Upgrade golang.zx2c4.com/wireguard from
v0.0.0-20231211153847-12269c276173 (2023-12-11) to
v0.0.0-20261024220952-b3bc704ef0ee (2026-10-24). Only go.mod and go.sum
change; the go and toolchain lines are unchanged. The new snapshot
requires a newer gvisor snapshot (v0.0.0-20250503011706-39ed1f5ac29c),
which moves through MVS and is reflected in go.sum.
frp uses wireguard-go only through its tun package for the virtual net
feature. The tun changes in this range are the Linux GRO path (clear the
virtioNetHdr in the receive buffer), checksum add-with-carry handling,
and darwin reading the interface flags and MTU directly from route
events. The Device API is unchanged and no code changes are needed.
This is not a security fix: govulncheck reports the same result before
and after. Binary size is unchanged for both frpc and frps.
Validation:
- go build ./...
- go test -count=1 ./... (all packages pass except the pre-existing
test/e2e/compatibility failure, which needs explicit baseline binary
flags and fails on a clean checkout as well)
- make e2e with the real binaries: 261 passed, 2 skipped
- repo-wide golangci-lint run: 0 issues
- govulncheck ./...: unchanged (11 reachable standard-library advisories,
no wireguard or gvisor entries)
- Binary size with embedded web assets (CGO_ENABLED=0, -trimpath,
-ldflags "-s -w"): frpc 15,607,842 bytes and frps 19,307,122 bytes,
identical before and after
- Manual virtual net smoke test on linux/arm64 (frps, an frpc virtual-net
server and an frpc visitor over the built-in TUN): TUN name, MTU and
routes match the old version, ICMP has 0% loss both ways, a 256 MB TCP
transfer matches sha256, throughput is about 41 MB/s on both versions,
and concurrent connections, high-rate pings, a 45s idle connection and
restart recovery all pass without panics. The repository e2e suite has
no virtual net coverage, so this is a one-off manual check.
Upgrade k8s.io/apimachinery and k8s.io/client-go from v0.28.8 to
v0.37.2, the latest stable minor, and k8s.io/utils from its 2023
pseudo-version to v0.0.0-20261023123148-ca04ba58ecab. The go and toolchain
lines are unchanged.
The upgrade is possible now because the annotation key check no longer
imports apimachinery's util/validation package, so apimachinery's klog
dependency does not reach frpc/frps; both binaries stay free of klog and
client-go remains test-only.
Indirect changes: sigs.k8s.io/yaml 1.3.0 -> 1.6.0 on top of
go.yaml.in/yaml/v2, sigs.k8s.io/json updated to 2025-07-30, and
gorilla/websocket moved by MVS from v1.5.3 to the 2025-03 pseudo-version
v1.5.4-0.20250319132907-e064f32e3674, which apimachinery v0.37.2
requires. gopkg.in/yaml.v2 leaves the module graph.
YAML and configuration parsing behave the same before and after: the
apimachinery YAML helper produces identical output on sample documents,
and frp's LoadConfigure output is byte-identical for YAML client/server
configs, strict dot-field handling, and JSON input.
This is not a security fix: govulncheck results are unchanged (11
reachable standard-library advisories only). Binary size changes by
+368 bytes for frpc and +496 bytes for frps with embedded web assets.
Upgrade github.com/quic-go/quic-go from v0.60.0 to v0.65.0. Only go.mod
and go.sum change; the go and toolchain lines are unchanged and no other
dependencies move.
This brings the QUIC transport fixes from v0.61-v0.65: connection
migration and NAT rebinding handling, congestion control and PMTU
recovery, and stream error handling. frp uses the core QUIC API only:
Dial/Listen, config timeouts and stream limits, Conn and Stream.
Move client_golang to v1.25.0 with its required module updates
(client_model v0.6.3, common v0.72.0, procfs v0.22.0, xxhash v2.3.0,
protobuf v1.36.12, munnerz/goautoneg). go.mod keeps go 1.26.0 and has
no toolchain line.
Sync the frpc text metrics clone with the new default Go collector:
add go_gc_gogc_percent, go_gc_gomemlimit_bytes and
go_sched_gomaxprocs_threads, update the go_memstats help texts, and
remove go_memstats_lookups_total. frpc still exposes go_* metrics only.
Upgrade golang.org/x/net v0.57.0 -> v0.62.0 and github.com/gorilla/websocket
v1.5.0 -> v1.5.3 to clear the reported HTTP/2 server and websocket
advisories, along with patch/minor updates to the other direct dependencies:
x/crypto, x/sys, x/sync, x/oauth2, x/time, go-oidc, go-toml/v2, samber/lo,
cobra, pflag, rodaine/table, netlink, ini, and the test-only testify,
ginkgo, gomega and gjson modules.
go.mod keeps `go 1.26.0` and has no toolchain line. Only go.mod and go.sum
change.
Update github.com/fatedier/yamux from v0.2.0 to v0.3.0. go.mod and go.sum are
the only dependency changes.
v0.3.0 adds a public Stream.Reset() and fixes several stream and session
lifecycle problems: a read or write blocked on a shutting-down session returns
instead of spinning, the stream close lifecycle is safe to retry, failed stream
opens release their tracking state, and ConnectionWriteTimeout is now enforced
as a write deadline on the underlying transport instead of only bounding how
long a caller waits for its own frame.
The last change is observable in frp. When a tcpMux connection stalls, the
write now fails at the transport and the session is torn down, so a new stream
returns ErrSessionShutdown; before, the caller timed out while the session
stayed blocked but alive until a keepalive ping also timed out. All frp
transports implement SetWriteDeadline (TCP, TLS, WebSocket, WSS and KCP); KCP
reports its own timeout error instead of the mapped one. Reads on an
established stream now return ErrSessionShutdown instead of io.EOF when the
session dies; a graceful stream close still returns io.EOF, and frp data paths
already treat any read error as the end of the stream.
Adapt TestDispatcherYamuxWriteTimeoutInterruptsRead to the new behaviour: the
delayed test connection now honours SetWriteDeadline, and the test asserts that
both yamux sessions close after the timed-out write instead of expecting the
session to stay usable.
x/crypto v0.56.0 fixes two denial-of-service bugs in golang.org/x/crypto/ssh
channel handling (GO-2026-6354 / CVE-2026-78662, GO-2026-6355 /
CVE-2026-56855), reachable through the frps SSH tunnel gateway in pkg/ssh.
v0.55.0 fixes GO-2026-6303 / CVE-2026-56854. v0.56.0 requires Go 1.26, so the
go directive, CI and Docker builders move from 1.25 to 1.26; Go 1.25 stopped
receiving security fixes when Go 1.27 was released.
Also bumps github.com/Azure/go-ntlmssp to v0.1.1 (GO-2026-5543 /
CVE-2026-32952).
Claude-Session: https://claude.ai/code/session_01FV4GkYDtbatepp2KH3s247
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Use net/http Server.Protocols and the merged golib listener path instead of the deprecated h2c handler. Keep HTTP/1.1 and cleartext HTTP/2 prior-knowledge support, while intentionally dropping HTTP/1.1 Upgrade: h2c.
- Update go.mod to use github.com/quic-go/quic-go v0.53.0
- Replace quic.Connection interface with *quic.Conn struct
- Replace quic.Stream interface with *quic.Stream struct
- Update all affected files to use new API:
- pkg/util/net/conn.go: Update QuicStreamToNetConn function and wrapQuicStream struct
- server/service.go: Update HandleQUICListener function parameter
- client/visitor/xtcp.go: Update QUICTunnelSession struct field
- client/connector.go: Update defaultConnectorImpl struct field
Fixes#4852
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
fatedier
stefanzier-prophetandClaude Opus 5.5
Oleksandr Redko
Roy Reznik
Guiwoo Park
Wang Xiang
gopherfarm
Remember
0x7fffandint7
Rene Leonhardt