1.12: reliability & security pass#609

Merged

jpillora merged 37 commits into

Jul 17, 2026

Commits on Jul 16, 2026

fix(tunnel): add ping timeout so dead connections are detected

jpillora
and
claude
committed
fix(settings): make authfile watcher survive rename/truncate/symlink

jpillora
and
claude
committed
fix(tunnel): enforce per-user ACL on socks channels

jpillora
and
claude
committed
fix(tunnel): sweep over-cap UDP flows instead of leaking them

jpillora
and
claude
committed
chore(tracker): triage stale dependabot PRs and resolved issues

jpillora
and
claude
committed
chore(ci): scope permissions, goreleaser-built docker images

jpillora
and
claude
committed
feat(tunnel): half-close support and dial-failure propagation

jpillora
and
claude
committed
feat(server): graceful shutdown on SIGTERM with http drain

jpillora
and
claude
committed
fix(cnet): cap websocket message size (pre-auth memory DoS)

jpillora
and
claude
committed
fix(share): fall back to module version when ldflags absent

jpillora
and
claude
committed
fix(tunnel): unbind earlier proxies when BindRemotes partially fails

jpillora
and
claude
committed
fix(server): remove auth session map, harden authUser

jpillora
and
claude
committed
fix(client): non-zero exit on give-up, saner retry backoff

jpillora
and
claude
committed
fix(server): auth string validation, pinned --auth user, live ACLs

jpillora
and
claude
committed
feat(server): info-level session open/close and failed-auth logs

jpillora
and
claude
committed
fix(settings): lowercase /UDP remote suffix proto

jpillora
and
claude
committed
fix(server): return key-loading errors instead of log.Fatal

jpillora
and
claude
committed
docs: fix help-text errors, refresh README, document env knobs

jpillora
and
claude
committed
feat(client): accept socks5:// scheme in --proxy

jpillora
and
claude
committed
chore: typo sweep, server_listen dead code, codespell CI

committed
fix(client): exact legacy fingerprint match, warn unanchored ACLs

jpillora
and
claude
committed
chore(build): makefile flags, build tags, api deprecations, test nits

jpillora
and
claude
committed
test(e2e): wait for reverse listeners after client readiness

jpillora
and
claude
committed
docs: state minimum OS versions for release binaries

jpillora
and
claude
committed
chore(tracker): record parked statuses for decision-gated tasks

jpillora
and
claude
committed
docs: add 1.12 unreleased changelog entry for this branch

jpillora
and
claude
committed
docs: reflect branch changes throughout the README body

jpillora
and
claude
committed
chore(deps): bump go modules and CI action versions

jpillora
and
claude
committed
fix(tunnel): log ACL denials at info level

jpillora
and
claude
committed
docs: 1.12 upgrade notes, changelog breaking entries, fingerprint help

jpillora
and
claude
committed
chore(deps): bump x/crypto, x/net, x/sync to latest dependabot targets

jpillora
and
claude
committed
docs: add 1.12-changes.md (UX & compatibility notes)

jpillora
and
claude
committed