0.9.2

What's Changed

• refactor(runtime):_harden_sync_and_routing_boundaries by @Mtoly in #131
• Fix/panel startup rollback by @Mtoly in #132
• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 by @dependabot[bot] in #133
• build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in #117
• build(deps): bump github.com/redis/go-redis/v9 from 9.20.0 to 9.20.1 by @dependabot[bot] in #118
• build(deps): bump github.com/apernet/hysteria/extras/v2 from 2.9.3 to 2.10.0 by @dependabot[bot] in #134
• build(deps): bump github.com/sagernet/sing from 0.8.10 to 0.8.11 by @dependabot[bot] in #136
• build(deps): bump actions/attest-build-provenance from 3.0.0 to 4.1.1 by @dependabot[bot] in #144
• build(deps): bump github.com/eko/gocache/lib/v4 from 4.2.3 to 4.2.4 by @dependabot[bot] in #140
• build(deps): bump github.com/redis/go-redis/v9 from 9.20.1 to 9.21.0 by @dependabot[bot] in #139
• build(deps): bump github.com/apernet/hysteria/core/v2 from 2.9.3 to 2.10.0 by @dependabot[bot] in #138
• build(deps): bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #141
• build(deps): bump github/codeql-action/autobuild from 3.37.3 to 4.37.3 by @dependabot[bot] in #142
• build(deps): bump actions/checkout from 5 to 7 by @dependabot[bot] in #143
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #145
• build(deps): bump github.com/sagernet/sing-box from 1.13.12 to 1.13.15 by @dependabot[bot] in #146
• build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @dependabot[bot] in #135
• build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 by @dependabot[bot] in #147
• fix(deps): update x/crypto for SSH security fixes by @Mtoly in #177
• fix(acme): reject malformed account private keys safely by @Mtoly in #183
• fix(cert): isolate content certificates by runtime identity by @Mtoly in #185
• docs: clarify project identity and architecture entry points by @Mtoly in #184
• fix(deps): update Hysteria to v2.12.2 by @Mtoly in #187
• test(runtime): cover host task rollback contract by @Mtoly in #188
• test(runtime): cover detached cleanup context by @Mtoly in #189
• test(runtime): cover producer shutdown ordering by @Mtoly in #190
• test(runtime): cover lifecycle context propagation by @Mtoly in #191
• test(runtime): cover canceled task cleanup by @Mtoly in #192
• fix(runtime): detach rollback cleanup context by @Mtoly in #193
• fix(runtime): rollback when startup context cancels after start by @Mtoly in #194
• fix(runtime): reject canceled taskless startup context by @Mtoly in #195
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 by @dependabot[bot] in #186
• fix(deps): support sing-box v1.14.0 by @Mtoly in #196
• build(deps): bump golang.org/x/mod from 0.40.0 to 0.41.0 by @dependabot[bot] in #182
• build(deps): bump github.com/gogf/gf/v2 from 2.10.2 to 2.10.3 by @dependabot[bot] in #181
• build(deps): bump github.com/eko/gocache/store/redis/v4 from 4.2.6 to 4.2.9 by @dependabot[bot] in #180
• build(deps): bump golang.org/x/time from 0.15.0 to 0.16.0 by @dependabot[bot] in #179
• fix(core): migrate to Xray-core v26 APIs by @Mtoly in #206
• fix(core): preserve XHTTP settings with upstream extra by @Mtoly in #207
• ci(security): fail on all reachable vulnerabilities by @Mtoly in #208
• docs(security): bound historical vulnerability policy by @Mtoly in #209
• build(deps): bump github.com/eko/gocache/store/go_cache/v4 from 4.2.5 to 4.2.7 by @dependabot[bot] in #197
• build(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.2 by @dependabot[bot] in #199
• build(deps): bump github.com/sagernet/sing-tun from 0.9.0-beta.4 to 0.9.1 by @dependabot[bot] in #210
• build(deps): bump github.com/sagernet/sing from 0.9.0-beta.4 to 0.9.3 by @dependabot[bot] in #211
• ci(security): keep CodeQL actions on one version by @Mtoly in #212
• build(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 by @dependabot[bot] in #204
• build(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #202
• chore(release): prepare 0.9.2 by @Mtoly in #213
• ci(security): temporarily allow GO-2026-5288 by @Mtoly in #214
• fix(container): align builder with Go 1.27 by @Mtoly in #215
• fix(release): restore Android arm64 build by @Mtoly in #216
• feat(controller): support trusted X-Forwarded-For headers by @Mtoly in #217

Full Changelog: 0.9.1...0.9.2