Upgrade k8s.io/apimachinery and k8s.io/client-go from v0.28.8 to
v0.37.2, the latest stable minor, and k8s.io/utils from its 2023
pseudo-version to v0.0.0-20261023123148-ca04ba58ecab. The go and toolchain
lines are unchanged.
The upgrade is possible now because the annotation key check no longer
imports apimachinery's util/validation package, so apimachinery's klog
dependency does not reach frpc/frps; both binaries stay free of klog and
client-go remains test-only.
Indirect changes: sigs.k8s.io/yaml 1.3.0 -> 1.6.0 on top of
go.yaml.in/yaml/v2, sigs.k8s.io/json updated to 2025-07-30, and
gorilla/websocket moved by MVS from v1.5.3 to the 2025-03 pseudo-version
v1.5.4-0.20250319132907-e064f32e3674, which apimachinery v0.37.2
requires. gopkg.in/yaml.v2 leaves the module graph.
YAML and configuration parsing behave the same before and after: the
apimachinery YAML helper produces identical output on sample documents,
and frp's LoadConfigure output is byte-identical for YAML client/server
configs, strict dot-field handling, and JSON input.
This is not a security fix: govulncheck results are unchanged (11
reachable standard-library advisories only). Binary size changes by
+368 bytes for frpc and +496 bytes for frps with embedded web assets.
Upgrade github.com/quic-go/quic-go from v0.60.0 to v0.65.0. Only go.mod
and go.sum change; the go and toolchain lines are unchanged and no other
dependencies move.
This brings the QUIC transport fixes from v0.61-v0.65: connection
migration and NAT rebinding handling, congestion control and PMTU
recovery, and stream error handling. frp uses the core QUIC API only:
Dial/Listen, config timeouts and stream limits, Conn and Stream.
Move client_golang to v1.25.0 with its required module updates
(client_model v0.6.3, common v0.72.0, procfs v0.22.0, xxhash v2.3.0,
protobuf v1.36.12, munnerz/goautoneg). go.mod keeps go 1.26.0 and has
no toolchain line.
Sync the frpc text metrics clone with the new default Go collector:
add go_gc_gogc_percent, go_gc_gomemlimit_bytes and
go_sched_gomaxprocs_threads, update the go_memstats help texts, and
remove go_memstats_lookups_total. frpc still exposes go_* metrics only.
Upgrade golang.org/x/net v0.57.0 -> v0.62.0 and github.com/gorilla/websocket
v1.5.0 -> v1.5.3 to clear the reported HTTP/2 server and websocket
advisories, along with patch/minor updates to the other direct dependencies:
x/crypto, x/sys, x/sync, x/oauth2, x/time, go-oidc, go-toml/v2, samber/lo,
cobra, pflag, rodaine/table, netlink, ini, and the test-only testify,
ginkgo, gomega and gjson modules.
go.mod keeps `go 1.26.0` and has no toolchain line. Only go.mod and go.sum
change.
Update github.com/fatedier/yamux from v0.2.0 to v0.3.0. go.mod and go.sum are
the only dependency changes.
v0.3.0 adds a public Stream.Reset() and fixes several stream and session
lifecycle problems: a read or write blocked on a shutting-down session returns
instead of spinning, the stream close lifecycle is safe to retry, failed stream
opens release their tracking state, and ConnectionWriteTimeout is now enforced
as a write deadline on the underlying transport instead of only bounding how
long a caller waits for its own frame.
The last change is observable in frp. When a tcpMux connection stalls, the
write now fails at the transport and the session is torn down, so a new stream
returns ErrSessionShutdown; before, the caller timed out while the session
stayed blocked but alive until a keepalive ping also timed out. All frp
transports implement SetWriteDeadline (TCP, TLS, WebSocket, WSS and KCP); KCP
reports its own timeout error instead of the mapped one. Reads on an
established stream now return ErrSessionShutdown instead of io.EOF when the
session dies; a graceful stream close still returns io.EOF, and frp data paths
already treat any read error as the end of the stream.
Adapt TestDispatcherYamuxWriteTimeoutInterruptsRead to the new behaviour: the
delayed test connection now honours SetWriteDeadline, and the test asserts that
both yamux sessions close after the timed-out write instead of expecting the
session to stay usable.
x/crypto v0.56.0 fixes two denial-of-service bugs in golang.org/x/crypto/ssh
channel handling (GO-2026-6354 / CVE-2026-78662, GO-2026-6355 /
CVE-2026-56855), reachable through the frps SSH tunnel gateway in pkg/ssh.
v0.55.0 fixes GO-2026-6303 / CVE-2026-56854. v0.56.0 requires Go 1.26, so the
go directive, CI and Docker builders move from 1.25 to 1.26; Go 1.25 stopped
receiving security fixes when Go 1.27 was released.
Also bumps github.com/Azure/go-ntlmssp to v0.1.1 (GO-2026-5543 /
CVE-2026-32952).
Claude-Session: https://claude.ai/code/session_01FV4GkYDtbatepp2KH3s247
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Use net/http Server.Protocols and the merged golib listener path instead of the deprecated h2c handler. Keep HTTP/1.1 and cleartext HTTP/2 prior-knowledge support, while intentionally dropping HTTP/1.1 Upgrade: h2c.
- Update go.mod to use github.com/quic-go/quic-go v0.53.0
- Replace quic.Connection interface with *quic.Conn struct
- Replace quic.Stream interface with *quic.Stream struct
- Update all affected files to use new API:
- pkg/util/net/conn.go: Update QuicStreamToNetConn function and wrapQuicStream struct
- server/service.go: Update HandleQUICListener function parameter
- client/visitor/xtcp.go: Update QUICTunnelSession struct field
- client/connector.go: Update defaultConnectorImpl struct field
Fixes#4852
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
fatedier
stefanzier-prophetandClaude Opus 5.5
Oleksandr Redko
Roy Reznik
Guiwoo Park
Wang Xiang
gopherfarm
Remember
0x7fffandint7
Rene Leonhardt