libmur-devandlibmur-dev a8d0700bf2 fix(auth): add node-admin token scope for panel updates (#6666) ...

* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <[email protected]>

2026-10-17 23:45:26 +02:00

..

amneziawg

fix(amneziawg): bound S1-S3 by the receive buffer, reject overlapping H (#6642)

2026-09-26 22:02:49 +02:00

amneziawgnet

fix(amneziawg): respect tunnel MTU when writing UDP replies (#6780)

2026-10-12 03:11:09 +02:00

config

v3.10.2

2026-10-14 17:18:43 +02:00

crypto/nodetoken

fix(nodetoken): stop refusing every node-token key file on Windows

2026-09-27 15:55:42 +02:00

database

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

eventbus

chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms

2026-07-25 16:08:09 +02:00

logger

fix(logger): reuse the open log rotator when InitLogger runs again

2026-09-27 15:32:20 +02:00

mtproto

feat(mtproto): expose mtg-multi's per-IP pending-handshake limit

2026-10-14 16:46:20 +02:00

nodee2e

chore(nodes): run the master+node scopes in parallel and document both layers

2026-10-05 13:30:18 +02:00

pia

chore(build): bump Go toolchain to 1.27.0

2026-08-23 21:57:03 +02:00

sub

fix(sub): export Hysteria2 Gecko obfs in Clash/Mihomo subscriptions

2026-10-14 14:42:00 +02:00

testpg

test(database): give each package its own schema when tests run on PostgreSQL (#6594)

2026-09-26 21:13:42 +02:00

tuic

fix(clients): balance renewal form layout and mode guidance (#6672)

2026-10-08 21:59:38 +02:00

tunnelmonitor

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

util

fix(link): read the XHTTP fields a vmess link carries inline (#6808)

2026-10-14 15:34:35 +02:00

web

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

xray

fix(xray): capture whole core crash reports instead of the first pipe chunk

2026-10-14 15:31:09 +02:00