Главная Обзор Помощь
Вход
txlyre
Репозитории Активность

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

  • ece1655939 fix(docs): prevent theme switch hydration mismatch
  • cb902314db fix(docs): restore theme switch without runtime warnings Move html/body shell and global css to root app layout to avoid hydration/script warnings from nested document nodes. Disable provider theme injection and add a custom script-free theme switch in shared layout slots. Also migrate docs search static client initializer to ZBSearch (initDB), add zbsearch dependency, and align docs lint tooling with ESLint 9 compatibility so npm run lint passes.
  • 7eacce6a46 chore(frontend): resolve the high-severity brace-expansion advisory (#6180) npm audit --omit=dev --audit-level=high is a CI gate and it currently fails on main: swagger-ui-react pulls @swagger-api/apidom-reference, which pins minimatch, which resolves brace-expansion to 5.0.8 — the range covered by GHSA-rgw5-rvv9-x895. Pin the patched 5.0.9 through the existing swagger-ui-react overrides block rather than globally: minimatch@3 under eslint-plugin-jsx-a11y still needs the 1.x line, and a blanket override would force v5 there too.
  • 199ddaf485 chore(deps-dev): bump brace-expansion (#6172) Bumps the npm_and_yarn group with 1 update in the /frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  • d142307366 chore(deps-dev): bump postcss (#6173) Bumps the npm_and_yarn group with 1 update in the /docs directory: [postcss](https://github.com/postcss/postcss). Updates `postcss` from 8.5.21 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.21...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  • Просмотр сравнение для этих 5 коммитов »

14 часов назад

txlyre синхронизированные и удаленные ссылки dependabot/npm_and_yarn/frontend/npm_and_yarn-84557ebc70 на txlyre/3x-ui из зеркала

14 часов назад

txlyre синхронизированные и удаленные ссылки dependabot/npm_and_yarn/docs/npm_and_yarn-6b7f7a8c69 на txlyre/3x-ui из зеркала

14 часов назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

  • 3883882726 chore: bump frontend and Go dependencies Updates multiple frontend packages (antd, react-hook-form, storybook, vite, swagger-ui-react, playwright, typescript-eslint, etc.) and Go dependencies (gopsutil, gorm postgres driver, pion/transport, ugorji/codec, genproto, and others). Also replaces `__dirname` with `import.meta.dirname` in vite.config.js for ESM compatibility.

3 дней назад

txlyre синхронизированные коммиты с dependabot/npm_and_yarn/frontend/npm_and_yarn-84557ebc70 на txlyre/3x-ui из зеркала

  • 2b83254733 chore(deps-dev): bump brace-expansion Bumps the npm_and_yarn group with 1 update in the /frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
  • 3883882726 chore: bump frontend and Go dependencies Updates multiple frontend packages (antd, react-hook-form, storybook, vite, swagger-ui-react, playwright, typescript-eslint, etc.) and Go dependencies (gopsutil, gorm postgres driver, pion/transport, ugorji/codec, genproto, and others). Also replaces `__dirname` with `import.meta.dirname` in vite.config.js for ESM compatibility.
  • 216d18b3c4 chore(vscode): fix Linux paths in the task and launch configs The "go: build" task hardcoded bin/3x-ui.exe, so building on Linux produced a binary carrying a Windows extension. It now emits bin/3x-ui and keeps the .exe name behind a windows override. The Postgres launch config prepended C:\Program Files\PostgreSQL\18\bin to PATH on every platform. Linux separates entries with ':', not ';', so that string fused into the first real PATH entry and clobbered it. Moved it into a windows block, which is where the pg_dump/pg_restore lookups in ServerService need it anyway.
  • 2a8c3bc0db fix(clients): stop a stale IP row from blocking a client edit Saving a client walks every inbound it is attached to and calls UpdateInboundClient, which re-keys the client's email in inbound_client_ips to the spelling in the edited settings. The email match is EqualFold, so when an inbound's settings JSON drifted in case from the client record the panel issues a case-only rename of the tracking row. inbound_client_ips.client_email is unique and case-sensitive, and the IP-limit job keys its rows on whatever casing Xray reports, so both spellings can already be present. The rename then aborts the whole edit with "duplicate key value violates unique constraint uni_inbound_client_ips_client_email" — the client could not be saved at all, including when only adding an inbound to it. The caller only renames onto an identity no live client holds, so a row on the target email is stale IP tracking: delete it before renaming. The blob is rebuilt by the next scan anyway.
  • e71b75e99e docs(claude): correct enforced-guard claims and add the runtime dispatch rule Fact-checked every line of CLAUDE.md against the tree. Six claims were wrong, and two told an agent the opposite of the truth. The file said nothing checks endpoints.ts against the Go routes and nothing fails the build on a missing i18n key. Both guards exist and both run in make verify: TestRouteRegistryContract diffs the real router against the registry in both directions, and i18n-dead-keys.test.ts rejects a locale that misses an en-US key as well as an en-US key nothing references. An agent trusting the old text either skips a step it thinks is unenforced or is blindsided when a "silent" omission turns the suite red. The rest: the Go locale returns an empty string for an unknown key, not the raw key; mtg-multi is a prebuilt binary fetched at build time, not a Go dependency built from source; commits are type(area): summary, not <area>: summary, and perf is in active use; make verify is the fast gate, not a mirror of CI, which also runs race, vulncheck, a live-Postgres job where a SKIP is a failure, and a fuzz smoke. Add the five facts most likely to burn an agent, all reproduced before writing them down. A fresh clone has no internal/web/dist, so go build dies on the embed pattern while thirty-odd packages pass — it reads as a broken repo rather than a missing make dist-stub. Every state-changing inbound/client op must dispatch through runtime.Runtime; a direct xray/api.go call passes all local tests and silently breaks every multi-node install, which is exactly what a hard rule is for. Node 24 is required because make gen imports .ts directly. Postgres, xray e2e and scale tests skip themselves without their env vars. An endpoint change has a fourth step nothing checks: syncing docs/public/openapi.json. Definition of done loses its first step — verify's gen-check already runs gen and fails on a dirty generated diff.
  • Просмотр сравнение для этих 10 коммитов »

3 дней назад

txlyre синхронизированные новые ссылки dependabot/npm_and_yarn/frontend/npm_and_yarn-84557ebc70 к txlyre/3x-ui из зеркала

3 дней назад

txlyre синхронизированные коммиты с dependabot/npm_and_yarn/docs/npm_and_yarn-6b7f7a8c69 на txlyre/3x-ui из зеркала

  • 0cb1b2778d chore(deps-dev): bump postcss Bumps the npm_and_yarn group with 1 update in the /docs directory: [postcss](https://github.com/postcss/postcss). Updates `postcss` from 8.5.21 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.21...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
  • 3883882726 chore: bump frontend and Go dependencies Updates multiple frontend packages (antd, react-hook-form, storybook, vite, swagger-ui-react, playwright, typescript-eslint, etc.) and Go dependencies (gopsutil, gorm postgres driver, pion/transport, ugorji/codec, genproto, and others). Also replaces `__dirname` with `import.meta.dirname` in vite.config.js for ESM compatibility.
  • 216d18b3c4 chore(vscode): fix Linux paths in the task and launch configs The "go: build" task hardcoded bin/3x-ui.exe, so building on Linux produced a binary carrying a Windows extension. It now emits bin/3x-ui and keeps the .exe name behind a windows override. The Postgres launch config prepended C:\Program Files\PostgreSQL\18\bin to PATH on every platform. Linux separates entries with ':', not ';', so that string fused into the first real PATH entry and clobbered it. Moved it into a windows block, which is where the pg_dump/pg_restore lookups in ServerService need it anyway.
  • 2a8c3bc0db fix(clients): stop a stale IP row from blocking a client edit Saving a client walks every inbound it is attached to and calls UpdateInboundClient, which re-keys the client's email in inbound_client_ips to the spelling in the edited settings. The email match is EqualFold, so when an inbound's settings JSON drifted in case from the client record the panel issues a case-only rename of the tracking row. inbound_client_ips.client_email is unique and case-sensitive, and the IP-limit job keys its rows on whatever casing Xray reports, so both spellings can already be present. The rename then aborts the whole edit with "duplicate key value violates unique constraint uni_inbound_client_ips_client_email" — the client could not be saved at all, including when only adding an inbound to it. The caller only renames onto an identity no live client holds, so a row on the target email is stale IP tracking: delete it before renaming. The blob is rebuilt by the next scan anyway.
  • e71b75e99e docs(claude): correct enforced-guard claims and add the runtime dispatch rule Fact-checked every line of CLAUDE.md against the tree. Six claims were wrong, and two told an agent the opposite of the truth. The file said nothing checks endpoints.ts against the Go routes and nothing fails the build on a missing i18n key. Both guards exist and both run in make verify: TestRouteRegistryContract diffs the real router against the registry in both directions, and i18n-dead-keys.test.ts rejects a locale that misses an en-US key as well as an en-US key nothing references. An agent trusting the old text either skips a step it thinks is unenforced or is blindsided when a "silent" omission turns the suite red. The rest: the Go locale returns an empty string for an unknown key, not the raw key; mtg-multi is a prebuilt binary fetched at build time, not a Go dependency built from source; commits are type(area): summary, not <area>: summary, and perf is in active use; make verify is the fast gate, not a mirror of CI, which also runs race, vulncheck, a live-Postgres job where a SKIP is a failure, and a fuzz smoke. Add the five facts most likely to burn an agent, all reproduced before writing them down. A fresh clone has no internal/web/dist, so go build dies on the embed pattern while thirty-odd packages pass — it reads as a broken repo rather than a missing make dist-stub. Every state-changing inbound/client op must dispatch through runtime.Runtime; a direct xray/api.go call passes all local tests and silently breaks every multi-node install, which is exactly what a hard rule is for. Node 24 is required because make gen imports .ts directly. Postgres, xray e2e and scale tests skip themselves without their env vars. An endpoint change has a fourth step nothing checks: syncing docs/public/openapi.json. Definition of done loses its first step — verify's gen-check already runs gen and fails on a dirty generated diff.
  • Просмотр сравнение для этих 10 коммитов »

3 дней назад

txlyre синхронизированные новые ссылки dependabot/npm_and_yarn/docs/npm_and_yarn-6b7f7a8c69 к txlyre/3x-ui из зеркала

3 дней назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

  • 216d18b3c4 chore(vscode): fix Linux paths in the task and launch configs The "go: build" task hardcoded bin/3x-ui.exe, so building on Linux produced a binary carrying a Windows extension. It now emits bin/3x-ui and keeps the .exe name behind a windows override. The Postgres launch config prepended C:\Program Files\PostgreSQL\18\bin to PATH on every platform. Linux separates entries with ':', not ';', so that string fused into the first real PATH entry and clobbered it. Moved it into a windows block, which is where the pg_dump/pg_restore lookups in ServerService need it anyway.
  • 2a8c3bc0db fix(clients): stop a stale IP row from blocking a client edit Saving a client walks every inbound it is attached to and calls UpdateInboundClient, which re-keys the client's email in inbound_client_ips to the spelling in the edited settings. The email match is EqualFold, so when an inbound's settings JSON drifted in case from the client record the panel issues a case-only rename of the tracking row. inbound_client_ips.client_email is unique and case-sensitive, and the IP-limit job keys its rows on whatever casing Xray reports, so both spellings can already be present. The rename then aborts the whole edit with "duplicate key value violates unique constraint uni_inbound_client_ips_client_email" — the client could not be saved at all, including when only adding an inbound to it. The caller only renames onto an identity no live client holds, so a row on the target email is stale IP tracking: delete it before renaming. The blob is rebuilt by the next scan anyway.
  • e71b75e99e docs(claude): correct enforced-guard claims and add the runtime dispatch rule Fact-checked every line of CLAUDE.md against the tree. Six claims were wrong, and two told an agent the opposite of the truth. The file said nothing checks endpoints.ts against the Go routes and nothing fails the build on a missing i18n key. Both guards exist and both run in make verify: TestRouteRegistryContract diffs the real router against the registry in both directions, and i18n-dead-keys.test.ts rejects a locale that misses an en-US key as well as an en-US key nothing references. An agent trusting the old text either skips a step it thinks is unenforced or is blindsided when a "silent" omission turns the suite red. The rest: the Go locale returns an empty string for an unknown key, not the raw key; mtg-multi is a prebuilt binary fetched at build time, not a Go dependency built from source; commits are type(area): summary, not <area>: summary, and perf is in active use; make verify is the fast gate, not a mirror of CI, which also runs race, vulncheck, a live-Postgres job where a SKIP is a failure, and a fuzz smoke. Add the five facts most likely to burn an agent, all reproduced before writing them down. A fresh clone has no internal/web/dist, so go build dies on the embed pattern while thirty-odd packages pass — it reads as a broken repo rather than a missing make dist-stub. Every state-changing inbound/client op must dispatch through runtime.Runtime; a direct xray/api.go call passes all local tests and silently breaks every multi-node install, which is exactly what a hard rule is for. Node 24 is required because make gen imports .ts directly. Postgres, xray e2e and scale tests skip themselves without their env vars. An endpoint change has a fourth step nothing checks: syncing docs/public/openapi.json. Definition of done loses its first step — verify's gen-check already runs gen and fails on a dirty generated diff.
  • Просмотр сравнение для этих 3 коммитов »

4 дней назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

  • 5bc81dfd1d fix(node): stop the node sync from deleting clients it never meant to A client that hit its quota or expiry was disabled, then destroyed on both panels a few seconds later. Five defects fed the same hard delete. ReconcileNode pushed buildRuntimeInboundForAPI, which strips disabled clients. Every other call site targets an in-memory Xray config, where dropping a user is harmless; a node target is a peer panel's DATABASE, so the node deleted the row, stopped reporting it, and the master mirrored that deletion back. Split the builder in two: buildInboundForNodePush injects fallbacks only, buildInboundForLocalRuntime adds the strip on top. The names now say which targets they are safe for. setRemoteTrafficLocked trusted a config_dirty the caller sampled before the snapshot round-trip. A client added inside that window commits on the same serialized writer and marks the node dirty, but the merge still treated the older snapshot as authoritative and deleted it. Re-read the flag inside the writer. In "selected" sync mode, FilterNodeSnapshot strips a deselected tag, but the sweep loaded every inbound with node_id set, so deselecting a tag read as "the node deleted it" and wiped an inbound the node still serves. Skip tags outside the node's managed set. A failed SyncInbound was logged and swallowed; on SQLite the transaction still commits, and the sweep then deleted the innocent clients whose links that failure had left unbuilt. Skip the sweep for such an inbound, and close the trigger: SyncInbound now stores the trimmed email it looks up by, and email validation rejects every unicode space rather than only U+0020. ClientService.Delete tombstones up front and deliberately keeps the record when an inbound fails, so the next attempt can retry the leftovers. The tombstone did not lift with it, so the next merge dropped the client from the synced settings and finished the deletion this path had refused. Add withdrawClientTombstones on every failure path, in BulkDelete too. Finally, make the sweep itself recoverable. "Ended the merge unattached" is true for a real remote deletion and equally true for a bad merge, so it now stamps sync_orphaned_at instead of deleting; any later merge that sees the client attached clears the mark, and a reaper removes only what stayed orphaned past the grace period. The traffic row survives that window too, or a reclaimed client would come back with its usage, quota and expiry reset. The mark is written by this sweep alone, so orphans from any other cause keep their existing manual-cleanup semantics.
  • f4b7b08e08 fix(ldap): stop auto-delete from wiping every client on an empty directory FetchVlessFlags returns (empty map, nil) whenever the bind succeeds but the search yields nothing usable — a renamed OU, a service account that lost read on the user attribute, a filter that stopped matching. The only guard on the destructive half of the sync was `err != nil`, so that answer was read as "every user is gone" and the job detached every client from the configured inbounds, once a minute, for as long as the directory stayed broken. Gate auto-delete behind autoDeleteSafeForFetch: refuse an empty fetch, and refuse one that collapsed below half of the last successful sync, which is a misconfigured directory far more often than real churn. Also stop splitCsv from defaulting an empty string to DefaultTruthyValues. That default belongs to the truthy-value setting, but splitCsv is also what parses ldapInboundTags, so an unconfigured tag list silently resolved to ["true","1","yes","on"]. It only ever bounded the blast radius by accident.
  • 1ff90c5b66 docs(claude): bound comment length, fix size, and test value Three agent-facing rules, each written after the same mistake showed up in review. Comments were banned outright, which the codebase itself contradicts on almost every file — the ban pushed real invariants out of the code entirely. Allow them, but cap a block at 2 lines and spend those lines on the *why* a name cannot carry. Add a scope rule: the fix must be the smallest change that removes the root cause. A small bug does not earn new columns, jobs, abstractions or config; if it genuinely needs architecture, agree on that first instead of shipping it alongside the fix. Add two testing rules: a test must go red when its fix is reverted, and it must cover something that can actually break. A test that passes either way certifies nothing and is then cited as proof the fix works.
  • Просмотр сравнение для этих 3 коммитов »

5 дней назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

  • 138e1bd840 chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 (#6162) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  • 31c1eed5dc fix dead code, typo, and minor bugs in main.go, process.go and index.go (#6167) Fixes several small issues found during code review: - fix(xray): return explicit nil instead of stale err in getLogPath - fix(xray): remove duplicate doc comment on GetErrorLogPath - refactor: remove unreachable return after log.Fatalf (×4) - fix(cli): add missing newline to listen IP success message - fix(cli): typo "form" → "from" in migrate help text - refactor: simplify var+assign to short declaration for server/subServer - fix(controller): return error from getTwoFactorEnable instead of swallowing it
  • Просмотр сравнение для этих 2 коммитов »

6 дней назад

txlyre синхронизированные и удаленные ссылки dependabot/go_modules/google.golang.org/grpc-1.83.0 на txlyre/3x-ui из зеркала

6 дней назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

  • 264f61eb90 Merge pull request #6161 from PathGao/feat-sidebar-pinning feat(ui): let users pin the sidebar
  • ac584cfc90 fix(ui): reserve space for pinned sidebar Keep page content accessible when the desktop sidebar remains expanded and cover the complete pin lifecycle.
  • 91c5d7b19f style(ui): preserve sidebar header spacing Keep the original title alignment while fitting the pin with the existing header actions.
  • b2fe233108 fix(ui): align sidebar pin controls Keep the pin with the expanded header actions and center the collapsed version link with the navigation rail.
  • 5373786faa feat(ui): let users pin the sidebar Restore a persistent expanded-sidebar choice while preserving the compact hover rail as the default.
  • Просмотр сравнение для этих 5 коммитов »

1 неделя назад

txlyre синхронизированные коммиты с dependabot/go_modules/google.golang.org/grpc-1.83.0 на txlyre/3x-ui из зеркала

  • 916db9b9e6 chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
  • c377dca27c v3.6.0
  • c56f6447a8 chore: refresh dependencies and modernize Go test idioms Frontend deps: @hookform/resolvers 5.4.3 -> 5.5.7, Storybook 10.5.4 -> 10.5.5 across the four packages we declare, globals 17.7.0 -> 17.8.0, and jsdom 29.1.1 -> 30.0.1. The jsdom major replaces its CSS and selector stack -- @asamuzakjp/css-color 5 -> 6, @asamuzakjp/dom-selector 7 -> 8, undici 7 -> 8, nwsapi and generational-cache folded into their parents, whatwg-url 17 nested underneath. Nothing in the Vitest suites reaches those directly and the whole frontend gate (typecheck, lint, tests, build, Storybook compile) is green. Panel frontend version to 0.6.0. Backend deps: mattn/go-sqlite3 1.14.48 -> 1.14.49 and valyala/fasthttp 1.72.0 -> 1.73.0, plus the golang.org/x/exp and genproto/googleapis/rpc indirect bumps that came with them. Go tests: modernize -fix output, covering range-over-int, sync.WaitGroup.Go in place of manual Add/Done pairs, maps.Copy, and Go 1.26 new(expr) for pointer-to-value in the forwarded-trust table. The storedAs helper is deleted instead of being left behind a //go:fix inline directive -- keeping it that way fails govet on the one call site the rewrite did not reach, and every caller now takes new(...) directly. Behaviour is unchanged. DnsTab: the hosts-sync effect tested dns while declaring dnsEnabled in its dependency array. Both carry the same truth value, so this is exhaustive-deps hygiene rather than a behaviour change.
  • 66740b7ef4 fix(frontend): preserve edited server drafts (#6156) * fix(frontend): preserve edited server drafts * fix(frontend): retain Xray server projections * fix(frontend): keep draft controls internal * fix(frontend): rehydrate saved redacted settings * fix(frontend): order saved draft hydration * fix(frontend): preserve draft baselines on security saves --------- Co-authored-by: PathGao <[email protected]>
  • 8d02ae28f5 fix(frontend): preserve theme body classes (#6157) * fix(storybook): preserve preview body classes * fix(frontend): retain theme body classes * fix(storybook): mirror panel theme attributes * test(storybook): cover theme switches * test(storybook): strengthen theme DOM coverage * fix(frontend): preserve message container classes --------- Co-authored-by: PathGao <[email protected]>
  • Просмотр сравнение для этих 10 коммитов »

1 неделя назад

txlyre синхронизированные новые ссылки dependabot/go_modules/google.golang.org/grpc-1.83.0 к txlyre/3x-ui из зеркала

1 неделя назад

txlyre синхронизированные коммиты с v3.6.0 на txlyre/3x-ui из зеркала

1 неделя назад

txlyre синхронизированные новые ссылки v3.6.0 к txlyre/3x-ui из зеркала

1 неделя назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

  • c377dca27c v3.6.0
  • c56f6447a8 chore: refresh dependencies and modernize Go test idioms Frontend deps: @hookform/resolvers 5.4.3 -> 5.5.7, Storybook 10.5.4 -> 10.5.5 across the four packages we declare, globals 17.7.0 -> 17.8.0, and jsdom 29.1.1 -> 30.0.1. The jsdom major replaces its CSS and selector stack -- @asamuzakjp/css-color 5 -> 6, @asamuzakjp/dom-selector 7 -> 8, undici 7 -> 8, nwsapi and generational-cache folded into their parents, whatwg-url 17 nested underneath. Nothing in the Vitest suites reaches those directly and the whole frontend gate (typecheck, lint, tests, build, Storybook compile) is green. Panel frontend version to 0.6.0. Backend deps: mattn/go-sqlite3 1.14.48 -> 1.14.49 and valyala/fasthttp 1.72.0 -> 1.73.0, plus the golang.org/x/exp and genproto/googleapis/rpc indirect bumps that came with them. Go tests: modernize -fix output, covering range-over-int, sync.WaitGroup.Go in place of manual Add/Done pairs, maps.Copy, and Go 1.26 new(expr) for pointer-to-value in the forwarded-trust table. The storedAs helper is deleted instead of being left behind a //go:fix inline directive -- keeping it that way fails govet on the one call site the rewrite did not reach, and every caller now takes new(...) directly. Behaviour is unchanged. DnsTab: the hosts-sync effect tested dns while declaring dnsEnabled in its dependency array. Both carry the same truth value, so this is exhaustive-deps hygiene rather than a behaviour change.
  • 66740b7ef4 fix(frontend): preserve edited server drafts (#6156) * fix(frontend): preserve edited server drafts * fix(frontend): retain Xray server projections * fix(frontend): keep draft controls internal * fix(frontend): rehydrate saved redacted settings * fix(frontend): order saved draft hydration * fix(frontend): preserve draft baselines on security saves --------- Co-authored-by: PathGao <[email protected]>
  • 8d02ae28f5 fix(frontend): preserve theme body classes (#6157) * fix(storybook): preserve preview body classes * fix(frontend): retain theme body classes * fix(storybook): mirror panel theme attributes * test(storybook): cover theme switches * test(storybook): strengthen theme DOM coverage * fix(frontend): preserve message container classes --------- Co-authored-by: PathGao <[email protected]>
  • 2c943da3e0 fix(frontend): keep DNS hosts synchronized (#6158) * fix(frontend): keep DNS hosts synchronized * fix(frontend): preserve incomplete DNS hosts * fix(frontend): reset DNS host drafts when disabled * fix(frontend): clear DNS host drafts when disabled --------- Co-authored-by: PathGao <[email protected]>
  • Просмотр сравнение для этих 7 коммитов »

1 неделя назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

  • af5a8e5d40 fix(database): create SQLite backup snapshots online (#6137) * fix(database): snapshot SQLite backups online Use SQLite's online backup API for downloadable backups and SQLite migration exports instead of checkpointing then reading the live database file. The regression test validates a backup made while writes continue. * style(database): group SQLite driver imports * fix(database): bound online backup retries Use a single backup step and a bounded connection-acquisition/retry context. Tighten temporary-file cleanup and regression assertions while removing the unused checkpoint helper. * test(database): cover existing backup destinations * fix(database): harden SQLite snapshot lifecycle Sweep interrupted snapshot directories at SQLite startup, keep rollback-journal backups incremental, and make caller-owned cleanup explicit. Reuse one scheduled Telegram snapshot across administrators and make the direct SQLite driver dependency explicit. --------- Co-authored-by: PathGao <[email protected]>
  • ad288a7ecc fix(sub): honor trustedProxyCIDRs before forwarded URLs (#6135) * fix(sub): honor trustedProxyCIDRs before forwarded URLs * fix(sub): avoid unused trust-setting lookups Skip the trustedProxyCIDRs lookup when no forwarded header can affect a subscription URL. Keep the shipped proxy default in one exported setting constant and document the subscription-link behavior for custom proxy boundaries. * fix(frontend): meet config text contrast requirements Keep compact configuration text readable in the light theme and satisfy the Storybook accessibility check. --------- Co-authored-by: PathGao <[email protected]>
  • ad5f2a28cb fix(xray): synchronize lifecycle state (#6138) * fix(xray): synchronize lifecycle snapshots Protect process replacement and result caching with a lifecycle state object, so read paths keep one process snapshot while restarts swap state safely. Bound version probing to prevent a stalled binary from holding the restart lock. * test(xray): cover concurrent lifecycle reads Exercise status, result, and traffic reads while the managed process is replaced, so the race detector guards the lifecycle snapshot boundary. * fix(xray): guard process config snapshots Synchronize hot-applied config snapshots, keep Telegram reads on one lifecycle snapshot, and strengthen lifecycle timeout and concurrency regression coverage. --------- Co-authored-by: PathGao <[email protected]>
  • e467b25f03 fix(sub): coalesce external subscription refreshes (#6139) * fix(sub): coalesce external subscription refreshes Limit concurrent cache misses to one upstream request per URL and evict the oldest entries once the cache reaches its bounded capacity. * fix(sub): preserve shared stale refresh results Release every in-flight waiter on panic or error, carry the leader outcome to waiters, and strengthen cache capacity and stale fallback coverage. --------- Co-authored-by: PathGao <[email protected]>
  • 03cc80bb9e fix(mtproto): synchronize child-process lifecycle (#6141) * fix(mtproto): synchronize child-process state Use lifecycle snapshots around the mtg command, completion signal, and exit error so Wait cannot race status and shutdown reads. * test(mtproto): cover concurrent process exit * test(mtproto): cover lifecycle field synchronization --------- Co-authored-by: PathGao <[email protected]>
  • Просмотр сравнение для этих 7 коммитов »

1 неделя назад

txlyre синхронизированные коммиты с main на txlyre/3x-ui из зеркала

  • 87ebcc7a6f feat(ui): tag settings that sit at their shipped default value (#6128) * feat(ui): tag settings that sit at their shipped default value A field showing 2096 reads identically whether the install never set it or the operator saved 2096 — newcomers cannot tell which knobs they have touched, and after the cleared-port fix (#6121) a port can never visually return to an unset state. Add a small grey tag next to numeric settings whose current value equals the shipped default. The tag deliberately compares values, not provenance: a stored 2096 and a fallback 2096 behave identically, so they read identically, and the tag reacts live as the user types. The backing endpoint filters defaultValueMap through the AllSetting field set, so per-install material (secret, panelGuid, node mTLS keys) and redacted credential fields never leave the server; a test pins that. Co-Authored-By: Claude Fable 5 <[email protected]> * fix(ui): keep the default tag out of the accessible name, pin the defaults contract From review, in order of severity: The badge was rendered inside the element whose id feeds the control's aria-labelledby, so a visible tag changed every field's accessible name ('Panel Port Default'). The title text now carries the id on its own span and the badge sits beside it. The same default values live in three places: the Go defaultValueMap, the frontend AllSetting class, and the tag's verdict. A new contract test parses the Go map's string literals and asserts every shared key matches the AllSetting class default through the tag's own comparison — and on first run it caught two real drifts (tgEnabledEvents / smtpEnabledEvents defaulted to '' in the class but 'login.attempt,cpu.high' on the server), now aligned. matchesFactoryDefault no longer coerces blank or unparsable defaults (Number('') is 0; a junk string is not false). The Go tests are table-driven t.Run subtests and gained the structural invariant: every returned key is an AllSetting json tag outside the credential deny-list. The service doc comment now describes the projection mechanism instead of overclaiming; the i18n key is re-indented and placed at the head of pages.settings in all 13 locales; the fetch falls back to {} when validation fails; and smtpPort gets the tag so plain numeric settings-list fields are covered uniformly. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
  • 55f0281692 chore(lint): forbid the Number-or-clamp idiom in direct-write settings pages (#6129) * chore(lint): forbid the Number-or-clamp idiom in direct-write settings pages Follow-up promised in #6127's review thread: the settings and xray pages write numeric changes straight into state, so a regressed handler silently ships the cleared-port bug again. A scoped no-restricted-syntax rule now rejects Number(...) || N inside an onChange attribute in those directories, pointing at onNumber(). The one remaining match, the Telegram notify interval, moves onto the helper with its floor intact: clearing now keeps the stored count instead of writing 1, and Math.max still clamps typed values. Form modals that stage values behind Zod keep their deliberate clear-means-zero semantics; the rule deliberately does not apply there. Co-Authored-By: Claude Fable 5 <[email protected]> * chore(lint): widen the numeric-clamp guard to the shapes that actually drift From review: the rule matched only the Number-or-literal shape, while two semantically identical ternary sites already lived inside its own directories, so 'zero suppressions' reflected the selector's narrowness rather than a clean subtree. The rule now catches the ternary typeof form and the nullish-coalescing form too, is anchored to InputNumber elements so its message can never point a ChangeEvent handler at a number-typed helper, and documents the extracted-handler shape it cannot see. The xray form modals stage values behind Zod like the clients modals do, so a follow-up config object exempts them explicitly instead of the comment claiming they were never in scope. BasicsTab's Happy Eyeballs try-delay — the one genuine direct-write ternary — moves onto onNumber: clearing keeps the stored delay instead of writing 0, and 0 stays reachable by typing it. The Telegram interval gains precision={0} so a typed decimal cannot compose an @every value its own parser rejects on reload. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
  • bcd71c9296 chore(build): stop shipping production sourcemaps inside the binary (#6131) * chore(build): stop shipping production sourcemaps inside the binary Everything under internal/web/dist is embedded into the release binary via embed.FS, and sourcemap: true put 112 .map files — 18MB, 72% of dist — inside every build users download. Nothing consumes them there: the panel never references them and npm run dev serves its own maps regardless of this flag. dist drops from 25MB to 6.7MB; flip the flag locally when a production bundle needs debugging. Co-Authored-By: Claude Fable 5 <[email protected]> * chore(build): gate production sourcemaps behind XUI_SOURCEMAP From review: hard-coding false made the documented debugging path an edit to a tracked file, and the XUI_DEBUG serve-from-disk flow lost maps with no zero-diff way back. XUI_SOURCEMAP=true at build time restores them; the default stays off. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
  • 33f72f8f4a fix(api): authenticate GET /panel/api/openapi.json + pin the route registry to the router (#6133) * test(web): pin the endpoints.ts registry to the actual Gin routes endpoints.ts is a hand-maintained registry and nothing checked it against the router: an omitted API route silently vanishes from the generated OpenAPI docs, and an entry for a removed route documents an endpoint that 404s. Two new tests construct the real router against a throwaway DB and diff the /panel/api surface both ways. The check found one gap on arrival: GET /panel/api/openapi.json — the endpoint that serves the docs — was itself undocumented. Registered. Co-Authored-By: Claude Fable 5 <[email protected]> * fix(api)+test: authenticate openapi.json, fold the two route-contract tests into one Three things from the review, in severity order. The bot found that GET /panel/api/openapi.json was registered on the base-path group one line before the /panel/api group installs checkAPIAuth, so Gin's snapshot of the parent chain meant the whole admin API surface plus build version was fetchable without a session — while this very PR was about to document it as auth-required. Move the registration inside the authed api group. Verified: unauthenticated it now 404s exactly like server/status (was 200), and a logged-in session still serves it 200, so the docs page is unaffected. The existing api_docs_test.go already checked the forward direction by regex-scanning controller source against a hand-maintained per-file path switch — which is why it missed this web.go-registered route, and whose fall-through default silently mis-paths any unlisted controller file. The new router-based test is a strict superset, so fold in the extra surface it guarded (/login, /logout, /csrf-token, /getTwoFactorEnable, /ws) and delete the old test rather than run two. Harden the endpoints.ts parser: pair each method with the next path sequentially instead of a brace-crossing regex, and fail loudly when the parsed count doesn't match the declared method fields. Construct the server once across both subtests, cancel it, and restore the previous global on cleanup. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
  • ea35884390 chore(i18n): delete 230 dead translation keys and guard against new ones (#6132) * chore(i18n): delete 230 dead translation keys and guard against new ones The 13 locale files carried 230 keys (11% of the set) that nothing in the frontend or Go sources references — leftovers of renamed features (the email notifier reuses tgbot.messages.* for subjects, the old email.subject*/title* set was orphaned; likewise menu.*, the clients bulk-copy strings, and the secAlert* family). Nothing detected this: a missing key falls back to en-US and an unused key fails nothing. A new test now fails the build when an en-US key has no reference in frontend/src or internal Go sources (dynamic keys are covered by harvesting concatenation and template-literal prefixes), and pins that all 13 locales carry exactly the en-US key set, so parity drift surfaces at test time instead of as a silent fallback. Each locale shrinks by the same 230 keys; net -2,900 lines across the translation set. Co-Authored-By: Claude Fable 5 <[email protected]> * fix(i18n): restore the 29 live remarkVars keys, match whole tokens, unmask 9 more From review: the template-literal harvester required the prefix to end on a dot, so pages.hosts.remarkVars.desc${token} harvested nothing and all 29 desc* tooltip keys were wrongly deleted — and the guard shared the flawed logic, so CI stayed green while the Hosts page would have shown raw key names in 13 languages. Restored from the parent commit; the harvester now requires at least one dot but not a trailing one. Also from review: references are matched as whole dotted tokens instead of substrings (a dead key can no longer hide behind a longer sibling — that unmasked 9 more genuinely dead keys, each verified by hand before deletion), and the test excludes itself from the scan so its own prose cannot whitelist a subtree. Net: -210 keys per locale instead of the previous -230. Co-Authored-By: Claude Fable 5 <[email protected]> --------- Co-authored-by: Claude Fable 5 <[email protected]>
  • Просмотр сравнение для этих 5 коммитов »

1 неделя назад