digitalocean/go-nbd v0.3.0

v0.3.0

Repository: digitalocean/go-nbd

Tag: v0.3.0

Published: 2026-03-04T18:03:02Z

Prerelease: no

Release notes:

What's Changed

This release has a large amount of breaking changes as we've decided to refactor a significant portion of the public API to address reports from security researchers in the community.

While there are considerable breaking changes in this release, we are not incrementing the major version number until we have first established a stable v1.0 in accordance with the Go module version numbering guidelines[1]. As of this writing, we're not anticipating any breaking changes that are this large and invasive between now and v1.0.

---

Many thanks again to the security researchers for their contributions! :tada:

9547ea3 introduce internal buffer for message (de)serialization (reported by m01e) 5d7f8fa push tls.Client requirements to the calling code (reported by ba1van7)

Reported and fixed by @oxcabe:

• d2f236c fix: detect overlapping chunks in structured read replies
• 70348df fix: read only datalen bytes from data chunks

b262636 switch Conn.BlockStatus over to push-based iterator (reported by @oxcabe)

(My sincerest apologies if I have missed anyone above, if that is the case, please email me and I will correct it! My email can be found in any of my commits to this repo.)

Upgrading From a Previous Release

If you are upgrading from v0.2.0 or earlier, there have been a large number of changes to the method signatures. If you run into any issues or are unsure of how to upgrade, please post in this release's GitHub discussion page.

Variable-length Responses

Any method that returns a variable amount of data from the NBD server has been updated to accept a callback rather than return a slice of values (or a struct that contains a variable amount of data). This is mainly to allow the client code to be in control of how memory is allocated for each of these responses from the server.

The exported \*Func types (BlockStatusFunc, ExportInfoFunc, ListExportsFunc, MetaContextFunc) all include information on how they're expected to be used.

Command Flag Relocation

The CommandFlags parameter on the transmission-phase methods has been relocated to be the last parameter that is passed.

Read and Write

The Conn.Read and Conn.Write methods have been changed to more closely resemble io.Reader and io.Writer respectively.

Removed Deprecations

The Dialer.TLSConfig field was deprecated in v0.2.0, and it has been removed in this release. The correct place to supply a \*tls.Config is as an argument to the Conn.StartTLS method.

[1] https://go.dev/doc/modules/version-numbers#v0-number