Merge pull request #69 from SubBoost/ryan/dev

release: SubBoost v2.7.0

Author: Ryson-32

docs/release-notes.md

@@ -1,43 +1,57 @@
-# SubBoost v2.6.0
+# SubBoost v2.7.0
 
 ## 中文
 
 ### 更新重点
 
-SubBoost v2.6.0 改进了高级代理组的成员管理，并增强多种订阅格式和 ECH 参数的兼容性。自部署备份流程也更加可靠。建议 v2.5.1 用户升级。
+SubBoost v2.7.0 新增代理组监听端口和自动节点处理，并加强自部署环境的订阅导入安全、首次初始化、定时任务、更新回滚与备份可靠性。本版本也改进了多处界面交互、可访问性和订阅配置兼容性。
 
 ### 主要变化
 
-- 高级代理组现在可以一键添加或移除全部节点、全部代理组，并可恢复默认成员；批量添加代理组时会自动跳过可能形成循环引用的项目。
-- 代理组成员区域会分别显示节点数和代理组数，代理组卡片的节点统计只计算真实节点，不再把 `DIRECT`、`REJECT` 或其它代理组引用计入节点数量。
-- 改进 Clash/Mihomo YAML 导入兼容性，可识别以单行对象列表书写的节点配置，并容忍这类列表中常见的缩进不一致。
-- 修复 VMess、VLESS、Trojan 和 AnyTLS 分享链接中的 ECH 查询服务器名称在转换时丢失的问题。
-- 自部署备份现在会在数据库导出失败时安全终止，不再把不完整文件当作成功备份；备份保留数量可通过 `SUBBOOST_BACKUP_RETENTION_COUNT` 调整，默认仍保留 10 份。
+- 代理组现在可以绑定独立的 mixed 监听端口，让接入该端口的流量固定通过指定代理组。默认只允许本机访问；允许局域网访问时，请务必使用防火墙阻止公网连接。
+- 新增自动节点处理，可通过节点名称正则表达式排除不需要的节点。关闭后会恢复原有节点和相关配置，不会永久删除选择。
+- 自部署管理员可以显式允许受信任的本机或局域网订阅源；默认仍会阻止本机、私有和保留地址，并继续检查重定向、响应大小和危险 URL。
+- 加强首次管理员初始化、登录限流、请求大小限制和定时任务互斥，降低未授权初始化、暴力尝试和重复任务带来的风险。
+- v2.7.0 会安装新的事务式更新器；从后续更新开始，它会先准备并验证回滚备份，候选版本失败时恢复旧镜像、配置和数据库。数据库备份失败时也不会再留下看似成功的不完整备份。
+- 修复更新后启动定时任务可能重新创建应用容器、导致短暂连接重置的问题。
+- 改进表单、弹窗、开关、密码输入、图标按钮和窄屏布局，并修复来源编辑、高级模式和代理组交互中的多处不一致。
+- 加强订阅解析、规则配置、导入错误和旧配置读取兼容性，同时更新存在安全公告的运行时依赖。
+- amd64 与 arm64 镜像现在使用原生构建环境，减少 QEMU 构建导致的偶发非法指令和长时间卡住。
 
 ### 升级说明
 
-- 建议升级前备份 `/opt/subboost/.env` 和数据库，方便需要时回滚。
-- 现有 v2.5.1 自部署实例可以继续使用 `subboost update` 更新。
-- 本次升级不要求手动迁移数据库，也不要求新增环境变量；只有需要修改默认备份保留数量时，才需要设置 `SUBBOOST_BACKUP_RETENTION_COUNT`。
-- 现有订阅、模板、规则和高级代理组配置保持兼容，不会因为升级自动改写成员选择。
+- 升级前仍建议备份 `/opt/subboost/.env` 和数据库。
+- 数据库变更是增量 migration，正常升级不需要手工运行 SQL，migration 会在启动时自动执行。
+- 官方 v2.6.0 一键安装即使还没有 `LOCAL_SETUP_TOKEN`，也可以通过 v2.7.0 Compose 配置完成第一跳；首次管理员初始化在令牌缺失时仍会拒绝执行。
+- 从 v2.6.0 发起的这一跳仍由旧更新器执行，因此本次升级本身还没有新版的事务式回滚保护。升级前请务必单独备份 `/opt/subboost/.env` 和数据库；安装 v2.7.0 后的后续更新才使用新的保护流程。
+- 完全手工维护 Docker Compose 的用户：全新初始化前必须在 `.env` 中设置高熵的 `LOCAL_SETUP_TOKEN`。已经初始化的旧实例即使暂时缺少它也能启动和正常登录，但在补齐令牌前不能再次执行首次管理员初始化。
+- 自动节点处理、内网订阅源和代理组监听端口默认都不会自动开启，现有订阅、模板、规则和代理组配置不会被升级过程主动改写。
+- 代理组监听端口若允许局域网访问，将成为没有账号密码的局域网代理入口；请只在可信网络使用，并确认公网防火墙未开放对应端口。
 
 ## English
 
 ### Highlights
 
-SubBoost v2.6.0 improves member management for advanced proxy groups and expands compatibility with several subscription formats and ECH parameters. It also makes self-hosted backups more reliable. Users on v2.5.1 are encouraged to upgrade.
+SubBoost v2.7.0 adds per-group listener ports and automatic node processing, while strengthening subscription-import security, first-time setup, scheduled jobs, update rollback, and backup reliability for self-hosted installations. It also improves interface consistency, accessibility, and subscription configuration compatibility.
 
 ### Main Changes
 
-- Advanced proxy groups can now add or remove all nodes or all proxy groups in one action, and restore their default members. Bulk proxy-group additions automatically skip entries that could create circular references.
-- Proxy-group member sections now show separate node and proxy-group counts. Node totals on proxy-group cards count real nodes only, excluding `DIRECT`, `REJECT`, and references to other proxy groups.
-- Improved Clash/Mihomo YAML import compatibility for node configurations written as lists of single-line objects, including common indentation inconsistencies in those lists.
-- Fixed ECH query server names being lost when converting VMess, VLESS, Trojan, and AnyTLS share links.
-- Self-hosted backups now stop safely when the database export fails instead of treating an incomplete file as a successful backup. Backup retention can be adjusted with `SUBBOOST_BACKUP_RETENTION_COUNT`, while the default remains 10 backups.
+- Proxy groups can now bind a dedicated mixed listener port, routing traffic received on that port through the selected group. Listeners are local-only by default; if LAN access is enabled, use a firewall to prevent public Internet access.
+- Added automatic node processing with regular expressions that exclude unwanted node names. Disabling the feature restores the original nodes and related configuration instead of permanently deleting selections.
+- Self-hosted administrators can explicitly allow trusted local or LAN subscription sources. Local, private, and reserved addresses remain blocked by default, with redirect, response-size, and unsafe-URL checks still enforced.
+- Strengthened first-administrator setup, login throttling, request-size limits, and scheduled-job locking to reduce unauthorized setup, brute-force attempts, and overlapping jobs.
+- v2.7.0 installs a new transactional updater. Starting with subsequent updates, it prepares and verifies a rollback backup before activation, then restores the previous image, configuration, and database if the candidate fails. Failed database exports are no longer left behind as apparently successful backups.
+- Fixed a case where starting scheduled jobs after an update could recreate the application container and briefly reset connections.
+- Improved forms, dialogs, switches, password fields, icon buttons, and narrow-screen layouts, while fixing inconsistencies in source editing, advanced mode, and proxy-group interactions.
+- Improved subscription parsing, rule configuration, import errors, and compatibility with older saved configurations, and updated runtime dependencies affected by security advisories.
+- amd64 and arm64 images now use native build environments, reducing intermittent illegal-instruction failures and long stalls associated with QEMU builds.
 
 ### Upgrade Notes
 
-- Back up `/opt/subboost/.env` and the database before upgrading so rollback is easier if needed.
-- Existing v2.5.1 self-hosted installations can continue to update with `subboost update`.
-- This upgrade does not require a manual database migration or a new environment variable. Set `SUBBOOST_BACKUP_RETENTION_COUNT` only if you want to change the default backup retention count.
-- Existing subscriptions, templates, rules, and advanced proxy-group configurations remain compatible, and upgrading does not automatically rewrite member selections.
+- Back up `/opt/subboost/.env` and the database before upgrading.
+- Database changes use additive migrations. Normal upgrades do not require manually running SQL, and migrations run automatically during startup.
+- An official v2.6.0 one-click installation without `LOCAL_SETUP_TOKEN` can pass the v2.7.0 Compose configuration and complete the first hop. First-administrator setup still fails closed while the token is absent.
+- The v2.6.0-to-v2.7.0 hop still runs through the old updater, so that upgrade itself does not yet have the new transactional rollback protection. Back up `/opt/subboost/.env` and the database separately before upgrading. Subsequent updates after v2.7.0 is installed use the new protected flow.
+- For manually maintained Docker Compose deployments, set a high-entropy `LOCAL_SETUP_TOKEN` in `.env` before a fresh setup. An already-initialized legacy instance can still boot and use normal login without it, but first-administrator setup remains unavailable until the token is configured.
+- Automatic node processing, local-network subscription sources, and per-group listener ports remain disabled until explicitly enabled. Existing subscriptions, templates, rules, and proxy-group settings are not automatically rewritten during the upgrade.
+- Enabling LAN access for a proxy-group listener creates a LAN proxy port without a username or password. Use it only on a trusted network and make sure the corresponding port is not exposed through the public firewall.

local/docker-compose.image.yml

@@ -27,7 +27,7 @@ services:
       ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY}
       JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET}
       CRON_SECRET: ${CRON_SECRET:?set CRON_SECRET}
-      LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?set LOCAL_SETUP_TOKEN}
+      LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:-}
       TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
       APP_URL: ${APP_URL:-http://localhost:3000}
 

local/docker-compose.yml

@@ -34,7 +34,7 @@ services:
       ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY}
       JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET}
       CRON_SECRET: ${CRON_SECRET:?set CRON_SECRET}
-      LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?set LOCAL_SETUP_TOKEN}
+      LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:-}
       TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
       APP_URL: ${APP_URL:-http://localhost:3000}
       APP_RELEASE_VERSION: ${APP_RELEASE_VERSION:-}

local/scripts/selfhost-lifecycle-shell.test.ts

@@ -138,10 +138,19 @@ describe("self-host update rollback lifecycle", () => {
     expect(installer).not.toContain("?setup-token=");
   });
 
+  it("allows the legacy v2.6.0 environment through first-hop Compose interpolation", () => {
+    // The v2.6.0 updater evaluates the candidate Compose file before the
+    // candidate manager can add LOCAL_SETUP_TOKEN to an initialized .env.
+    for (const file of ["local/docker-compose.yml", "local/docker-compose.image.yml"]) {
+      const compose = readFileSync(path.join(publicRoot, file), "utf8");
+      expect(compose).toContain("LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:-}");
+      expect(compose).not.toContain("LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?");
+    }
+  });
+
   it("propagates cron endpoint failures to the container restart policy", () => {
     for (const file of ["local/docker-compose.yml", "local/docker-compose.image.yml"]) {
       const compose = readFileSync(path.join(publicRoot, file), "utf8");
-      expect(compose).toContain("LOCAL_SETUP_TOKEN: ${LOCAL_SETUP_TOKEN:?set LOCAL_SETUP_TOKEN}");
       expect(compose).toContain("curl -fsS");
       expect(compose).toContain("failed=1");
       expect(compose).toContain("exit 1");

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "subboost",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "license": "AGPL-3.0-only",
   "private": true,
   "engines": {