Skip to content

build(deps): upgrade helia and libp2p dependencies#140

Merged
Rinse12 merged 3 commits into
masterfrom
upgrade/helia-libp2p-deps
Jun 13, 2026
Merged

build(deps): upgrade helia and libp2p dependencies#140
Rinse12 merged 3 commits into
masterfrom
upgrade/helia-libp2p-deps

Conversation

@Rinse12

@Rinse12 Rinse12 commented Jun 13, 2026

Copy link
Copy Markdown
Collaborator

Closes #139

Summary

Upgrades all helia and libp2p dependencies, plus the surrounding multiformats-14 ecosystem, to their latest versions:

Package From To
@helia/delegated-routing-v1-http-api-client 6.0.1 8.0.1
@libp2p/gossipsub 15.0.21 16.0.2
libp2p 3.2.3 3.3.3
@libp2p/interface 3.2.2 3.2.3
@libp2p/crypto 5.1.17 5.1.19
@libp2p/fetch 4.1.3 4.1.6
@libp2p/identify 4.1.3 4.1.7
@libp2p/peer-id 6.0.8 6.0.10
@multiformats/multiaddr 13.0.1 13.0.3
multiformats 13.4.2 14.0.0
ipns 10.1.3 11.0.0
uint8arrays 5.1.0 6.1.1
kubo-rpc-client 6.1.0 7.1.0
ipfs-unixfs-importer 16.1.4 17.0.1
blockstore-core 6.1.2 7.0.1

helia, @helia/block-brokers, @helia/ipns and @helia/unixfs were already at latest (6.1.4 / 5.2.4 / 9.2.1 / 7.2.1). The majors of multiformats, ipns, uint8arrays, kubo-rpc-client, ipfs-unixfs-importer and blockstore-core all share a single breaking change: CIDs and returned byte arrays now come from multiformats 14 (Uint8Array backed by ArrayBuffer). With the whole top-level tree on multiformats 14, no type casts are needed at the libp2p boundaries.

Breaking-change adaptations

delegated-routing client 8.x silently stops registering as a content router. The raw client returned by delegatedRoutingV1HttpApiClient() no longer exposes the libp2p contentRouting/peerRouting symbols, so placing it in libp2p services registers zero content routers and findProviders throws NoContentRoutersError (this broke every IPNS-over-pubsub warmup). getDelegatedRoutingFields now uses the dedicated delegatedRoutingV1HttpApiClientContentRouting() factory, with get/put overridden to fail fast since pkc HTTP routers do not serve IPNS records. This replaces the old hack of undefining client.getIPNS/getPeers/putIPNS, and peer routing (getPeers) is now simply never registered.

helia 6 internals are the one remaining multiformats-13 island. ipfs-unixfs-exporter (inside @helia/unixfs) strict-checks CID class identity (CID.asCID(path) === path || path instanceof CID), so a multiformats-14 CID instance is rejected at runtime with InvalidParametersError: Path must be string or CID, which broke every helia cat()/fetchCid call. heliaFs.cat is therefore handed the CID string (asHeliaCatCid in helia-for-pkc.ts): @helia/unixfs's resolve() only template-interpolates the cid into an /ipfs/... path, and the exporter's string branch parses it with its own multiformats copy, keeping the whole DAG walk self-consistent. CID.parse stays as input validation. Remove once helia ships on multiformats 14.

npm overrides were considered for unifying multiformats and rejected: they do not propagate to downstream consumers of the published package.

Verification

  • npm run build passes (node, browser, bundle and all verify steps)
  • npx tsc --project test/tsconfig.json --noEmit passes
  • Test runs, all green (after the final bump set):
    • test/node-and-browser/helia/helia.test.ts (17 tests; covers gossipsub interop with Kubo, IPNS-over-pubsub resolution, fetch-by-CID through the new string-path cat, and the cat AbortSignal regression)
    • IPNS unit tests: helia-ipns-router-errors, helia-ipns-resolve-equivalence, gateway-ipns-chain, resolve-ipns-p2p (20 tests)
    • libp2pjs.kuboRpc.clients, delegated-ipns, pubsub-msgs suite, signer + encryption (84 tests; covers ipns 11 and uint8arrays 6)
    • getcomment.pkc and purged comment-moderation (261 tests; kubo-rpc-client 7 heavy)
    • garbage.collection.community (5 tests; in-process LocalCommunity exercising kubo-rpc-client 7 block.put/pin/MFS/routing.provide and the ipfs-unixfs-importer 17 size calculation)

Summary by CodeRabbit

  • Chores

    • Updated multiple core dependencies to newer releases.
  • New Features

    • Improved content fetching: UnixFS-style file retrieval now correctly supports directory sub-paths.
  • Breaking Changes

    • IPNS resolution and related operations are no longer supported.

- @helia/delegated-routing-v1-http-api-client 6.0.1 -> 8.0.1
- @libp2p/gossipsub 15.0.21 -> 16.0.2
- libp2p 3.2.3 -> 3.3.3, @libp2p/interface 3.2.2 -> 3.2.3
- @libp2p/crypto, fetch, identify, peer-id, @multiformats/multiaddr,
  blockstore-core patch bumps

Adaptations for breaking changes:

- delegated-routing client 8.x no longer exposes the libp2p routing
  symbols on the raw client, so getDelegatedRoutingFields now uses the
  delegatedRoutingV1HttpApiClientContentRouting() factory, with get/put
  overridden to fail fast since pkc HTTP routers do not serve IPNS
  records.
- @libp2p/interface 3.2.3+ and @libp2p/peer-id 6.0.10+ type against
  multiformats 14 while helia 6 is still on 13. We stay on 13 at
  runtime (ipfs-unixfs-exporter strict-checks CID class identity, so a
  14 CID breaks helia cat()) and bridge the three libp2p-facing call
  sites with typed casts; the 13 vs 14 difference is type-level only.
@coderabbitai

coderabbitai Bot commented Jun 13, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f789ce94-c1de-4899-9f02-1ebff8b71581

📥 Commits

Reviewing files that changed from the base of the PR and between 3050890 and 33ba583.

📒 Files selected for processing (2)
  • src/helia/helia-for-pkc.ts
  • test/node-and-browser/helia/helia.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • src/helia/helia-for-pkc.ts

📝 Walkthrough

Walkthrough

Upgrades Helia/libp2p-related dependencies, refactors delegated routing to use the content-routing HTTP client (disabling IPNS operations), adds an asHeliaCatCid adapter for CID compatibility, and adds a regression test verifying UnixFS sub-path (directory/file) cat behavior.

Changes

Dependency upgrade and code compatibility

Layer / File(s) Summary
Dependency version updates
package.json
Versions are bumped for @helia/delegated-routing-v1-http-api-client, libp2p components (crypto, fetch, gossipsub, identify, interface, peer-id), @multiformats/multiaddr, blockstore-core, ipfs-unixfs-importer, ipns, kubo-rpc-client, libp2p, multiformats, and uint8arrays.
Delegated routing content-routing refactor
src/helia/helia-for-pkc.ts
Imports updated to use delegatedRoutingV1HttpApiClientContentRouting and NotFoundError. getDelegatedRoutingFields now constructs content-routing-only routers where get throws NotFoundError and put is a no-op, removing IPNS methods from delegated routing.
UnixFS cat CID type compatibility
src/helia/helia-for-pkc.ts
Adds asHeliaCatCid adapter that validates the root CID using CID.parse but returns the original string for heliaFs.cat. cat now always passes the input through this adapter into heliaFs.cat.
Regression test for UnixFS sub-path cat
test/node-and-browser/helia/helia.test.ts
Adds ipfs-unixfs-importer import and a regression test that builds a UnixFS directory with an update file in the Helia blockstore and asserts _fetchCidP2P can fetch both <dirCid>/update and the bare file CID payloads.

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues:

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main changes: upgrading helia and libp2p dependencies as detailed in package.json and related code adaptations.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch upgrade/helia-libp2p-deps

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

…lient 7, importers (#139)

- multiformats 13.4.2 -> 14.0.0
- ipns 10.1.3 -> 11.0.0
- uint8arrays 5.1.0 -> 6.1.1
- kubo-rpc-client 6.1.0 -> 7.1.0
- ipfs-unixfs-importer 16.1.4 -> 17.0.1
- blockstore-core 6.1.3 -> 7.0.1

Every one of these majors is the same breaking change: CIDs/byte arrays
now come from multiformats 14 (Uint8Array<ArrayBuffer>). With the whole
top-level tree on multiformats 14 the typed casts added in the previous
commit are no longer needed and have been removed.

The one remaining multiformats-13 island is helia 6's internals.
ipfs-unixfs-exporter (inside @helia/unixfs) strict-checks CID class
identity (CID.asCID(path) === path), so a multiformats-14 CID instance
is rejected at runtime with "Path must be string or CID". heliaFs.cat
is therefore handed the CID *string* (asHeliaCatCid): @helia/unixfs's
resolve() only template-interpolates the cid, and the exporter's string
branch parses it with its own multiformats copy, keeping the DAG walk
self-consistent. CID.parse stays as input validation. Remove once helia
ships on multiformats 14.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
package.json (1)

87-123: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Inconsistency between PR summary and actual upgrades.

The PR summary states "Deliberately not upgraded: ipns 11, multiformats 14, uint8arrays 6, blockstore-core 7, ipfs-unixfs-importer 17, kubo-rpc-client 7", but the package.json shows all of these packages ARE upgraded to exactly those versions. This suggests the PR summary is stale or refers to an earlier commit.

Please update the PR summary to accurately reflect the final dependency versions.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 87 - 123, The PR summary is out of sync with
package.json: the dependencies ipns, multiformats, uint8arrays, blockstore-core,
ipfs-unixfs-importer, and kubo-rpc-client are actually upgraded to versions 11,
14, 6, 7, 17, and 7 respectively; update the PR description/summary to remove
the "Deliberately not upgraded" claim and list the true final versions (or
explain any exceptions), referencing those package names (ipns, multiformats,
uint8arrays, blockstore-core, ipfs-unixfs-importer, kubo-rpc-client) so the
summary matches the package.json changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@package.json`:
- Around line 87-123: The PR summary is out of sync with package.json: the
dependencies ipns, multiformats, uint8arrays, blockstore-core,
ipfs-unixfs-importer, and kubo-rpc-client are actually upgraded to versions 11,
14, 6, 7, 17, and 7 respectively; update the PR description/summary to remove
the "Deliberately not upgraded" claim and list the true final versions (or
explain any exceptions), referencing those package names (ipns, multiformats,
uint8arrays, blockstore-core, ipfs-unixfs-importer, kubo-rpc-client) so the
summary matches the package.json changes.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b0aa2610-29b1-4296-8718-94d66ab5dbfb

📥 Commits

Reviewing files that changed from the base of the PR and between b99c6c6 and 3050890.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json, !package-lock.json
📒 Files selected for processing (2)
  • package.json
  • src/helia/helia-for-pkc.ts

…er CID identity)

The cat wrapper split <root>/<bucket>/update into a root CID + path option,
which made @helia/unixfs resolve() mint an intermediate CID object that the
mf-13 exporter rejected ("Path must be string or CID"), breaking every
libp2pjs CommentUpdate fetch (timeouts + wrong-state-order across the
libp2pjs CI configs; bare-CID configs were unaffected). Hand the whole path
as one string instead, keeping it on the exporter's string branch.

Adds a deterministic regression test under test/node-and-browser/helia.
@Rinse12 Rinse12 merged commit 7f4304e into master Jun 13, 2026
14 of 15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Upgrade helia and libp2p dependencies to latest

1 participant