Update github.com/fatedier/yamux from v0.2.0 to v0.3.0. go.mod and go.sum are
the only dependency changes.
v0.3.0 adds a public Stream.Reset() and fixes several stream and session
lifecycle problems: a read or write blocked on a shutting-down session returns
instead of spinning, the stream close lifecycle is safe to retry, failed stream
opens release their tracking state, and ConnectionWriteTimeout is now enforced
as a write deadline on the underlying transport instead of only bounding how
long a caller waits for its own frame.
The last change is observable in frp. When a tcpMux connection stalls, the
write now fails at the transport and the session is torn down, so a new stream
returns ErrSessionShutdown; before, the caller timed out while the session
stayed blocked but alive until a keepalive ping also timed out. All frp
transports implement SetWriteDeadline (TCP, TLS, WebSocket, WSS and KCP); KCP
reports its own timeout error instead of the mapped one. Reads on an
established stream now return ErrSessionShutdown instead of io.EOF when the
session dies; a graceful stream close still returns io.EOF, and frp data paths
already treat any read error as the end of the stream.
Adapt TestDispatcherYamuxWriteTimeoutInterruptsRead to the new behaviour: the
delayed test connection now honours SetWriteDeadline, and the test asserts that
both yamux sessions close after the timed-out write instead of expecting the
session to stay usable.
x/crypto v0.56.0 fixes two denial-of-service bugs in golang.org/x/crypto/ssh
channel handling (GO-2026-6354 / CVE-2026-78662, GO-2026-6355 /
CVE-2026-56855), reachable through the frps SSH tunnel gateway in pkg/ssh.
v0.55.0 fixes GO-2026-6303 / CVE-2026-56854. v0.56.0 requires Go 1.26, so the
go directive, CI and Docker builders move from 1.25 to 1.26; Go 1.25 stopped
receiving security fixes when Go 1.27 was released.
Also bumps github.com/Azure/go-ntlmssp to v0.1.1 (GO-2026-5543 /
CVE-2026-32952).
Claude-Session: https://claude.ai/code/session_01FV4GkYDtbatepp2KH3s247
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Use net/http Server.Protocols and the merged golib listener path instead of the deprecated h2c handler. Keep HTTP/1.1 and cleartext HTTP/2 prior-knowledge support, while intentionally dropping HTTP/1.1 Upgrade: h2c.
- Update go.mod to use github.com/quic-go/quic-go v0.53.0
- Replace quic.Connection interface with *quic.Conn struct
- Replace quic.Stream interface with *quic.Stream struct
- Update all affected files to use new API:
- pkg/util/net/conn.go: Update QuicStreamToNetConn function and wrapQuicStream struct
- server/service.go: Update HandleQUICListener function parameter
- client/visitor/xtcp.go: Update QUICTunnelSession struct field
- client/connector.go: Update defaultConnectorImpl struct field
Fixes#4852
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
fatedier
stefanzier-prophetandClaude Opus 5.5
Oleksandr Redko
Roy Reznik
Guiwoo Park
Wang Xiang
gopherfarm
Remember
0x7fffandint7
Rene Leonhardt