SagerNet / SagerNet/sing-box

1.14.0: implicit default HTTP client warning is still emitted by the API dashboard on a config with no rule-sets

Open
#4,531 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
38.1k
Forks
4.6k
Avg merge
19d 15h
Merged PRs (30d)
1

Description

Operating system

Linux

System version

Debian 12 (bookworm), amd64

Installation type

Original command line program (static binary from the GitHub release), run under systemd

If you are using a graphical client, please provide the version of the client.

N/A

Version
$ sing-box version
sing-box version 1.14.0

Environment: go1.26.7 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_purego
Revision: 0b8995879f29a9b98ee027bc17b75e101445b238
CGO: disabled
Description

implicit default HTTP client using default outbound for remote rule-sets is deprecated in sing-box 1.14.0 and will be removed in sing-box 1.16.0. is still emitted on v1.14.0 (stable) by a configuration that contains no rule-sets at all — route is not even present, so the router never fetches anything remote.

This looks like a second consumer of the same deprecation that #4051 (local-only rule-sets) did not cover; that one was closed as fixed in 1.14.0-alpha.14.

The actual trigger here is the API service dashboard:

  • service/api/dashboard.go — resolveTransport() falls back to httpClientManager.DefaultTransport() whenever d.options.HTTPClient is unset/empty.
  • box.go — the lazy default-client callback passed to httpClientManager.Initialize(...) is where deprecated.Report(ctx, deprecated.OptionImplicitDefaultHTTPClient) lives, so reporting happens for any consumer of the implicit default client, not only for remote rule-sets.
  • The dashboard resolves its transport during startup, so the warning is printed even though the dashboard directory is user-provided and non-empty (auto-update disabled) and therefore has nothing to fetch.

The wording is also misleading in this case: what is deprecated is the implicit default HTTP client (built from the default outbound), while the message implies remote rule-sets are the only trigger.

Expected: no deprecation report when nothing remote is configured — or at least a message that names the actual consumer; and ideally the dashboard should not resolve a transport at all when it serves user-provided files with auto-update disabled.

Reproduction
  1. Provide a non-empty dashboard directory (so auto-update is disabled):
mkdir -p /tmp/sb-repro/dashboard
echo '<html><body>dummy</body></html>' > /tmp/sb-repro/dashboard/index.html
  1. Minimal config — no route, no rule_set, no http_clients — /tmp/sb-repro/config.json:
{
  "log": { "level": "info" },
  "inbounds": [
    { "type": "mixed", "tag": "in", "listen": "127.0.0.1", "listen_port": 12080 }
  ],
  "services": [
    {
      "type": "api",
      "tag": "api",
      "listen": "127.0.0.1",
      "listen_port": 19090,
      "dashboard": { "enabled": true, "path": "/tmp/sb-repro/dashboard" }
    }
  ]
}
  1. Run it:
timeout 6 sing-box run -c /tmp/sb-repro/config.json

  1. The warning is printed on every start, right after the inbounds start and before the dashboard logs that it is serving user-provided files.

  2. Declaring the HTTP client explicitly (the documented migration) removes it — same config plus:

"http_clients": [ { "tag": "direct", "detour": "direct" } ],
"route": { "default_http_client": "direct" }
Logs
$ timeout 6 sing-box run -c /tmp/sb-repro/config.json
INFO[0000] inbound/mixed[in]: tcp server started at 127.0.0.1:12080
INFO[0000] network: updated default interface eth0, index 2
WARN[0000] implicit default HTTP client using default outbound for remote rule-sets is deprecated in sing-box 1.14.0 and will be removed in sing-box 1.16.0.
INFO[0000] service/api[api]: tcp server started at 127.0.0.1:19090
INFO[0000] sing-box started (0.01s)
INFO[0000] service/api[api]: dashboard: serving user-provided files at /tmp/sb-repro/dashboard, auto-update disabled

Same config with http_clients + route.default_http_client declared:

$ timeout 6 sing-box run -c /tmp/sb-repro/config-fixed.json
INFO[0000] inbound/mixed[in]: tcp server started at 127.0.0.1:12080
INFO[0000] network: updated default interface eth0, index 2
INFO[0000] service/api[api]: tcp server started at 127.0.0.1:19090
INFO[0000] sing-box started (0.00s)
INFO[0000] service/api[api]: dashboard: serving user-provided files at /tmp/sb-repro/dashboard, auto-update disabled

No WARN line — only the implicit-client path reports it.

Supporter
Integrity requirements
  • I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
  • I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
  • I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
  • I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read service/api/dashboard.go, especially resolveTransport(), and box.go where httpClientManager.Initialize receives the lazy default-client callback. Reproduce the minimal configuration with a non-empty dashboard directory and no rule-sets, then verify the dashboard does not report the implicit default HTTP-client deprecation when auto-update is disabled, while the documented explicit-client configuration remains unaffected.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.