chore: release v0.14.0

[lidel]

Fix release with the IPIP-548 Ipfs-Uri tests; breaking for gateways that still send only X-Ipfs-Path so this is a major bump, allowing implementations to upgrade at their own convenience/pace.

Once tagged, ipfs/kubo#11437 swaps its branch pin for this version.

[github-actions]

v0.14.0

Added

• New TestGatewayIpfsUri* tests for the Ipfs-Uri response header introduced by IPIP-548, one request per failure class: canonical percent-encoded path segments (delimiters, platform-encoder gaps like !'()*~, 4-byte UTF-8), request-spelling independence over the existing dir-with-percent-encoded-filename.car (raw sub-delims, lowercase hex escapes), decode-once normalization (%2F, %2E, dot segments), nested-directory trailing slashes, query exclusion on alternate formats, redirects, and CIDv0 / legacy base58 peer ID authority normalization. Backed by the new dir-with-tricky-filenames.car and dir-with-tricky-nested-filenames.car fixtures, plus a hand-built dir-with-slash-in-filename.car proving that a dag-pb link with / in its name is not addressable by any content path (%2F always decodes to a separator); the full byte-level vectors live in the IPIP-0548 test fixtures table. TestDNSLinkGatewayUnixFSDirectoryListing also asserts the ipns:// value for DNSLink hosts, and TestDNSLinkGatewayIpfsUriAuthority checks that only dotted DNSLink names appear as ipns:// authorities.

Changed

• Updated github.com/ipfs/boxo to v0.42.2 and github.com/libp2p/go-libp2p to v0.49.0.
• BREAKING: IPIP-548 deprecates X-Ipfs-Path in favor of Ipfs-Uri. Existing X-Ipfs-Path expectations on deserialized responses (TestGatewayCache, TestGatewayCacheWithIPNS, TestNativeDag, TestGatewayJSONCborAndIPNS) now assert Ipfs-Uri instead, and TestCors expects Ipfs-Uri in Access-Control-Expose-Headers. On raw block responses (TestTrustlessRaw, TestGatewayBlock) the X-Ipfs-Path expectation was dropped without a replacement, because gateways MAY omit both headers with trustless response types (application/vnd.ipld.raw and application/vnd.ipld.car). The TestGatewayIpfsUri* tests also fail gateways that return X-Ipfs-Path for content paths containing bytes invalid in HTTP field values (outside HTAB, SP, and visible ASCII per RFC 9110 section 5.5): such gateways must omit the header, since the raw legacy value would be corrupted in transit. When the header is returned for an ASCII-safe path, its value must be the decoded legacy content path, unchanged.

Fixed

• Header().Has() checked only its last argument, so all but one value in each list were silently ignored. It now checks every value, which tightens TestCors: the full Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Expose-Headers lists are enforced. The kubo-specific X-Chunked-Output and X-Stream-Output entries, which no spec mandates, were removed from the Access-Control-Expose-Headers expectation instead of becoming newly enforced.

[github-actions]

Results against Kubo latest:

Summary

Tests	Failures	Errors	Skipped
1328	75	0	0

[github-actions]

Results against Kubo master:

Important

See the action summary for full results. This PR cannot be merged until there is a Kubo PR that uses tests from this branch and passes CI. Link related PRs (boxo, kubo) in the PR description.

Summary

Tests	Failures	Errors	Skipped
1328	75	0	0

[lidel]

All green. (Kubo failures above will go away once kubo master switches to v14)