Ghostunnel Files

Maintenance release.

New Features

• Software Bill of Materials. Starting with this release, every binary attached to a GitHub release ships with an SBOM next to it, in both SPDX 2.3 and CycloneDX JSON format, generated from the compiled binary itself so it reflects exactly what was linked in. Docker images from this release onward carry a BuildKit SBOM attestation covering both the Ghostunnel binary and the base image packages. Earlier releases are unchanged. The new sbom:generate build target produces the same documents locally (requires Syft). See the SBOM docs for where to find them and how to inspect them (#824).

Bug Fixes

• Windows connection resets no longer logged as errors. On Windows a socket reset surfaces as the WSA errno WSAECONNRESET (10054) rather than ECONNRESET, so a peer resetting the connection during teardown was counted as a copy error and logged as such instead of being treated as a routine close, as it already was on Unix. Both are now recognized (#817).
• Spurious "server closed" error on shutdown. The status port no longer logs http: Server closed as an error during a graceful shutdown (#817).

Other

• Dependency upgrades. All Go dependencies updated to their latest versions, including OPA v1.21.2, grpc v1.84.0, certmagic v0.25.6, go-spiffe v2.9.0, go-landlock v0.10.1, and prometheus/client_golang v1.25.0 (#818, [#821], [#833]).
• Build tooling. golangci-lint moved into a separate tools/ Go module so its dependency graph no longer constrains Ghostunnel's own, and was bumped to v2.14.0 (#833). Spellcheck now also runs on comments and error strings (#817).