML wrapper page or upstream error). It now returns a graceful failure that includes the parser error and offending body, so consumers can use Go's -skip to selectively skip leaf sub-tests like .../GET_for/Body without losing sibling coverage. #298

[!NOTE] This release was brought to you by the Shipyard team.

v0.13.1

Fixed

• Release workflow failed when changelog body contained special characters (<, "), preventing the v0.13.0 Docker image from being published. #292

[!NOTE] This release was brought to you by the Shipyard team.

Changelog

Sourced from ipfs/gateway-conformance's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

Changed

Fixed

[0.14.1] - 2026-08-27

Added

• New TestUnixFSPBNodeFieldOrder and TestTrustlessRawPBNodeFieldOrder tests covering both PBNode field orders: the streaming-friendly Data-before-Links order proposed for the unixfs-v1-2026 profile in IPIP-550, and the legacy Links-before-Data order. Path resolution must work through UnixFS directories and HAMT shards in either encoding, and raw block responses must return the stored bytes verbatim without re-encoding to a preferred order. Backed by the new pbnode-field-orders.car fixture, byte-identical to the IPIP-550 fixtures table.

[0.14.0] - 2026-08-27

Added

• New TestGatewayIpfsUri* tests for the Ipfs-Uri response header introduced by IPIP-548, one request per failure class: canonical percent-encoded path segments (delimiters, platform-encoder gaps like !'()*~, 4-byte UTF-8), request-spelling independence over the existing dir-with-percent-encoded-filename.car (raw sub-delims, lowercase hex escapes), decode-once normalization (%2F, %2E, dot segments), nested-directory trailing slashes, query exclusion on alternate formats, redirects, and CIDv0 / legacy base58 peer ID authority normalization. Backed by the new dir-with-tricky-filenames.car and dir-with-tricky-nested-filenames.car fixtures, plus a hand-built dir-with-slash-in-filename.car proving that a dag-pb link with / in its name is not addressable by any content path (%2F always decodes to a separator); the full byte-level vectors live in the IPIP-0548 test fixtures table. TestDNSLinkGatewayUnixFSDirectoryListing also asserts the ipns:// value for DNSLink hosts, and TestDNSLinkGatewayIpfsUriAuthority checks that only dotted DNSLink names appear as ipns:// authorities.

Changed

• Updated github.com/ipfs/boxo to v0.42.2 and github.com/libp2p/go-libp2p to v0.49.0.
• BREAKING: IPIP-548 deprecates X-Ipfs-Path in favor of Ipfs-Uri. Existing X-Ipfs-Path expectations on deserialized responses (TestGatewayCache, TestGatewayCacheWithIPNS, TestNativeDag, TestGatewayJSONCborAndIPNS) now assert Ipfs-Uri instead, and TestCors expects Ipfs-Uri in Access-Control-Expose-Headers. On raw block responses (TestTrustlessRaw, TestGatewayBlock) the X-Ipfs-Path expectation was dropped without a replacement, because gateways MAY omit both headers with trustless response types (application/vnd.ipld.raw and application/vnd.ipld.car). The TestGatewayIpfsUri* tests also fail gateways that return X-Ipfs-Path for content paths containing bytes invalid in HTTP field values (outside HTAB, SP, and visible ASCII per RFC 9110 section 5.5): such gateways must omit the header, since the raw legacy value would be corrupted in transit. When the header is returned for an ASCII-safe path, its value must be the decoded legacy content path, unchanged.

Fixed

• Header().Has() checked only its last argument, so all but one value in each list were silently ignored. It now checks every value, which tightens TestCors: the full Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Expose-Headers lists are enforced. The kubo-specific X-Chunked-Output and X-Stream-Output entries, which no spec mandates, were removed from the Access-Control-Expose-Headers expectation instead of becoming newly enforced.

[0.13.2] - 2026-04-30

Fixed

• check.CheckIsJSONEqual.Check no longer panics when the gateway response body is not valid JSON (e.g. an HTML wrapper page or upstream error). It now returns a graceful failure that includes the parser error and offending body, so consumers can use Go's -skip to selectively skip leaf sub-tests like .../GET_for/Body without losing sibling coverage. #298

[0.13.1] - 2026-04-08

Fixed

• Release workflow failed when changelog body contained special characters (<, "), preventing the v0.13.0 Docker image from being published. #292

[0.13.0] - 2026-04-01

Changed

• Removed If-None-Match test that sent bare CID as weak ETag (W/"<CID>") for directory listings. Matching a bare CID against a DirIndex-* ETag is not a spec requirement, just an optimization specific to boxo/gateway. Test moved to ipfs/boxo#1129. #261
• BREAKING: Range request tests (TestGatewayUnixFSFileRanges) moved to a new path-range-gateway spec. Gateways that do not support HTTP Range requests can now skip them with --specs -path-range-gateway. Multi-range response detection via side-effect was replaced by AnyOf that accepts both single-range and multipart responses. #258

Fixed

• HeaderBuilder.Clone() was copying Key_ into Value_, silently weakening response header assertions in cloned test cases (e.g. range request and CAR helpers). #280
• Removed X-Content-Type-Options: nosniff assertion from dag-json and dag-cbor response tests in TestNativeDag. The spec only requires this header for application/vnd.ipld.car and application/vnd.ipld.raw responses. #282
• CheckNot error messages now include a human-readable description of the negated check instead of printing Go pointer addresses (e.g. not(contains 'nosniff') instead of &{0x140001b3710}). #282
• Removed Content-Type request header from range test helpers. GET requests should not include Content-Type per RFC 7231 section 3.1.1.5, as it describes message body payload. #282
• JSON report now uses suite_pass/suite_fail actions for the overall test suite result, making it easier to distinguish from individual test pass/fail events. #250
• JSON report (--json-output) is now streamed as tests run instead of being generated after the suite finishes. Results appear in the file incrementally, and partial output is preserved if the process is interrupted. #249

[0.12.0] - 2026-03-11

... (truncated)

Commits

• 011d20b feat: tests for IPIP-550 PBNode field ordering (#304)
• 104cceb chore: release v0.14.0 (#303)
• c67f3b4 chore: bump boxo v0.42.2, go-libp2p v0.49.0 (#302)
• d3abdcd feat: tests for IPIP-548 Ipfs-Uri header (#301)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)