Acasă Explorează Ajutor
Autentificare
txlyre
Repozitorii Activitate publică

txlyre a sincronizat consemnările de la main la txlyre/3x-ui din oglindire

  • b53a5515d6 fix(frontend): make the jalali expiry clear button actually clear persian-calendar-suite seeds today's date and emits it whenever it mounts without a value. Clearing the expiry remounts the picker with a null value, so the library immediately fired onChange(today) and the date came straight back — and it also painted that seeded date into its read-only input. Swallow the mount-time emit (re-armed on every clear-remount) and hide the seeded text while the value is empty, so a cleared expiry stays empty and a fresh client/inbound form no longer silently adopts today as its expiry.
  • 3fa88adbd7 fix(inbounds): surface form validation errors (#6084) * inbounds: surface form validation errors React Hook Form validation previously returned early without showing why an inbound save was blocked. Report the first field error and switch to the corresponding form tab so operators can correct it. * Fix inbound form tab error navigation Improve react-hook-form error traversal so validation stops on real `FieldError` leaves (detected by `type`) instead of any object with a `message`. This makes Save reliably jump to the tab containing the first invalid field and show the specific error, avoiding the previous generic/ambiguous invalid-state handling. --------- Co-authored-by: sonic <[email protected]>
  • 930a0ed59d feat(inbound): DisableFlow — opt an inbound out of auto XTLS Vision (#5689) (#5698) * feat(inbound): add DisableFlow to opt an inbound out of auto XTLS Vision Adds an inbound-level DisableFlow flag so operators can suppress automatic xtls-rprx-vision injection on a specific inbound even when its transport is flow-capable — e.g. a tunneled/CDN-fronted XHTTP+vlessenc inbound where Vision is not wanted, while keeping it on the same client's Reality inbounds. When set, the inbound reports tlsFlowCapable=false, the write path clamps each attached client's flow to empty (so flow_override stores ""), and share links/subscriptions never carry the flow for it. The flag is panel-only metadata and is never sent to xray. Closes part of #5689. * feat(inbound): DisableFlow toggle in the inbound form (frontend) Wire the DisableFlow field through the form schema + adapters and add a VLESS-gated switch in the inbound form, plus en-US strings. tsc --noEmit and eslint pass. * fix(inbound): honor DisableFlow in all emitters + on toggle; regen OpenAPI Addresses review on #5690: - Clash (clash_service.go) and JSON (json_service.go) subscription emitters now also skip the flow for a DisableFlow inbound — previously only the raw share-link path was gated, so those two still advertised it (blocking 1). - UpdateInbound now strips any flow already stored on a DisableFlow inbound's clients (settings.clients[].flow + client_inbounds.flow_override) so xray and the subscription agree; otherwise toggling DisableFlow on an existing Vision client left xray expecting a flow the client no longer sends. - Regenerated the OpenAPI + zod/types/examples artifacts for the new field and added an example tag (blocking 2; make gen-check is clean). - Added Clash + JSON DisableFlow suppression tests alongside the raw-link one. * fix(inbound): make DisableFlow durable, clamp on create, guard live config Addresses the review + completeness audit on #5690: - UpdateInbound now persists inbound.DisableFlow onto the saved row. It was only read to branch strip-vs-restore, so toggling the flag on an existing inbound never stuck and MigrationRestoreVisionFlow re-injected the flow — the exact #5689 path (editing a multi-inbound client's inbound) self-reverted. - DBInbound (frontend) declares + initializes disableFlow so ObjectUtil .cloneProps carries the API value through; the edit Switch previously always read false and re-saving silently reverted the opt-out. - AddInbound strips client flow (settings + parsed clients) when DisableFlow is set, so a created-disabled inbound never persists a flow xray would expect. - GetXrayConfig forces flow="" for DisableFlow inbounds (VLESS + Trojan) as defense-in-depth, keeping the live config and the subscription in agreement. - genTrojanLink share link honors DisableFlow too. - Drop the dead explicit flow_override clear in UpdateInbound (SyncInbound rebuilds it from the stripped settings). - Clear disableFlow in the inbound form when switching to a non-VLESS protocol. - Add disableFlow/disableFlowHelp to the remaining 12 locales. Tests: stripClientFlows unit cases; DB-backed AddInbound clamp; UpdateInbound persist+strip+resist-restore regression (fails without the persist fix); frontend DBInbound + adapter round-trip (fails without the model field). * style(inbound): drop // line comments per repo CLAUDE.md The DisableFlow work followed the surrounding code's commenting style; the repo CLAUDE.md forbids // line comments in committed Go/TS. Remove the comments I added (Go + frontend + tests) and regenerate OpenAPI/schemas, which drops the generated field descriptions sourced from the Go doc comments. No behavior change; full go test (service+sub, CGO) + frontend typecheck/vitest green; golangci-lint clean on the changed files. * fix(runtime): propagate disableFlow to nodes Preserve the inbound DisableFlow flag when syncing inbounds across nodes and when recreating central records from remote traffic snapshots. This keeps multi-node deployments from reintroducing VLESS Vision flow in node configs and share links, and updates the related tests to cover the wired field and VLESS JSON generation.
  • f22df49a71 fix(sub): restore the subscription info page for browser visits Revert 43bc9153 and its follow-up 338822ab. The copy-only notice replaced the themed sub page for every browser request, so mobile users got a bare "This is a subscription link" screen instead of their traffic, expiry and links — and it left serveSubPage plus the custom-theme renderer as dead code.
  • b4e4478699 feat(inbounds): add a narrow endpoint for subscription sort order (#6179) * feat(inbounds): add a narrow endpoint for subscription sort order Changing an inbound's position in subscription output currently goes through /update/:id, which takes a whole inbound: the caller has to send settings and the entire client list back, and whatever it read before the edit is what gets written. Two people reordering and editing clients in the same inbound race on one blob, and the reorder wins by overwriting. Mirror the existing /setEnable/:id shape. The handler takes only the index and the service reads the stored inbound, so nothing in the request can reach the settings JSON. Node-owned inbounds are marked dirty in the same transaction and pushed through the existing runtime update. * fix(nodes): scope sub sort index updates --------- Co-authored-by: n0ctal <293235942+[email protected]>
  • Vizualizați comparația pentru aceste 7 consemnări »

1 oră în urmă

txlyre a sincronizat consemnările de la main la txlyre/3x-ui din oglindire

  • 43bc915397 fix(sub): serve a copy-only page when a subscription URL is opened in a browser (#6183) * fix(sub): show copy-only page for browser subscription visits Browser navigation to /sub previously rendered the normal subscription page, which exposed subscription material in page data or raw base64 depending on request headers. Keep VPN clients on the raw subscription body, but classify browser document requests and return a neutral static copy-only HTML page with no embedded share links or page data. This preserves the C1 LimitIP parser fix in the same master candidate while avoiding a DE rollback of the browser subscription UX. * fix(sub): keep the themed page for an explicit html request Only implicit browser navigation is downgraded to the copy-only page. An operator who appends html=1 or view=html already holds the URL, so the themed subscription page keeps rendering for them and serveSubPage stays in use. * fix(sub): keep browser pages copy-only
  • dafd3c0e64 feat(sub): warn when salamander settings cannot reach the client (#6177) * feat(sub): warn when salamander settings cannot reach the client A hysteria2 share link carries obfuscation as obfs=salamander plus obfs-password, and nothing else. Xray's finalmask accepts more than that — packetSize among them — and those extra settings change what the server expects on the wire. The emitted URI then looks complete but describes a server the client cannot reach: every standard client applies plain salamander, the server drops the packets, and the failure is silent on both ends. Log the unexpressible keys when building such a link, naming the inbound, so the cause is visible instead of appearing as a client-side problem. * fix(sub): deduplicate salamander warnings
  • acbf09e710 fix(frontend): restore responsive table height Remove viewport-capped vertical scrolling so page size controls the rendered table height and page scrolling remains responsive.
  • be70535b94 feat(inbounds): improve multi-node online attribution (#6164)
  • 2d669fa4b7 feat(sub): add template variables to subscription metadata (#6163)
  • Vizualizați comparația pentru aceste 17 consemnări »

9 ore în urmă

txlyre referință sincronizată și ștersă copilot/fix-review-comment-3774434337 la txlyre/3x-ui din oglindire

9 ore în urmă

txlyre a sincronizat consemnările de la main la txlyre/3x-ui din oglindire

  • ad32144c42 fix(sub): use a fullwidth percent in USAGE_PERCENTAGE (#6174) * fix(sub): use a fullwidth percent in USAGE_PERCENTAGE A remark is placed in the share link fragment, so an ASCII percent is percent-encoded to %25. Happ treats such a fragment as malformed, discards the whole remark and falls back to showing the server hostname, which defeats the point of a remark template and leaks the host into the client's server list. Emit U+FF05 FULLWIDTH PERCENT SIGN instead. It renders the same to a reader, never produces %25, and round-trips through url.Parse unchanged. * test(sub): exercise production fragment encoding --------- Co-authored-by: n0ctal <293235942+[email protected]>
  • 34c248bb79 fix(cli): stop -getApiToken accumulating admin tokens (#6175) * fix(cli): stop -getApiToken accumulating admin tokens `x-ui setting -getApiToken` reads like a getter, but when tokens already exist it minted a brand-new one named `cli-fallback-<unix>` on every invocation. The plaintext is printed once and the row stays enabled forever, so an operator who runs the command a few times while debugging silently leaves several admin-equivalent credentials behind that nobody can tell apart or revoke knowingly. Keep the convenience the fallback was added for, but rotate a single `cli-fallback` token instead: RecreateByName drops any existing row with that name before issuing a new one, so at most one CLI-issued token exists at a time and the previous plaintext stops working. * fix(api-token): preserve token on failed replacement --------- Co-authored-by: n0ctal <293235942+[email protected]>
  • 17fea2f656 fix(database): keep IP limits when the fail2ban probe is inconclusive (#6176) * fix(database): keep IP limits when the fail2ban probe is inconclusive ResetIpLimitNoFail2ban clears limitIp on every client — inbound settings JSON and the clients table — whenever fail2banCanEnforce() returns false, then records itself in the seeder history so it never re-evaluates. The probe was a single `fail2ban-client -h` run, so it answered false both when fail2ban is genuinely absent and when the command merely failed that once: a panel that starts before fail2ban is up, or in a container where it is installed a moment later, permanently loses every configured limit with no log line and no way back. Separate the two. A missing binary still means "absent" and the cleanup runs as before; a binary that exists but will not run is reported as unknown, leaves the configured values untouched, logs why, and does not record the seeder, so the next start decides again. * test(database): cover fail2ban reset safeguards --------- Co-authored-by: n0ctal <293235942+[email protected]>
  • c5dec64d36 fix(clients): push bulk client changes to nodes only after the commit lands (#6181) * fix(clients): apply bulk mutations after durable commit * test(clients): guard bulk pushes behind commit * fix(clients): fully delete remote bulk clients --------- Co-authored-by: n0ctal <293235942+[email protected]>
  • b56b087254 fix(migration): stop a half-applied startup migration from committing silently (#6182) * fix(traffic): check maintenance commits and IP-limit errors * fix(migrations): propagate transactional failures --------- Co-authored-by: n0ctal <293235942+[email protected]>
  • Vizualizați comparația pentru aceste 13 consemnări »

1 zi în urmă

txlyre a sincronizat consemnările de la main la txlyre/3x-ui din oglindire

  • d291e1c5ee Bump Go toolchain and x dependencies Refresh the Go toolchain from 1.26.5 to 1.26.6 and update the related x/* and protobuf dependency set in go.mod/go.sum. This keeps the project aligned with the current patch releases and ensures the module graph matches the expected transitive versions.
  • ecadfd0e60 fix(clients): stop recomputing the summary badges from the client_stats snapshot (#6169) * fix(clients): stop recomputing the summary badges from the client_stats snapshot pickClientsSummary's coverage guard (serverSummary.total > allClientStats.length) only catches a net shortfall: an orphaned client_traffics row and a client still missing one can cancel out, or an orphan surplus alone can pass uncaught, and either way the guard fails to fall back (#6116). client_paging.go's q.summary() already derives the same bucket counts with clients as the driving table (LEFT JOIN client_traffics), so it cannot miscount either shape regardless of how the row got there, and listQuery already polls it every 5s — the same cadence client_stats ticks on. The client-side recompute bought no fresher a number than the server already provides on its own poll, only a window to get one wrong, so this drops it: the summary badges now always read serverSummary directly. allClientStats, computeClientsSummary, pickClientsSummary and sameSummaryInputs are removed as dead code along with it; the per-row live traffic patch in applyClientStatsEvent is untouched, since it reads the same snapshot by email match rather than by count and was never exposed to this class of bug. * fix(clients): force a refetch on window focus and drop a stale comment Review feedback on PR #6169: listQuery combines staleTime: Infinity with refetchInterval: 5000, which pauses while the tab is hidden. The WS-driven per-row traffic patch in applyClientStatsEvent has no such visibility gating, so on a background tab a row's live numbers keep moving while the summary badges above them freeze at whatever they were before the tab was hidden, and staleTime: Infinity blocks refetchOnWindowFocus from closing that gap on return. Before this PR the client-side recompute this branch removed happened to paper over the same underlying gap; now that it's gone, the gap is directly visible. refetchOnWindowFocus: 'always' forces exactly one refetch on refocus, ignoring staleTime, without touching the interval/staleTime pairing that governs the rest of this query's behavior. Separately, useInbounds.ts still referenced computeClientsSummary by name in a comment explaining bucket priority; that function no longer exists after this PR. Dropped the comment rather than repoint it, per the repo's no-//-comment convention.
  • d05e44e401 fix(outbound): import Hysteria2 salamander properly from standard obfs params (#6166) * fix(outbound): import Hysteria2 salamander from standard obfs params The outbound share-link importers only reconstructed salamander from the private fm=<json> finalmask dump. Every standard Hysteria2 link — and this panel's own generator (internal/sub) since it stopped emitting fm= — carries the obfuscation as the standard obfs=salamander & obfs-password=<pw> pair, which the importers ignored. As a result, importing a normal Hysteria2 link (pasted into the outbound form or pulled from a subscription) silently dropped the salamander config and produced an outbound that negotiates plain QUIC against a server expecting obfuscation. Parse the standard obfs/obfs-password pair in both the Go importer (internal/util/link, used by subscription + JSON import) and the frontend form parser (outbound-link-parser.ts), folding it into finalmask.udp. A salamander mask already supplied via fm= still wins, so 3x-ui→3x-ui links are unchanged. Co-Authored-By: Claude Opus 4.8 <[email protected]> * fix(outbound): address review — mport hop, password-less fm mask, tests Follow-up to the automated PR review on #6166: - Import the Hysteria2 UDP port-hopping range from the standard `mport` param (finalmask.quicParams.udpHop.ports) in both importers — the same class of gap as salamander: the subscription generator emits `mport` standalone and no `fm=`, so port hopping was silently lost on import. An `fm=`-supplied udpHop still wins. - When `fm=` carries a salamander mask without a usable password, fill it in from the obfs pair instead of treating the empty mask as authoritative (would otherwise enable obfuscation with an empty password). - Trim the duplicated rationale comments to two lines each. - Tests: collapse the four per-case Go functions into table-driven subtests; cover the obfs_password/obfsPassword aliases, case-insensitive obfs value, append-onto-non-salamander-udp, password-less-fm fill, and the mport paths; assert the fm-wins masks stay length 1 in both suites. Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Claude Opus 4.8 <[email protected]> Co-authored-by: Sanaei <[email protected]>
  • 9165ab67eb fix(install): preserve custom bin/ files (e.g. hand-added geoip) across updates (#6152) * fix(install): preserve custom bin/ files (e.g. hand-added geoip) across updates Every reinstall/update wipes /usr/local/x-ui/ wholesale and re-extracts the release tarball, which only ships known assets (xray/mtg binaries, the bundled geoip*/geosite*.dat sets). A user-reported real incident: a hand-placed custom geoip file referenced from a routing rule via "ext:<file>:<code>" got silently deleted on update, and Xray refused to start at all afterward ("failed to open <file>: no such file or directory"), taking down every inbound until the file was manually restored from the user's own backup. install_x-ui now backs up the old bin/ before the wipe and restores, after extraction, only the files the fresh release doesn't provide -- bundled assets still get the newer per-release copy, nothing custom silently disappears. Verified in isolation: standard files (geoip.dat, the xray binary) end up as the fresh release's copy; a custom file absent from the release survives untouched. Co-Authored-By: Claude Sonnet 5 <[email protected]> * fix: harden the bin/ snapshot-and-restore against the review round on #6152 - Replace the mktemp+cp snapshot with a same-filesystem mv of bin/ aside: an unchecked mktemp failure previously made the very next line copy bin/'s contents into "/" (empty custom_bin_backup + trailing slash), and a silently-ignored cp failure (stderr redirected, exit code never checked) could leave a truncated custom geo file that gets "restored" as if it were intact. A rename is atomic and needs no extra disk space, removing both failure modes at once; if it fails, back off cleanly and say so instead of proceeding as if a backup exists. - Add a trap so an interrupted update (Ctrl-C, signal) between the backup and the restore doesn't leave the snapshot (which contains bin/config.json and every mtproto client's FakeTLS secret) sitting around indefinitely; the two exit-path cleanups this replaces are gone since the trap now covers those exits too. - Move the restore below the arm arch-rename/chmod block instead of before it, so xray-linux-arm32/mtg-linux-arm already exist under their final names and don't get needlessly restored-then-overwritten and misreported as "custom". - Exclude bin/config.json and bin/mtproto/*.toml from the restore: those are the panel's own generated runtime state (internal/xray/process.go, internal/mtproto/manager.go), not admin-placed files, and restoring a stale one only resurrects dead state or recreates bin/mtproto/ with the wrong (more permissive) directory mode. - Match symlinks in the restore's find, not just plain files -- cp -a already preserves them in the snapshot, but the restore loop was silently dropping them, which is exactly the failure mode (a geo file symlinked in from elsewhere) this PR set out to fix. - Quote the two new xui_folder expansions. - Extend the non-interactive smoke test to reinstall over an existing install with a sentinel file in bin/, asserting it survives and that the bundled geoip.dat is still the release's own copy -- the update path this PR touches had no CI coverage at all before this. Co-Authored-By: Claude Sonnet 5 <[email protected]> --------- Co-authored-by: Claude Sonnet 5 <[email protected]>
  • Vizualizați comparația pentru aceste 4 consemnări »

1 zi în urmă

txlyre a sincronizat consemnările de la main la txlyre/3x-ui din oglindire

2 zile în urmă

txlyre a sincronizat consemnările de la copilot/fix-review-comment-3774434337 la txlyre/3x-ui din oglindire

2 zile în urmă

txlyre a sincronizat referință nouă copilot/fix-review-comment-3774434337 la txlyre/3x-ui din oglindire

2 zile în urmă

txlyre a sincronizat consemnările de la main la txlyre/3x-ui din oglindire

  • 5b80d4562d chore(docs): bump docs dependencies Update fumadocs-core/mdx/ui to 16.14.3, lucide-react to 1.31.0, @types/node to 26.2.0, typescript-eslint to 8.67.0, esbuild to 0.28.2, shiki to 4.4.3, and various other transitive dependencies.

3 zile în urmă

txlyre a sincronizat consemnările de la main la txlyre/3x-ui din oglindire

  • e2f75acad2 chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#6212) Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.19.1 to 1.19.2. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.19.1...v1.19.2) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  • 69a8237581 fix(i18n): localize Chinese Xray labels (#6202) * fix(i18n): localize Traditional Chinese Xray labels Several navigation, outbound, balancer, VPN, and DNS labels still displayed their English source text in the zh-TW interface. Translate the non-protocol labels while retaining established Xray terminology. * fix(i18n): localize Simplified Chinese Xray labels Mirror the reviewed Xray UI coverage in zh-CN so the same labels no longer fall back to English there. Signed-off-by: 陳廷安 <73953029+[email protected]> --------- Signed-off-by: 陳廷安 <73953029+[email protected]> Co-authored-by: Sanaei <[email protected]>
  • f3f57e66f5 fix(frontend): wait out Collapse fade before a11y scan in ConfigBlock story Collapse animates opacity in over motionDurationMid; the Collapsed story's play function only waited for visibility, so the addon-a11y color-contrast check could sample a mid-fade, lower-contrast frame and fail flakily in CI. Wait for the panel's opacity to settle to 1 first.
  • 8a8da88548 fix(frontend): isolate swagger deps from main vendor chunk Keep swagger-ui-react and its transitive dependencies in the lazy swagger chunk so the initial panel bundle stays smaller. This avoids eager loading the OpenAPI UI on first paint while keeping the API docs route unchanged.
  • 1f846c3cb2 fix(frontend): clean test validation output
  • Vizualizați comparația pentru aceste 7 consemnări »

3 zile în urmă

txlyre referință sincronizată și ștersă dependabot/npm_and_yarn/frontend/npm_and_yarn-37951cc692 la txlyre/3x-ui din oglindire

3 zile în urmă

txlyre a sincronizat consemnările de la dependabot/npm_and_yarn/frontend/npm_and_yarn-37951cc692 la txlyre/3x-ui din oglindire

  • e2ac7a85d3 chore(deps): bump dompurify Bumps the npm_and_yarn group with 1 update in the /frontend directory: [dompurify](https://github.com/cure53/DOMPurify). Updates `dompurify` from 3.4.12 to 3.4.13 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](https://github.com/cure53/DOMPurify/compare/3.4.12...3.4.13) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
  • ece1655939 fix(docs): prevent theme switch hydration mismatch
  • cb902314db fix(docs): restore theme switch without runtime warnings Move html/body shell and global css to root app layout to avoid hydration/script warnings from nested document nodes. Disable provider theme injection and add a custom script-free theme switch in shared layout slots. Also migrate docs search static client initializer to ZBSearch (initDB), add zbsearch dependency, and align docs lint tooling with ESLint 9 compatibility so npm run lint passes.
  • 7eacce6a46 chore(frontend): resolve the high-severity brace-expansion advisory (#6180) npm audit --omit=dev --audit-level=high is a CI gate and it currently fails on main: swagger-ui-react pulls @swagger-api/apidom-reference, which pins minimatch, which resolves brace-expansion to 5.0.8 — the range covered by GHSA-rgw5-rvv9-x895. Pin the patched 5.0.9 through the existing swagger-ui-react overrides block rather than globally: minimatch@3 under eslint-plugin-jsx-a11y still needs the 1.x line, and a blanket override would force v5 there too.
  • 199ddaf485 chore(deps-dev): bump brace-expansion (#6172) Bumps the npm_and_yarn group with 1 update in the /frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  • Vizualizați comparația pentru aceste 10 consemnări »

6 zile în urmă

txlyre a sincronizat referință nouă dependabot/npm_and_yarn/frontend/npm_and_yarn-37951cc692 la txlyre/3x-ui din oglindire

6 zile în urmă

txlyre a sincronizat consemnările de la main la txlyre/3x-ui din oglindire

  • ece1655939 fix(docs): prevent theme switch hydration mismatch
  • cb902314db fix(docs): restore theme switch without runtime warnings Move html/body shell and global css to root app layout to avoid hydration/script warnings from nested document nodes. Disable provider theme injection and add a custom script-free theme switch in shared layout slots. Also migrate docs search static client initializer to ZBSearch (initDB), add zbsearch dependency, and align docs lint tooling with ESLint 9 compatibility so npm run lint passes.
  • 7eacce6a46 chore(frontend): resolve the high-severity brace-expansion advisory (#6180) npm audit --omit=dev --audit-level=high is a CI gate and it currently fails on main: swagger-ui-react pulls @swagger-api/apidom-reference, which pins minimatch, which resolves brace-expansion to 5.0.8 — the range covered by GHSA-rgw5-rvv9-x895. Pin the patched 5.0.9 through the existing swagger-ui-react overrides block rather than globally: minimatch@3 under eslint-plugin-jsx-a11y still needs the 1.x line, and a blanket override would force v5 there too.
  • 199ddaf485 chore(deps-dev): bump brace-expansion (#6172) Bumps the npm_and_yarn group with 1 update in the /frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  • d142307366 chore(deps-dev): bump postcss (#6173) Bumps the npm_and_yarn group with 1 update in the /docs directory: [postcss](https://github.com/postcss/postcss). Updates `postcss` from 8.5.21 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.21...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  • Vizualizați comparația pentru aceste 5 consemnări »

1 săptămână în urmă

txlyre referință sincronizată și ștersă dependabot/npm_and_yarn/frontend/npm_and_yarn-84557ebc70 la txlyre/3x-ui din oglindire

1 săptămână în urmă

txlyre referință sincronizată și ștersă dependabot/npm_and_yarn/docs/npm_and_yarn-6b7f7a8c69 la txlyre/3x-ui din oglindire

1 săptămână în urmă

txlyre a sincronizat consemnările de la main la txlyre/3x-ui din oglindire

  • 3883882726 chore: bump frontend and Go dependencies Updates multiple frontend packages (antd, react-hook-form, storybook, vite, swagger-ui-react, playwright, typescript-eslint, etc.) and Go dependencies (gopsutil, gorm postgres driver, pion/transport, ugorji/codec, genproto, and others). Also replaces `__dirname` with `import.meta.dirname` in vite.config.js for ESM compatibility.

1 săptămână în urmă

txlyre a sincronizat consemnările de la dependabot/npm_and_yarn/frontend/npm_and_yarn-84557ebc70 la txlyre/3x-ui din oglindire

  • 2b83254733 chore(deps-dev): bump brace-expansion Bumps the npm_and_yarn group with 1 update in the /frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
  • 3883882726 chore: bump frontend and Go dependencies Updates multiple frontend packages (antd, react-hook-form, storybook, vite, swagger-ui-react, playwright, typescript-eslint, etc.) and Go dependencies (gopsutil, gorm postgres driver, pion/transport, ugorji/codec, genproto, and others). Also replaces `__dirname` with `import.meta.dirname` in vite.config.js for ESM compatibility.
  • 216d18b3c4 chore(vscode): fix Linux paths in the task and launch configs The "go: build" task hardcoded bin/3x-ui.exe, so building on Linux produced a binary carrying a Windows extension. It now emits bin/3x-ui and keeps the .exe name behind a windows override. The Postgres launch config prepended C:\Program Files\PostgreSQL\18\bin to PATH on every platform. Linux separates entries with ':', not ';', so that string fused into the first real PATH entry and clobbered it. Moved it into a windows block, which is where the pg_dump/pg_restore lookups in ServerService need it anyway.
  • 2a8c3bc0db fix(clients): stop a stale IP row from blocking a client edit Saving a client walks every inbound it is attached to and calls UpdateInboundClient, which re-keys the client's email in inbound_client_ips to the spelling in the edited settings. The email match is EqualFold, so when an inbound's settings JSON drifted in case from the client record the panel issues a case-only rename of the tracking row. inbound_client_ips.client_email is unique and case-sensitive, and the IP-limit job keys its rows on whatever casing Xray reports, so both spellings can already be present. The rename then aborts the whole edit with "duplicate key value violates unique constraint uni_inbound_client_ips_client_email" — the client could not be saved at all, including when only adding an inbound to it. The caller only renames onto an identity no live client holds, so a row on the target email is stale IP tracking: delete it before renaming. The blob is rebuilt by the next scan anyway.
  • e71b75e99e docs(claude): correct enforced-guard claims and add the runtime dispatch rule Fact-checked every line of CLAUDE.md against the tree. Six claims were wrong, and two told an agent the opposite of the truth. The file said nothing checks endpoints.ts against the Go routes and nothing fails the build on a missing i18n key. Both guards exist and both run in make verify: TestRouteRegistryContract diffs the real router against the registry in both directions, and i18n-dead-keys.test.ts rejects a locale that misses an en-US key as well as an en-US key nothing references. An agent trusting the old text either skips a step it thinks is unenforced or is blindsided when a "silent" omission turns the suite red. The rest: the Go locale returns an empty string for an unknown key, not the raw key; mtg-multi is a prebuilt binary fetched at build time, not a Go dependency built from source; commits are type(area): summary, not <area>: summary, and perf is in active use; make verify is the fast gate, not a mirror of CI, which also runs race, vulncheck, a live-Postgres job where a SKIP is a failure, and a fuzz smoke. Add the five facts most likely to burn an agent, all reproduced before writing them down. A fresh clone has no internal/web/dist, so go build dies on the embed pattern while thirty-odd packages pass — it reads as a broken repo rather than a missing make dist-stub. Every state-changing inbound/client op must dispatch through runtime.Runtime; a direct xray/api.go call passes all local tests and silently breaks every multi-node install, which is exactly what a hard rule is for. Node 24 is required because make gen imports .ts directly. Postgres, xray e2e and scale tests skip themselves without their env vars. An endpoint change has a fourth step nothing checks: syncing docs/public/openapi.json. Definition of done loses its first step — verify's gen-check already runs gen and fails on a dirty generated diff.
  • Vizualizați comparația pentru aceste 10 consemnări »

1 săptămână în urmă

txlyre a sincronizat referință nouă dependabot/npm_and_yarn/frontend/npm_and_yarn-84557ebc70 la txlyre/3x-ui din oglindire

1 săptămână în urmă

txlyre a sincronizat consemnările de la dependabot/npm_and_yarn/docs/npm_and_yarn-6b7f7a8c69 la txlyre/3x-ui din oglindire

  • 0cb1b2778d chore(deps-dev): bump postcss Bumps the npm_and_yarn group with 1 update in the /docs directory: [postcss](https://github.com/postcss/postcss). Updates `postcss` from 8.5.21 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.21...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
  • 3883882726 chore: bump frontend and Go dependencies Updates multiple frontend packages (antd, react-hook-form, storybook, vite, swagger-ui-react, playwright, typescript-eslint, etc.) and Go dependencies (gopsutil, gorm postgres driver, pion/transport, ugorji/codec, genproto, and others). Also replaces `__dirname` with `import.meta.dirname` in vite.config.js for ESM compatibility.
  • 216d18b3c4 chore(vscode): fix Linux paths in the task and launch configs The "go: build" task hardcoded bin/3x-ui.exe, so building on Linux produced a binary carrying a Windows extension. It now emits bin/3x-ui and keeps the .exe name behind a windows override. The Postgres launch config prepended C:\Program Files\PostgreSQL\18\bin to PATH on every platform. Linux separates entries with ':', not ';', so that string fused into the first real PATH entry and clobbered it. Moved it into a windows block, which is where the pg_dump/pg_restore lookups in ServerService need it anyway.
  • 2a8c3bc0db fix(clients): stop a stale IP row from blocking a client edit Saving a client walks every inbound it is attached to and calls UpdateInboundClient, which re-keys the client's email in inbound_client_ips to the spelling in the edited settings. The email match is EqualFold, so when an inbound's settings JSON drifted in case from the client record the panel issues a case-only rename of the tracking row. inbound_client_ips.client_email is unique and case-sensitive, and the IP-limit job keys its rows on whatever casing Xray reports, so both spellings can already be present. The rename then aborts the whole edit with "duplicate key value violates unique constraint uni_inbound_client_ips_client_email" — the client could not be saved at all, including when only adding an inbound to it. The caller only renames onto an identity no live client holds, so a row on the target email is stale IP tracking: delete it before renaming. The blob is rebuilt by the next scan anyway.
  • e71b75e99e docs(claude): correct enforced-guard claims and add the runtime dispatch rule Fact-checked every line of CLAUDE.md against the tree. Six claims were wrong, and two told an agent the opposite of the truth. The file said nothing checks endpoints.ts against the Go routes and nothing fails the build on a missing i18n key. Both guards exist and both run in make verify: TestRouteRegistryContract diffs the real router against the registry in both directions, and i18n-dead-keys.test.ts rejects a locale that misses an en-US key as well as an en-US key nothing references. An agent trusting the old text either skips a step it thinks is unenforced or is blindsided when a "silent" omission turns the suite red. The rest: the Go locale returns an empty string for an unknown key, not the raw key; mtg-multi is a prebuilt binary fetched at build time, not a Go dependency built from source; commits are type(area): summary, not <area>: summary, and perf is in active use; make verify is the fast gate, not a mirror of CI, which also runs race, vulncheck, a live-Postgres job where a SKIP is a failure, and a fuzz smoke. Add the five facts most likely to burn an agent, all reproduced before writing them down. A fresh clone has no internal/web/dist, so go build dies on the embed pattern while thirty-odd packages pass — it reads as a broken repo rather than a missing make dist-stub. Every state-changing inbound/client op must dispatch through runtime.Runtime; a direct xray/api.go call passes all local tests and silently breaks every multi-node install, which is exactly what a hard rule is for. Node 24 is required because make gen imports .ts directly. Postgres, xray e2e and scale tests skip themselves without their env vars. An endpoint change has a fourth step nothing checks: syncing docs/public/openapi.json. Definition of done loses its first step — verify's gen-check already runs gen and fails on a dirty generated diff.
  • Vizualizați comparația pentru aceste 10 consemnări »

1 săptămână în urmă