Upgrade github.com/xtaci/kcp-go/v5 from v5.6.13 to v5.6.73. The
templexxx/cpu and templexxx/xorsimd indirect dependencies are no longer
required and are dropped from go.mod and go.sum. The go and toolchain
lines are unchanged and no other module changes.
This release carries the KCP-side fixes frp relies on: write backpressure
and duplicate fast-retransmit suppression, ACK and fast-retransmit flush
timing, the zero-window probe interval, and MTU accounting for FEC
overhead. The wire format is unchanged and frp interoperates with peers
on the old version in both directions.
kcp-go marks UDPSession.SetStreamMode as deprecated, but frp still needs
stream mode and there is no replacement. The calls stay as they are and a
staticcheck exclusion scoped to pkg/util/net/kcp.go is added to
.golangci.yml instead of //nolint comments. No code changes.
This is not a security fix: govulncheck reports the same result before and
after. Binary size with embedded web assets (CGO_ENABLED=0, -trimpath,
-ldflags "-s -w"): darwin/arm64 frpc 15,607,842 -> 15,591,282 (-16,560)
and frps 19,307,122 -> 19,290,434 (-16,688); linux/amd64 frpc
17,416,354 -> 17,449,122 (+32,768) and frps 21,274,786 -> 21,311,650
(+36,864).
Validation:
- go build ./...
- go test -count=1 ./... (all packages pass except the pre-existing
test/e2e/compatibility failure, which needs explicit baseline binary
flags and fails on a clean checkout as well)
- make e2e with the real binaries (263 specs: 261 passed, 2 skipped)
- repo-wide golangci-lint run: 2 SA1019 reports without the exclusion,
0 issues with it
- govulncheck ./...: unchanged (11 reachable standard-library advisories,
no kcp-go or xtaci entries)
- Manual KCP throughput check on linux/arm64 loopback (frpc <-> frps over
transport.protocol=kcp with TLS, yamux and FEC 10/3): a single 256 MB
transfer goes from 7.8 MB/s to about 153 MB/s and 8 x 16 MB concurrent
transfers from 7.8 MB/s to about 470 MB/s with matching sha256, and old
and new peers interoperate in both directions. The repository e2e suite
has no KCP throughput assertions, so this is a one-off manual check.
Use net/http Server.Protocols and the merged golib listener path instead of the deprecated h2c handler. Keep HTTP/1.1 and cleartext HTTP/2 prior-knowledge support, while intentionally dropping HTTP/1.1 Upgrade: h2c.