diff --git a/core/config_compat_test.go b/core/config_compat_test.go
index c8832b2..c053195 100644
--- a/core/config_compat_test.go
+++ b/core/config_compat_test.go
@@ -125,13 +125,15 @@ func TestConfigCompat(t *testing.T) {
 	}
 }
 
-// TestConfigCompatClean asserts that the post-migration shapes produced by
-// database.migrateSingBox114 start without any deprecation warning, so the
-// migration is known to actually resolve what it claims to.
+// TestConfigCompatClean builds each config in testdata/clean and asserts it
+// raises no deprecation warning. It covers the post-migration shapes produced
+// by database.migrateSingBox114, so the migration is known to actually resolve
+// what it claims to.
 //
-// These configs are only constructed, not started: an ACME provider would try
-// to reach Let's Encrypt on start. Every deprecation these shapes could raise
-// is reported while the box is being built.
+// These configs are built but not started, which is what lets them cover cases
+// TestConfigCompat cannot: an ACME provider would reach out to Let's Encrypt on
+// start, and a bridge outbound needs privileges to create its tun. Every
+// deprecation these shapes could raise is reported while the box is built.
 func TestConfigCompatClean(t *testing.T) {
 	acmeDir := t.TempDir()
 	cacheDir := t.TempDir()
diff --git a/core/testdata/clean/bridge.json b/core/testdata/clean/bridge.json
new file mode 100644
index 0000000..2891bc8
--- /dev/null
+++ b/core/testdata/clean/bridge.json
@@ -0,0 +1,16 @@
+{
+  "log": {
+    "level": "error"
+  },
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "bridge",
+      "tag": "bridge-out",
+      "bridge_name": "sing-bridge"
+    }
+  ]
+}
diff --git a/core/testdata/configs/11-new-protocols.json b/core/testdata/configs/11-new-protocols.json
new file mode 100644
index 0000000..f3df5c7
--- /dev/null
+++ b/core/testdata/configs/11-new-protocols.json
@@ -0,0 +1,46 @@
+{
+  "log": {
+    "level": "error"
+  },
+  "inbounds": [
+    {
+      "type": "snell",
+      "tag": "snell-v6-in",
+      "listen": "127.0.0.1",
+      "listen_port": 42101,
+      "version": 6,
+      "psk": "snell-pre-shared-key",
+      "mode": "default"
+    },
+    {
+      "type": "snell",
+      "tag": "snell-v5-in",
+      "listen": "127.0.0.1",
+      "listen_port": 42102,
+      "version": 5,
+      "psk": "snell-pre-shared-key",
+      "obfs_mode": "http"
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    },
+    {
+      "type": "snell",
+      "tag": "snell-out",
+      "server": "127.0.0.1",
+      "server_port": 42101,
+      "version": 6,
+      "psk": "snell-pre-shared-key"
+    }
+  ],
+  "services": [
+    {
+      "type": "oom-killer",
+      "tag": "oom",
+      "memory_limit": "1gb"
+    }
+  ]
+}
diff --git a/frontend b/frontend
index 5d44a11..8a92bc9 160000
--- a/frontend
+++ b/frontend
@@ -1 +1 @@
-Subproject commit 5d44a115504f465b937e43b4c5a79445846a4e85
+Subproject commit 8a92bc920d501f73f6927eca6a1dd8ca73e895a9