From 900d9eda1936989d151344f5803746c0b35aa46d Mon Sep 17 00:00:00 2001
From: gammazero <11790789+gammazero@users.noreply.github.com>
Date: Wed, 29 Jul 2026 07:00:14 -1000
Subject: [PATCH] chore: release v1.24.0

---
 CHANGELOG.md | 23 +++++++++++++++++++----
 version.json |  2 +-
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2aa60b5..f723d9a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,16 +17,31 @@ The following emojis are used to highlight certain changes:
 
 ### Changed
 
-- upgrade to `boxo` [v0.43.1](https://github.com/ipfs/boxo/releases/tag/v0.42.1)
-- update `go-ds-pebble` to [v0.5.12](https://github.com/ipfs/go-ds-pebble/releases/tag/v0.5.12)
-- upgrade to `go-libp2p-kad-dht` [v0.42.1](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.42.1)
-
 ### Fixed
 
 ### Removed
 
 ### Security
 
+## [1.24.0]
+
+### Changed
+
+- upgrade to `boxo` [v0.43.1](https://github.com/ipfs/boxo/releases/tag/v0.42.1)
+- update `go-ds-pebble` to [v0.5.12](https://github.com/ipfs/go-ds-pebble/releases/tag/v0.5.12)
+- upgrade to `go-libp2p-kad-dht` [v0.42.1](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.42.1)
+- upgrade to `go-libp2p` [v0.49.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.49.0)
+- upgrade to `go-test` [v0.4.1](https://github.com/ipfs/go-test/releases/tag/v0.4.1) (includes [v0.4.0](https://github.com/ipfs/go-test/releases/tag/v0.4.0)).
+
+### Security
+
+- `go-libp2p` update contains security enhancements for DoS/hardening:
+  - fix for CVE-2026-57497: https://github.com/advisories/GHSA-g35j-m5xg-vh3q
+  - [3501](https://github.com/libp2p/go-libp2p/pull/3501) bounds protocols accepted per peer in identify (a peer could plant 1800+ protocol entries in your peerstore via chunked identify)
+  - [3486](https://github.com/libp2p/go-libp2p/pull/3486) caps unconnected addrs per peer (stops DHT gossip flooding the peerstore with stale addrs; relevant to us)
+  - [3500](https://github.com/libp2p/go-libp2p/pull/3500) caps webrtc remote addrs per ufrag
+  - [3487](https://github.com/libp2p/go-libp2p/pull/3487) evicts stale certified addrs when a newer signed peer record drops them (an address a peer once advertised no longer lingers after removal)
+
 ## [1.23.2]
 
 ### Changed
diff --git a/version.json b/version.json
index fc660c9..e5489d3 100644
--- a/version.json
+++ b/version.json
@@ -1,3 +1,3 @@
 {
-  "version": "v1.23.2"
+  "version": "v1.24.0"
 }