Changes

🚨 RUSTSEC Dependency Updates

This release updates rustls to fix the recently reported RUSTSEC advisories: RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349. If you're running iroh-relay or iroh-dns-server, than you should rebuild from source or switch to the binaries in this release.

The latest versions of dumbpipe, sendme, and pigeons have already been released with these fixes.

See PR #4606 for more details.

X-Iroh-Endpoint-Id Header

Thanks to contributor ash0x72, the relay client now sends an X-Iroh-Endpoint-Id header. The old X-Iroh-NodeId header, a leftover from our previous NodeId naming, is deprecated. See PR #4586.

Better Local-Only Networking

When the network on your device changes, iroh usually waits until it has re-probed a relay before updating its addresses. The probe tells iroh what its public-facing IP addresses are now.

But on a local-only network with no relays, there's nothing to probe, and nothing to wait for. On a LAN, the addresses iroh finds by checking the local system are exactly the ones other devices on the network should dial.

Now, when your local network configuration changes and there are no relays, iroh updates the addresses it advertises immediately.

Many thanks to contributor ok300 for fixing this in PR #4605. Check it out for more details.

Performance & Correctness

Faster iroh-relay Startup

Thanks to contributor orielhaim for switching the LRU caches in iroh-relay and iroh-dns-server to a sparse cache that doesn't allocate its full capacity upfront.

See PR #4574 for more details.

Bounded Path Queues

Thanks to contributor damianmiles for fixing unbounded growth of a VecDeque that could happen when a path was waiting for more connection IDs or path IDs to become available.

See PR #4551 for more details.

Captive Portal Check Timeouts

One of the relay's jobs is to help clients detect whether they are behind a captive portal. Previously, the relay kept connections to its /generate_204 route open with a keep-alive and no timeout, so it would hold onto idle connections indefinitely. Connections close after one response and time out after 30 seconds.

See PR #4614 for more details.

Other Fixes

IPv6 Relays with no Domain Name

Previously, we couldn't run a net report against relays addressed by an IPv6 literal, because QAD probes passed the bracketed address on as the TLS server name. Thanks again to contributor William-Herly for the fix. See PR #4527.

HTTP Proxy Cleanup

We cleaned up and unified how iroh uses HTTP proxies with reqwest, with help from contributor fluffypony:

• pkarr lookups and publishes now go through the endpoint's configured proxy, just like relay connections (PR #4595).
• net report probes no longer pick up a proxy from the HTTP_PROXY/HTTPS_PROXY/ALL_PROXY environment variables when none is configured (PR #4592).
• iroh-relay now sends correctly encoded Proxy-Authorization credentials (PR #4591).

Tracing in Async Contexts

We fixed a spot where a sync tracing API was being used in an async context. See PR #4582.

CHANGELOG

⛰️ Features

• (iroh-relay) Send X-Iroh-Endpoint-Id header and deprecate X-Iroh-NodeId (#4586) - (f953e82)

🐛 Bug Fixes

• (dns-server) Stop leaky idle connections (#4620) - (be65184)
• (iroh) Handle IPv6 literal relay URLs in QAD probes (#4527) - (a152c9b)
• (iroh) Bound pending_open_paths while a connection is stuck (#4551) - (43e232f)
• (iroh) Reduce cache startup memory (#4574) - (dce5173)
• (iroh) Correct tracing span for async context (#4582) - (a03424a)
• (iroh) Send pkarr requests through the endpoint's proxy (#4595) - (188593d)
• (iroh) Don't send net_report probes through the environment's proxy (#4592) - (2e3b7bf)
• (iroh) Update local addresses on network change (#4605) - (86b1242)
• (iroh) Preserve relay receive outputs and retry after message drops (#4573) - (26dfe1d)
• (iroh-relay) Send correct Proxy-Authorization credentials (#4591) - (d4490fc)
• (iroh-relay) Put a timeout on captive portal checks (#4614) - (2624e32)
• Increase listen backlog on dns server (#4619) - (97941d6)

🚜 Refactor

• (iroh-dns-server) Update clap usage to modern v4 APIs (#4567) - (12cd62b)

📚 Documentation

• ()* Add new policies around PR creation and AI use. (#4575) - (b4c8fc6)

🧪 Testing

• (iroh) Mark some more patchbay tests flaky (#4587) - (41e782a)

⚙️ Miscellaneous Tasks

• ()* Fix link in AI_POLICY.md (#4583) - (82e6f04)
• (ci) Use the common workflow for min-crates (#4505) - (71efe80)
• (ci) Set pinact cooldown to only 6 days (#4569) - (5a09b2a)
• (ci) Use safer self-repo syntax (#4570) - (5c2f5bc)
• (ci) Drop the stale setup-android pinact exception (#4563) - (13cd54d)
• Fix typo (#4560) - (187f59e)
• Fixup some linting infra (#4609) - (0a3ef1a)
• Trigger some more CI steps for the merge group (#4618) - (62d71c5)
• Update noq dependency - (d506cb9)