fix: keep go 1.25-compatible modernizations, add v0.40.1 changelog

- config/autoconf.go: restore math/rand/v2 (available since go 1.22)
- core/corehttp/p2p_proxy.go: restore httputil.ReverseProxy.Rewrite (available since go 1.21)
- core/commands/name/name.go: restore %d format for ValidityType int64
- docs/changelogs/v0.40.md: keep shipped v0.40.0 notes intact, add v0.40.1 section

Author: lidel

config/autoconf.go

@@ -2,7 +2,7 @@ package config
 
 import (
 	"maps"
-	"math/rand"
+	"math/rand/v2"
 	"strings"
 
 	"github.com/ipfs/boxo/autoconf"
@@ -70,7 +70,7 @@ func selectRandomResolver(resolvers []string) string {
 	if len(resolvers) == 0 {
 		return ""
 	}
-	return resolvers[rand.Intn(len(resolvers))]
+	return resolvers[rand.IntN(len(resolvers))]
 }
 
 // DNSResolversWithAutoConf returns DNS resolvers with "auto" values replaced by autoconf values

core/commands/name/name.go

@@ -234,7 +234,7 @@ Passing --verify will verify signature against provided public key.
 			}
 
 			if out.Entry.ValidityType != nil {
-				fmt.Fprintf(tw, "Validity Type:\t%q\n", *out.Entry.ValidityType)
+				fmt.Fprintf(tw, "Validity Type:\t%d\n", *out.Entry.ValidityType)
 			}
 
 			if out.Entry.Validity != nil {

core/corehttp/p2p_proxy.go

@@ -35,8 +35,13 @@ func P2PProxyOption() ServeOption {
 			}
 
 			rt := p2phttp.NewTransport(ipfsNode.PeerHost, p2phttp.ProtocolOption(parsedRequest.name))
-			proxy := httputil.NewSingleHostReverseProxy(target)
-			proxy.Transport = rt
+			proxy := &httputil.ReverseProxy{
+				Transport: rt,
+				Rewrite: func(r *httputil.ProxyRequest) {
+					r.SetURL(target)
+					r.SetXForwarded()
+				},
+			}
 			proxy.ServeHTTP(w, request)
 		})
 		return mux, nil

docs/changelogs/v0.40.md

@@ -5,6 +5,7 @@
 This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
 
 - [v0.40.0](#v0400)
+- [v0.40.1](#v0401)
 
 ## v0.40.0
 
@@ -35,6 +36,7 @@ This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
   - [📉 Fixed Prometheus metrics bloat on popular subdomain gateways](#-fixed-prometheus-metrics-bloat-on-popular-subdomain-gateways)
   - [📢 libp2p announces all interface addresses](#-libp2p-announces-all-interface-addresses)
   - [🗑️ Badger v1 datastore slated for removal this year](#-badger-v1-datastore-slated-for-removal-this-year)
+  - [🐹 Go 1.26](#-go-126)
   - [📦️ Dependency updates](#-dependency-updates)
 - [📝 Changelog](#-changelog)
 - [👨‍👩‍👧‍👦 Contributors](#-contributors)
@@ -334,6 +336,12 @@ The `badgerds` datastore (based on badger 1.x) is slated for removal. Badger v1
 
 See the [`badgerds` profile documentation](https://github.com/ipfs/kubo/blob/master/docs/config.md#badgerds-profile) for migration guidance, and [#11186](https://github.com/ipfs/kubo/issues/11186) for background.
 
+#### 🐹 Go 1.26
+
+This release is built with [Go 1.26](https://go.dev/doc/go1.26).
+
+You should see lower memory usage and reduced GC pauses thanks to the new Green Tea garbage collector (10-40% less GC overhead). Reading block data and API responses is faster due to `io.ReadAll` improvements (~2x faster, ~50% less memory). On 64-bit platforms, heap base address randomization adds a layer of security hardening.
+
 #### 📦️ Dependency updates
 
 - update `go-libp2p` to [v0.47.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.47.0) (incl. [v0.46.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.46.0))
@@ -613,3 +621,22 @@ See the [`badgerds` profile documentation](https://github.com/ipfs/kubo/blob/mas
 | [@willscott](https://github.com/willscott) | 1 | +1/-1 | 1 |
 | [@lbarrettanderson](https://github.com/lbarrettanderson) | 1 | +1/-1 | 1 |
 | [@filipremb](https://github.com/filipremb) | 1 | +1/-1 | 1 |
+
+## v0.40.1
+
+### 🔦 Highlights
+
+#### Windows stability fix
+
+If you run Kubo on Windows, v0.40.0 can crash after running for a while. The daemon starts fine and works normally at first, but eventually hits a memory corruption in Go's network I/O layer and dies. This is likely caused by an upstream Go 1.26 regression in overlapped I/O handling that has known issues ([go#77142](https://github.com/golang/go/issues/77142), [#11214](https://github.com/ipfs/kubo/issues/11214)).
+
+This patch release downgrades the Go toolchain from 1.26 to 1.25, which does not have this bug. If you are running Kubo on Windows, upgrade to v0.40.1. We will switch back to Go 1.26.x once the upstream fix lands.
+
+### 📝 Changelog
+
+<details><summary>Full Changelog v0.40.1</summary>
+
+- github.com/ipfs/kubo:
+  - chore: downgrade to Go 1.25 to fix Windows crash ([ipfs/kubo#11215](https://github.com/ipfs/kubo/pull/11215))
+
+</details>