feat: upgrade iroh to 1.0.2

Cargo.toml

@@ -8,7 +8,7 @@ exclude = ["n0des-local"]
 resolver = "2"
 
 [workspace.dependencies]
-iroh-proxy-utils = "0.1.0"
+iroh-proxy-utils = "0.3"
 lib = { path = "lib" }
 # n0-snafu 0.2.2 requires ^0.7.0 but color-backtrace 0.7.3 removed
 # `is_dependency_code` which n0-snafu uses. This constraint intersects with
@@ -26,12 +26,12 @@ hex = "0.4.3"
 http = "1"
 hyper = "1"
 hyper-util = { version = "0.1.19", features = ["full"] }
-iroh = { version = "0.97", default-features = false }
-iroh-base = { version = "0.97" }
-iroh-tickets = "0.2"
-iroh-metrics = "0.38"
-iroh-services = { version = "0.12", features = ["net_diagnostics", "client_host"] }
-iroh-relay = { version = "0.97" }
+iroh = { version = "1.0", default-features = false }
+iroh-base = { version = "1.0" }
+iroh-tickets = "1.0"
+iroh-metrics = "1.0"
+iroh-services = { version = "1.0" }
+iroh-relay = { version = "1.0" }
 log = "0.4"
 open = "5"
 openidconnect = "4.0.1"
@@ -51,7 +51,7 @@ tracing = "0.1.40"
 tracing-subscriber = { version = "0.3.20", features = ["env-filter"] }
 tracing-appender = "0.2"
 data-encoding = "2.9.0"
-n0-error = { version = "0.1", features = ["anyhow"] }
+n0-error = { version = "1.0", features = ["anyhow"] }
 n0-future = "0.3"
 uuid = { version = "1.18.1", features = ["v4"] }
 url = "2"

lib/Cargo.toml

@@ -46,20 +46,13 @@ tracing-subscriber.workspace = true
 tracing.workspace = true
 url.workspace = true
 uuid.workspace = true
-iroh-blobs = "0.99.0"
+iroh-blobs = "0.103.0"
 httparse = "1.10.1"
 ttl_cache = "0.5.1"
 k8s-openapi = { version = "0.26.1", features = ["v1_30"] }
 kube = { version = "2.0.1", default-features = false, features = ["client", "derive", "rustls-tls"] }
 gateway-api = "0.19.0"
 gethostname = "1.1.0"
-# Pin transitive: pkcs8 0.11.0-rc.12 (released 2026-04-27) made
-# Error::KeyMalformed a tuple variant, breaking both ed25519 3.0.0-rc.4 and
-# ed25519-dalek 3.0.0-pre.1 (used via iroh*) which still treat it as a unit
-# variant. Bundle CI runs `cargo generate-lockfile`, so the constraint must
-# live in the manifest, not just the lock. Remove once iroh upgrades to an
-# ed25519/dalek release that targets pkcs8 rc.12+.
-pkcs8 = "=0.11.0-rc.11"
 
 [dev-dependencies]
 http-body-util = "0.1.3"

lib/src/node.rs

@@ -3,6 +3,7 @@ use std::{fmt::Debug, net::SocketAddr, str::FromStr, sync::Arc, time::Duration};
 use iroh::{
     Endpoint, EndpointId, SecretKey,
     address_lookup::dns::DnsAddressLookup,
+    dns::{DnsProtocol, DnsResolver},
     endpoint::{default_relay_mode, presets},
     protocol::Router,
 };
@@ -15,7 +16,6 @@ use iroh_proxy_utils::{
     downstream::{DownstreamProxy, EndpointAuthority, ProxyMode},
     upstream::{AuthError, AuthHandler, UpstreamProxy},
 };
-use iroh_relay::dns::{DnsProtocol, DnsResolver};
 use iroh_relay::{RelayConfig, RelayMap};
 use iroh_services::CLIENT_HOST_ALPN;
 use n0_error::{Result, StdResultExt};
@@ -310,7 +310,7 @@ impl OutboundProxyHandle {
 pub(crate) async fn build_endpoint(secret_key: SecretKey, common: &Config) -> Result<Endpoint> {
     let relay_mode = relay_mode_from_env_or_build().await?;
     let mut builder = match common.discovery_mode {
-        crate::config::DiscoveryMode::Dns => Endpoint::empty_builder()
+        crate::config::DiscoveryMode::Dns => Endpoint::builder(presets::Empty)
             .relay_mode(relay_mode)
             .secret_key(secret_key),
         crate::config::DiscoveryMode::Default | crate::config::DiscoveryMode::Hybrid => {

lib/src/repo.rs

@@ -129,7 +129,7 @@ impl Repo {
     }
 
     async fn create_key(&self, key_file_path: &PathBuf) -> Result<SecretKey> {
-        let key = SecretKey::generate(&mut rand::rng());
+        let key = SecretKey::generate();
         tokio::fs::write(key_file_path, key.to_bytes()).await?;
         Ok(key)
     }

lib/src/state.rs

@@ -269,18 +269,18 @@ impl FromStr for AdvertismentTicket {
     type Err = ParseError;
 
     fn from_str(s: &str) -> Result<Self, Self::Err> {
-        iroh_tickets::Ticket::deserialize(s)
+        Self::decode_string(s)
     }
 }
 
 impl Ticket for AdvertismentTicket {
     const KIND: &'static str = "datum";
 
-    fn to_bytes(&self) -> Vec<u8> {
+    fn encode_bytes(&self) -> Vec<u8> {
         postcard::to_allocvec(&self).expect("serialize should work")
     }
 
-    fn from_bytes(bytes: &[u8]) -> Result<Self, iroh_tickets::ParseError> {
+    fn decode_bytes(bytes: &[u8]) -> Result<Self, iroh_tickets::ParseError> {
         let ticket: Self = postcard::from_bytes(bytes)?;
         Ok(ticket)
     }

n0des-local/Cargo.toml

@@ -7,8 +7,8 @@ publish = false
 [dependencies]
 iroh = { workspace = true }
 iroh-n0des = "0.10"
-irpc = "0.13"
-irpc-iroh = "0.13"
+irpc = "0.17"
+irpc-iroh = "0.17"
 n0-error = { workspace = true }
 rand = { workspace = true }
 tokio = { workspace = true }

n0des-local/src/lib.rs

@@ -27,7 +27,7 @@ pub fn start(endpoint: Endpoint) -> Result<(ApiSecret, Router)> {
         .spawn();
 
     // Create an ApiSecret ticket string that clients can put into N0DES_API_SECRET.
-    let api_secret_key = SecretKey::generate(&mut rand::rng());
+    let api_secret_key = SecretKey::generate();
     let api_secret = ApiSecret::new(api_secret_key, endpoint.addr());
 
     Ok((api_secret, router))