sing-box-python 1.13.19__tar.gz → 1.13.21__tar.gz

sing_box_python-1.13.21/.go-version

@@ -0,0 +1 @@
+1.25.12

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/MANIFEST.in

@@ -7,5 +7,6 @@ include LICENSE
 include README.md
 include pyproject.toml
 include setup.py
+include .go-version
 include UPSTREAM_COMMIT
 include UPSTREAM_VERSION

{sing_box_python-1.13.19/sing_box_python.egg-info → sing_box_python-1.13.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sing-box-python
-Version: 1.13.19
+Version: 1.13.21
 Summary: Python binding for sing-box
 License: GPL-3.0-or-later
 Project-URL: Source, https://github.com/LorenEteval/sing-box-python
@@ -47,7 +47,8 @@ Binary wheels are published for Linux x86-64 and ARM64, Windows x86-64 and ARM64
 A source distribution is also published as a fallback. If pip cannot find a compatible wheel, it may build the native
 binding from source. A source build requires:
 
-* [Go 1.24.7](https://go.dev/doc/install) in `PATH`.
+* The [Go toolchain version recorded in `.go-version`](https://go.dev/doc/install), or a newer compatible release, in
+  `PATH`. The pinned version matches the compiler used by the synchronized upstream release workflow.
 * A working C and C++ compiler toolchain.
 * MinGW-w64 on Windows x86-64, or LLVM-MinGW on Windows ARM64, with `gcc` and `g++` available in `PATH`.
 
@@ -178,11 +179,14 @@ paths and blob contents remain identical to upstream. Synchronization runs on Li
 `.github/workflows/sync-upstream.yml` checks the latest stable upstream release daily and can also be started manually
 from the Actions page. Drafts and prereleases are rejected. `UPSTREAM_VERSION` is the single version source for both the
 Python distribution version and the sing-box version embedded in the native library, while `UPSTREAM_COMMIT` pins the
-commit to which that release tag resolved during import.
+commit to which that release tag resolved during import. The root `.go-version` pins the exact Go compiler used by
+upstream's release workflow; this is intentionally independent of the minimum language version in `singbox-go/go.mod`.
 
 The synchronization script checks the current vendor tree against its exact upstream tag, fetches the requested tag,
-replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, and verifies every
-vendored upstream path and Git blob. Repeated checks are no-ops when the stable release is already synchronized.
+replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, `UPSTREAM_COMMIT`,
+and `.go-version`, and verifies every vendored upstream path and Git blob. The Go pin is extracted from exact
+`go-version` entries in upstream's build workflow; synchronization fails instead of guessing if no single exact version
+can be identified. Repeated checks are no-ops when the stable release is already synchronized.
 
 Run the same operations locally from the repository root:
 
@@ -192,10 +196,12 @@ python scripts/sync-sing-box.py verify --tag v1.13.18
 python scripts/sync-sing-box.py sync --tag vX.Y.Z
 ```
 
-For an automated update, the sync workflow commits `chore: sync sing-box vX.Y.Z` to `main`, then explicitly dispatches
-the existing build-and-publish workflow at that commit. The latter builds and tests every distribution before creating
-the `vX.Y.Z` tag, publishing `X.Y.Z` to PyPI through Trusted Publishing, and creating the GitHub Release. Explicit
-dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not trigger new push workflows.
+For an automated update, the sync workflow installs the synchronized `.go-version` toolchain and compiles the Go
+binding before committing `chore: sync sing-box vX.Y.Z` to `main`. It then explicitly dispatches the existing
+build-and-publish workflow at that commit. The latter uses the same exact Go version for every wheel platform, builds
+and tests every distribution, then creates the `vX.Y.Z` tag, publishes `X.Y.Z` to PyPI through Trusted Publishing, and
+creates the GitHub Release. Explicit dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not
+trigger new push workflows.
 
 ## Binary Wheel Platforms
 

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/README.md

@@ -20,7 +20,8 @@ Binary wheels are published for Linux x86-64 and ARM64, Windows x86-64 and ARM64
 A source distribution is also published as a fallback. If pip cannot find a compatible wheel, it may build the native
 binding from source. A source build requires:
 
-* [Go 1.24.7](https://go.dev/doc/install) in `PATH`.
+* The [Go toolchain version recorded in `.go-version`](https://go.dev/doc/install), or a newer compatible release, in
+  `PATH`. The pinned version matches the compiler used by the synchronized upstream release workflow.
 * A working C and C++ compiler toolchain.
 * MinGW-w64 on Windows x86-64, or LLVM-MinGW on Windows ARM64, with `gcc` and `g++` available in `PATH`.
 
@@ -151,11 +152,14 @@ paths and blob contents remain identical to upstream. Synchronization runs on Li
 `.github/workflows/sync-upstream.yml` checks the latest stable upstream release daily and can also be started manually
 from the Actions page. Drafts and prereleases are rejected. `UPSTREAM_VERSION` is the single version source for both the
 Python distribution version and the sing-box version embedded in the native library, while `UPSTREAM_COMMIT` pins the
-commit to which that release tag resolved during import.
+commit to which that release tag resolved during import. The root `.go-version` pins the exact Go compiler used by
+upstream's release workflow; this is intentionally independent of the minimum language version in `singbox-go/go.mod`.
 
 The synchronization script checks the current vendor tree against its exact upstream tag, fetches the requested tag,
-replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, and verifies every
-vendored upstream path and Git blob. Repeated checks are no-ops when the stable release is already synchronized.
+replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, `UPSTREAM_COMMIT`,
+and `.go-version`, and verifies every vendored upstream path and Git blob. The Go pin is extracted from exact
+`go-version` entries in upstream's build workflow; synchronization fails instead of guessing if no single exact version
+can be identified. Repeated checks are no-ops when the stable release is already synchronized.
 
 Run the same operations locally from the repository root:
 
@@ -165,10 +169,12 @@ python scripts/sync-sing-box.py verify --tag v1.13.18
 python scripts/sync-sing-box.py sync --tag vX.Y.Z
 ```
 
-For an automated update, the sync workflow commits `chore: sync sing-box vX.Y.Z` to `main`, then explicitly dispatches
-the existing build-and-publish workflow at that commit. The latter builds and tests every distribution before creating
-the `vX.Y.Z` tag, publishing `X.Y.Z` to PyPI through Trusted Publishing, and creating the GitHub Release. Explicit
-dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not trigger new push workflows.
+For an automated update, the sync workflow installs the synchronized `.go-version` toolchain and compiles the Go
+binding before committing `chore: sync sing-box vX.Y.Z` to `main`. It then explicitly dispatches the existing
+build-and-publish workflow at that commit. The latter uses the same exact Go version for every wheel platform, builds
+and tests every distribution, then creates the `vX.Y.Z` tag, publishes `X.Y.Z` to PyPI through Trusted Publishing, and
+creates the GitHub Release. Explicit dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not
+trigger new push workflows.
 
 ## Binary Wheel Platforms
 

sing_box_python-1.13.21/UPSTREAM_COMMIT

@@ -0,0 +1 @@
+628cb31ffa79cffffd34c2f9cde6cae044e4fc12

sing_box_python-1.13.21/UPSTREAM_VERSION

@@ -0,0 +1 @@
+v1.13.21

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/pyproject.toml

@@ -30,27 +30,38 @@ test-command = [
 ]
 
 [tool.cibuildwheel.linux]
-before-all = """
+manylinux-x86_64-image = "manylinux2014"
+manylinux-aarch64-image = "manylinux2014"
+before-all = '''
+go_version="$(
+    tr -d '\r\n' < "{project}/.go-version"
+)"
+if ! printf '%s\n' "${go_version}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+    echo "Invalid Go version in .go-version: ${go_version}" >&2
+    exit 1
+fi
 case "$(uname -m)" in
     x86_64)
         go_arch='amd64'
-        go_sha256='da18191ddb7db8a9339816f3e2b54bdded8047cdc2a5d67059478f8d1595c43f'
         ;;
     aarch64|arm64)
         go_arch='arm64'
-        go_sha256='fd2bccce882e29369f56c86487663bb78ba7ea9e02188a5b0269303a0c3d33ab'
         ;;
     *)
         echo "Unsupported Linux architecture: $(uname -m)" >&2
         exit 1
         ;;
 esac
-go_archive="/tmp/go1.24.7.linux-${go_arch}.tar.gz"
-curl -fsSLo "${go_archive}" "https://go.dev/dl/go1.24.7.linux-${go_arch}.tar.gz"
+go_archive="/tmp/go${go_version}.linux-${go_arch}.tar.gz"
+go_checksum="${go_archive}.sha256"
+go_url="https://dl.google.com/go/go${go_version}.linux-${go_arch}.tar.gz"
+curl -fsSLo "${go_archive}" "${go_url}"
+curl -fsSLo "${go_checksum}" "${go_url}.sha256"
+go_sha256="$(tr -d '\r\n' < "${go_checksum}")"
 echo "${go_sha256}  ${go_archive}" | sha256sum -c -
 tar -C /usr/local -xzf "${go_archive}"
 /usr/local/go/bin/go version
-"""
+'''
 environment = { PATH = "/usr/local/go/bin:$PATH", GOTOOLCHAIN = "local" }
 
 [tool.cibuildwheel.macos]

{sing_box_python-1.13.19 → sing_box_python-1.13.21/sing_box_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sing-box-python
-Version: 1.13.19
+Version: 1.13.21
 Summary: Python binding for sing-box
 License: GPL-3.0-or-later
 Project-URL: Source, https://github.com/LorenEteval/sing-box-python
@@ -47,7 +47,8 @@ Binary wheels are published for Linux x86-64 and ARM64, Windows x86-64 and ARM64
 A source distribution is also published as a fallback. If pip cannot find a compatible wheel, it may build the native
 binding from source. A source build requires:
 
-* [Go 1.24.7](https://go.dev/doc/install) in `PATH`.
+* The [Go toolchain version recorded in `.go-version`](https://go.dev/doc/install), or a newer compatible release, in
+  `PATH`. The pinned version matches the compiler used by the synchronized upstream release workflow.
 * A working C and C++ compiler toolchain.
 * MinGW-w64 on Windows x86-64, or LLVM-MinGW on Windows ARM64, with `gcc` and `g++` available in `PATH`.
 
@@ -178,11 +179,14 @@ paths and blob contents remain identical to upstream. Synchronization runs on Li
 `.github/workflows/sync-upstream.yml` checks the latest stable upstream release daily and can also be started manually
 from the Actions page. Drafts and prereleases are rejected. `UPSTREAM_VERSION` is the single version source for both the
 Python distribution version and the sing-box version embedded in the native library, while `UPSTREAM_COMMIT` pins the
-commit to which that release tag resolved during import.
+commit to which that release tag resolved during import. The root `.go-version` pins the exact Go compiler used by
+upstream's release workflow; this is intentionally independent of the minimum language version in `singbox-go/go.mod`.
 
 The synchronization script checks the current vendor tree against its exact upstream tag, fetches the requested tag,
-replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, and verifies every
-vendored upstream path and Git blob. Repeated checks are no-ops when the stable release is already synchronized.
+replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, `UPSTREAM_COMMIT`,
+and `.go-version`, and verifies every vendored upstream path and Git blob. The Go pin is extracted from exact
+`go-version` entries in upstream's build workflow; synchronization fails instead of guessing if no single exact version
+can be identified. Repeated checks are no-ops when the stable release is already synchronized.
 
 Run the same operations locally from the repository root:
 
@@ -192,10 +196,12 @@ python scripts/sync-sing-box.py verify --tag v1.13.18
 python scripts/sync-sing-box.py sync --tag vX.Y.Z
 ```
 
-For an automated update, the sync workflow commits `chore: sync sing-box vX.Y.Z` to `main`, then explicitly dispatches
-the existing build-and-publish workflow at that commit. The latter builds and tests every distribution before creating
-the `vX.Y.Z` tag, publishing `X.Y.Z` to PyPI through Trusted Publishing, and creating the GitHub Release. Explicit
-dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not trigger new push workflows.
+For an automated update, the sync workflow installs the synchronized `.go-version` toolchain and compiles the Go
+binding before committing `chore: sync sing-box vX.Y.Z` to `main`. It then explicitly dispatches the existing
+build-and-publish workflow at that commit. The latter uses the same exact Go version for every wheel platform, builds
+and tests every distribution, then creates the `vX.Y.Z` tag, publishes `X.Y.Z` to PyPI through Trusted Publishing, and
+creates the GitHub Release. Explicit dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not
+trigger new push workflows.
 
 ## Binary Wheel Platforms
 

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/sing_box_python.egg-info/SOURCES.txt

@@ -1,3 +1,4 @@
+.go-version
 CMakeLists.txt
 LICENSE
 MANIFEST.in
@@ -850,6 +851,7 @@ singbox-go/route/rule/rule_action.go
 singbox-go/route/rule/rule_default.go
 singbox-go/route/rule/rule_default_interface_address.go
 singbox-go/route/rule/rule_dns.go
+singbox-go/route/rule/rule_dns_address_filter_test.go
 singbox-go/route/rule/rule_headless.go
 singbox-go/route/rule/rule_interface_address.go
 singbox-go/route/rule/rule_item_adguard.go

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/.github/workflows/build.yml

@@ -1098,37 +1098,36 @@ jobs:
           echo "ASC_KEY_ID=$ASC_KEY_ID" >> "$GITHUB_ENV"
           echo "ASC_KEY_ISSUER_ID=$ASC_KEY_ISSUER_ID" >> "$GITHUB_ENV"
         env:
-          ASC_KEY: ${{ secrets.ASC_KEY }}
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_KEY_ISSUER_ID: ${{ secrets.ASC_KEY_ISSUER_ID }}
+          ASC_KEY: ${{ secrets.LEGACY_ASC_KEY }}
+          ASC_KEY_ID: ${{ secrets.LEGACY_ASC_KEY_ID }}
+          ASC_KEY_ISSUER_ID: ${{ secrets.LEGACY_ASC_KEY_ISSUER_ID }}
       - name: Install Apple provisioning profiles
         if: matrix.if && matrix.type != 'jailbreak'
         run: |-
           PROFILES_ZIP_PATH=$RUNNER_TEMP/AppleProvisioningProfiles.zip
-          for index in $(seq 1 16); do
-            variable="PROVISIONING_PROFILES_$index"
+          for variable in $(compgen -v | grep -E '^PROVISIONING_PROFILES_[0-9]+$' | sort -t_ -k3 -n); do
             printf '%s' "${!variable}"
           done | base64 --decode -o $PROFILES_ZIP_PATH
           PROFILES_PATH="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
           mkdir -p "$PROFILES_PATH"
           unzip -q $PROFILES_ZIP_PATH -d "$PROFILES_PATH"
         env:
-          PROVISIONING_PROFILES_1: ${{ secrets.APPLE_PROVISIONING_PROFILES_1 }}
-          PROVISIONING_PROFILES_2: ${{ secrets.APPLE_PROVISIONING_PROFILES_2 }}
-          PROVISIONING_PROFILES_3: ${{ secrets.APPLE_PROVISIONING_PROFILES_3 }}
-          PROVISIONING_PROFILES_4: ${{ secrets.APPLE_PROVISIONING_PROFILES_4 }}
-          PROVISIONING_PROFILES_5: ${{ secrets.APPLE_PROVISIONING_PROFILES_5 }}
-          PROVISIONING_PROFILES_6: ${{ secrets.APPLE_PROVISIONING_PROFILES_6 }}
-          PROVISIONING_PROFILES_7: ${{ secrets.APPLE_PROVISIONING_PROFILES_7 }}
-          PROVISIONING_PROFILES_8: ${{ secrets.APPLE_PROVISIONING_PROFILES_8 }}
-          PROVISIONING_PROFILES_9: ${{ secrets.APPLE_PROVISIONING_PROFILES_9 }}
-          PROVISIONING_PROFILES_10: ${{ secrets.APPLE_PROVISIONING_PROFILES_10 }}
-          PROVISIONING_PROFILES_11: ${{ secrets.APPLE_PROVISIONING_PROFILES_11 }}
-          PROVISIONING_PROFILES_12: ${{ secrets.APPLE_PROVISIONING_PROFILES_12 }}
-          PROVISIONING_PROFILES_13: ${{ secrets.APPLE_PROVISIONING_PROFILES_13 }}
-          PROVISIONING_PROFILES_14: ${{ secrets.APPLE_PROVISIONING_PROFILES_14 }}
-          PROVISIONING_PROFILES_15: ${{ secrets.APPLE_PROVISIONING_PROFILES_15 }}
-          PROVISIONING_PROFILES_16: ${{ secrets.APPLE_PROVISIONING_PROFILES_16 }}
+          PROVISIONING_PROFILES_1: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_1 }}
+          PROVISIONING_PROFILES_2: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_2 }}
+          PROVISIONING_PROFILES_3: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_3 }}
+          PROVISIONING_PROFILES_4: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_4 }}
+          PROVISIONING_PROFILES_5: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_5 }}
+          PROVISIONING_PROFILES_6: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_6 }}
+          PROVISIONING_PROFILES_7: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_7 }}
+          PROVISIONING_PROFILES_8: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_8 }}
+          PROVISIONING_PROFILES_9: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_9 }}
+          PROVISIONING_PROFILES_10: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_10 }}
+          PROVISIONING_PROFILES_11: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_11 }}
+          PROVISIONING_PROFILES_12: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_12 }}
+          PROVISIONING_PROFILES_13: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_13 }}
+          PROVISIONING_PROFILES_14: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_14 }}
+          PROVISIONING_PROFILES_15: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_15 }}
+          PROVISIONING_PROFILES_16: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_16 }}
       - name: Setup Apple Development certificate
         if: matrix.if && matrix.type != 'jailbreak'
         run: |-
@@ -1145,8 +1144,8 @@ jobs:
           security find-identity -v -p codesigning $KEYCHAIN_PATH
           echo "APPLE_DEVELOPMENT_KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
         env:
-          APPLE_DEVELOPMENT_CERTIFICATES_P12: ${{ secrets.APPLE_DEVELOPMENT_CERTIFICATES_P12 }}
-          P12_PASSWORD: ${{ secrets.APPLE_DEVELOPMENT_P12_PASSWORD }}
+          APPLE_DEVELOPMENT_CERTIFICATES_P12: ${{ secrets.LEGACY_APPLE_DEVELOPMENT_CERTIFICATES_P12 }}
+          P12_PASSWORD: ${{ secrets.LEGACY_APPLE_DEVELOPMENT_P12_PASSWORD }}
           KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
       - name: Setup Developer ID certificates
         if: matrix.if && matrix.type == 'standalone'
@@ -1164,8 +1163,8 @@ jobs:
           security find-identity -v -p codesigning $KEYCHAIN_PATH
           echo "SIGNING_KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
         env:
-          DEVELOPER_ID_CERTIFICATES_P12: ${{ secrets.DEVELOPER_ID_CERTIFICATES_P12 }}
-          P12_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }}
+          DEVELOPER_ID_CERTIFICATES_P12: ${{ secrets.LEGACY_DEVELOPER_ID_CERTIFICATES_P12 }}
+          P12_PASSWORD: ${{ secrets.LEGACY_DEVELOPER_ID_P12_PASSWORD }}
           KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
       - name: Setup notarization credentials
         if: matrix.if && matrix.type == 'standalone' && github.event_name == 'workflow_dispatch'

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/adapter/experimental.go

@@ -143,6 +143,7 @@ type OutboundGroup interface {
 type URLTestGroup interface {
 	OutboundGroup
 	URLTest(ctx context.Context) (map[string]uint16, error)
+	PerformUpdateCheck()
 }
 
 func OutboundTag(detour Outbound) string {

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/adapter/inbound.go

@@ -94,7 +94,7 @@ type InboundContext struct {
 	SourcePortMatch              bool
 	DestinationAddressMatch      bool
 	DestinationPortMatch         bool
-	DidMatch                     bool
+	DefinitiveMatchStates        uint16
 	IgnoreDestinationIPCIDRMatch bool
 }
 
@@ -109,7 +109,7 @@ func (c *InboundContext) ResetRuleMatchCache() {
 	c.SourcePortMatch = false
 	c.DestinationAddressMatch = false
 	c.DestinationPortMatch = false
-	c.DidMatch = false
+	c.DefinitiveMatchStates = 0
 }
 
 type inboundContextKey struct{}

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/cmd/sing-box/cmd.go

@@ -10,6 +10,7 @@ import (
 	"github.com/sagernet/sing-box/experimental/deprecated"
 	"github.com/sagernet/sing-box/include"
 	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/service"
 	"github.com/sagernet/sing/service/filemanager"
 
@@ -52,7 +53,9 @@ func preRun(cmd *cobra.Command, args []string) {
 		globalCtx = filemanager.WithDefault(globalCtx, "", "", sudoUID, sudoGID)
 	}
 	if disableColor {
-		log.SetStdLogger(log.NewDefaultFactory(context.Background(), log.Formatter{BaseTime: time.Now(), DisableColors: true}, os.Stderr, "", nil, false).Logger())
+		logFactory := log.NewDefaultFactory(context.Background(), log.Formatter{BaseTime: time.Now(), DisableColors: true}, os.Stderr, "", nil, false)
+		common.Must(logFactory.Start())
+		log.SetStdLogger(logFactory.Logger())
 	}
 	if workingDir != "" {
 		_, err := os.Stat(workingDir)

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/docs/changelog.md

@@ -2,6 +2,14 @@
 icon: material/alert-decagram
 ---
 
+#### 1.13.21
+
+* Fixes and improvements
+
+#### 1.13.20
+
+* Fixes and improvements
+
 #### 1.13.19
 
 * Fixes and improvements

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/docs/configuration/dns/rule.md

@@ -203,9 +203,9 @@ icon: material/alert-decagram
 !!! note ""
 
     The default rule uses the following matching logic:  
-    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite`) &&  
+    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite` || `ip_cidr` || `ip_is_private` || `ip_accept_any`) &&  
     (`port` || `port_range`) &&  
-    (`source_geoip` || `source_ip_cidr` ｜｜ `source_ip_is_private`) &&  
+    (`source_geoip` || `source_ip_cidr` || `source_ip_is_private`) &&  
     (`source_port` || `source_port_range`) &&  
     `other fields`
 

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/docs/configuration/dns/rule.zh.md

@@ -202,7 +202,7 @@ icon: material/alert-decagram
 !!! note ""
 
     默认规则使用以下匹配逻辑:  
-    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite`) &&  
+    (`domain` || `domain_suffix` || `domain_keyword` || `domain_regex` || `geosite` || `ip_cidr` || `ip_is_private` || `ip_accept_any`) &&  
     (`port` || `port_range`) &&  
     (`source_geoip` || `source_ip_cidr` || `source_ip_is_private`) &&  
     (`source_port` || `source_port_range`) &&  

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/experimental/clashapi/proxies.go

@@ -184,6 +184,30 @@ func updateProxy(w http.ResponseWriter, r *http.Request) {
 	render.NoContent(w, r)
 }
 
+func groupContains(outboundManager adapter.OutboundManager, outboundGroup adapter.OutboundGroup, tag string, visited map[string]bool) bool {
+	for _, memberTag := range outboundGroup.All() {
+		if memberTag == tag {
+			return true
+		}
+		member, loaded := outboundManager.Outbound(memberTag)
+		if !loaded {
+			continue
+		}
+		if group.RealTag(member) == tag {
+			return true
+		}
+		memberGroup, isGroup := member.(adapter.OutboundGroup)
+		if !isGroup || visited[memberTag] {
+			continue
+		}
+		visited[memberTag] = true
+		if groupContains(outboundManager, memberGroup, tag, visited) {
+			return true
+		}
+	}
+	return false
+}
+
 func getProxyDelay(server *Server) func(w http.ResponseWriter, r *http.Request) {
 	return func(w http.ResponseWriter, r *http.Request) {
 		query := r.URL.Query()
@@ -213,6 +237,16 @@ func getProxyDelay(server *Server) func(w http.ResponseWriter, r *http.Request)
 					Delay: delay,
 				})
 			}
+			for _, detour := range server.outbound.Outbounds() {
+				urlTestGroup, isURLTestGroup := detour.(adapter.URLTestGroup)
+				if !isURLTestGroup {
+					continue
+				}
+				if !groupContains(server.outbound, urlTestGroup, realTag, map[string]bool{detour.Tag(): true}) {
+					continue
+				}
+				urlTestGroup.PerformUpdateCheck()
+			}
 		}()
 
 		if ctx.Err() != nil {

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/go.mod

@@ -34,16 +34,16 @@ require (
 	github.com/sagernet/gomobile v0.1.12
 	github.com/sagernet/gvisor v0.0.0-20250811.0-sing-box-mod.1
 	github.com/sagernet/quic-go v0.59.0-sing-box-mod.4
-	github.com/sagernet/sing v0.8.13
+	github.com/sagernet/sing v0.8.14
 	github.com/sagernet/sing-mux v0.3.5
-	github.com/sagernet/sing-quic v0.6.4-0.20260803041914-d83826c306d7
+	github.com/sagernet/sing-quic v0.6.5
 	github.com/sagernet/sing-shadowsocks v0.2.8
 	github.com/sagernet/sing-shadowsocks2 v0.2.1
 	github.com/sagernet/sing-shadowtls v0.2.1
-	github.com/sagernet/sing-tun v0.8.12-0.20260810140523-7c73233bd0fb
+	github.com/sagernet/sing-tun v0.8.15
 	github.com/sagernet/sing-vmess v0.2.8-0.20250909125414-3aed155119a1
 	github.com/sagernet/smux v1.5.50-sing-box-mod.1
-	github.com/sagernet/tailscale v1.92.4-sing-box-1.13-mod.9
+	github.com/sagernet/tailscale v1.92.4-sing-box-1.13-mod.10
 	github.com/sagernet/wireguard-go v0.0.4
 	github.com/sagernet/ws v0.0.0-20231204124109-acfe8907c854
 	github.com/spf13/cobra v1.10.2
@@ -80,7 +80,6 @@ require (
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/gaissmai/bart v0.18.0 // indirect
-	github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/go.sum

@@ -62,8 +62,6 @@ github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=
 github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0=
 github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
 github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
-github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced h1:Q311OHjMh/u5E2TITc++WlTP5We0xNseRMkHDyvhW7I=
-github.com/go-json-experiment/json v0.0.0-20250813024750-ebf49471dced/go.mod h1:TiCD2a1pcmjd7YnhGH0f/zKNcCD06B029pHhzV23c2M=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
@@ -236,26 +234,26 @@ github.com/sagernet/nftables v0.3.0-mod.2 h1:ck2KMU02OxL1eDFgGaWYglMDpoOZ7OHzxje
 github.com/sagernet/nftables v0.3.0-mod.2/go.mod h1:8kslHG4VvYNihcco+i6uxIX7qbT8A56T0y5q7U44ZaQ=
 github.com/sagernet/quic-go v0.59.0-sing-box-mod.4 h1:6qvrUW79S+CrPwWz6cMePXohgjHoKxLo3c+MDhNwc3o=
 github.com/sagernet/quic-go v0.59.0-sing-box-mod.4/go.mod h1:OqILvS182CyOol5zNNo6bguvOGgXzV459+chpRaUC+4=
-github.com/sagernet/sing v0.8.13 h1:yVoXnx9nPxfjlwD4Tp+Wd9zuW2tfiSVrcRDBZNbKRCw=
-github.com/sagernet/sing v0.8.13/go.mod h1:olXxWQNqRW/l2Q6JI3b2Qmz8iQnIFlOeeH8bx6JhgUA=
+github.com/sagernet/sing v0.8.14 h1:S6Netv4F61uNAuD/sUbHnGuNUEPwtL08Ouk0//CVYgM=
+github.com/sagernet/sing v0.8.14/go.mod h1:olXxWQNqRW/l2Q6JI3b2Qmz8iQnIFlOeeH8bx6JhgUA=
 github.com/sagernet/sing-mux v0.3.5 h1:RHnhVEc+SFqkrK4xMygYjDwwLhzp2Bj3lztSukONfhI=
 github.com/sagernet/sing-mux v0.3.5/go.mod h1:QvlKMyNBNrQoyX4x+gq028uPbLM2XeRpWtDsWBJbFSk=
-github.com/sagernet/sing-quic v0.6.4-0.20260803041914-d83826c306d7 h1:D46kmyvKMNVFvL3KXdq3T4vy8r29xCMmSqNuQHJBybE=
-github.com/sagernet/sing-quic v0.6.4-0.20260803041914-d83826c306d7/go.mod h1:K5bWvITOm4vE10fwLfrWpw27bCoVJ+tfQ79tOWg+Ko8=
+github.com/sagernet/sing-quic v0.6.5 h1:DVH4mgPkWhNoc47JK6Q2ePCBXqIG5oJnTB+Fw9laL/M=
+github.com/sagernet/sing-quic v0.6.5/go.mod h1:K5bWvITOm4vE10fwLfrWpw27bCoVJ+tfQ79tOWg+Ko8=
 github.com/sagernet/sing-shadowsocks v0.2.8 h1:PURj5PRoAkqeHh2ZW205RWzN9E9RtKCVCzByXruQWfE=
 github.com/sagernet/sing-shadowsocks v0.2.8/go.mod h1:lo7TWEMDcN5/h5B8S0ew+r78ZODn6SwVaFhvB6H+PTI=
 github.com/sagernet/sing-shadowsocks2 v0.2.1 h1:dWV9OXCeFPuYGHb6IRqlSptVnSzOelnqqs2gQ2/Qioo=
 github.com/sagernet/sing-shadowsocks2 v0.2.1/go.mod h1:RnXS0lExcDAovvDeniJ4IKa2IuChrdipolPYWBv9hWQ=
 github.com/sagernet/sing-shadowtls v0.2.1 h1:ZiHZdnEnP+YS73NMsxiZmIFCwNd0M4k7PkGCKNXhbaM=
 github.com/sagernet/sing-shadowtls v0.2.1/go.mod h1:sWqKnGlMipCHaGsw1sTTlimyUpgzP4WP3pjhCsYt9oA=
-github.com/sagernet/sing-tun v0.8.12-0.20260810140523-7c73233bd0fb h1:WbxqW8U8iCD1o+VuiyETyZm4Vyl86JANzuBtnmp3O+0=
-github.com/sagernet/sing-tun v0.8.12-0.20260810140523-7c73233bd0fb/go.mod h1:QvarqUtHfj1ULaRR+6kZOS/OoCE+pYGq67A5tyIy+dQ=
+github.com/sagernet/sing-tun v0.8.15 h1:YlBDwulG6mpgh4R8Rw3NueAK0eiMQCoZFSztgohfx5c=
+github.com/sagernet/sing-tun v0.8.15/go.mod h1:QvarqUtHfj1ULaRR+6kZOS/OoCE+pYGq67A5tyIy+dQ=
 github.com/sagernet/sing-vmess v0.2.8-0.20250909125414-3aed155119a1 h1:aSwUNYUkVyVvdmBSufR8/nRFonwJeKSIROxHcm5br9o=
 github.com/sagernet/sing-vmess v0.2.8-0.20250909125414-3aed155119a1/go.mod h1:P11scgTxMxVVQ8dlM27yNm3Cro40mD0+gHbnqrNGDuY=
 github.com/sagernet/smux v1.5.50-sing-box-mod.1 h1:XkJcivBC9V4wBjiGXIXZ229aZCU1hzcbp6kSkkyQ478=
 github.com/sagernet/smux v1.5.50-sing-box-mod.1/go.mod h1:NjhsCEWedJm7eFLyhuBgIEzwfhRmytrUoiLluxs5Sk8=
-github.com/sagernet/tailscale v1.92.4-sing-box-1.13-mod.9 h1:ytlmw4f8AOjyJH3SeDMF4j6tQ679W4+dMS0JMl/e7pQ=
-github.com/sagernet/tailscale v1.92.4-sing-box-1.13-mod.9/go.mod h1:p8Ms8FbGlwQJyHb862XmdShTS50fFJ8C71VdO6xvWyk=
+github.com/sagernet/tailscale v1.92.4-sing-box-1.13-mod.10 h1:KpTpzkDQKAlC2PCWB6AcsUQQ3ynnxVz0vY/XEP6HqEo=
+github.com/sagernet/tailscale v1.92.4-sing-box-1.13-mod.10/go.mod h1:mcjmzmnvYguJ8lPFVu46ZueMz8lizGWMUqZMUhhUMoI=
 github.com/sagernet/wireguard-go v0.0.4 h1:w/vHtk7AzMG37+D/uQROBL72Gj/Gj+FHMY5kg4q0CQ4=
 github.com/sagernet/wireguard-go v0.0.4/go.mod h1:hEqi4y5czEg6LYtX2Bpjg+lV0b/J1n+5rA885Z66Mx0=
 github.com/sagernet/ws v0.0.0-20231204124109-acfe8907c854 h1:6uUiZcDRnZSAegryaUGwPC/Fj13JSHwiTftrXhMmYOc=

{sing_box_python-1.13.19 → sing_box_python-1.13.21}/singbox-go/log/export.go

@@ -4,19 +4,23 @@ import (
 	"context"
 	"os"
 	"time"
+
+	"github.com/sagernet/sing/common"
 )
 
 var std ContextLogger
 
 func init() {
-	std = NewDefaultFactory(
+	factory := NewDefaultFactory(
 		context.Background(),
 		Formatter{BaseTime: time.Now()},
 		os.Stderr,
 		"",
 		nil,
 		false,
-	).Logger()
+	)
+	common.Must(factory.Start())
+	std = factory.Logger()
 }
 
 func StdLogger() ContextLogger {