Merge tag 'v1.13.14' into extended

Integrate upstream sing-box v1.13.14 (18 commits, v1.13.12..v1.13.14).

Conflict resolutions:
- Makefile: keep fork's upload_android (no otherLegacy, codeberg-release.sh),
  add upstream's SFA-version-metadata.json step.
- go.sum: regenerated via go mod tidy from merged go.mod.
- transport/wireguard/endpoint_options.go: keep fork fields, add ICMPTimeout.
- clients/android, clients/apple: keep fork's submodule pointers.

.github/CRONET_GO_VERSION

@@ -1 +1 @@
-2faf34666c2cc8234f10f2ab6d4c4d6104d34ae2
+98d539ce67568fb911654e66a14cf4247ed833ec

.github/setup_go_for_macos1013.sh

@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-VERSION="1.25.9"
+VERSION="1.25.10"
 PATCH_COMMITS=(
   "afe69d3cec1c6dcf0f1797b20546795730850070"
   "1ed289b0cf87dc5aae9c6fe1aa5f200a83412938"

.github/setup_go_for_windows7.sh

@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-VERSION="1.25.9"
+VERSION="1.25.10"
 PATCH_COMMITS=(
   "466f6c7a29bc098b0d4c987b803c779222894a11"
   "1bdabae205052afe1dadb2ad6f1ba612cdbc532a"

.github/workflows/build.yml

@@ -47,7 +47,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: ~1.25.9
+          go-version: ~1.25.10
       - name: Check input version
         if: github.event_name == 'workflow_dispatch'
         run: |-
@@ -124,7 +124,7 @@ jobs:
         if: ${{ ! matrix.legacy_win7 }}
         uses: actions/setup-go@v5
         with:
-          go-version: ~1.25.9
+          go-version: ~1.25.10
       - name: Cache Go for Windows 7
         if: matrix.legacy_win7
         id: cache-go-for-windows7
@@ -240,7 +240,8 @@ jobs:
         if: matrix.variant == 'purego' && matrix.naive
         run: |
           cd ~/cronet-go
-          CGO_ENABLED=0 go run -v ./cmd/build-naive extract-lib --target ${{ matrix.os }}/${{ matrix.arch }} -o $GITHUB_WORKSPACE/dist
+          CGO_ENABLED=0 go build -v -o "$RUNNER_TEMP/build-naive" ./cmd/build-naive
+          GOPROXY=direct GOSUMDB=off "$RUNNER_TEMP/build-naive" extract-lib --target ${{ matrix.os }}/${{ matrix.arch }} -o $GITHUB_WORKSPACE/dist
       - name: Build (glibc)
         if: matrix.variant == 'glibc'
         run: |
@@ -594,8 +595,15 @@ jobs:
         if: matrix.naive
         run: |
           $CRONET_GO_VERSION = Get-Content .github/CRONET_GO_VERSION
+          git init "$env:RUNNER_TEMP/cronet-go"
+          git -C "$env:RUNNER_TEMP/cronet-go" remote add origin https://github.com/sagernet/cronet-go.git
+          git -C "$env:RUNNER_TEMP/cronet-go" fetch --depth=1 origin "$CRONET_GO_VERSION"
+          git -C "$env:RUNNER_TEMP/cronet-go" checkout FETCH_HEAD
           $env:CGO_ENABLED = "0"
-          go run -v "github.com/sagernet/cronet-go/cmd/build-naive@$CRONET_GO_VERSION" extract-lib --target windows/${{ matrix.arch }} -o dist
+          go -C "$env:RUNNER_TEMP/cronet-go" build -v -o "$env:RUNNER_TEMP/build-naive.exe" ./cmd/build-naive
+          $env:GOPROXY = "direct"
+          $env:GOSUMDB = "off"
+          & "$env:RUNNER_TEMP/build-naive.exe" extract-lib --target windows/${{ matrix.arch }} -o dist
       - name: Archive
         if: matrix.naive
         run: |
@@ -641,7 +649,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: ~1.25.9
+          go-version: ~1.25.10
       - name: Setup Android NDK
         id: setup-ndk
         uses: nttld/setup-ndk@v1
@@ -673,6 +681,10 @@ jobs:
         run: |-
           cd clients/android
           git checkout dev
+      - name: Checkout submodule recursive
+        run: |-
+          cd clients/android
+          git submodule update --init --recursive -v
       - name: Gradle cache
         uses: actions/cache@v4
         with:
@@ -731,7 +743,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: ~1.25.9
+          go-version: ~1.25.10
       - name: Setup Android NDK
         id: setup-ndk
         uses: nttld/setup-ndk@v1
@@ -830,7 +842,7 @@ jobs:
         if: matrix.if
         uses: actions/setup-go@v5
         with:
-          go-version: ~1.25.9
+          go-version: ~1.25.10
       - name: Set tag
         if: matrix.if
         run: |-

.github/workflows/docker.yml

@@ -55,7 +55,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: ~1.25.9
+          go-version: ~1.25.10
       - name: Clone cronet-go
         if: matrix.naive
         run: |

.github/workflows/linux.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: ~1.25.9
+          go-version: ~1.25.10
       - name: Check input version
         if: github.event_name == 'workflow_dispatch'
         run: |-
@@ -72,7 +72,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: ~1.25.9
+          go-version: ~1.25.10
       - name: Clone cronet-go
         if: matrix.naive
         run: |