txlyre

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

ccd56a56a8 chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 (#5731) Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.6 to 1.19.0. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
7a844682b3 chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.5 to 4.26.6 (#5730) Bumps [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) from 4.26.5 to 4.26.6. - [Release notes](https://github.com/shirou/gopsutil/releases) - [Commits](https://github.com/shirou/gopsutil/compare/v4.26.5...v4.26.6) --- updated-dependencies: - dependency-name: github.com/shirou/gopsutil/v4 dependency-version: 4.26.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
6626bf4a07 chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#5729) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
c0df365524 chore(frontend): bump minor npm deps Update frontend dependencies to newer patch/minor versions in package.json and refresh package-lock accordingly. This includes runtime libraries (i18next, react-router-dom, recharts) and tooling updates (typescript-eslint, vite) to keep the frontend stack current and aligned.
5361b56e5e fix(update): avoid full dnf system upgrade (#5717)
对比 22 次代码提交 »

3 小时之前

txlyre 从镜像同步并从 txlyre/3x-ui 删除了引用 dependabot/npm_and_yarn/frontend/vite-8.1.3

3 小时之前

txlyre 从镜像同步并从 txlyre/3x-ui 删除了引用 dependabot/npm_and_yarn/frontend/typescript-eslint-8.62.1

3 小时之前

txlyre 从镜像同步并从 txlyre/3x-ui 删除了引用 dependabot/npm_and_yarn/frontend/recharts-3.9.1

3 小时之前

txlyre 从镜像同步并从 txlyre/3x-ui 删除了引用 dependabot/npm_and_yarn/frontend/react-router-dom-7.18.1

3 小时之前

txlyre 从镜像同步并从 txlyre/3x-ui 删除了引用 dependabot/npm_and_yarn/frontend/i18next-26.3.4

3 小时之前

txlyre 从镜像同步并从 txlyre/3x-ui 删除了引用 dependabot/go_modules/google.golang.org/grpc-1.82.0

3 小时之前

txlyre 从镜像同步并从 txlyre/3x-ui 删除了引用 dependabot/go_modules/github.com/shirou/gopsutil/v4-4.26.6

3 小时之前

txlyre 从镜像同步并从 txlyre/3x-ui 删除了引用 dependabot/go_modules/github.com/klauspost/compress-1.19.0

3 小时之前

txlyre 从镜像同步了 main 分支的代码到 txlyre/3x-ui

62f303905e fix(scripts): pass --force to acme.sh --installcert so it survives sudo acme.sh guards every non-install command behind _checkSudo: when a non-root user runs the panel scripts via sudo, it prints the sudo wiki warning and exits before doing anything, unless FORCE is set. All our --issue calls already pass --force and were unaffected, but none of the --installcert calls did, so issuance succeeded and installation then aborted silently, ending in "Certificate files not found after installation". FORCE has no other effect on the installcert path, so mirror the --issue calls and pass --force everywhere we install certs. Closes #5741
c8ef1b1f68 feat(reality): derive a stable per-client spiderX for shared links The inbound's spiderX now acts as a per-client seed: exports emit sha256(seed|subKey) truncated to a 15-hex "/path", so a client's spx no longer changes on every subscription fetch (#5718) while different clients stop sharing one fingerprintable value. The form gains a regenerate button that rotates every client's path at once. The frontend link builders derive through the same function (lib/xray/spider-x.ts, @noble/hashes) keyed on subId-then-email like the Go subKey, so panel QR/copy links and subscription output agree — cross-language vector tests lock both sides byte-for-byte. streamData now tolerates malformed stored stream settings (unparseable JSON, null tls/reality settings) instead of panicking the subscription request.
64c306037f feat(wireguard): make client allowedIPs editable with validation The WireGuard peer address was allocated server-side and shown read-only in the client editor, so changing it required hand-editing the inbound's raw settings JSON (#5715). The backend add/update paths already honored a submitted allowedIPs; only the form withheld it. Make the field editable (comma-separated, empty still auto-assigns) and validate submissions server-side: entries must parse as an IP or CIDR, bare addresses normalize to single-host prefixes, and an address already used by another peer on the inbound is rejected. Closes #5715
8dd3b31ee8 fix(node): show the activated first-use deadline on the Clients page With "start after first use" on a node inbound, the node activates the absolute deadline and the master adopts it into client_traffics via the sync CASE merge — but the client record (what the Clients page reads) was only refreshed by SyncInbound from the snapshot's settings JSON. A node whose JSON still carried the negative duration (stale conversion, older node build, or a mixed local+node attachment) kept rewriting the record back to "not started" even though the DB held the real deadline (#5714). Lift the activated deadline from client_traffics onto still-negative client records at the end of every node sync, after SyncInbound has run. Intentional resets back to delayed start are unaffected: editing a client also resets client_traffics to the negative duration, so the lift's expiry_time > 0 guard never matches. Closes #5714
e5b56c9444 fix(xray): reconcile client auto-disable through the API instead of a forced restart When a client expired or hit its traffic limit, XrayTrafficJob called RestartXray(true), stopping the whole process and dropping every live connection on every inbound (#5712 reported this as XHTTP on 443 dying) — even though disableInvalidClients had already removed the user from the running core over gRPC. The force restart existed only to re-sync the process's config snapshot. Switch the job to a non-forced restart and teach ComputeHotDiff to express a client-only inbound change as per-user AlterInbound operations for vless/vmess/trojan, so the reconcile is a no-op RemoveUser plus a snapshot update rather than a handler swap that would still blip that inbound's listener. Anything beyond the clients list still falls back to handler replacement or a full restart as before. Closes #5712
对比 9 次代码提交 »

11 小时之前

txlyre 从镜像同步了 dependabot/npm_and_yarn/frontend/vite-8.1.3 分支的代码到 txlyre/3x-ui

b2c12fa639 chore(deps-dev): bump vite from 8.1.0 to 8.1.3 in /frontend Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.1.0 to 8.1.3. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.3/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.1.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
64c306037f feat(wireguard): make client allowedIPs editable with validation The WireGuard peer address was allocated server-side and shown read-only in the client editor, so changing it required hand-editing the inbound's raw settings JSON (#5715). The backend add/update paths already honored a submitted allowedIPs; only the form withheld it. Make the field editable (comma-separated, empty still auto-assigns) and validate submissions server-side: entries must parse as an IP or CIDR, bare addresses normalize to single-host prefixes, and an address already used by another peer on the inbound is rejected. Closes #5715
8dd3b31ee8 fix(node): show the activated first-use deadline on the Clients page With "start after first use" on a node inbound, the node activates the absolute deadline and the master adopts it into client_traffics via the sync CASE merge — but the client record (what the Clients page reads) was only refreshed by SyncInbound from the snapshot's settings JSON. A node whose JSON still carried the negative duration (stale conversion, older node build, or a mixed local+node attachment) kept rewriting the record back to "not started" even though the DB held the real deadline (#5714). Lift the activated deadline from client_traffics onto still-negative client records at the end of every node sync, after SyncInbound has run. Intentional resets back to delayed start are unaffected: editing a client also resets client_traffics to the negative duration, so the lift's expiry_time > 0 guard never matches. Closes #5714
e5b56c9444 fix(xray): reconcile client auto-disable through the API instead of a forced restart When a client expired or hit its traffic limit, XrayTrafficJob called RestartXray(true), stopping the whole process and dropping every live connection on every inbound (#5712 reported this as XHTTP on 443 dying) — even though disableInvalidClients had already removed the user from the running core over gRPC. The force restart existed only to re-sync the process's config snapshot. Switch the job to a non-forced restart and teach ComputeHotDiff to express a client-only inbound change as per-user AlterInbound operations for vless/vmess/trojan, so the reconcile is a no-op RemoveUser plus a snapshot update rather than a handler swap that would still blip that inbound's listener. Anything beyond the clients list still falls back to handler replacement or a full restart as before. Closes #5712
1153d5db8c fix(groups): keep group traffic totals stable across client resets and deletes ListGroups displays live_sum(client_traffics) minus the group's stored reset baseline, but only ResetGroupTraffic ever moved the baseline. Any client-level operation that zeroed or deleted traffic rows (single/bulk reset, client delete, removing a client's last inbound) shrank the live sum and silently subtracted that client's history from the group total. Shift the baseline down by the removed counters inside the same transaction, so group totals only change through group reset. Derived groups without a stored row get one with a negative baseline, which the existing clamp handles. Closes #5675
对比 10 次代码提交 »

11 小时之前

txlyre 从镜像同步了新的引用 dependabot/npm_and_yarn/frontend/vite-8.1.3 到 txlyre/3x-ui

11 小时之前

txlyre 从镜像同步了 dependabot/npm_and_yarn/frontend/typescript-eslint-8.62.1 分支的代码到 txlyre/3x-ui

7fc0ca16bc chore(deps-dev): bump typescript-eslint in /frontend Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.62.0 to 8.62.1. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.62.1/packages/typescript-eslint) --- updated-dependencies: - dependency-name: typescript-eslint dependency-version: 8.62.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
64c306037f feat(wireguard): make client allowedIPs editable with validation The WireGuard peer address was allocated server-side and shown read-only in the client editor, so changing it required hand-editing the inbound's raw settings JSON (#5715). The backend add/update paths already honored a submitted allowedIPs; only the form withheld it. Make the field editable (comma-separated, empty still auto-assigns) and validate submissions server-side: entries must parse as an IP or CIDR, bare addresses normalize to single-host prefixes, and an address already used by another peer on the inbound is rejected. Closes #5715
8dd3b31ee8 fix(node): show the activated first-use deadline on the Clients page With "start after first use" on a node inbound, the node activates the absolute deadline and the master adopts it into client_traffics via the sync CASE merge — but the client record (what the Clients page reads) was only refreshed by SyncInbound from the snapshot's settings JSON. A node whose JSON still carried the negative duration (stale conversion, older node build, or a mixed local+node attachment) kept rewriting the record back to "not started" even though the DB held the real deadline (#5714). Lift the activated deadline from client_traffics onto still-negative client records at the end of every node sync, after SyncInbound has run. Intentional resets back to delayed start are unaffected: editing a client also resets client_traffics to the negative duration, so the lift's expiry_time > 0 guard never matches. Closes #5714
e5b56c9444 fix(xray): reconcile client auto-disable through the API instead of a forced restart When a client expired or hit its traffic limit, XrayTrafficJob called RestartXray(true), stopping the whole process and dropping every live connection on every inbound (#5712 reported this as XHTTP on 443 dying) — even though disableInvalidClients had already removed the user from the running core over gRPC. The force restart existed only to re-sync the process's config snapshot. Switch the job to a non-forced restart and teach ComputeHotDiff to express a client-only inbound change as per-user AlterInbound operations for vless/vmess/trojan, so the reconcile is a no-op RemoveUser plus a snapshot update rather than a handler swap that would still blip that inbound's listener. Anything beyond the clients list still falls back to handler replacement or a full restart as before. Closes #5712
1153d5db8c fix(groups): keep group traffic totals stable across client resets and deletes ListGroups displays live_sum(client_traffics) minus the group's stored reset baseline, but only ResetGroupTraffic ever moved the baseline. Any client-level operation that zeroed or deleted traffic rows (single/bulk reset, client delete, removing a client's last inbound) shrank the live sum and silently subtracted that client's history from the group total. Shift the baseline down by the removed counters inside the same transaction, so group totals only change through group reset. Derived groups without a stored row get one with a negative baseline, which the existing clamp handles. Closes #5675
对比 10 次代码提交 »

11 小时之前

txlyre 从镜像同步了新的引用 dependabot/npm_and_yarn/frontend/typescript-eslint-8.62.1 到 txlyre/3x-ui

11 小时之前

txlyre 从镜像同步了 dependabot/npm_and_yarn/frontend/recharts-3.9.1 分支的代码到 txlyre/3x-ui

257ada792a chore(deps): bump recharts from 3.9.0 to 3.9.1 in /frontend Bumps [recharts](https://github.com/recharts/recharts) from 3.9.0 to 3.9.1. - [Release notes](https://github.com/recharts/recharts/releases) - [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md) - [Commits](https://github.com/recharts/recharts/compare/v3.9.0...v3.9.1) --- updated-dependencies: - dependency-name: recharts dependency-version: 3.9.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
64c306037f feat(wireguard): make client allowedIPs editable with validation The WireGuard peer address was allocated server-side and shown read-only in the client editor, so changing it required hand-editing the inbound's raw settings JSON (#5715). The backend add/update paths already honored a submitted allowedIPs; only the form withheld it. Make the field editable (comma-separated, empty still auto-assigns) and validate submissions server-side: entries must parse as an IP or CIDR, bare addresses normalize to single-host prefixes, and an address already used by another peer on the inbound is rejected. Closes #5715
8dd3b31ee8 fix(node): show the activated first-use deadline on the Clients page With "start after first use" on a node inbound, the node activates the absolute deadline and the master adopts it into client_traffics via the sync CASE merge — but the client record (what the Clients page reads) was only refreshed by SyncInbound from the snapshot's settings JSON. A node whose JSON still carried the negative duration (stale conversion, older node build, or a mixed local+node attachment) kept rewriting the record back to "not started" even though the DB held the real deadline (#5714). Lift the activated deadline from client_traffics onto still-negative client records at the end of every node sync, after SyncInbound has run. Intentional resets back to delayed start are unaffected: editing a client also resets client_traffics to the negative duration, so the lift's expiry_time > 0 guard never matches. Closes #5714
e5b56c9444 fix(xray): reconcile client auto-disable through the API instead of a forced restart When a client expired or hit its traffic limit, XrayTrafficJob called RestartXray(true), stopping the whole process and dropping every live connection on every inbound (#5712 reported this as XHTTP on 443 dying) — even though disableInvalidClients had already removed the user from the running core over gRPC. The force restart existed only to re-sync the process's config snapshot. Switch the job to a non-forced restart and teach ComputeHotDiff to express a client-only inbound change as per-user AlterInbound operations for vless/vmess/trojan, so the reconcile is a no-op RemoveUser plus a snapshot update rather than a handler swap that would still blip that inbound's listener. Anything beyond the clients list still falls back to handler replacement or a full restart as before. Closes #5712
1153d5db8c fix(groups): keep group traffic totals stable across client resets and deletes ListGroups displays live_sum(client_traffics) minus the group's stored reset baseline, but only ResetGroupTraffic ever moved the baseline. Any client-level operation that zeroed or deleted traffic rows (single/bulk reset, client delete, removing a client's last inbound) shrank the live sum and silently subtracted that client's history from the group total. Shift the baseline down by the removed counters inside the same transaction, so group totals only change through group reset. Derived groups without a stored row get one with a negative baseline, which the existing clamp handles. Closes #5675
对比 10 次代码提交 »

11 小时之前

txlyre 从镜像同步了新的引用 dependabot/npm_and_yarn/frontend/recharts-3.9.1 到 txlyre/3x-ui

11 小时之前

txlyre 从镜像同步了 dependabot/npm_and_yarn/frontend/react-router-dom-7.18.1 分支的代码到 txlyre/3x-ui

9eee4be44a chore(deps): bump react-router-dom from 7.18.0 to 7.18.1 in /frontend Bumps [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) from 7.18.0 to 7.18.1. - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/[email protected]/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/[email protected]/packages/react-router-dom) --- updated-dependencies: - dependency-name: react-router-dom dependency-version: 7.18.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
64c306037f feat(wireguard): make client allowedIPs editable with validation The WireGuard peer address was allocated server-side and shown read-only in the client editor, so changing it required hand-editing the inbound's raw settings JSON (#5715). The backend add/update paths already honored a submitted allowedIPs; only the form withheld it. Make the field editable (comma-separated, empty still auto-assigns) and validate submissions server-side: entries must parse as an IP or CIDR, bare addresses normalize to single-host prefixes, and an address already used by another peer on the inbound is rejected. Closes #5715
8dd3b31ee8 fix(node): show the activated first-use deadline on the Clients page With "start after first use" on a node inbound, the node activates the absolute deadline and the master adopts it into client_traffics via the sync CASE merge — but the client record (what the Clients page reads) was only refreshed by SyncInbound from the snapshot's settings JSON. A node whose JSON still carried the negative duration (stale conversion, older node build, or a mixed local+node attachment) kept rewriting the record back to "not started" even though the DB held the real deadline (#5714). Lift the activated deadline from client_traffics onto still-negative client records at the end of every node sync, after SyncInbound has run. Intentional resets back to delayed start are unaffected: editing a client also resets client_traffics to the negative duration, so the lift's expiry_time > 0 guard never matches. Closes #5714
e5b56c9444 fix(xray): reconcile client auto-disable through the API instead of a forced restart When a client expired or hit its traffic limit, XrayTrafficJob called RestartXray(true), stopping the whole process and dropping every live connection on every inbound (#5712 reported this as XHTTP on 443 dying) — even though disableInvalidClients had already removed the user from the running core over gRPC. The force restart existed only to re-sync the process's config snapshot. Switch the job to a non-forced restart and teach ComputeHotDiff to express a client-only inbound change as per-user AlterInbound operations for vless/vmess/trojan, so the reconcile is a no-op RemoveUser plus a snapshot update rather than a handler swap that would still blip that inbound's listener. Anything beyond the clients list still falls back to handler replacement or a full restart as before. Closes #5712
1153d5db8c fix(groups): keep group traffic totals stable across client resets and deletes ListGroups displays live_sum(client_traffics) minus the group's stored reset baseline, but only ResetGroupTraffic ever moved the baseline. Any client-level operation that zeroed or deleted traffic rows (single/bulk reset, client delete, removing a client's last inbound) shrank the live sum and silently subtracted that client's history from the group total. Shift the baseline down by the removed counters inside the same transaction, so group totals only change through group reset. Derived groups without a stored row get one with a negative baseline, which the existing clamp handles. Closes #5675
对比 10 次代码提交 »

11 小时之前

txlyre 从镜像同步了新的引用 dependabot/npm_and_yarn/frontend/react-router-dom-7.18.1 到 txlyre/3x-ui

11 小时之前

txlyre 从镜像同步了 dependabot/npm_and_yarn/frontend/i18next-26.3.4 分支的代码到 txlyre/3x-ui

ec9f7a3a04 chore(deps): bump i18next from 26.3.3 to 26.3.4 in /frontend Bumps [i18next](https://github.com/i18next/i18next) from 26.3.3 to 26.3.4. - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](https://github.com/i18next/i18next/compare/v26.3.3...v26.3.4) --- updated-dependencies: - dependency-name: i18next dependency-version: 26.3.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
64c306037f feat(wireguard): make client allowedIPs editable with validation The WireGuard peer address was allocated server-side and shown read-only in the client editor, so changing it required hand-editing the inbound's raw settings JSON (#5715). The backend add/update paths already honored a submitted allowedIPs; only the form withheld it. Make the field editable (comma-separated, empty still auto-assigns) and validate submissions server-side: entries must parse as an IP or CIDR, bare addresses normalize to single-host prefixes, and an address already used by another peer on the inbound is rejected. Closes #5715
8dd3b31ee8 fix(node): show the activated first-use deadline on the Clients page With "start after first use" on a node inbound, the node activates the absolute deadline and the master adopts it into client_traffics via the sync CASE merge — but the client record (what the Clients page reads) was only refreshed by SyncInbound from the snapshot's settings JSON. A node whose JSON still carried the negative duration (stale conversion, older node build, or a mixed local+node attachment) kept rewriting the record back to "not started" even though the DB held the real deadline (#5714). Lift the activated deadline from client_traffics onto still-negative client records at the end of every node sync, after SyncInbound has run. Intentional resets back to delayed start are unaffected: editing a client also resets client_traffics to the negative duration, so the lift's expiry_time > 0 guard never matches. Closes #5714
e5b56c9444 fix(xray): reconcile client auto-disable through the API instead of a forced restart When a client expired or hit its traffic limit, XrayTrafficJob called RestartXray(true), stopping the whole process and dropping every live connection on every inbound (#5712 reported this as XHTTP on 443 dying) — even though disableInvalidClients had already removed the user from the running core over gRPC. The force restart existed only to re-sync the process's config snapshot. Switch the job to a non-forced restart and teach ComputeHotDiff to express a client-only inbound change as per-user AlterInbound operations for vless/vmess/trojan, so the reconcile is a no-op RemoveUser plus a snapshot update rather than a handler swap that would still blip that inbound's listener. Anything beyond the clients list still falls back to handler replacement or a full restart as before. Closes #5712
1153d5db8c fix(groups): keep group traffic totals stable across client resets and deletes ListGroups displays live_sum(client_traffics) minus the group's stored reset baseline, but only ResetGroupTraffic ever moved the baseline. Any client-level operation that zeroed or deleted traffic rows (single/bulk reset, client delete, removing a client's last inbound) shrank the live sum and silently subtracted that client's history from the group total. Shift the baseline down by the removed counters inside the same transaction, so group totals only change through group reset. Derived groups without a stored row get one with a negative baseline, which the existing clamp handles. Closes #5675
对比 10 次代码提交 »

11 小时之前

txlyre 从镜像同步了新的引用 dependabot/npm_and_yarn/frontend/i18next-26.3.4 到 txlyre/3x-ui

11 小时之前