chore: sync upstream v1.14.0-beta.7

.github/CRONET_GO_VERSION

@@ -1 +1 @@
-617d38f41f935b46a68f550d9add2e38abb3f168
+cfbca3ad7edb3f8c1bd78b4bcb7c4c1a1ae3d195

common/networkquality/networkquality.go

@@ -407,11 +407,9 @@ func (r *directionRunner) addConnection(ctx context.Context) error {
 	r.connMu.Lock()
 	r.connections = append(r.connections, conn)
 	r.connMu.Unlock()
-	r.wg.Add(1)
-	go func() {
-		defer r.wg.Done()
+	r.wg.Go(func() {
 		conn.run(ctx, r.onConnectionFailed)
-	}()
+	})
 	return nil
 }
 
@@ -437,9 +435,7 @@ func (r *directionRunner) pickReadyConnection() *loadConnection {
 }
 
 func (r *directionRunner) startProber(ctx context.Context) {
-	r.wg.Add(1)
-	go func() {
-		defer r.wg.Done()
+	r.wg.Go(func() {
 		ticker := time.NewTicker(r.probeInterval())
 		defer ticker.Stop()
 		for {
@@ -455,7 +451,7 @@ func (r *directionRunner) startProber(ctx context.Context) {
 			r.runProbeRound(ctx, conn.client)
 			ticker.Reset(r.probeInterval())
 		}
-	}()
+	})
 }
 
 func (r *directionRunner) runProbeRound(ctx context.Context, selfClient *http.Client) {

daemon/started_service_tailscale_ssh.go

@@ -211,9 +211,7 @@ func (s *StartedService) StartTailscaleSSHSession(
 		Message: &TailscaleSSHServerMessage_Ready{Ready: &TailscaleSSHReady{}},
 	})
 
-	workersWg.Add(1)
-	go func() {
-		defer workersWg.Done()
+	workersWg.Go(func() {
 		for {
 			msg, recvErr := server.Recv()
 			if recvErr == io.EOF {
@@ -243,10 +241,9 @@ func (s *StartedService) StartTailscaleSSHSession(
 				}))
 			}
 		}
-	}()
+	})
 
 	pumpReader := func(reader io.Reader) {
-		defer workersWg.Done()
 		buffer := buf.Get(buf.BufferSize)
 		defer buf.Put(buffer)
 		for {
@@ -261,14 +258,10 @@ func (s *StartedService) StartTailscaleSSHSession(
 			}
 		}
 	}
-	workersWg.Add(1)
-	go pumpReader(stdout)
-	workersWg.Add(1)
-	go pumpReader(stderr)
+	workersWg.Go(func() { pumpReader(stdout) })
+	workersWg.Go(func() { pumpReader(stderr) })
 
-	workersWg.Add(1)
-	go func() {
-		defer workersWg.Done()
+	workersWg.Go(func() {
 		ticker := time.NewTicker(30 * time.Second)
 		defer ticker.Stop()
 		for {
@@ -283,11 +276,9 @@ func (s *StartedService) StartTailscaleSSHSession(
 				}
 			}
 		}
-	}()
+	})
 
-	workersWg.Add(1)
-	go func() {
-		defer workersWg.Done()
+	workersWg.Go(func() {
 		waitErr := sshSession.Wait()
 		exitMessage := &TailscaleSSHExit{}
 		switch waitErrTyped := waitErr.(type) {
@@ -302,7 +293,7 @@ func (s *StartedService) StartTailscaleSSHSession(
 			Message: &TailscaleSSHServerMessage_Exit{Exit: exitMessage},
 		})
 		cancel()
-	}()
+	})
 
 	go func() {
 		<-sessionCtx.Done()

dns/transport/local/local_darwin_test.go

@@ -134,9 +134,7 @@ func TestSystemExchangeConcurrent(t *testing.T) {
 		if i%2 == 1 {
 			qtype = mDNS.TypeAAAA
 		}
-		waitGroup.Add(1)
-		go func() {
-			defer waitGroup.Done()
+		waitGroup.Go(func() {
 			message := new(mDNS.Msg)
 			message.SetQuestion("localhost.", qtype)
 			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
@@ -149,7 +147,7 @@ func TestSystemExchangeConcurrent(t *testing.T) {
 			if len(response.Answer) == 0 {
 				errors <- context.DeadlineExceeded
 			}
-		}()
+		})
 	}
 	waitGroup.Wait()
 	close(errors)

docs/changelog.md

@@ -2,6 +2,49 @@
 icon: material/alert-decagram
 ---
 
+#### 1.14.0-beta.7
+
+* Add Hysteria2 Chrome QUIC fingerprint parroting **1**
+* Update quic-go to v0.61.0
+* Update tailscale to v1.102.1
+* Update gvisor to 20260727.0
+* Fixes and improvements
+
+**1**:
+
+Hysteria2 client connections now parrot Chrome's QUIC handshake by default,
+making the traffic harder to identify by handshake fingerprinting. Since
+Chrome does not declare support for Ed25519, servers using Ed25519
+certificates will fail the handshake; see
+[disable_chrome_parrot](/configuration/outbound/hysteria2/#disable_chrome_parrot).
+
+#### 1.14.0-beta.5
+
+* Remove client metadata from AnyTLS requests by default **1**
+* Update naiveproxy to v150.0.7871.63-1
+* Fixes and improvements
+
+**1**:
+
+We found that the AnyTLS client implementation uploads metadata that is
+**not used by the open-source server**, and there are reports of vendors using
+it to profile and discriminate against users. We now leave it empty by default
+and allow you to customize it, see
+[AnyTLS client metadata](/manual/misc/anytls-client-metadata/).
+
+#### 1.13.16
+
+* Remove client metadata from AnyTLS requests by default **1**
+* Fixes and improvements
+
+**1**:
+
+We found that the AnyTLS client implementation uploads metadata that is
+**not used by the open-source server**, and there are reports of vendors using
+it to profile and discriminate against users. We now leave it empty by default
+and allow you to customize it, see
+[AnyTLS client metadata](/manual/misc/anytls-client-metadata/).
+
 #### 1.14.0-beta.4
 
 * Fixes and improvements

docs/configuration/outbound/anytls.md

@@ -17,6 +17,7 @@ icon: material/new-box
   "idle_session_check_interval": "30s",
   "idle_session_timeout": "30s",
   "min_idle_session": 5,
+  "client_metadata": "",
   "tls": {},
 
   ... // Dial Fields
@@ -55,6 +56,12 @@ In the check, close sessions that have been idle for longer than this. Default:
 
 In the check, at least the first `n` idle sessions are kept open. Default value: `n`=0
 
+#### client_metadata
+
+!!! question "Since sing-box 1.13.16"
+
+Check [AnyTLS client metadata](/manual/misc/anytls-client-metadata/).
+
 #### tls
 
 ==Required==

docs/configuration/outbound/anytls.zh.md

@@ -17,6 +17,7 @@ icon: material/new-box
   "idle_session_check_interval": "30s",
   "idle_session_timeout": "30s",
   "min_idle_session": 5,
+  "client_metadata": "",
   "tls": {},
 
   ... // 拨号字段
@@ -55,6 +56,12 @@ AnyTLS 密码。
 
 在检查中，至少前 `n` 个空闲会话保持打开状态。默认值：`n`=0
 
+#### client_metadata
+
+!!! question "自 sing-box 1.13.16 起"
+
+参阅 [AnyTLS 客户端元数据](/zh/manual/misc/anytls-client-metadata/)。
+
 #### tls
 
 ==必填==

docs/configuration/outbound/hysteria2.md

@@ -2,6 +2,7 @@
 
     :material-plus: [hop_interval_max](#hop_interval_max)  
     :material-plus: [bbr_profile](#bbr_profile)  
+    :material-plus: [disable_chrome_parrot](#disable_chrome_parrot)  
     :material-plus: [realm](#realm)  
     :material-alert: [obfs](#obfstype)
 
@@ -38,6 +39,7 @@
 
   "bbr_profile": "",
   "brutal_debug": false,
+  "disable_chrome_parrot": false,
   "realm": {
     "server_url": "https://realm.example.com",
     "token": "",
@@ -178,6 +180,25 @@ BBR congestion control algorithm profile, one of `conservative` `standard` `aggr
 
 Enable debug information logging for Hysteria Brutal CC.
 
+#### disable_chrome_parrot
+
+!!! question "Since sing-box 1.14.0"
+
+Disable Chrome QUIC fingerprint parroting.
+
+If it is not disabled, the client's QUIC handshake is made to parrot Chrome's, so that Hysteria traffic
+is harder to identify by handshake fingerprinting.
+
+To match Chrome, the client uses Chrome's own QUIC parameters, which override some settings:
+`idle_timeout` is fixed at 30 seconds, `max_concurrent_streams` and `initial_packet_size` are replaced by
+Chrome's values, and the receive windows start at Chrome's initial values before growing to the configured
+maximums.
+
+!!! warning ""
+
+    Chrome does not declare support for Ed25519, so a server using an Ed25519 certificate will fail the
+    handshake. Use an ECDSA or RSA certificate instead; certificates issued by ACME are unaffected.
+
 #### realm
 
 !!! question "Since sing-box 1.14.0"

docs/configuration/outbound/hysteria2.zh.md

@@ -2,6 +2,7 @@
 
     :material-plus: [hop_interval_max](#hop_interval_max)  
     :material-plus: [bbr_profile](#bbr_profile)  
+    :material-plus: [disable_chrome_parrot](#disable_chrome_parrot)  
     :material-plus: [realm](#realm)  
     :material-alert: [obfs](#obfstype)
 
@@ -38,6 +39,7 @@
 
   "bbr_profile": "",
   "brutal_debug": false,
+  "disable_chrome_parrot": false,
   "realm": {
     "server_url": "https://realm.example.com",
     "token": "",
@@ -176,6 +178,23 @@ BBR 拥塞控制算法配置，可选 `conservative` `standard` `aggressive`。
 
 启用 Hysteria Brutal CC 的调试信息日志记录。
 
+#### disable_chrome_parrot
+
+!!! question "自 sing-box 1.14.0 起"
+
+禁用 Chrome QUIC 指纹模仿。
+
+如果没有禁用，客户端的 QUIC 握手将被构造为模仿 Chrome，使 Hysteria 流量更难通过握手指纹识别。
+
+为了与 Chrome 一致，客户端使用 Chrome 自己的 QUIC 参数，其覆盖部分设置：
+`idle_timeout` 固定为 30 秒，`max_concurrent_streams` 与 `initial_packet_size` 被替换为 Chrome 的值，
+接收窗口从 Chrome 的初始值开始，再增长到配置的最大值。
+
+!!! warning ""
+
+    Chrome 不声明支持 Ed25519，因此使用 Ed25519 证书的服务端将无法完成握手。
+    请改用 ECDSA 或 RSA 证书；由 ACME 签发的证书不受影响。
+
 #### realm
 
 !!! question "自 sing-box 1.14.0 起"

docs/manual/misc/anytls-client-metadata.md

@@ -0,0 +1,67 @@
+---
+icon: material/incognito
+---
+
+# AnyTLS client metadata
+
+The AnyTLS protocol has a design flaw: its settings frame requires the client
+to send its software name and version to the server, and the protocol
+specification requires that clients not disguise this information.
+
+This field serves no protocol purpose — AnyTLS already has a separate version
+field for compatibility negotiation, and the open-source server implementation
+does not use client metadata. However, the field allows vendors to collect and track client types, and for
+platform-specific clients, potentially infer private information such as the operating system type and version range —
+something that should not, and is not expected by users to, appear in an
+anti-censorship protocol. We have received reports that
+commercial proxy providers use this information to identify and block
+connections from the official library provided by AnyTLS for sing-box
+integration, reportedly because abusive users connect to their servers with
+sing-box or with clients using the same official library. This indicates that
+client metadata is being collected and used for discrimination in practice.
+
+The protocol specification states that "disguising it has no value." We
+disagree: the situation is analogous to browsers implementing TLS ECH GREASE —
+without it, privacy-protecting clients can be fingerprinted and treated
+differently.
+
+## Status
+
+### 2025-02-20
+
+We merged the
+[pull request adding this protocol](https://github.com/SagerNet/sing-box/pull/2615).
+Since the metadata was fixed at `sing-anytls/<library version>` in the
+implementation provided for our use, and we did not carefully review the
+protocol specification and other implementations, we wrongly believed that it
+was not private information.
+
+### 2025-04-05
+
+The protocol document
+[added](https://github.com/anytls/anytls-go/commit/8812aae7ab29dd88bb89067b9ca676e2e7e29171)
+the requirement that third-party implementations fill in the real software
+name and version, claiming that "disguising it has no value".
+
+### 2026-07-18
+
+A [pull request submitted to sing-box](https://github.com/SagerNet/sing-box/pull/4311)
+was found to additionally upload the `sing-box` name and the actual version;
+the change was subsequently reverted and was never released.
+
+### 2026-08-03
+
+sing-box 1.13.16 and 1.14.0-beta.5 have been released; the client metadata in
+AnyTLS requests is now empty by default. For compatibility, the
+[client_metadata](/configuration/outbound/anytls/#client_metadata) outbound
+option allows users to set a custom value.
+
+Since the open-source server implementation does not use this information and
+it has no legitimate use, this is not considered a breaking change.
+
+## Recommendations
+
+We recommend that the AnyTLS protocol remove the client metadata, or replace
+it with an option that is not sent by default and can be customized by the
+user; and that other client implementations also take action, to jointly stop
+statistics collection and discrimination based on client metadata.