cppla · dependabot · Aug 22, 2026 · Aug 22, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -13,6 +13,30 @@ updates:
           - minor
           - patch
 
+  - package-ecosystem: gomod
+    directory: /third_party/hysteria-core
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    groups:
+      hardened-core-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: gomod
+    directory: /third_party/quic-go
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    groups:
+      hardened-quic-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
   - package-ecosystem: github-actions
     directory: /
     schedule:
@@ -24,6 +48,11 @@ updates:
         update-types:
           - minor
           - patch
+        exclude-patterns:
+          - github/codeql-action/*
+      codeql-actions:
+        patterns:
+          - github/codeql-action/*
 
   - package-ecosystem: docker
     directory: /

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -22,21 +22,36 @@ jobs:
       matrix:
         go: [1.25.x, 1.27.x]
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ matrix.go }}
           cache: true
       - name: Verify formatting
         run: make fmt-check
+      - name: Verify local-fork provenance
+        run: make fork-provenance-check
       - name: Verify module files
         run: make mod-check
+      - name: Verify third-party notices
+        run: make notices-check
       - name: Vet
         run: make vet
       - name: Test with coverage
         run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
+      - name: Test hardened Hysteria module
+        working-directory: third_party/hysteria-core
+        run: go test -shuffle=on -count=1 ./...
+      - name: Test hardened QUIC core, HTTP/3, and RFC 9002 recovery
+        working-directory: third_party/quic-go
+        run: |
+          go test -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
+          go test -shuffle=on -count=1 ./http3 ./internal/ackhandler
+      - name: Test Chrome fingerprint, datagrams, and path MTU discovery
+        working-directory: third_party/quic-go
+        run: go test -shuffle=on -count=1 ./integrationtests/self -run '^(TestChromeParrot|TestDatagram(Negotiation|SizeLimit)|TestPathMTUDiscovery)'
       - name: Upload coverage
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-go-${{ matrix.go }}
           path: coverage.out
@@ -46,24 +61,32 @@ jobs:
     name: Race detector
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.27.x
           cache: true
       - run: make race
+      - name: Race-test hardened Hysteria resource limits
+        working-directory: third_party/hysteria-core
+        run: go test -race -shuffle=on -count=1 ./client ./server ./internal/frag ./internal/protocol ./internal/congestion/...
+      - name: Race-test hardened QUIC admission and loss recovery
+        working-directory: third_party/quic-go
+        run: |
+          go test -race -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
+          go test -race -shuffle=on -count=1 ./http3 ./internal/ackhandler
 
   vulnerability-scan:
     name: Reachable vulnerability scan
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.27.x
           cache: true
       - name: Run govulncheck
-        run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
+        run: ./scripts/govulncheck.sh
 
   build:
     name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
@@ -74,19 +97,27 @@ jobs:
         include:
           - goos: linux
             goarch: amd64
-            output: autocar-linux-amd64
+            artifact: autocar-linux-amd64
+            binary: autocar
+            archive: autocar-linux-amd64.tar.gz
           - goos: linux
             goarch: arm64
-            output: autocar-linux-arm64
+            artifact: autocar-linux-arm64
+            binary: autocar
+            archive: autocar-linux-arm64.tar.gz
           - goos: darwin
             goarch: arm64
-            output: autocar-darwin-arm64
+            artifact: autocar-darwin-arm64
+            binary: autocar
+            archive: autocar-darwin-arm64.tar.gz
           - goos: windows
             goarch: amd64
-            output: autocar-windows-amd64.exe
+            artifact: autocar-windows-amd64
+            binary: autocar.exe
+            archive: autocar-windows-amd64.zip
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.27.x
           cache: true
@@ -96,19 +127,26 @@ jobs:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
         run: |
-          mkdir -p dist
-          go build -trimpath -o "dist/${{ matrix.output }}" ./cmd/autocar
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+          mkdir -p dist/package
+          go build -trimpath -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
+          cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
+          if [ "${{ matrix.goos }}" = "windows" ]; then
+            (cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
+          else
+            tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
+          fi
+          test -s "dist/${{ matrix.archive }}"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: ${{ matrix.output }}
-          path: dist/${{ matrix.output }}
+          name: ${{ matrix.artifact }}
+          path: dist/${{ matrix.archive }}
           if-no-files-found: error
 
   container:
     name: Multi-platform container build
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build OCI image index
         run: |
           docker buildx create --name autocar-ci --driver docker-container --use

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -22,17 +22,17 @@ jobs:
     name: Analyze Go
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.27.x
           cache: true
-      - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: go
           build-mode: manual
       - name: Build
         run: go build -o /tmp/autocar-codeql ./cmd/autocar
-      - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: /language:go
diff --git a/.github/workflows/netem.yml b/.github/workflows/netem.yml
@@ -19,8 +19,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.27.x
           cache: true
@@ -32,7 +32,7 @@ jobs:
         run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
       - name: Publish measurements and diagnostics
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: netem-results
           path: artifacts/netem

diff --git a/Dockerfile b/Dockerfile
@@ -12,6 +12,9 @@ WORKDIR /src
 RUN apk add --no-cache ca-certificates
 
 COPY go.mod go.sum ./
+# Local replace directives are resolved during go mod download, so make the
+# audited module forks available before dependency resolution.
+COPY third_party ./third_party
 RUN go mod download
 
 COPY . .
@@ -23,11 +26,13 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
 FROM --platform=$TARGETPLATFORM scratch
 
 LABEL org.opencontainers.image.source="https://github.com/cppla/autocar" \
-      org.opencontainers.image.description="Authenticated dual-ended QUIC/TLS TCP proxy" \
-      org.opencontainers.image.licenses="Apache-2.0"
+      org.opencontainers.image.description="Secure dual-ended QUIC/TLS TCP and UDP accelerator" \
+      org.opencontainers.image.licenses="MIT"
 
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build --chown=65532:65532 /out/autocar /autocar
+COPY --from=build /src/LICENSE /licenses/autocar-LICENSE
+COPY --from=build /src/THIRD_PARTY_NOTICES.md /licenses/THIRD_PARTY_NOTICES.md
 
 USER 65532:65532
 EXPOSE 8443/tcp 8443/udp 1080/tcp 8080/tcp

diff --git a/Makefile b/Makefile
@@ -8,24 +8,37 @@ LDFLAGS := -s -w \
 	-X github.com/cppla/autocar/internal/version.Commit=$(COMMIT) \
 	-X github.com/cppla/autocar/internal/version.Date=$(BUILD_DATE)
 
-.PHONY: all check fmt fmt-check mod-check vet test race build cross-build docker integration-netem clean
+.PHONY: all check fmt fmt-check fork-provenance-check mod-check notices notices-check vet test race build cross-build release docker integration-netem clean
 
 all: check build
 
-check: fmt-check mod-check vet test
+check: fmt-check fork-provenance-check mod-check notices-check vet test
 
 fmt:
 	$(GO) fmt ./...
 
 fmt-check:
 	@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "Go files need formatting" >&2; exit 1; }
 
+fork-provenance-check:
+	./scripts/check-fork-provenance.sh
+
 mod-check:
 	$(GO) mod tidy
-	git diff --exit-code -- go.mod go.sum
+	cd third_party/hysteria-core && $(GO) mod tidy
+	cd third_party/quic-go && $(GO) mod tidy
+	git diff --exit-code -- go.mod go.sum third_party/hysteria-core/go.mod third_party/hysteria-core/go.sum third_party/quic-go/go.mod third_party/quic-go/go.sum
+
+notices:
+	$(GO) run ./tools/notices
+
+notices-check:
+	$(GO) run ./tools/notices -check
 
 vet:
 	$(GO) vet ./...
+	cd third_party/hysteria-core && $(GO) vet ./...
+	cd third_party/quic-go && $(GO) vet . ./http3 ./internal/ackhandler
 
 test:
 	$(GO) test -shuffle=on -count=1 ./...
@@ -37,12 +50,29 @@ build:
 	mkdir -p $(dir $(BINARY))
 	CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/autocar
 
-cross-build:
+cross-build: notices-check
 	mkdir -p dist
-	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-amd64 ./cmd/autocar
-	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-arm64 ./cmd/autocar
-	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-darwin-arm64 ./cmd/autocar
-	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-windows-amd64.exe ./cmd/autocar
+	rm -f dist/autocar-linux-amd64 dist/autocar-linux-arm64 dist/autocar-darwin-arm64 dist/autocar-windows-amd64.exe
+	rm -rf dist/.release-stage-autocar
+	mkdir -p dist/.release-stage-autocar/autocar-linux-amd64
+	mkdir -p dist/.release-stage-autocar/autocar-linux-arm64
+	mkdir -p dist/.release-stage-autocar/autocar-darwin-arm64
+	mkdir -p dist/.release-stage-autocar/autocar-windows-amd64
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-amd64/autocar ./cmd/autocar
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-arm64/autocar ./cmd/autocar
+	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-darwin-arm64/autocar ./cmd/autocar
+	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-windows-amd64/autocar.exe ./cmd/autocar
+	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-amd64/
+	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-arm64/
+	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-darwin-arm64/
+	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-windows-amd64/
+	tar -C dist/.release-stage-autocar/autocar-linux-amd64 -czf dist/autocar-linux-amd64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
+	tar -C dist/.release-stage-autocar/autocar-linux-arm64 -czf dist/autocar-linux-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
+	tar -C dist/.release-stage-autocar/autocar-darwin-arm64 -czf dist/autocar-darwin-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
+	cd dist/.release-stage-autocar/autocar-windows-amd64 && zip -q -X ../../autocar-windows-amd64.zip autocar.exe LICENSE THIRD_PARTY_NOTICES.md
+	rm -rf dist/.release-stage-autocar
+
+release: cross-build
 
 docker:
 	docker build --build-arg VERSION="$(VERSION)" --build-arg COMMIT="$(COMMIT)" --build-arg BUILD_DATE="$(BUILD_DATE)" -t autocar:local .