xtls/xray-core: technical due diligence, read from its repository

The median source file here is 97 lines. 6 files exceed 1,000 lines, the largest being 1,308. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: CI workflows. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

6 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.

The newest was published on 2026-07-10. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. None of them affects the surveyed version.