chore(deps): bump ipfs/gateway-conformance from 0.8 to 0.10

[dependabot]

Bumps ipfs/gateway-conformance from 0.8 to 0.10.

Release notes

Sourced from ipfs/gateway-conformance's releases.

v0.10.0

Changed

• IPIP-524: codec conversion tests now expect HTTP 406 Not Acceptable when the requested format does not match the block's native codec. Implementations supporting optional codec conversions for backward compatibility may skip these tests. #254

[!NOTE] This release was brought to you by the Shipyard team.

v0.9.0

Changed

• IPIP-523: ?format= URL query parameter now takes precedence over Accept HTTP header. URL query parameters for CAR options (car-version, car-order, car-dups) also take precedence over parameters in the Accept header. #252

[!NOTE] This release was brought to you by the Shipyard team.

v0.8.4

Fixed

• Prevent panic in report template when dump fails, allowing test reports to render gracefully on timeouts. #253

Changed

• Use official ipfs org for munge.js instead of fork. d3f6a67

[!NOTE] This release was brought to you by the Shipyard team.

v0.8.3

Changed

• Added temporary support for legacy 200 with X-Stream-Error header behavior when missing blocks are detected during CAR streaming. This ensures compatibility with current boxo/gateway implementations that defer header setting. This third option will be removed once implementations ship with ipfs/boxo#1019. #245

[!NOTE] This release was brought to you by the Shipyard team.

v0.8.2

Changed

• Relaxed CAR tests to accept both HTTP 200 and 404 for non-existing paths. The response code now depends on implementation details such as locality and cost of path traversal checks. Implementations that can efficiently detect non-existing paths should return 404 (improved behavior per ipfs/boxo#458). Implementations focusing on stateless streaming and low latency may return 200 with partial CAR up to the missing link (legacy behavior). #244

[!NOTE] This release was brought to you by the Shipyard team.

v0.8.1

Changed

... (truncated)

Changelog

Sourced from ipfs/gateway-conformance's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.10.1] - 2026-02-13

Fixed

• Renamed Base32Cid() to DNSSafeCidV1() and fixed it to convert CIDv0 to CIDv1 before encoding. Uses base36 for libp2p-key codec (IPNS keys) and base32 for everything else, producing valid DNS-safe CID strings for subdomain gateway tests. #264

[0.10.0] - 2026-02-05

Changed

• IPIP-524: codec conversion tests now expect HTTP 406 Not Acceptable when the requested format does not match the block's native codec. Implementations supporting optional codec conversions for backward compatibility may skip these tests. #254

[0.9.0] - 2026-02-04

Changed

• IPIP-523: ?format= URL query parameter now takes precedence over Accept HTTP header. URL query parameters for CAR options (car-version, car-order, car-dups) also take precedence over parameters in the Accept header. #252

[0.8.4] - 2025-12-12

Fixed

• Prevent panic in report template when dump fails, allowing test reports to render gracefully on timeouts. #253

Changed

• Use official ipfs org for munge.js instead of fork. d3f6a67

[0.8.3] - 2025-09-01

Changed

• Added temporary support for legacy 200 with X-Stream-Error header behavior when missing blocks are detected during CAR streaming. This ensures compatibility with current boxo/gateway implementations that defer header setting. This third option will be removed once implementations ship with ipfs/boxo#1019. #245

[0.8.2] - 2025-08-31

Changed

• Relaxed CAR tests to accept both HTTP 200 and 404 for non-existing paths. The response code now depends on implementation details such as locality and cost of path traversal checks. Implementations that can efficiently detect non-existing paths should return 404 (improved behavior per ipfs/boxo#458). Implementations focusing on stateless streaming and low latency may return 200 with partial CAR up to the missing link (legacy behavior). #244

[0.8.1] - 2025-06-17

Changed

• DAG-CBOR HTML preview pages previously had to be returned without Cache-Control headers. Now they can use Cache-Control headers similar to those used in generated UnixFS directory listings. #241

[0.8.0] - 2025-05-28

Changed

• Comprehensive tests for HTTP Range Requests over deserialized UnixFS files have been added. The --specs path-gateway now requires support for at least single-range requests. Deserialized range-requests can be skipped with --skip 'TestGatewayUnixFSFileRanges' #213
• Updated dependencies #236 & #239

[0.7.1] - 2025-01-03

Changed

• Expect all URL escapes to use uppercase hex #232

[0.7.0] - 2025-01-03

Changed

• Update dependencies #226 and #227
• Expect upper-case hex digits in escaped redirect URL #225

... (truncated)

Commits

• e32d846 fix: ensure DNSSafeCidV1 returns valid CIDv1 (#265)
• 68b916f test!(ipip-524/v0.10): codec mismatch returns 406 (#254)
• aba417f test!(ipip-523/v0.9): prefer format query param over accept header (#252)
• da3ce3f build(deps): bump golang.org/x/crypto (#247)
• 94abace build(deps): bump golang.org/x/crypto from 0.38.0 to 0.45.0 (#248)
• ffba4f4 update fixtures dependencies (#263)
• 5ad708d update dependencies (#262)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)