Release v0.0.4 · nx-panel/node

Nexora Node v0.0.4

No panel update is needed. This release changes nothing the panel sends or reads, so it works with the same panel releases as v0.0.3.

A crash fix you should not skip. A crafted QUIC packet could crash the whole node when a routing rule sniffs traffic, such as the torrent-blocking preset. This release closes that hole, along with several other input-validation fixes: a size cap on HTTP transport requests, the gRPC frame length check, a Trojan multiplex memory leak, and a race in multi-user Shadowsocks.
Changing an outbound now updates everything that goes through it. Detours, selectors, URL tests and DNS servers that use an outbound are rebuilt when that outbound changes. Before, they kept using the old settings until the node restarted.
Removed inbounds really stop serving. Clients that were already connected kept working after their inbound was removed or the node stopped. This affected SSH, AnyTLS, and multiplexed VLESS, VMess, Trojan and Shadowsocks. Those clients are now cut off.
OpenConnect no longer hangs. Removing an OpenConnect endpoint, or stopping the node, while a client was connected could freeze the node.
Fewer leftovers after a failed update. When the panel pushes a configuration the node refuses, nothing from it keeps running in the background. A removed MASQUE (WARP) outbound also stops reconnecting to Cloudflare.
DNS changes apply in one go. Removing several DNS servers at once, where one depends on another, no longer makes the whole update fail.
UDP fixes for Hysteria, Hysteria 2 and TUIC packet fragmentation, and for packets with a zero UDP checksum.

Built compatible with sing-box 1.14.3. The node now keeps its own inbound, outbound, endpoint and DNS managers, so live changes keep working on the new engine.
The OpenVPN module is updated to v0.1.4.
Built with Go 1.27.2.