Upgrade github.com/xtaci/kcp-go/v5 from v5.6.13 to v5.6.73. The
templexxx/cpu and templexxx/xorsimd indirect dependencies are no longer
required and are dropped from go.mod and go.sum. The go and toolchain
lines are unchanged and no other module changes.
This release carries the KCP-side fixes frp relies on: write backpressure
and duplicate fast-retransmit suppression, ACK and fast-retransmit flush
timing, the zero-window probe interval, and MTU accounting for FEC
overhead. The wire format is unchanged and frp interoperates with peers
on the old version in both directions.
kcp-go marks UDPSession.SetStreamMode as deprecated, but frp still needs
stream mode and there is no replacement. The calls stay as they are and a
staticcheck exclusion scoped to pkg/util/net/kcp.go is added to
.golangci.yml instead of //nolint comments. No code changes.
This is not a security fix: govulncheck reports the same result before and
after. Binary size with embedded web assets (CGO_ENABLED=0, -trimpath,
-ldflags "-s -w"): darwin/arm64 frpc 15,607,842 -> 15,591,282 (-16,560)
and frps 19,307,122 -> 19,290,434 (-16,688); linux/amd64 frpc
17,416,354 -> 17,449,122 (+32,768) and frps 21,274,786 -> 21,311,650
(+36,864).
Validation:
- go build ./...
- go test -count=1 ./... (all packages pass except the pre-existing
test/e2e/compatibility failure, which needs explicit baseline binary
flags and fails on a clean checkout as well)
- make e2e with the real binaries (263 specs: 261 passed, 2 skipped)
- repo-wide golangci-lint run: 2 SA1019 reports without the exclusion,
0 issues with it
- govulncheck ./...: unchanged (11 reachable standard-library advisories,
no kcp-go or xtaci entries)
- Manual KCP throughput check on linux/arm64 loopback (frpc <-> frps over
transport.protocol=kcp with TLS, yamux and FEC 10/3): a single 256 MB
transfer goes from 7.8 MB/s to about 153 MB/s and 8 x 16 MB concurrent
transfers from 7.8 MB/s to about 470 MB/s with matching sha256, and old
and new peers interoperate in both directions. The repository e2e suite
has no KCP throughput assertions, so this is a one-off manual check.
Upgrade golang.zx2c4.com/wireguard from
v0.0.0-20231211153847-12269c276173 (2023-12-11) to
v0.0.0-20261024220952-b3bc704ef0ee (2026-10-24). Only go.mod and go.sum
change; the go and toolchain lines are unchanged. The new snapshot
requires a newer gvisor snapshot (v0.0.0-20250503011706-39ed1f5ac29c),
which moves through MVS and is reflected in go.sum.
frp uses wireguard-go only through its tun package for the virtual net
feature. The tun changes in this range are the Linux GRO path (clear the
virtioNetHdr in the receive buffer), checksum add-with-carry handling,
and darwin reading the interface flags and MTU directly from route
events. The Device API is unchanged and no code changes are needed.
This is not a security fix: govulncheck reports the same result before
and after. Binary size is unchanged for both frpc and frps.
Validation:
- go build ./...
- go test -count=1 ./... (all packages pass except the pre-existing
test/e2e/compatibility failure, which needs explicit baseline binary
flags and fails on a clean checkout as well)
- make e2e with the real binaries: 261 passed, 2 skipped
- repo-wide golangci-lint run: 0 issues
- govulncheck ./...: unchanged (11 reachable standard-library advisories,
no wireguard or gvisor entries)
- Binary size with embedded web assets (CGO_ENABLED=0, -trimpath,
-ldflags "-s -w"): frpc 15,607,842 bytes and frps 19,307,122 bytes,
identical before and after
- Manual virtual net smoke test on linux/arm64 (frps, an frpc virtual-net
server and an frpc visitor over the built-in TUN): TUN name, MTU and
routes match the old version, ICMP has 0% loss both ways, a 256 MB TCP
transfer matches sha256, throughput is about 41 MB/s on both versions,
and concurrent connections, high-rate pings, a 45s idle connection and
restart recovery all pass without panics. The repository e2e suite has
no virtual net coverage, so this is a one-off manual check.
Upgrade k8s.io/apimachinery and k8s.io/client-go from v0.28.8 to
v0.37.2, the latest stable minor, and k8s.io/utils from its 2023
pseudo-version to v0.0.0-20261023123148-ca04ba58ecab. The go and toolchain
lines are unchanged.
The upgrade is possible now because the annotation key check no longer
imports apimachinery's util/validation package, so apimachinery's klog
dependency does not reach frpc/frps; both binaries stay free of klog and
client-go remains test-only.
Indirect changes: sigs.k8s.io/yaml 1.3.0 -> 1.6.0 on top of
go.yaml.in/yaml/v2, sigs.k8s.io/json updated to 2025-07-30, and
gorilla/websocket moved by MVS from v1.5.3 to the 2025-03 pseudo-version
v1.5.4-0.20250319132907-e064f32e3674, which apimachinery v0.37.2
requires. gopkg.in/yaml.v2 leaves the module graph.
YAML and configuration parsing behave the same before and after: the
apimachinery YAML helper produces identical output on sample documents,
and frp's LoadConfigure output is byte-identical for YAML client/server
configs, strict dot-field handling, and JSON input.
This is not a security fix: govulncheck results are unchanged (11
reachable standard-library advisories only). Binary size changes by
+368 bytes for frpc and +496 bytes for frps with embedded web assets.
Upgrade github.com/quic-go/quic-go from v0.60.0 to v0.65.0. Only go.mod
and go.sum change; the go and toolchain lines are unchanged and no other
dependencies move.
This brings the QUIC transport fixes from v0.61-v0.65: connection
migration and NAT rebinding handling, congestion control and PMTU
recovery, and stream error handling. frp uses the core QUIC API only:
Dial/Listen, config timeouts and stream limits, Conn and Stream.
Move client_golang to v1.25.0 with its required module updates
(client_model v0.6.3, common v0.72.0, procfs v0.22.0, xxhash v2.3.0,
protobuf v1.36.12, munnerz/goautoneg). go.mod keeps go 1.26.0 and has
no toolchain line.
Sync the frpc text metrics clone with the new default Go collector:
add go_gc_gogc_percent, go_gc_gomemlimit_bytes and
go_sched_gomaxprocs_threads, update the go_memstats help texts, and
remove go_memstats_lookups_total. frpc still exposes go_* metrics only.
Upgrade golang.org/x/net v0.57.0 -> v0.62.0 and github.com/gorilla/websocket
v1.5.0 -> v1.5.3 to clear the reported HTTP/2 server and websocket
advisories, along with patch/minor updates to the other direct dependencies:
x/crypto, x/sys, x/sync, x/oauth2, x/time, go-oidc, go-toml/v2, samber/lo,
cobra, pflag, rodaine/table, netlink, ini, and the test-only testify,
ginkgo, gomega and gjson modules.
go.mod keeps `go 1.26.0` and has no toolchain line. Only go.mod and go.sum
change.
Update github.com/fatedier/yamux from v0.2.0 to v0.3.0. go.mod and go.sum are
the only dependency changes.
v0.3.0 adds a public Stream.Reset() and fixes several stream and session
lifecycle problems: a read or write blocked on a shutting-down session returns
instead of spinning, the stream close lifecycle is safe to retry, failed stream
opens release their tracking state, and ConnectionWriteTimeout is now enforced
as a write deadline on the underlying transport instead of only bounding how
long a caller waits for its own frame.
The last change is observable in frp. When a tcpMux connection stalls, the
write now fails at the transport and the session is torn down, so a new stream
returns ErrSessionShutdown; before, the caller timed out while the session
stayed blocked but alive until a keepalive ping also timed out. All frp
transports implement SetWriteDeadline (TCP, TLS, WebSocket, WSS and KCP); KCP
reports its own timeout error instead of the mapped one. Reads on an
established stream now return ErrSessionShutdown instead of io.EOF when the
session dies; a graceful stream close still returns io.EOF, and frp data paths
already treat any read error as the end of the stream.
Adapt TestDispatcherYamuxWriteTimeoutInterruptsRead to the new behaviour: the
delayed test connection now honours SetWriteDeadline, and the test asserts that
both yamux sessions close after the timed-out write instead of expecting the
session to stay usable.
x/crypto v0.56.0 fixes two denial-of-service bugs in golang.org/x/crypto/ssh
channel handling (GO-2026-6354 / CVE-2026-78662, GO-2026-6355 /
CVE-2026-56855), reachable through the frps SSH tunnel gateway in pkg/ssh.
v0.55.0 fixes GO-2026-6303 / CVE-2026-56854. v0.56.0 requires Go 1.26, so the
go directive, CI and Docker builders move from 1.25 to 1.26; Go 1.25 stopped
receiving security fixes when Go 1.27 was released.
Also bumps github.com/Azure/go-ntlmssp to v0.1.1 (GO-2026-5543 /
CVE-2026-32952).
Claude-Session: https://claude.ai/code/session_01FV4GkYDtbatepp2KH3s247
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Use net/http Server.Protocols and the merged golib listener path instead of the deprecated h2c handler. Keep HTTP/1.1 and cleartext HTTP/2 prior-knowledge support, while intentionally dropping HTTP/1.1 Upgrade: h2c.
- Update go.mod to use github.com/quic-go/quic-go v0.53.0
- Replace quic.Connection interface with *quic.Conn struct
- Replace quic.Stream interface with *quic.Stream struct
- Update all affected files to use new API:
- pkg/util/net/conn.go: Update QuicStreamToNetConn function and wrapQuicStream struct
- server/service.go: Update HandleQUICListener function parameter
- client/visitor/xtcp.go: Update QUICTunnelSession struct field
- client/connector.go: Update defaultConnectorImpl struct field
Fixes#4852
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
fatedier
stefanzier-prophetandClaude Opus 5.5
Oleksandr Redko
Roy Reznik
Guiwoo Park
Wang Xiang
gopherfarm
Remember
0x7fffandint7
Rene Leonhardt