v2026.10.6-1064547980-meso

v2026.10.6-1064547980-meso

This release brings meso-miner level with the 3.23-fix provider line and lands the whole H3 (QUIC) transport stack, all of it behind opt-in controls. This release also carries the live status and top rework staged since the last release, the capacity and observation work, and the set of correctness fixes found while porting them. full-bars/sn carries its own release on its own schedule.

Note

The new transport and capacity behaviour is off by default. H3 needs URNETWORK_H3=on, the DATAGRAM receive lane and the DATAGRAM send lane each need their own key, the OOM-aware start cap runs in shadow, and the smart dialer is off. The baseline recorder is on and only writes a small local file. A default provider changes in what it logs and records, and in the corrections listed below.

What's Changed

Added

• H3 (QUIC) beside H1 for the direct identity, behind URNETWORK_H3 (#159): the engine already carried a working H3 platform transport that Auto mode never launched. With URNETWORK_H3=on the direct (non-proxied) identity starts it beside H1. A proxied identity never does, because H3 opens a host UDP socket that would bypass the proxy. H3 is auxiliary: H1 stays the health signal, so an H3 connect failure reads as "mode unavailable", backs off quietly up to ten minutes, and is not counted as a backend failure or a proxy auth failure. The H3 socket's bytes count into the identity's total traffic. Costs one extra platform connection per box. No platform-side gain is proven.
• The H3 runtime gate and per-mode transport counters (#162): H3 can be switched on and off live with no restart, a persisted off beats URNETWORK_H3=on, and clearing the key hands the decision back to URNETWORK_H3. The provider now reports what each transport mode carries, and measures the H3 share against the direct identity's H1 rather than against every proxy. urnet-tools set h3 on|off, or URNETWORK_H3 as the startup default.
• The QUIC DATAGRAM receive lane (#162): a versioned bounded message layer with offer and accept negotiation, behind the h3_datagram control key. Receive side only and off by default. Everything the provider sends still goes on the reliable stream.
• The QUIC DATAGRAM send lane (#165): on an H3 connection where the server accepted DATAGRAM, a dispatcher chooses the lane per message. A frame that fits one datagram goes as a datagram, and anything larger goes to the reliable stream. The lane falls back to the stream when it is full, when a send errors, or when a blackhole guard trips. Behind urnet-tools set h3-datagram-send on|off, default off, read per message so it takes effect at once.
• The baseline transport series and its panels (#162): every baseline sample records which transport carried the traffic, and the DNS and DNS-pump modes count under their own names. Eight new Grafana panels chart the series.
• Transport rows in the Internals panel (#163): top shows what each transport mode carries, with the h3/all byte pair rendered in one unit. The rows appear only once the provider has reported a transport read, so a box with no H3 and no DNS modes draws exactly the panel it drew before.
• ReportId on the close contract (#154): each logical close report now carries a random 16-byte identifier. It is a backward and forward compatible proto3 optional field, so an older backend ignores it, and it gives the backend a durable dedup identity for retries and out-of-band reports. No client decodes it.
• A STUN success aggregate in the log (#153): a raw STUN binding probe per endpoint over IPv4 and IPv6, grouped by provider and aggregated as one line on an adaptive 1 or 5 minute interval. stun.cloudflare.com joins the ICE-gather endpoints. Log only; no NAT or ICE behaviour changed.
• Live traffic, runtime internals and a reworked top view (#131): the live status block separates billable from total traffic, so bytes that were not billable, a direct socket for instance, are visible instead of folded into one number. Session totals follow proxies being removed or respawning rather than jumping. top gains a zoomable graph, a runtime panel (goroutines, heap, descriptors), a theme and graph-style menu, and a layout that adapts to a small terminal. The provider answers three new light control-socket commands, traffic, internals and goroutines, so the 100ms poll no longer rebuilds a full snapshot, and an older provider is detected and falls back to the snapshot's own rates.
• A stated reason for the node's state (#131): starting and degraded now say why. The reasons are still resolving proxies, a source that could not be read, a source that returned nothing, or how many proxies are dead against how many are configured.
• An OOM-aware start cap, shadow by default, with a kill switch (#134): after a kernel OOM kill of this provider's own cgroup subtree since the previous start (same boot, higher oom_kill counter; a reboot is never blamed), the next start runs 80% of the peak running proxies instead of the load that just died. The cap never goes below the larger of 50 and a quarter of the desired pool, takes at most three reductions per 24 hours and then freezes, relaxes 10% at a start that comes a full clean day after the last change, and clears at the desired size. It never writes your proxy trim file; the tighter of the two caps applies. The default is shadow, which decides and logs and enforces nothing. urnet-tools set oom-cap on|off|shadow or URNETWORK_OOM_CAP switches it, any source saying off wins, and off forgets a standing cap so it cannot rebind when the switch goes back on.
• An action ledger and urnet-tools autopilot log [limit] (#134): every OOM-cap decision and every trim result is appended to ~/.urnetwork/autopilot.jsonl (time, actor, action, from, to, mode, reason; capped at 256 KiB, newest lines kept). autopilot log shows it as a timeline, marks shadow decisions [shadow], and prints the current oom-cap value. A provider that predates the ledger control command answers with an explanatory error.
• Trim commands leave a receipt in the log (#134): [proxy][trim] received: cap=N (was X); R running, D desired, applying once per change, an applied: result line even when nothing needed shedding, and received: cap cleared. These capacity lines also reach the important buffer and the disk event log, so they survive a reboot.
• A low memory headroom log and startup memory warnings (#134): host or cgroup available memory below the larger of 150 MiB and 10% of RAM, capped at 400 MiB, for two consecutive 30 second samples logs [proxy][resources] low memory headroom, and recovered once it sits clearly above the line again. At startup the provider warns when the finite GOMEMLIMIT is short for the heap the pool needs or the box is short for the whole-process footprint, flags a GOGC pinned under URNETWORK_PROFILE=auto, and logs one effective RAM ceiling line naming the limit in force. All advisory: the provider never changes these values.
• urnet-tools smart-dialer [status|on|off] (#133, #134): transport scoring carried a hardcoded 500 ms latency baseline that assumed what the network costs. With the smart dialer on, weights come from success ratio and error streak, then scale by measured connect cost relative to the fastest transport that works on this network, and serial attempts try measured-faster transports first. It never removes a transport, failures keep their authority, and below a sample floor the existing order stands. A background probe gives every transport connect-only attempts so the alternatives get measured, and a failed probe never demotes a transport with real successes. Off by default, live, persisted and re-applied at startup. With it off, scoring is exactly what it was.
• Billable and total traffic in the node snapshot (#136): the snapshot now carries session byte totals, the total-traffic rate and the persisted lifetime billable total next to the billable rate. Session totals accumulate the same per-tick deltas the rates use, so a proxy that is removed or respawns never adds or subtracts bytes.
• A built-in baseline recorder (#137, #138): every provider keeps a small local record of how it behaves in ~/.urnetwork/baseline.jsonl (1 MiB, newest whole lines kept), a start mark at launch and then one sample every 15 minutes. On by default with no setup, so an upgrade can be judged against what the box did before it. Counts and totals only, never proxy addresses, usernames or passwords, and a field that could not be measured is omitted rather than written as zero. urnet-tools baseline show|mark|compare; compare derives the rate from the lifetime counter's delta, excludes the post-start ramp from both sides, prints insufficient data for a short segment and warns when capacity changed. urnet-tools set baseline off stops recording at once and keeps ...

v2026.9.22-1052862940-meso

v2026.9.22-1052862940-meso

Note

This release is one release that carries the reliability batch originally tagged 09.21 together with a message-pool buffer fix, re-cut under a corrected version number. full-bars/sn ships the same combined release on the same tag.

This release fixes a memory leak in the provider connection path and ships the reliability work from the previous batch in one update: the audit ring survives a hotswap, and urnet-tools history tells the story of an update from start to finish.

What's Changed

Fixed

• Message-pool buffer leak on connect failure (#126): when the provider tries to reach an upstream peer and that connection fails, the pooled packet was released without returning its buffer to the pool. On any node where dials fail often, that pool grows without bound. The failure branch now returns the buffer exactly once, with a regression test.
• HotSwap reachable on installer-created units (#109): a unit with no Type= line now migrates to Type=notify, stale processes are declined up front, and urnet-tools is put on PATH by the installer and by update.
• Proxy credential rotation on re-paste (#107): pasting an address with different credentials rotates the running proxy instead of silently keeping the old ones; pool-leak call sites are named and test suites deflaked.
• Container-discovery ghost hardening, round 2 (#106): containerized providers no longer appear as host providers, and the state paths are read and written through descriptor-pinned handles.
• Interactive delegated subcommands wire stdin (#105): proxy remove-dead, remove, and trim now read your answer instead of timing out on piped runs.
• Docs fixed and CI retargeted (#102): stale links updated and the CI workflows point at this repository's own targets.

Added

• Audit ring survives hotswap (#118): the old process flushes its audit ring at the handover point, before the takeover message, on every path (systemd, Windows, Docker). The new process merges the ring from disk and deduplicates it, so the commands you issued right before an update are not lost.
• Lifecycle events in the audit trail (#118): urnet-tools history now shows process start (with the version), the hotswap handoff, and control-socket shutdown alongside the usual set and clear changes. After an update the stream shows the handoff: on the spawned-candidate path (systemd, Windows) the successor writes its start at boot and merges the parent's hotswap after takeover, so the order reads start then hotswap; the Docker execve successor stamps start after the takeover, so it reads hotswap then start. Both orders end with the upgrade complete.
• Sliding severity scale for provider status (#118): active at 90% or more of configured proxies live, partial at 70-89%, degraded at 50-69%, critical below 50% (including zero), with the exact percentage shown and clamped at 100.
• Bandwidth and heartbeat reporters ported (#103): the hub-lane reporters now ship on this lane, and the legacy PowerShell scripts are retired.
• HotSwap design proposal (#111): docs/design/hotswap-make-before-break.md plans a per-client handover that keeps every client connected. Proposal only, no code.
• Live node snapshot, restart reason and urnet-tools top (#114, #115): status gains a live block and --json snapshot output, restarts are explained via the restart reason metric, and urnet-tools top is a full-screen live view.
• Automated proxy audit and quality enforcement (#116): urnet-tools proxy audit on|off|status|release parks proxies that grade as proven junk; the status line reports parked and paused states.
• Control unitless providers (#119): lifecycle and settings commands work against bare or containerized providers, state-dir rows are deduplicated, and urnet-tools get reads one setting.
• File-backed proxy add and paste fixed (#113): comments and blank lines survive, lock-guarded deduplication, keyed credentials preserved.
• Security blocklist syncs (#108, #117): refreshed the content-filtering blocklist from upstream — a net reduction of about 6,400 IPv4 ranges and 32 IPv6 prefixes after upstream pruning. The shipped file is the sync-time upstream snapshot; upstream has since moved.

Maintenance

• Deterministic test suite (#124): the reload and health tests no longer depend on timing or shared state.
• Security blocklist sync (#125): refreshed the content-filtering blocklist to the current published ranges.
• Security blocklist syncs (#101, #104, #108): refreshed the content filtering blocklist three times.
• Parity completion (#94, #112): repository parity with the 3.23-fix release state, and release-prep groundwork for this release.

CI

• Ship-release hands off to the tag pipeline (#99, #100): the one-click ship release dispatches release.yml explicitly after the tag push, so the tag-triggered pipeline fires reliably.

Deploy Notes

1. Restart the provider to reclaim leaked memory. New connections protect themselves the moment the binary runs. The message-pool fix returns the buffer on the dial-failure path, so the pool stops growing on nodes where dials fail.
2. No unit changes. Provider runtime only; existing installs pick this up on the next urnet-tools update -f.
3. urnet-tools history shows more. Lifecycle entries are new; paging and the 1000-entry ring are unchanged.

Full Changelog: v2026.9.18-1049118720-meso...v2026.9.22-1052862940-meso

Security Scan (parallel, non-blocking)

---

VirusTotal Scan

The release artifacts were scanned with VirusTotal (70+ antivirus engines) during CI.

Result: PASS — every artifact is within 2 malicious detections.

Artifact	Status	Malicious	Suspicious	VT link
provider	PASS	1	0	report
provider	PASS	1	0	report
provider	PASS	0	0	report
provider	PASS	0	0	report
provider	PASS	0	0	report
provider	PASS	0	0	report
urnet-tools	PASS	0	0	report
urnet-tools	PASS	0	0	report
urnet-tools	PASS	0	0	report
urnet-tools	PASS	0	0	report
urnet-tools	PASS	1	0	report
urnet-tools	PASS	0	0	report
urnet-docker	PASS	1	0	report
urnet-docker	PASS	0	0	report
urnet-docker	PASS	0	0	report
urnet-docker	PASS	1	0	report
urnet-docker	PASS	1	0	report
urnet-docker	PASS	0	0	report

NOTE: 1 to 2 detections are the known machine-learning false-positive pattern on str...

v2026.9.18-1049118720-meso

v2026.9.18-1049118720-meso — 2026-09-18

Note

This release completes full parity with the urnetwork-3.23-fix fork. The provider runtime, the urnet-tools CLI, the CI pipeline, and the test suites now match the mature fork byte-for-byte, with the hub intentionally stripped. Nodes on v2026.9.9 or older should rebuild and redeploy to pick up the parity feature set.

1. The story of this release

meso-miner was a lean provider binary with a fraction of the fork's operational surface. Operators had no zero-downtime updates, no live metrics, no control socket, and a shakedown suite that exercised a fraction of what ships. This release closes the gap: the fork's entire provider runtime and operator tooling were ported, adapted to the v2026 connect API, and verified by the fork's own test suites and shakedown coverage.

2. Provider runtime parity (PR #92)

• Zero-downtime HotSwap: in-place binary handover with decline/engage state machine, metrics carried across the handover, and automatic self-heal of the install path.
• UNIX control socket (provider.sock): live overrides for settings like gomemlimit, report_url, report_interval, and the self-heal marker — no restart required.
• Prometheus /metrics endpoint: enabled by default on a free loopback port (9100-9103), zero new dependencies.
• Dynamic state overrides: ~/.urnetwork/node_name and control-socket state take precedence at startup and at runtime.
• Earnings-aware proxy prioritization: warm proxies launch first, high-earning URL proxies are promoted into the trusted group, with an exploration quota so unproven proxies are not starved.
• Startup log cleanup: phased startup with a Ready summary instead of a wall of text; idle log spam suppressed.
• Audit ring buffer: durable 1000-entry connection-lifecycle event log with atomic flush and checksum recovery.
• systemd Type=notify integration: the provider signals READY=1, enabling hotswap-capable updates on native installs.

3. urnet-tools CLI parity (PR #92)

New commands, matching the fork: config, hotswap, history, lifecycle, metrics on|off/listen/status, profile, proxy_ids, ramlogs, usage, dashboard, and the promtext lint helpers. update verifies restarts by PID, checks explicit digests on same-version updates, and restart verification now waits 60s.

4. Transfer and core engine parity (PR #93)

• Transfer flight tracking with lease management and forget-on-RTO congestion semantics.
• Selective-ack hole wake-up: acks leave in ascending sequence order and the compression wait ends early when a hole becomes provable — lossy routes recover faster with fewer duplicate retransmits.
• WebRTC data channel hardening and route-manager concurrency fixes.
• Prometheus gzip compression and stable metric sorting.

5. Tests, monitoring and docs (PR #94)

• All 26 fork test suites ported: hotswap, control socket, state overrides, proxy warmth, transfer flight, selective acks, connection metrics.
• The Prometheus/Grafana monitoring bundle ships in monitoring/ with pre-built fleet dashboards.
• README refreshed: fork-changes table, copy-pasteable quick start.

6. CI and shakedown parity (PR #96, #97)

• shakedown.sh and docker-shakedown.sh aligned with the current release state and extended with the fork's full Q-Z coverage: drop-in merge-order matrix, settings-survive-update, bare update leg, Type=notify READY/STATUS, hotswap decline/engage, pending_overrides.json failure injection, MemoryMax sweep, 5000-proxy stress, multi-provider-per-box.
• Dead hub test sections removed; branding and version guards moved to the meso tag shape.
• vt-scan.py gains the VT_JSON_FILE machine-readable export, and a JSON write failure now fails the scan instead of silently skipping WDSI staging.
• Docker images publish to GHCR only (ghcr.io/full-bars/meso-miner). The Docker Hub mirror leg never had credentials on this repo and failed every main push; nothing consumed the mirror. The build notification embed shows the correct pull command.

7. Also in this release

• JWT build mode autodetect: passing an auth code positionally (or URNETWORK_AUTH_CODE) selects jwt mode automatically; explicit BUILD= still wins.
• CFAA blocklist refreshes from upstream.
• Wiki provisioned and auto-synced from docs/ (17 pages + Home + sidebar).

Deploy Notes

1. Rebuild or docker pull ghcr.io/full-bars/meso-miner for the new image; native installs re-deploy the binary.
2. HotSwap engages without downtime once a node runs this release and the unit is Type=notify.
3. urnet-tools metrics on turns on the metrics endpoint without a restart.
4. The shakedown's hotswap decline/engage section (V) resolves its two required tags from the release list and skips until two distinct hotswap-capable meso tags exist — i.e. this release and the next one.

Full Changelog: v2026.9.9-1788916951-meso...v2026.9.18-1049118720-meso

v2026.9.9-1788917009-meso-hub

What's Changed

• sync: merge urnetwork-3.23-fix main (through 30.7 + #462) into meso-miner by @full-bars in #1
• sync(urnet-tools): port #472 deleted-binary recovery + #473 windows narrowToAccessible (full, hub retained) by @full-bars in #14
• sync(provider): port #471 persistent lifetime metrics (dev/hub) by @full-bars in #16
• sync(urnet-tools/provider/hub): bring dev/hub to 3.23-fix parity (hub retained) by @full-bars in #12
• sync: port #475 backlog gaps lifecycle refactor (dev/hub, full parity) by @full-bars in #18
• fix: port full parity from 3.23-fix to dev/hub lane by @full-bars in #37
• fix(urnet-tools): security audit remediation — dev/hub lane by @full-bars in #41
• docs(release): v3.23.0-fix.30.9 — release notes, changelog, fork changes, project structure (dev/hub) by @full-bars in #44
• chore: port 3.23-fix provider-core + security + features by @full-bars in #50
• docs: remove review-process references from source comments (dev/hub) by @full-bars in #54
• Port provider and urnet-tools parity fixes from urnetwork-3.23-fix (PRs 502, 514, 516, 517, 520, 521, 522) by @full-bars in #55
• chore(security): sync CFAA blocklist from upstream 86715ee6 by @full-bars in #58
• chore(security): sync CFAA blocklist from upstream fb888dc8 + add automated sync workflow by @full-bars in #64
• ci: fire repository_dispatch to trigger CFAA sync on upstream CFAA file changes by @full-bars in #66
• feat(dev/hub): port warm proxy priority and CLI parity (PRs #525 & #526) by @full-bars in #62
• chore(security): sync CFAA blocklist from upstream (dev/hub) by @full-bars in #68
• chore(security): sync CFAA blocklist from upstream (dev/hub port) by @full-bars in #71

Full Changelog: https://github.com/full-bars/meso-miner/commits/v2026.9.9-1788917009-meso-hub

v2026.9.9 — Full v30.9 parity, warm proxy prioritization, sn-status, security hardening

v2026.9.9 — 2026-09-09

Note

This release brings full parity with urnetwork-3.23-fix v30.9, adds warm proxy prioritization, the new sn-status command, direct IP toggle, and extensive security hardening. Rebuild and redeploy provider nodes to pick up SSRF fixes and the proxy startup optimization.

1. The story of this release

Since v2026.8.28, the fork has accumulated a significant body of work: security hardening across the transfer, network, and proxy subsystems; upstream parity through v30.9; and several new operator-facing features. The most impactful user-visible change is warm proxy prioritization — providers now start faster by connecting to known-good client ID proxies first, instead of treating all proxies equally during startup.

This release also brings the sn-status command for inspecting SN (Service Node) status, a direct IP runtime toggle for quick connectivity debugging, and a proxy paste command for interactive proxy list normalization. Behind the scenes, SSRF guards have been hardened, the memory pool uses saturating counters, and the transfer contract system settles dropped items before closing them.

2. Warm proxy prioritization at startup (PR #526)

• Providers now classify proxies by warmth: warm (recently connected client ID proxies) get priority at startup.
• Accelerated stagger for warm proxies — they connect first, giving the provider a working identity before cold proxies ramp up.
• This is the single biggest startup-time improvement for providers with large proxy lists.

3. sn-status command (from v30.9 parity)

• New provider sn-status [--json] command for inspecting Service Node status.
• JSON output mode for automated tooling and monitoring integration.

4. Direct IP toggle

• Runtime direct IP toggle with CLI commands — operators can enable/disable direct IP connectivity without restarting the provider.
• Reload wiring so the change takes effect immediately.

5. Proxy paste command

• proxy paste for interactive and piped proxy list normalization.
• Accepts proxy lists from clipboard or stdin, normalizes and deduplicates.

6. Usage history

• Ported the urnet-tools usage feature — providers track and display bandwidth usage history with day/month graphs.

7. Security hardening

• SSRF guard bypass fixed: hostname dial targets no longer bypass the SSRF protection.
• Proxy-source URL fetches hardened: all proxy source URLs are validated against SSRF before fetching.
• Paste signal handler: registered before writing plaintext credentials to disk.
• Transfer contract settlement: dropped-item contracts are settled before closing on sequence exit.
• Memory pool: saturating counter replaces single-bit counter for refused-share forgiveness.
• Subprocess sandboxing: all discovery and systemctl calls bounded (5s/10s), preventing hung processes from wedging the tool.

8. Review findings remediation

• Linger guard, auto-update off error, session archive bound, rename parent dir sync, hot-restart help.
• Self-heal status works without provider discovery.
• FHS PATH defaults validated, retention events flushed on exit, hot path no longer blocked on drop.

9. CFAA blocklist sync

• Automated CFAA blocklist sync with upstream — IPv4 and IPv6 prefixes refreshed on a cron schedule (04:00/16:00 UTC).

10. What's Changed

• feat(provider): port warm proxy prioritization (PR #526) — accelerated stagger for client ID proxies
• feat(provider): sn-status command (v30.9 parity)
• feat(provider): direct IP runtime toggle and CLI commands
• feat(provider): proxy paste command for interactive proxy list normalization
• feat(usage): port urnet-tools usage feature and provider usage history
• feat(provider): choose_network main|beta presets
• feat(jwt): log human-readable transfer stats on refresh verification
• fix(security): resolve SSRF guard bypass for hostname dial targets
• fix(security): harden proxy-source URL fetches against SSRF
• fix(provider): register paste signal handler before writing credentials to disk
• fix(provider): parse connect URL for benchmark endpoint
• fix(provider): validate FHS PATH defaults, flush retention events on exit
• fix(provider): publish startup direct goroutine's done channel to reloader
• fix(transfer): settle dropped-item contracts before closing on sequence exit
• fix(message_pool): saturating counter for refused-share forgiveness
• fix(urnettools): pass UTC now to usage graph truncate closures
• fix(urnettools): chown direct-toggle dir/file to state dir owner
• fix(urnettools): sum every post-restart segment in bucket
• fix(urnettools): stop dropping flags after usage graph subcommand token
• fix(urnettools): security audit remediation — subprocess sandboxing, session auth, drop-in safety
• fix(provider): register paste signal handler before writing credentials
• fix(test): release dnsCache.mu on t.Fatal in DNS cache prune tests
• parity: port urnetwork-3.23-fix v30.9 to meso-miner main (PR #72) and dev/hub (PR #73)
• chore(security): automated CFAA blocklist sync with upstream
• docs: remove review-process references from source comments

11. Deploy notes

Important

• Rebuild and redeploy provider nodes. The SSRF fixes and warm proxy prioritization only activate after nodes run this build.
• Providers with large proxy lists will see the biggest startup improvement from warm proxy prioritization.
• Docker images: re-pull :latest to pick up all fixes.
• Update urnet-tools and urnet-docker for the new commands (sn-status, proxy paste, direct IP toggle).

Full changelog: https://github.com/full-bars/meso-miner/commits/main

What's Changed

• doh: port upstream production-grade DoH optimizations + provider integration by @full-bars in #34
• fix(provider): port PR #494 — client JWT hot-restart renew-on-expiry + snapshot/backup by @full-bars in #35
• fix(provider): port remaining parity + remove unreliable outage watcher by @full-bars in #36
• fix(urnet-tools): security audit remediation — subprocess sandboxing, session auth, drop-in safety, port range, state ownership by @full-bars in #40
• fix(urnet-tools): address code review findings — linger guard, auto-update off error, session archive bound, rename parent dir sync, hot-restart help by @full-bars in #42
• docs(release): v2026.8.30 — release notes, changelog, fork changes, project structure (meso-main) by @full-bars in #43
• chore: port 3.23-fix provider-core + security fixes by @full-bars in #49
• chore(security): sync CFAA blocklist from upstream by @full-bars in #45
• feat(provider): add choose_network main|beta presets (complete parity port) by @full-bars in #51
• docs: clean up source code comments for clarity and consistency by @full-bars in #52
• docs: remove review-process references from source comments by @full-bars in #53
• Port usage feature, proxy-paste, and review-finding parity fixes from urnetwork-3.23-fix (PRs 507, 502, 514-517, 520-522) by @full-bars in #56
• chore(security): sync CFAA blocklist from upstream 86715ee6 by @full-bars in #57
• chore(security): sync CFAA blocklist from upstream fb888dc8 + add automated sync workflow by @full-bars in #63
• ci: fire repository_dispatch to trigger CFAA sync on upstream CFAA file changes by @full-bars in #65
• feat: port warm proxy priority and CLI parity (PRs #525 & #526) by @full-bars in #61
• chore(security): sync CFAA blocklist from upstream by @github-actions[bot] in #67
• chore(security): sync CFAA blocklist from upstream by @github-actions[bot] in #69
• fix(ci): add dev/hub branch to CFAA blocklist sync workflow by @full-bars in #70

New Contributors

• @github-actions[bot] made their first contribution in #67

Full Changelog: v2026.8.28-1031582360-meso...v2026.9.9-1788916951-meso

Security Scan (parallel, non-blocking)

---

VirusTotal Scan

The release artifacts were scanned with VirusTotal (70+ antivirus engines) during CI.

Result: PASS — every artifact is within 2 malicious detections.

Artifact	Status	Malicious	Suspicious	VT link
provider	PASS	1	0	report
provider	PASS	1	0	report
provider	PASS	0	0	report
provider	PASS	0	0	report
provider	PASS	1	0	report
provider	PASS	1	0	report

NOTE: 1 to 2 detections are the known machine-learning false-positive pattern on stripped Go binaries (PASS). 3 to 10 detections ...

v2026.8.28-1031582360-meso

v2026.8.28 — 2026-08-28

Note

This release fixes the infinite proxy retry loop that wasted resources on dead proxies, hardens Docker
self-update to fetch from this fork, and adds Pelican game-server panel egg support. Rebuild and
redeploy provider nodes to pick up the slow-retry cap and Docker fixes.

1. The story of this release

A provider's paid proxies are its livelihood. Before this release, a proxy that failed to authenticate
would retry every 15 minutes forever — no ceiling, no backoff, no drop. One box had 356 proxies stuck
for 16 days, each making 1500+ auth attempts. On restart, all 356 would fire 10 fast auth calls each
before any throttling kicked in — 3,560 unthrottled requests hitting the API simultaneously.

This release closes that gap. Dead proxies are now dropped after 14 days of continuous failure. The
retry loop backs off from 5m/10m/15m ramp to a flat 24h daily cadence. State persists across reboots,
and the restart storm is eliminated by consulting persisted state before entering the fast-retry phase.

Separately, Docker self-update scripts were fetching from upstream urnetwork instead of this fork —
silently replacing the fork binary with vanilla upstream. And the Pelican game-server panel now has
a one-click egg for deploying the hardened provider image.

2. Proxy slow-retry cap: 24h daily gate + 14-day drop

• Operator-curated proxies (file/internal) that exhaust maxAuthFailures enter a slow retry loop.
• Before: 15min retry forever, no ceiling. 356 proxies × 1500+ attempts = thousands of wasted goroutines.
• After: 5m/10m/15m ramp (3 attempts), then 24h daily retry. Proxy dropped after 14 days continuous failure.
• State persisted to ~/.urnetwork/proxy-slow-retry.json — survives reboots.
• Restart storm guard: consults LastAttemptAt at goroutine start, skips fast-retry phase.
• Thundering-herd semaphore: max 4 concurrent slow-retry auth attempts.
• Dropped proxies cleaned from proxyCancelMap — proxy refresh can now relaunch them.
• Corrupt-state recovery (meso-only, not in 3.23-fix): proxy_slow_retry.go now returns fresh state on JSON unmarshal failure instead of returning partially-parsed state that could cause undefined behavior.

3. Docker self-update fetches fork releases

• start_nightly.sh and start_update.sh now fetch from full-bars/meso-miner releases.
• Before: Containers running BUILD=nightly silently replaced the fork binary with upstream vanilla.
• Digest verification: downloaded binaries are checked against expected SHA256 before swap.
• urnet-tools.sh symlink fallback to /app for Pelican egg compatibility.

4. Pelican game-server panel egg

• pelican/egg-urnetwork-323fix.json: PLCN_v3 egg for one-click import into Pelican panel.
• BUILD (stable/nightly/jwt) user-editable; PASSWORD and AUTHCODE admin-only.
• PELICAN=yes pins security defaults (vnStat off, IP checker off) — non-editable in egg.
• Runtime self-update disabled under PELICAN=yes — the published image is the single source of truth.
• Deployment guide in docs/Docker-Deployment.md (Pelican Panel section).

5. CFAA blocklist sync

• IPv4 blocked prefixes refreshed: 42779 → 44882 (+2103).
• IPv6 blocked prefixes refreshed: 537 → 580 (+43).
• Data-only change — ships with normal release cycle.

6. urnet-tools update verification hardening

• PID tracking: captures old PIDs before SIGTERM, waits for specific PIDs — prevents accidental SIGKILL of new process.
• Fixed-string grep: ramlog version check uses grep -aF to avoid regex dot-matching.
• Version flag consistency: -v instead of --version, matching rest of script.
• Trap cleanup: temp files cleaned on all exit paths.

7. What's Changed

• feat(pelican): Pelican panel egg with PELICAN-gated runtime updates by @full-bars in #21
• fix(urnet-tools): harden update verification — PID tracking, ramlog check, trap cleanup by @full-bars in #23
• fix(provider): cap slow-retry at 14 days, drop dead proxies from active pool by @full-bars in #24
• v30.8: release notes, docs updates, Pelican egg proxy support by @full-bars in #25
• fix(provider): corrupt-state bug — return fresh state on Unmarshal failure by @full-bars in #26
• docs: fix wrong env var defaults, eviction threshold by @full-bars in #27
• fix(docker): self-update must fetch THIS fork's releases, with digest verification by @full-bars in #28
• fix(provider): parity — timer leak fix, log wording, drop-clock comment by @full-bars in #29
• fix(docker): urnet-tools function names must match update_verify.sh exports by @full-bars in #30

Full changelog: https://github.com/full-bars/meso-miner/commits/main

8. Deploy notes

Important

• Rebuild and redeploy provider nodes. The slow-retry cap and restart storm guard only activate after nodes run this build.
• Update urnet-tools and urnet-docker for the update verification hardening.
• Fleet nodes on v30.5 with stuck proxies (amd2: 47 proxies, chi: 356 proxies) will benefit immediately — dead proxies will be dropped after 14 days instead of retrying forever.
• Docker images: re-pull :latest to pick up the self-update fix and Pelican egg support.

Security Scan (parallel, non-blocking)

---

VirusTotal Scan

The release artifacts were scanned with VirusTotal (70+ antivirus engines) during CI.

Result: PASS — every artifact is within 2 malicious detections.

Artifact	Status	Malicious	Suspicious	VT link
provider	PASS	0	0	report
provider	PASS	1	0	report
provider	PASS	0	0	report
provider	PASS	0	0	report
provider	PASS	1	0	report
provider	PASS	1	0	report

NOTE: 1 to 2 detections are the known machine-learning false-positive pattern on stripped Go binaries (PASS). 3 to 10 detections ship as REVIEW and should be checked. More than 10 detections blocks the release.

Wacatac.C!ml (Microsoft Defender) on these binaries is a confirmed false positive: Microsoft analyst review reversed the hub (2026-08-14) and the provider submission is in progress. Keep the detection visible in the tally — a future real hit would still appear. Do not suppress it.

_{Scan run: 33219103865.}

v2026.8.28-1031544720-meso

v2026.8.28 — 2026-08-28

Note

This release fixes the infinite proxy retry loop that wasted resources on dead proxies, hardens Docker
self-update to fetch from this fork, and adds Pelican game-server panel egg support. Rebuild and
redeploy provider nodes to pick up the slow-retry cap and Docker fixes.

1. The story of this release

A provider's paid proxies are its livelihood. Before this release, a proxy that failed to authenticate
would retry every 15 minutes forever — no ceiling, no backoff, no drop. One box had 356 proxies stuck
for 16 days, each making 1500+ auth attempts. On restart, all 356 would fire 10 fast auth calls each
before any throttling kicked in — 3,560 unthrottled requests hitting the API simultaneously.

This release closes that gap. Dead proxies are now dropped after 14 days of continuous failure. The
retry loop backs off from 5m/10m/15m ramp to a flat 24h daily cadence. State persists across reboots,
and the restart storm is eliminated by consulting persisted state before entering the fast-retry phase.

Separately, Docker self-update scripts were fetching from upstream urnetwork instead of this fork —
silently replacing the fork binary with vanilla upstream. And the Pelican game-server panel now has
a one-click egg for deploying the hardened provider image.

2. Proxy slow-retry cap: 24h daily gate + 14-day drop

• Operator-curated proxies (file/internal) that exhaust maxAuthFailures enter a slow retry loop.
• Before: 15min retry forever, no ceiling. 356 proxies × 1500+ attempts = thousands of wasted goroutines.
• After: 5m/10m/15m ramp (3 attempts), then 24h daily retry. Proxy dropped after 14 days continuous failure.
• State persisted to ~/.urnetwork/proxy-slow-retry.json — survives reboots.
• Restart storm guard: consults LastAttemptAt at goroutine start, skips fast-retry phase.
• Thundering-herd semaphore: max 4 concurrent slow-retry auth attempts.
• Dropped proxies cleaned from proxyCancelMap — proxy refresh can now relaunch them.
• Corrupt-state recovery (meso-only, not in 3.23-fix): proxy_slow_retry.go now returns fresh state on JSON unmarshal failure instead of returning partially-parsed state that could cause undefined behavior.

3. Docker self-update fetches fork releases

• start_nightly.sh and start_update.sh now fetch from full-bars/meso-miner releases.
• Before: Containers running BUILD=nightly silently replaced the fork binary with upstream vanilla.
• Digest verification: downloaded binaries are checked against expected SHA256 before swap.
• urnet-tools.sh symlink fallback to /app for Pelican egg compatibility.

4. Pelican game-server panel egg

• pelican/egg-urnetwork-323fix.json: PLCN_v3 egg for one-click import into Pelican panel.
• BUILD (stable/nightly/jwt) user-editable; PASSWORD and AUTHCODE admin-only.
• PELICAN=yes pins security defaults (vnStat off, IP checker off) — non-editable in egg.
• Runtime self-update disabled under PELICAN=yes — the published image is the single source of truth.
• Deployment guide in docs/Docker-Deployment.md (Pelican Panel section).

5. CFAA blocklist sync

• IPv4 blocked prefixes refreshed: 42779 → 44882 (+2103).
• IPv6 blocked prefixes refreshed: 537 → 580 (+43).
• Data-only change — ships with normal release cycle.

6. urnet-tools update verification hardening

• PID tracking: captures old PIDs before SIGTERM, waits for specific PIDs — prevents accidental SIGKILL of new process.
• Fixed-string grep: ramlog version check uses grep -aF to avoid regex dot-matching.
• Version flag consistency: -v instead of --version, matching rest of script.
• Trap cleanup: temp files cleaned on all exit paths.

7. What's Changed

• feat(pelican): Pelican panel egg with PELICAN-gated runtime updates by @full-bars in #21
• fix(urnet-tools): harden update verification — PID tracking, ramlog check, trap cleanup by @full-bars in #23
• fix(provider): cap slow-retry at 14 days, drop dead proxies from active pool by @full-bars in #24
• v30.8: release notes, docs updates, Pelican egg proxy support by @full-bars in #25
• fix(provider): corrupt-state bug — return fresh state on Unmarshal failure by @full-bars in #26
• docs: fix wrong env var defaults, eviction threshold by @full-bars in #27
• fix(docker): self-update must fetch THIS fork's releases, with digest verification by @full-bars in #28
• fix(provider): parity — timer leak fix, log wording, drop-clock comment by @full-bars in #29
• fix(docker): urnet-tools function names must match update_verify.sh exports by @full-bars in #30

Full changelog: https://github.com/full-bars/meso-miner/commits/main

8. Deploy notes

Important

• Rebuild and redeploy provider nodes. The slow-retry cap and restart storm guard only activate after nodes run this build.
• Update urnet-tools and urnet-docker for the update verification hardening.
• Fleet nodes on v30.5 with stuck proxies (amd2: 47 proxies, chi: 356 proxies) will benefit immediately — dead proxies will be dropped after 14 days instead of retrying forever.
• Docker images: re-pull :latest to pick up the self-update fix and Pelican egg support.

Security Scan (parallel, non-blocking)

---

VirusTotal Scan

The release artifacts were scanned with VirusTotal (70+ antivirus engines) during CI.

Result: PASS — every artifact is within 2 malicious detections.

Artifacts marked UNKNOWN were not fully scanned (VirusTotal upload, lookup, or analysis timed out). Rescan them before relying on a clear verdict.

Artifact	Status	Malicious	Suspicious	VT link
provider	UNKNOWN	n/a	n/a	report
provider	PASS	1	0	report
provider	PASS	0	0	report
provider	PASS	0	0	report
provider	PASS	0	0	report
provider	PASS	2	0	report
urnet-tools	PASS	1	0	report
urnet-tools	PASS	1	0	report
urnet-tools	PASS	0	0	report
urnet-tools	PASS	0	0	report
urnet-tools	PASS	0	0	report
urnet-tools	PASS	0	0	report
urnet-docker	PASS	1	0	report
urnet-docker	PASS	0	0	report
urnet-docker	PASS	0	0	report
urnet-docker	PASS	0	0	report
urnet-docker	PASS	2	0	report
urnet-docker	PASS	1	0	report

NOTE: 1 to 2 detections are the known machine-learning false-positive pattern on stripped Go binaries (PASS). 3 to 10 detections ship as REVIEW and should be checked. More than 10 detections blocks the release.

Wacatac.C!ml (Microsoft Defender) on these binaries is a confirmed false positive: Microsoft analyst review reversed the hub (2026-08-14) and the provider submission is in progress. Keep the detection visible in the tally — a future real hit would still appear. Do not suppress it.

_{Scan run: 33215049128.}