Upgrade github.com/quic-go/quic-go from v0.60.0 to v0.65.0. Only go.mod
and go.sum change; the go and toolchain lines are unchanged and no other
dependencies move.
This brings the QUIC transport fixes from v0.61-v0.65: connection
migration and NAT rebinding handling, congestion control and PMTU
recovery, and stream error handling. frp uses the core QUIC API only:
Dial/Listen, config timeouts and stream limits, Conn and Stream.
Move client_golang to v1.25.0 with its required module updates
(client_model v0.6.3, common v0.72.0, procfs v0.22.0, xxhash v2.3.0,
protobuf v1.36.12, munnerz/goautoneg). go.mod keeps go 1.26.0 and has
no toolchain line.
Sync the frpc text metrics clone with the new default Go collector:
add go_gc_gogc_percent, go_gc_gomemlimit_bytes and
go_sched_gomaxprocs_threads, update the go_memstats help texts, and
remove go_memstats_lookups_total. frpc still exposes go_* metrics only.
Upgrade golang.org/x/net v0.57.0 -> v0.62.0 and github.com/gorilla/websocket
v1.5.0 -> v1.5.3 to clear the reported HTTP/2 server and websocket
advisories, along with patch/minor updates to the other direct dependencies:
x/crypto, x/sys, x/sync, x/oauth2, x/time, go-oidc, go-toml/v2, samber/lo,
cobra, pflag, rodaine/table, netlink, ini, and the test-only testify,
ginkgo, gomega and gjson modules.
go.mod keeps `go 1.26.0` and has no toolchain line. Only go.mod and go.sum
change.
Update github.com/fatedier/yamux from v0.2.0 to v0.3.0. go.mod and go.sum are
the only dependency changes.
v0.3.0 adds a public Stream.Reset() and fixes several stream and session
lifecycle problems: a read or write blocked on a shutting-down session returns
instead of spinning, the stream close lifecycle is safe to retry, failed stream
opens release their tracking state, and ConnectionWriteTimeout is now enforced
as a write deadline on the underlying transport instead of only bounding how
long a caller waits for its own frame.
The last change is observable in frp. When a tcpMux connection stalls, the
write now fails at the transport and the session is torn down, so a new stream
returns ErrSessionShutdown; before, the caller timed out while the session
stayed blocked but alive until a keepalive ping also timed out. All frp
transports implement SetWriteDeadline (TCP, TLS, WebSocket, WSS and KCP); KCP
reports its own timeout error instead of the mapped one. Reads on an
established stream now return ErrSessionShutdown instead of io.EOF when the
session dies; a graceful stream close still returns io.EOF, and frp data paths
already treat any read error as the end of the stream.
Adapt TestDispatcherYamuxWriteTimeoutInterruptsRead to the new behaviour: the
delayed test connection now honours SetWriteDeadline, and the test asserts that
both yamux sessions close after the timed-out write instead of expecting the
session to stay usable.
Add pkg/metrics/text, a small Prometheus text-format writer, and use it
for frpc's /metrics. The endpoint lives only on metricsServer and is
covered by its Basic Auth, like the other endpoints there.
The package emits the Go runtime families and, on Linux, the process
families read from /proc. Their names, types and help strings match
client_golang's default collectors, so existing Go runtime dashboards
keep working. It deliberately emits no frp_ business metrics and none of
client_golang's promhttp_ handler metrics.
Writing the subset ourselves keeps client_golang and protobuf out of the
frpc binary; both are still used by frps and by the tests here.
x/crypto v0.56.0 fixes two denial-of-service bugs in golang.org/x/crypto/ssh
channel handling (GO-2026-6354 / CVE-2026-78662, GO-2026-6355 /
CVE-2026-56855), reachable through the frps SSH tunnel gateway in pkg/ssh.
v0.55.0 fixes GO-2026-6303 / CVE-2026-56854. v0.56.0 requires Go 1.26, so the
go directive, CI and Docker builders move from 1.25 to 1.26; Go 1.25 stopped
receiving security fixes when Go 1.27 was released.
Also bumps github.com/Azure/go-ntlmssp to v0.1.1 (GO-2026-5543 /
CVE-2026-32952).
Claude-Session: https://claude.ai/code/session_01FV4GkYDtbatepp2KH3s247
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Use net/http Server.Protocols and the merged golib listener path instead of the deprecated h2c handler. Keep HTTP/1.1 and cleartext HTTP/2 prior-knowledge support, while intentionally dropping HTTP/1.1 Upgrade: h2c.
- Update go.mod to use github.com/quic-go/quic-go v0.53.0
- Replace quic.Connection interface with *quic.Conn struct
- Replace quic.Stream interface with *quic.Stream struct
- Update all affected files to use new API:
- pkg/util/net/conn.go: Update QuicStreamToNetConn function and wrapQuicStream struct
- server/service.go: Update HandleQUICListener function parameter
- client/visitor/xtcp.go: Update QUICTunnelSession struct field
- client/connector.go: Update defaultConnectorImpl struct field
Fixes#4852
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
fatedier
stefanzier-prophetandClaude Opus 5.5
Oleksandr Redko
Roy Reznik
Guiwoo Park
Wang Xiang
gopherfarm
Remember