MHSanaei 2c18cbe1cd fix(sub): close a deleted host binding only on the inbound it served ...

Deleting the only host a client was bound to blanked that client on every
inbound. Once the host row was gone, the binding could no longer say which
inbound it guarded, so it failed closed everywhere: a client on inbounds A
and B, bound to one host on A, lost B's link the moment that host was
deleted, and nothing in the panel hinted at it.

Every host delete (host groups, the externalProxy sync, inbound deletion,
the depleted-inbound sweep and the orphan prune) now goes through
database.DeleteHosts, which keeps each deleted host's inbound in
host_tombstones in the same transaction. A binding to a deleted host closes
only that inbound; ids that resolve to no host at all still fail closed
everywhere. The Postgres Host step now runs the deletion cases as well.

2026-10-24 20:07:55 +02:00

..

claude

feat(i18n): add the Slovak (sk-SK) panel locale (#6889)

2026-10-24 07:35:28 +02:00

ISSUE_TEMPLATE

fix(ci): resync the bot prompts with the repo and close the gaps an audit found

2026-08-17 02:41:21 +02:00

workflows

fix(sub): close a deleted host binding only on the inbound it served

2026-10-24 20:07:55 +02:00

dependabot.yml

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)

2026-05-13 12:52:52 +02:00

FUNDING.yml

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00

pull_request_template.md

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00