Baike.dev
Log in
Back to tool/Back to issues
#4531·sing-box

1.14.0: implicit default HTTP client warning is still emitted by the API dashboard on a config with no rule-sets

Author: adaebeaCreated Sep 14, 2026Updated Sep 16, 2026
Labelsbug

Operating system

Linux

System version

Debian 12 (bookworm), amd64

Installation type

Original command line program (static binary from the GitHub release), run under systemd

If you are using a graphical client, please provide the version of the client.

N/A

Version

bash
$ sing-box version
sing-box version 1.14.0

Environment: go1.26.7 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_purego
Revision: 0b8995879f29a9b98ee027bc17b75e101445b238
CGO: disabled

Description

implicit default HTTP client using default outbound for remote rule-sets is deprecated in sing-box 1.14.0 and will be removed in sing-box 1.16.0. is still emitted on v1.14.0 (stable) by a configuration that contains no rule-sets at all — route is not even present, so the router never fetches anything remote.

This looks like a second consumer of the same deprecation that #4051 (local-only rule-sets) did not cover; that one was closed as fixed in 1.14.0-alpha.14.

The actual trigger here is the API service dashboard:

  • service/api/dashboard.go — resolveTransport() falls back to httpClientManager.DefaultTransport() whenever d.options.HTTPClient is unset/empty.
  • box.go — the lazy default-client callback passed to httpClientManager.Initialize(...) is where deprecated.Report(ctx, deprecated.OptionImplicitDefaultHTTPClient) lives, so reporting happens for any consumer of the implicit default client, not only for remote rule-sets.
  • The dashboard resolves its transport during startup, so the warning is printed even though the dashboard directory is user-provided and non-empty (auto-update disabled) and therefore has nothing to fetch.

The wording is also misleading in this case: what is deprecated is the implicit default HTTP client (built from the default outbound), while the message implies remote rule-sets are the only trigger.

Expected: no deprecation report when nothing remote is configured — or at least a message that names the actual consumer; and ideally the dashboard should not resolve a transport at all when it serves user-provided files with auto-update disabled.

Reproduction

  1. Provide a non-empty dashboard directory (so auto-update is disabled):
bash
mkdir -p /tmp/sb-repro/dashboard
echo '<html><body>dummy</body></html>' > /tmp/sb-repro/dashboard/index.html
  1. Minimal config — no route, no rule_set, no http_clients — /tmp/sb-repro/config.json:
json
{
  "log": { "level": "info" },
  "inbounds": [
    { "type": "mixed", "tag": "in", "listen": "127.0.0.1", "listen_port": 12080 }
  ],
  "services": [
    {
      "type": "api",
      "tag": "api",
      "listen": "127.0.0.1",
      "listen_port": 19090,
      "dashboard": { "enabled": true, "path": "/tmp/sb-repro/dashboard" }
    }
  ]
}
  1. Run it:
bash
timeout 6 sing-box run -c /tmp/sb-repro/config.json

  1. The warning is printed on every start, right after the inbounds start and before the dashboard logs that it is serving user-provided files.

  2. Declaring the HTTP client explicitly (the documented migration) removes it — same config plus:

json
"http_clients": [ { "tag": "direct", "detour": "direct" } ],
"route": { "default_http_client": "direct" }

Logs

$ timeout 6 sing-box run -c /tmp/sb-repro/config.json
INFO[0000] inbound/mixed[in]: tcp server started at 127.0.0.1:12080
INFO[0000] network: updated default interface eth0, index 2
WARN[0000] implicit default HTTP client using default outbound for remote rule-sets is deprecated in sing-box 1.14.0 and will be removed in sing-box 1.16.0.
INFO[0000] service/api[api]: tcp server started at 127.0.0.1:19090
INFO[0000] sing-box started (0.01s)
INFO[0000] service/api[api]: dashboard: serving user-provided files at /tmp/sb-repro/dashboard, auto-update disabled

Same config with http_clients + route.default_http_client declared:

$ timeout 6 sing-box run -c /tmp/sb-repro/config-fixed.json
INFO[0000] inbound/mixed[in]: tcp server started at 127.0.0.1:12080
INFO[0000] network: updated default interface eth0, index 2
INFO[0000] service/api[api]: tcp server started at 127.0.0.1:19090
INFO[0000] sing-box started (0.00s)
INFO[0000] service/api[api]: dashboard: serving user-provided files at /tmp/sb-repro/dashboard, auto-update disabled

No WARN line — only the implicit-client path reports it.

Supporter

Integrity requirements

  • I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
  • I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
  • I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
  • I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Source: SagerNet/sing-box

View original on GitHubView discussion on GitHub