build(deps): bump github.com/ipfs/kubo from 0.34.1 to 0.36.0

[dependabot]

Bumps github.com/ipfs/kubo from 0.34.1 to 0.36.0.

Release notes

Sourced from github.com/ipfs/kubo's releases.

v0.36.0

[!NOTE] This release was brought to you by the Shipyard team.

• Overview
• 🔦 Highlights
  • HTTP Retrieval Client Now Enabled by Default
  • Bitswap Broadcast Reduction
  • Update go-log to v2
  • Kubo now uses AutoNATv2 as a client
    • Smarter AutoTLS registration
  • Overwrite option for files cp command
  • Gateway now supports negative HTTP Range requests
  • Option for filestore command to remove bad blocks
  • ConnMgr.SilencePeriod configuration setting exposed
  • Fix handling of EDITOR env var
  • 📦️ Important dependency updates
• 📝 Changelog
• 👨‍👩‍👧‍👦 Contributors

Overview

🔦 Highlights

HTTP Retrieval Client Now Enabled by Default

This release promotes the HTTP Retrieval client from an experimental feature to a standard feature that is enabled by default. When possible, Kubo will retrieve blocks over plain HTTPS (HTTP/2) without any extra user configuration.

See HTTPRetrieval for more details.

Bitswap Broadcast Reduction

The Bitswap client now supports broadcast reduction logic, which is enabled by default. This feature significantly reduces the number of broadcast messages sent to peers, resulting in lower bandwidth usage during load spikes.

The overall logic works by sending to non-local peers only if those peers have previously replied that they want data blocks. To minimize impact on existing workloads, by default, broadcasts are still always sent to peers on the local network, or the ones defined in Peering.Peers.

At Shipyard, we conducted A/B testing on our internal Kubo staging gateway with organic CID requests to ipfs.io. While these results may not exactly match your specific workload, the benefits proved significant enough to make this feature default. Here are the key findings:

• Dramatic Resource Usage Reduction: Internal testing demonstrated a reduction in Bitswap broadcast messages by 80-98% and network bandwidth savings of 50-95%, with the greatest improvements occurring during high traffic and peer spikes. These efficiency gains lower operational costs of running Kubo under high load and improve the IPFS Mainnet (which is >80% Kubo-based) by reducing ambient traffic for all connected peers.
• Improved Memory Stability: Memory stays stable even during major CID request spikes that increase peer count, preventing the out-of-memory (OOM) issues found in earlier Kubo versions.
• Data Retrieval Performance Remains Strong: Our tests suggest that Kubo gateway hosts with broadcast reduction enabled achieve similar or better HTTP 200 success rates compared to version 0.35, while maintaining equivalent or higher want-have responses and unique blocks received.

For more information about our A/B tests, see kubo#10825.

To revert to the previous behavior for your own A/B testing, set Internal.Bitswap.BroadcastControl.Enable to false and monitor relevant metrics (ipfs_bitswap_bcast_skips_total, ipfs_bitswap_haves_received, ipfs_bitswap_unique_blocks_received, ipfs_bitswap_wanthaves_broadcast, HTTP 200 success rate).

... (truncated)

Commits

• 37b8411 Merge pull request #10841 from ipfs/release-v0.36.0
• 0276b3f chore: 0.36.0
• 12144db chore: update links in markdown
• ee9a76f chore: 0.36.0-rc2
• 9d19996 feat(httpnet): gather metrics for allowlist
• f17f89e chore: changelog
• d3a4558 test: TestEditorParsing
• 9545368 fix: handling of EDITOR env var (#10855)
• ca2b8f6 refactor: use slices.Sort where appropriate (#10858)
• 120ea0d Upgrade to Boxo v0.33.0 (#10857)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)