the websocket listener kept its accept channel open on Close, so an Accept call that was already waiting blocked forever
every other listener in pkg/util/net closes the channel and returns an error, but this one never did, so the HandleListener goroutine stayed stuck after the server closed
i close the channel on Close, guard the hand off send so a late connection does not panic, and return ErrWebsocketListenerClosed which was declared but never reached
Signed-off-by: Abdel <62770500+hktitof@users.noreply.github.com>
When bandwidthLimitMode is "server", the work connection is wrapped by
libio.WrapReadWriteCloser with a close callback that captured the
variable being reassigned (local/rwc). At call time the callback
referenced the wrapper itself, whose closed guard was already set, so
Close returned nil without closing the underlying work connection.
For TCP proxies this left libio.Join blocked on the other copy
goroutine after the user disconnected, keeping the work connection and
the backend connection open. HTTP and UDP proxies had the same pattern.
Bind the Close method value before reassignment, and add an e2e test
verifying that the local connection is closed after the user
disconnects.
x/crypto v0.56.0 fixes two denial-of-service bugs in golang.org/x/crypto/ssh
channel handling (GO-2026-6354 / CVE-2026-78662, GO-2026-6355 /
CVE-2026-56855), reachable through the frps SSH tunnel gateway in pkg/ssh.
v0.55.0 fixes GO-2026-6303 / CVE-2026-56854. v0.56.0 requires Go 1.26, so the
go directive, CI and Docker builders move from 1.25 to 1.26; Go 1.25 stopped
receiving security fixes when Go 1.27 was released.
Also bumps github.com/Azure/go-ntlmssp to v0.1.1 (GO-2026-5543 /
CVE-2026-32952).
Claude-Session: https://claude.ai/code/session_01FV4GkYDtbatepp2KH3s247
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The 2024 bundler-mode migration changed the dashboard tsconfig include
lists to src/**, leaving the root env.d.ts files outside the TypeScript
programs. Move the Vite client declarations into src/ for both the frpc
and frps dashboards so they are part of the programs again.
Drop the *.vue wildcard module shim: the current vue-tsc toolchain
resolves SFC types without it, and the shim would only mask real
component prop types under plain tsc.
fatedierandGitHub
Abdellatif AnaflousandGitHub
Mxmilu666andGitHub
dhairyaandGitHub
CyoidandGitHub
SebastianandGitHub
Rui JingAnandGitHub
flyingandGitHub
Yarden ShohamandGitHub
barkureandGitHub