Merge tag 'v1.14.1'

.github/CRONET_GO_VERSION

@@ -1 +1 @@
-45832ab074849607406baa3e3a2c4660274602ed
+0d28acc44093df24b2526dea3d6ffefd6b0a54f0

.github/go_ios_cpu_features.patch

@@ -0,0 +1,28 @@
+--- a/src/internal/cpu/cpu_arm64_ios.go
++++ b/src/internal/cpu/cpu_arm64_ios.go
+@@ -0,0 +1,14 @@
++// Copyright 2020 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++//go:build arm64 && ios
++
++package cpu
++
++func osInit() {
++	ARM64.HasAES = true
++	ARM64.HasPMULL = true
++	ARM64.HasSHA1 = true
++	ARM64.HasSHA2 = true
++}
+--- a/src/internal/cpu/cpu_arm64_other.go
++++ b/src/internal/cpu/cpu_arm64_other.go
+@@ -2,7 +2,7 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build arm64 && !linux && !freebsd && !android && (!darwin || ios) && !openbsd
++//go:build arm64 && !linux && !freebsd && !android && !darwin && !openbsd
+ 
+ package cpu
+ 

.github/patch_go_for_ios.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Go's internal/cpu never detects ARM64 features on GOOS=ios, so crypto/aes,
+# AES-GCM and crypto/sha256 use their generic implementations on iOS and tvOS.
+# See https://github.com/SagerNet/sing-box/issues/4486
+#
+# Only the ARMv8.0 cryptographic extensions are asserted; ARMv8.1 atomics and
+# SHA-512 are absent on the A8/A9 devices still supported by the deployment targets.
+#
+# Remove once the Go release used by the Apple library build includes the fix.
+
+export GOTOOLCHAIN=local
+
+GOROOT="$(go env GOROOT)"
+PATCH_FILE="$(cd "$(dirname "$0")" && pwd)/go_ios_cpu_features.patch"
+
+cd "$GOROOT"
+if [[ -f src/internal/cpu/cpu_arm64_ios.go ]]; then
+  echo "already patched"
+else
+  patch --verbose -p1 < "$PATCH_FILE"
+fi
+
+CPU_FILES="$(GOOS=ios GOARCH=arm64 CGO_ENABLED=0 go list -f '{{.GoFiles}}' internal/cpu)"
+echo "internal/cpu files for ios/arm64: $CPU_FILES"
+case "$CPU_FILES" in
+*cpu_arm64_ios.go*) ;;
+*)
+  echo "patch is not effective" >&2
+  exit 1
+  ;;
+esac

.github/setup_go_for_macos1013.sh

@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-VERSION="1.26.7"
+VERSION="1.26.8"
 PATCH_COMMITS=(
   "f080b0c6346eb690c0dc82497b35925f385b35ac"
   "2d9c12887c342fb9051d231aa5388743cb7e9cb6"

.github/setup_go_for_windows7.sh

@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-VERSION="1.26.7"
+VERSION="1.26.8"
 PATCH_COMMITS=(
   "a4ae550aa148b04c9d4890e98bee63aede5c4b53"
   "95b851f661584711faa8115b3234a461044f4510"

.github/workflows/build.yml

@@ -54,7 +54,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         uses: actions/cache/restore@v4
@@ -145,7 +145,7 @@ jobs:
         if: ${{ ! matrix.legacy_win7 }}
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         uses: actions/cache/restore@v4
@@ -160,7 +160,7 @@ jobs:
         with:
           path: |
             ~/go/go_win7
-          key: go_win7_1267
+          key: go_win7_1268
       - name: Setup Go for Windows 7
         if: matrix.legacy_win7 && steps.cache-go-for-windows7.outputs.cache-hit != 'true'
         env:
@@ -488,7 +488,7 @@ jobs:
         if: ${{ ! matrix.legacy_osx }}
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         uses: actions/cache/restore@v4
@@ -503,7 +503,7 @@ jobs:
         with:
           path: |
             ~/go/go_osx
-          key: go_osx_1267
+          key: go_osx_1268
       - name: Setup Go for macOS 10.13
         if: matrix.legacy_osx && steps.cache-go-for-macos1013.outputs.cache-hit != 'true'
         env:
@@ -587,7 +587,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         uses: actions/cache@v4
@@ -690,7 +690,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         uses: actions/cache@v4
@@ -754,7 +754,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         uses: actions/cache/restore@v4
@@ -862,7 +862,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         uses: actions/cache/restore@v4
@@ -975,7 +975,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         uses: actions/cache@v4
@@ -1087,7 +1087,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         uses: actions/cache@v4
@@ -1244,8 +1244,11 @@ jobs:
         if: matrix.build
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
+      - name: Patch Go for iOS
+        if: matrix.build && (matrix.platform == 'ios/arm64' || matrix.platform == 'tvos/arm64')
+        run: .github/patch_go_for_ios.sh
       - name: Cache Go modules
         if: matrix.build
         uses: actions/cache@v4
@@ -1258,13 +1261,15 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ~/Library/Caches/go-build
-          key: libbox-go-build-${{ matrix.artifact }}-1.26.7-${{ hashFiles('go.sum') }}
-          restore-keys: libbox-go-build-${{ matrix.artifact }}-1.26.7-
+          key: libbox-go-build-${{ matrix.artifact }}-1.26.8-${{ hashFiles('go.sum') }}
+          restore-keys: libbox-go-build-${{ matrix.artifact }}-1.26.8-
       - name: Set tag
         if: matrix.build
         run: git tag v${{ needs.calculate_version.outputs.version }} -f
       - name: Build library
         if: matrix.build
+        env:
+          GOTOOLCHAIN: local
         run: |-
           make lib_install
           export PATH="$PATH:$(go env GOPATH)/bin"
@@ -1326,7 +1331,7 @@ jobs:
         if: matrix.if
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
           cache: false
       - name: Cache Go modules
         if: matrix.if
@@ -1370,10 +1375,10 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ${{ matrix.type == 'standalone' && 'clients/apple/build/SFM.System-*.dd' || matrix.type == 'jailbreak' && 'clients/apple/build/jailbreak/DerivedData' || format('{0}/DerivedData', runner.temp) }}
-          key: apple-derived-data-${{ matrix.type }}-${{ matrix.platform }}-${{ matrix.variant || 'default' }}-${{ hashFiles('clients/apple/sing-box.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}-${{ github.sha }}
+          key: apple-derived-data-${{ matrix.type }}-${{ matrix.platform }}-${{ matrix.variant || 'default' }}-${{ github.ref_name }}-${{ hashFiles('clients/apple/sing-box.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}-${{ github.sha }}
           restore-keys: |
-            apple-derived-data-${{ matrix.type }}-${{ matrix.platform }}-${{ matrix.variant || 'default' }}-${{ hashFiles('clients/apple/sing-box.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}-
-            apple-derived-data-${{ matrix.type }}-${{ matrix.platform }}-${{ matrix.variant || 'default' }}-
+            apple-derived-data-${{ matrix.type }}-${{ matrix.platform }}-${{ matrix.variant || 'default' }}-${{ github.ref_name }}-${{ hashFiles('clients/apple/sing-box.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved') }}-
+            apple-derived-data-${{ matrix.type }}-${{ matrix.platform }}-${{ matrix.variant || 'default' }}-${{ github.ref_name }}-
       - name: Setup App Store Connect key
         if: matrix.if && matrix.type != 'jailbreak' && github.event_name == 'workflow_dispatch'
         run: |-

.github/workflows/docker.yml

@@ -55,7 +55,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
       - name: Clone cronet-go
         if: matrix.naive
         run: |

.github/workflows/linux.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
       - name: Check input version
         if: github.event_name == 'workflow_dispatch'
         run: |-
@@ -72,7 +72,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.26.7
+          go-version: 1.26.8
       - name: Clone cronet-go
         if: matrix.naive
         run: |