v3.0.2 #2112

0xJacky · 2026-11-11T13:53:41Z

0xJacky
Nov 11, 2026
Maintainer

The cluster node proxy checks the caller's authorization for every guarded route it forwards, including plugin management and changes to certificate deploy targets, blocklist sources and upstream discoveries (GHSA-9mj5-fhr8-59xw) by @0xJacky (27bfdd3f)
The node pairing upgrade and controller credential rotation endpoints can no longer be reached through the cluster proxy (GHSA-3m8v-354g-68qf) by @0xJacky (45820c34)
Read-only service tokens no longer receive the stored credentials of certificate deploy targets, blocklist sources and upstream discoveries from child nodes (GHSA-23gr-943q-cjh9) by @0xJacky (aea4cef5)
The cluster proxy refuses paths with . or .. segments, empty segments, backslashes or encoded separators with HTTP 400, and WebSocket connections are forwarded to exactly the path that was authorized (GHSA-2phx-h598-cv4x) by @0xJacky (136acaf8, 79fd40d4)
Requests are no longer forwarded to cluster nodes that have been disabled by @0xJacky (440bbca5)
DDNS public IP detection no longer fails on every fallback when one endpoint stalls, IPv6 detection only uses IPv6 connections, and endpoints reachable from mainland China are tried early by @0xJacky (dd88c5dc)
Auto backup tasks created before v2.4.3 with characters such as : in their name can be saved again by @RyoKusnadi (4e90fab9)
The Browser, OS and Device tables of the log dashboard show "Unknown" instead of a blank row for user agents that are not recognized by @0xJacky (21732a60)

集群节点代理会对转发的每个受保护路由校验调用者的权限，包括插件管理，以及对证书部署目标、黑名单来源和上游发现的修改（GHSA-9mj5-fhr8-59xw） by @0xJacky (27bfdd3f)
节点配对升级和控制端凭据轮换接口不再能通过集群代理访问（GHSA-3m8v-354g-68qf） by @0xJacky (45820c34)
只读服务令牌不再从子节点获取证书部署目标、黑名单来源和上游发现中保存的凭据（GHSA-23gr-943q-cjh9） by @0xJacky (aea4cef5)
集群代理会以 HTTP 400 拒绝包含 . 或 .. 段、空段、反斜杠或编码分隔符的路径，WebSocket 连接也只会转发到通过鉴权的那个路径（GHSA-2phx-h598-cv4x） by @0xJacky (136acaf8, 79fd40d4)
请求不再转发到已被禁用的集群节点 by @0xJacky (440bbca5)
DDNS 公网 IP 检测不会再因为某个接口卡住而让后续所有备用接口一起失败，IPv6 检测只走 IPv6 连接，并优先尝试中国大陆可访问的接口 by @0xJacky (dd88c5dc)
v2.4.3 之前创建、名称中含有 : 等字符的自动备份任务可以重新保存 by @RyoKusnadi (4e90fab9)
日志看板的浏览器、操作系统和设备表格对无法识别的 User-Agent 显示为“Unknown”，不再显示空白行 by @0xJacky (21732a60)

This discussion was created from the release v3.0.2.