fix: empty Bootstrap list no longer dials stale backup peers

[karawitan]

Summary

Rework of this PR per @lidel's review in #11453 (review). The fix belongs in boxo (bootstrap.bootstrapRound skips the backup list when no bootstrap peers are configured), not behind a Routing.Type=none guard in kubo. This PR is now the companion kubo PR for ipfs/boxo#1213.

What changed here

• go.mod / go.sum: pin the boxo fix via a temporary replace directive pointing at the boxo PR branch (karawitan/boxo@76cf61a). Once ipfs/boxo#1213 merges, this repoints at boxo main and converts to a pseudo-version pin.
• core/core_test.go: add TestBootstrapWithEmptyPeerListAndStaleBackupPeers, a kubo-level regression test for #11452. It verifies IpfsNode.Bootstrap runs without error with an empty Bootstrap config and a populated TempBootstrapPeersKey (stale backup peers from a previous run), and starts a bootstrapper whose rounds are no-ops for the backup list. The dialing behavior itself is fixed and unit-tested in boxo.
• docs/config.md: document under Bootstrap that an empty list disables all bootstrap dialing, including saved backup peers. Note that Peering.Peers and mDNS are independent and may still dial. (Reverts the overpromising Routing.Type=none wording from the original PR — Peering.Peers and mDNS still dial regardless.)
• docs/changelogs/v0.44.md: add a v0.44 highlight. Drops the v0.43 entry (already released) and the broken emoji from the original PR.

What was removed from the original PR

• The Routing.Type=none guard in core/core.go is gone. Per lidel: Routing.Type and Bootstrap are separate settings; some users run Routing.Type=none with their own Bootstrap peers (private/static swarms), and the guard would silently break those. The guard also missed ipfs daemon --routing=none, which overrides routing at runtime without changing the config file.
• The TestBootstrapSkippedWhenRoutingNone test is replaced by TestBootstrapWithEmptyPeerListAndStaleBackupPeers.

Behavior change

Previously, a node with default routing and an empty Bootstrap list would still dial backup peers persisted from previous runs. After this change (boxo fix), it does not. This aligns behavior with operator intent: an empty Bootstrap list now means "no bootstrap dialing at all, including saved backup peers." Nodes that configure explicit Bootstrap peers are unaffected; the backup-list fallback still runs when those peers fail to connect.

Test plan

• go test ./core/ -run TestBootstrapWithEmptyPeerListAndStaleBackupPeers -v -count=1 passes
• go test ./core/ -count=1 passes (all existing core tests green)
• go vet ./core/... passes
• gofmt -l core/ clean
• make mod_tidy run (all three go.mod files tidied)
• Kubo CI green (this PR is a draft while it pins the unmerged boxo branch ipfs/boxo#1213)

References

• Closes Routing.Type=none still runs bootstrap process, dials stale backup peers and triggers external DNS resolution #11452
• Companion boxo PR: fix(bootstrap): skip backup peer list when no bootstrap peers configured boxo#1213
• Original review directing this approach: fix: empty Bootstrap list no longer dials stale backup peers #11453 (review)
• https://discuss.ipfs.tech/t/how-can-i-disable-dht-in-kubo/19249

Generated with Devin

[lidel]

Thanks for digging into this. The root cause you found is right. The fix needs more work.

Feels like a wrong place: Routing.Type and Bootstrap are two separate settings. Some people run Routing.Type=none together with their own Bootstrap peers (private or static setups), and with this change those nodes would never connect. The check also misses ipfs daemon --routing=none, since that flag does not change the config file.

The backup peer list exists so a node can recover when its configured bootstrap peers are down (#8856). If Bootstrap is empty, there is nothing to recover from, so the backup list should not be used at all. The simplest fix is in boxo, in bootstrap.bootstrapRound: when cfg.BootstrapPeers() returns nothing, stop there instead of trying the backup list. That covers your Bootstrap: null case (it becomes an empty list), works with the --routing flag, and keeps none + explicit bootstrap peers working. No new config option is needed.

If you open that change against ipfs/boxo, this PR can become: the boxo bump, the changelog line, and one sentence under Bootstrap in docs/config.md saying that an empty list turns off all bootstrap dialing, including saved backup peers.

Two smaller things: the changelog entry landed in v0.43.md (already released) instead of v0.44.md, and both files now have a broken emoji (�) in the headings, probably from the editor's encoding. The new config.md wording "will not attempt to dial any external peers" also promises too much, since Peering.Peers and mDNS still dial.

Hope this helps.

ps. since this should be v0.44, be mindful it may take some time before new maintainer is identified and picks this up

[karawitan]

Thanks @lidel — reworked this PR per your review.

Fix moved to boxo: ipfs/boxo#1213 adds an early return in bootstrap.bootstrapRound when cfg.BootstrapPeers() is empty, before consulting the backup list. That covers the Bootstrap: null case, works with ipfs daemon --routing=none (runtime override, no config change), and keeps Routing.Type=none + explicit Bootstrap peers working. Two boxo tests pin both sides: backup list is not consulted when no peers are configured, and is still consulted when configured peers fail to connect (#8856 recovery preserved).

This PR is now the companion kubo PR for ipfs/boxo#1213:

• go.mod pins the boxo branch via a temporary replace (repointed to main as a pseudo-version once the boxo PR merges).
• core/core_test.go adds TestBootstrapWithEmptyPeerListAndStaleBackupPeers — a kubo-level regression test that seeds TempBootstrapPeersKey with stale peers and verifies IpfsNode.Bootstrap runs without error with an empty Bootstrap config.
• docs/config.md documents under Bootstrap that an empty list disables all bootstrap dialing, including saved backup peers, and notes Peering.Peers and mDNS are independent. The overpromising Routing.Type=none wording is gone.
• Changelog moved to v0.44; the broken emoji and the v0.43 entry are dropped.

Marked as draft while it pins the unmerged boxo branch.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​ipfs/​boxo@​v0.42.3-0.20260904132258-02026ddcf262 ⏵ v0.42.3-0.20260907225511-2edf737db3aa	+1

View full report

[lidel]

Thanks for the report and for following through on both repos.

Pushed three commits on top, so this is ready to leave draft:

• 5931539 chore: review follow-ups for empty Bootstrap list
  Replaces the kubo test with one that fails without the boxo fix (mocknet backup peer, no DNS) and trims the docs.
• f1fd8c5 test: bootstrap fallback needs a configured peer
  TestBackupBootstrapPeers encoded the old behavior: empty Bootstrap plus saved peers still reconnected. With the new semantics that test needed an unreachable bootstrap peer instead of an empty list, and the changelog now says plainly what still connects and when backup peers are used.
• 3ac90ca chore: update boxo to 2edf737db3aa
  Drops the fork replace now that ipfs/boxo#1213 is merged, and moves the entry to the v0.43.1 changelog so it ships in the next patch release.

Same note as on the boxo side: the generated text/code was longer than the change needed, so I trimmed it; a quick pass over the tool's output before posting saves reviewers time (you may want to tune you LLM harness to use something like ASD-STE100 Simplified Technical English to produce better docs etc).

Otherwise LGTM, merging once CI is green.