Blog Index

Release Recap — June 21 to July 22, 2026 — Settling Into 1.0

by okdistribute

Welcome to the latest release recap for iroh, a modular networking stack in Rust for building direct connections between devices. This one covers June 21 through July 22, 2026 — the first full stretch of life after 1.0, and it looks like it: three iroh patch releases, two noq releases, a new iroh-ffi, and a lot of sharp edges filed down in the transport layer underneath all of it.

The top changes

  • Windows connections no longer break on spurious ICMP errors. noq's UDP layer now sets the Windows ioctls that suppress ICMP errors on receive, so a stray port-unreachable coming back to the socket doesn't surface as a transient receive error mid-connection. It landed in noq 1.0.1 and reached iroh users through the dependency bump in iroh v1.0.1; iroh v1.0.2 added a regression test so it stays fixed.

  • Connecting with an empty ALPN is now an error. iroh returns an error at connect time instead of letting an empty ALPN through to fail in a more confusing way later. If you build ALPNs dynamically, this is the one change in the window most likely to show up in your code after upgrading to iroh v1.0.3 — check the value you're passing before you connect.

  • The n0 preset now includes a pkarr resolver. Discovery with the n0 preset resolves pkarr-published node addresses without extra wiring, which is one less thing to configure for anyone using the defaults. Shipped in iroh v1.0.3.

  • DNS discovery works on Android without a JNI context. iroh-dns now falls back to a set of default nameservers when no JNI context has been initialized, instead of coming up with nowhere to resolve. That mostly matters if you embed iroh in an Android app or any host where JNI setup isn't guaranteed. In iroh v1.0.1.

  • Path migration and address discovery got a lot more correct. noq 1.0.1 fixed a cluster of multipath bugs: OBSERVED_ADDR frames are queued and retransmitted per-path, PATH_CIDS_BLOCKED is ignored when it refers to an abandoned path, path responses moved to the packet number space they belong to, probing packets no longer update local_ip, and *_BLOCKED retransmissions carry the right information. noq 1.1.0 continued the arc by setting the loss detection timer on path validation failure and using the path idle timeout when validating a newly opened path. Together this is fewer wedged migrations and more reliable address observation — the machinery hole punching depends on.

  • CUBIC stops throwing away congestion window. Two congestion control fixes in noq 1.1.0 — no more double-reducing on fast convergence, and excess cwnd increment is preserved rather than dropped. Real throughput on lossy links, no API changes required. It's in iroh as of iroh v1.0.3.

  • Kernel receive timestamps on Linux and Android. noq's UDP layer can now take packet arrival times from the kernel instead of timing them in user space, which makes RTT measurement less sensitive to how busy your process is. New in noq 1.1.0 and pulled into iroh v1.0.3.

  • Relay operators can change per-client rate limits without a restart. iroh-relay accepts live updates to its per-client rate limit, so tuning it no longer means a deploy and a window of dropped connections. In iroh v1.0.2.

  • The relay handles invalid protocol messages properly. Also in iroh v1.0.2: expanded proptests over the relay protocol turned up cases where malformed messages weren't handled cleanly, and they now are. If you run your own relay on the public internet, this is the fix to take.

  • iroh-ffi gets a real endpoint builder, better errors, and Mac Catalyst. iroh-ffi v1.1.0 adds an EndpointBuilder constructor with a bind() method, improves error handling across the bindings, and ships a Mac Catalyst slice in the Swift xcframework. The release notes are empty, so: that's what's in it.

  • Quieter logs across the stack. iroh stopped using span levels above info in iroh v1.0.1 and trimmed a batch of warn logs in iroh v1.0.3, while noq 1.1.0 demoted a noisy error! to debug! and moved sendmsg errors down to debug. If your logs at info level have been louder than they should be, they're calmer now.

Also in this window

  • New and changed noq APIs in noq 1.1.0: Connection::authenticated, Connection::poll_timeout now takes an immutable receiver, ProtectedHeader::decode accepts a generic reference, and UdpStats::ios is deprecated because I/O operations can't be measured from that crate.
  • More hardening in noq 1.1.0: DATAGRAMs larger than the send buffer are rejected, Initial packets are dropped silently when saturated, a coalescing fix keeps Initial space clean, ArrayRangeSet uses binary search, and an active_connections underflow from a double-emitted Draining event is gone. Redox targets got patches too.
  • iroh v1.0.2 fixed a fairness counter bug in the receive transport lanes, and iroh v1.0.1 restored an item that had gone missing for backwards compatibility.
  • iroh v1.0.3 bumps crossbeam-epoch to pick up an invalid pointer dereference fix, and drops vergen from the build scripts — one less build-time dependency.
  • Docs that were actively unhelpful got fixed: keep-alive behaviour, the description of QUIC streams, portmapping configuration, iroh-relay's system dependencies and build command, and the iroh-dns-server production config link (iroh v1.0.1, iroh v1.0.3). On the noq side, RecvStream::is_0rtt got expanded docs and SendStream::stopped is now documented as the way to detect 0-RTT rejection.
  • Unreleased, in iroh-docs: an invalid message from a peer no longer aborts the receive loop.
  • Unreleased, in iroh-services: net diagnostics now builds for wasm.
  • Unreleased, on the docs site: the NAT traversal article has a proper animation, the diagrams moved from mermaid to SVG so they render correctly in dark mode, the net diagnostics tutorial now covers ClientHost setup and troubleshooting, and the languages section picked up pages for iroh-go and C bindings via iroh-c-ffi.
  • Unreleased, in iroh-ffi since 1.1.0: release workflow dry-runs and artifact verification, plus the Python example now passes ALPNs as bytes directly.
  • Our hosted service tracked the 1.0 line and moved to iroh 1.0.2, alongside dashboard work around endpoints.

What's next

More of the same, honestly: the 1.0 line is stable and we're spending the time on transport correctness, platform coverage, and making the defaults do the right thing without configuration. noq 1.1 is already in iroh as of 1.0.3, so the congestion control and timestamp work is available to you today.

If something here breaks for you, or you hit a bug we haven't found yet, please tell us: https://github.com/n0-computer/iroh/issues

Iroh is a dial-any-device networking library that just works. Compose from an ecosystem of ready-made protocols to get the features you need, or go fully custom on a clean abstraction over dumb pipes. Iroh is open source, and already running in production on hundreds of thousands of devices.
To get started, take a look at our docs, dive directly into the code, or chat with us in our discord channel.