feat: upstream catch-up to sing-box 1.14.0-alpha.40 (snell, bridge, api, usbip) + binary pins 1.13.14/α40#345
Merged
Merged
Conversation
The daily sync PR (#344) predated the alpha.40 release by ~8h; force re-sync brings in the bridge outbound docs and the pre-match L3-forwarding update. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds the six new testing-channel types (snell in/out, bridge outbound, api + usbip-server + usbip-client services) to the doc-derived field sets. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
All three pin sites move together (root installer + container installer + Dockerfile ARGs) with fresh sha256 sums from the GitHub release digests, and CACHE_BUST forces the Cloudflare image rebuild. 1.12.25 is still the newest 1.12.x. The root installer now stamps .version and reinstalls on mismatch — a bare existence check silently kept stale binaries after a pin bump, so test:binaries could validate against the wrong sing-box. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Six new testing-only types, full palette->inspector->diagnostics surface: - snell inbound/outbound (alpha.38): version-asymmetric enums (in 5|6, out 4|6), psk/userkey/reuse/obfs controls, multi-user editor, and a binary- verified v6 psk 12-255-byte gate (check-time FATAL on alpha.40) - bridge outbound (alpha.40): L3 egress controls, no dial fields by design, privileged platform badge - api service (alpha.30/32): secret/CORS/private-network controls + dashboard editor (bool/string shorthand normalized to the object form) - usbip-server/usbip-client services (alpha.32): provider enum + shared device-match editor; devices-required-with-default-provider is an error (binary-verified check-time FATAL) Cross-cutting: - inbound/outbound/service version gates are now generic over the TYPE_MIN_VERSION table (historical ids preserved: outbound-naive-version, service-ccm-ocm-version); store creation gates read SchemaRow.channel via isTestingOnlyType() instead of hardcoded type names - rule-set-implicit-http-client-deprecated is now also suppressed by a non-empty http_clients[] (alpha.40 docs pin the fallback order as default_http_client, else the FIRST http_clients entry), and the api dashboard gets the mirrored api-dashboard-implicit-http-client-deprecated - fixtures/testing/upstream-114-catchup.json: all six types check-clean on the real alpha.40 binary (stable 1.13.14 rejects the same file) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…h-up
- usbip-server devices gate now requires an EFFECTIVE match: empty strings and
zero-valued ids count as unset, matching the binary's per-entry rejection
("at least one of busid/vendor_id/product_id/serial is required") — the
previous length-only check passed the exact state the inspector's Add button
creates
- outbound snell v6 psk message no longer claims a startup refusal: only the
inbound arm is check-FATAL; the outbound passes check and fails later as
"cipher: message authentication failed" (still an error — it can never
authenticate)
- an empty http_client string no longer suppresses the implicit-HTTP-client
deprecations (rule-set + api dashboard): the docs pin "When empty, the
default HTTP client is used", so "" falls back exactly like absent
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
sbcv | c3c37b0 | Jul 08 2026, 05:21 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
sbc-validator-gw | c3c37b0 | Jul 08 2026, 05:21 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Catches the editor up from the 1.14.0-alpha.29 baseline to upstream 1.14.0-alpha.40, on all three tracks:
Docs + generated data
knownFields.generated.tsregenerated (six new testing types enter the unknown-field linter's doc-derived sets)Binary pins (all three sites + stale-guard)
1.13.12 → 1.13.14, testing1.14.0-alpha.29 → 1.14.0-alpha.40(1.12.25 still newest 1.12.x) in the root installer, container installer, and Dockerfile ARGs, with sha256 from the GitHub release digests;CACHE_BUSTbumped to force the Cloudflare image rebuild.versionand reinstalls on mismatch — previously a pin bump silently kept stale local binaries undertest:binariesModeling (alpha.30..40 schema deltas, complete per docs-tree diff)
privilegedplatform badgehttp_clientfallback wording (alpha.40):rule-set-implicit-http-client-deprecatedis now also suppressed by a non-emptyhttp_clients[]; the api dashboard gets the mirrored warningCross-cutting
TYPE_MIN_VERSION(historical idsoutbound-naive-version/service-ccm-ocm-versionpreserved)SchemaRow.channelviaisTestingOnlyType()— no more hardcoded type literals; new outbound gate added (first testing-only outbounds)Verification
1.14.0-alpha.40(and1.13.14rejection side): snell required/psk-length FATALs, usbip empty-match FATALs, api dashboard shorthandsfixtures/testing/upstream-114-catchup.jsoncovers all six types, check-clean on alpha.40, decode-rejected by 1.13.14tscclean · unit 1799/1799 ·validate:fixtures19 official checks ·test:binaries20/20 with the NEW pins · external render gate 220 fixtures · targeted e2e (editor/inspector/diagnostics) 11/11 · production build OKc3c37b0(usbip effective-match, outbound-snell message overclaim, empty-string http_client suppression); the snell empty-userkeynit follows the existing product stance (ss2022 parity) and is left as a follow-up🤖 Generated with Claude Code