Xray-core v26.8.26-0855

Highlights

• Online-presence accounting behind trusted HTTP frontends now records the effective client address selected by sockopt.trustedXForwardedFor, instead of always preferring the accepted PROXY peer.

Fork fixes

• Fixed presence identity for CDN/fronted inbounds that combine accepted PROXY protocol with a configured trusted X-Forwarded-For source. The trusted effective address now wins when usable.
• Preserved the previous fail-closed provenance behavior: inbounds without trustedXForwardedFor are unchanged, and an unusable effective address falls back to the accepted PROXY source.
• Clarified the trusted-XFF stream configuration helper naming after review.

Upstream changes

• No new upstream merge was required for this release. upstream/main at f124daf5 is already contained in the release commit.

Compatibility notes

• The behavior change applies only when sockopt.trustedXForwardedFor is explicitly configured.
• REALITY client-version bounds remain operator-configurable with no implicit minimum.
• The maintained mux implementation remains the in-tree SMUX stack under common/singmux.

Validation

• Version identity test and CLI version output for 26.8.26-0855.
• Affected presence/provenance package tests, race detector, and vet.
• Generated protobuf header consistency check.
• Static Linux/amd64 GOAMD64=v1 release build with Go 1.27.0 and embedded version verification.
• GitHub Tests and Checkings and Pre-release Validation candidate workflows.