Release created at Fri Nov 6 11:18:53 CST 2026
Synchronize Alpha branch code updates, keeping only the latest version


我应该下载哪个文件? / Which file should I download?
二进制文件筛选 / Binary file selector
查看文档 / Docs

What's Changed

• chore: allow mieru inbound to actively close idle TCP connection by @enfein in #3354
• fix: prevent SOCKS domain length arithmetic overflow by @SaladDay in #3359
• feat: add ss-password generation functionality to the command line tool by @Zephyruso in #3372
• fix: keep bytes that arrive with the HTTP proxy's CONNECT response by @gtoxlili in #3382
• feat: add Snell version 6 support (outbound + inbound) by @hungrybirder in #3410
• fix(easytier): drain unused host packets to prevent data-plane stalls by @Chikage0o0 in #3400
• fix: convert httpupgrade share links to ws with v2ray-http-upgrade by @Dv2Corn in #3415
• feat: support multiple users for shadowsocks listener by @RomanovCaesar in #3383

New Contributors

• @SaladDay made their first contribution in #3359
• @gtoxlili made their first contribution in #3382
• @hungrybirder made their first contribution in #3410
• @Chikage0o0 made their first contribution in #3400
• @Dv2Corn made their first contribution in #3415

Full Changelog: v1.19.33...Prerelease-Alpha

What's Changed

• 2df147b feat: support dns-mode for tun (#3288) by @chenx Dust

BUG & Fix

• 349af19 fix: the embedded shadowsocks listener can't be closed (#3314) by @token
• 8010193 fix: bound doh dials so ones the query gave up on cannot pile up (#3274) by @Cassian433
• 94b13ae fix: dialer-proxy cycle check takes quadratic time and memory (#3315) by @token
• c4e8186 fix: CVE-2026-97031 for crypto/tls by @wwqgtxx
• df1b07a fix: a sub-millisecond URL test is reported as a failure (#3316) by @token
• e4dd968 fix: keep fake-ip allocation state when cloning the pool on reload (#3283) by @younes Beriane
• 1354e52 fix: unpassed loadbalance test by @wwqgtxx

Maintenance

• 3f27ef3 chore: refactored and fixed issues for sudoku while also improving performance (#3333) by @saba-futai
• 9f053c4 chore: lazy init wireguard device and stack by @wwqgtxx
• bc76c13 chore: update mieru version (#3304) by @enfein

Full Changelog: v1.19.32...v1.19.33

What's Changed

• 3025efa feat: add load-balance hash-key to pin a session on the inbound user (#3133) by @简直蠢丶

BUG & Fix

• 409ee57 fix: populate HWCap from auxv on linux by @artbred
• 41b8a05 fix: account for TCP options in effective MSS by @wwqgtxx
• 5019cc0 fix: potential race condition in c.idleSession.Len() in idleCleanupExpTime() for anytls (#3225) by @chenx Dust
• 60f70ce fix: align unconnected UDP and raw IP ICMP errors with Linux for mipstack by @wwqgtxx
• 88dcbf7 fix: default listener tun to mips stack (#3264) by @jiawen Geng
• 8d57a8c fix: exclude opcode from P_DATA_V1 AEAD additional data for OpenVPN (#3237) by @FlyingSB
• 8fa048d fix: half-close in sing-mux by @proxi
• ac65297 fix: nil pconn deref when ctx is canceled during h2 ClientConn setup by @BestRui
• afe94da fix: set udp InUser metadata for mieru inbound (#3236) by @ryoma Dev
• fbb6742 fix: restart EasyTier outbound after silent overlay failure (#3215) by @MiaM1ku

Maintenance

• 1341769 chore: support RX checksum offload for mipstack by @wwqgtxx
• 3c947c7 chore: convert support xhttp extra.headers (#3230) by @peter Solomon
• 63bd52e chore: change default IP stack mode to mips and support congestion-controller option for tun by @wwqgtxx
• 91dd03a chore: support lazy receive buffer reads for mipstack and gvisor by @wwqgtxx
• f103639 chore: update mieru version (#3242) by @enfein

Full Changelog: v1.19.31...v1.19.32

What's Changed

• dca26db feat: add EasyTier outbound (#3194) by @MiaM1ku
• ab405ba feat: support stack: mips in tun configuration by @wwqgtxx
• 390870c feat: support identity-secret for ZeroTier by @wwqgtxx

BUG & Fix

• 0159cf4 fix: restore hysteria v1 udp handling (#3178) by @chenx Dust
• 0436650 fix: close connection after error handling in doq by @wwqgtxx
• 06b2c5b fix: close connection after error handling in mkcp outbound by @wwqgtxx
• 127b139 fix: split-DNS UDP queries fail silently in tsnet mode when upstream is a tailnet peer by @wwqgtxx
• 187c634 fix: close connection after error handling in snell outbound by @wwqgtxx
• 1cdca1a fix: handle decryption handshake errors in server by @wwqgtxx
• 20bcda2 fix: avoid VLESS decryption cleanup panic (#3195) by @浅小沫
• 5183232 fix: RandomPaddingAddition and DisableCookies for AmneziaWG v3 by @wwqgtxx
• 5f95109 fix: DomainSet wildcard matching with overlapping rules by @wwqgtxx
• 634b319 fix: hysteria2 UDP sessions not closed on connection close by @wwqgtxx
• 68ec4fa fix: ipv6 url parse in xhttp (#3160) by @CyberVacation
• 6d179a1 fix: openvpn derive the tls-auth HMAC digest from auth instead of hard-coding SHA-1 (#3189) by @token
• 77b9393 fix: preserve domain rules across Foreach round trips by @wwqgtxx
• 78210c9 fix: close connection after error handling in kcptun by @wwqgtxx
• 7d7532d fix: error using of safeConnClose in sudoku outbound by @wwqgtxx
• 94ccba5 fix: mieru listener doesn't obey "listen" config (#3205) by @enfein
• 99c4978 fix: prevent nil pointer dereference in WireGuard initialization (#3148) by @sinspired
• a91201f fix: correct android amd64 core asset name in updater (#3167) by @Nuofang
• c0e43eb fix: tailscale should always use UserDial for upstream TCP DNS server by @wwqgtxx
• d5f57a5 fix: missing NeedHandshake for shadowsocks none by @wwqgtxx
• dc66a8a fix: close connection after error handling in handleContextListener by @wwqgtxx
• e0f1d2b fix: close udp endpoint in mieru server by @wwqgtxx
• faeb537 fix: close connection after error handling in tuic server by @wwqgtxx
• fb66af8 fix: typo in config.yaml (#3145) by @kosta
• fd74ecb fix: trusttunnel client not waiting for TCP connection established by @wwqgtxx

Maintenance

• 061966e chore: OpenVPN no longer relies on the underlying conn deadline functions by @wwqgtxx
• 2ecceb5 chore: improve mipstack under device backpressure by @wwqgtxx
• 2f7eae5 chore: report detailed errors for invalid Clash-style domain patterns by @wwqgtxx
• 2fe7ecb chore: change yaml library to go.yaml.in/yaml/v3 by @wwqgtxx
• 4aa9cc1 chore: avoid redundant select calculations in DomainSet by @wwqgtxx
• 4dfaa90 chore: align the APIs between mipstack and gvisor by @wwqgtxx
• 518c703 chore: convert support REALITY ML-KEM option (#3199) by @Aethersailor
• 6087521 chore: avoid a separate rule slice in DumpMrs by @wwqgtxx
• 65287f0 chore: reduce memory usage in converter (#3159) by @beck
• 8e2f18a chore: avoid redundant rank calculations in DomainSet by @wwqgtxx
• 8e6738f chore: update tailscale to v1.102.3 by @wwqgtxx
• 8f54283 chore: updated sudoku to v0.5.0 (#3187) by @saba-futai
• 92433db chore: reduce gVisor memory usage by @wwqgtxx
• b59a7e7 chore: sharing synthetic datasets used for build benchmarking by @wwqgtxx
• bbb8cb9 chore: add standalone DomainSetBuilder by @wwqgtxx
• c210be2 chore: buffer geodata reads with a 16 KiB reader (#3185) by @huffer
• d37f58e chore: add new DomainMap implement based on succinct DomainSet by @wwqgtxx
• dd26c52 chore: reduce connection memory and actor stack overhead for mipstack by @wwqgtxx
• ebf82e2 chore: reuse queues during DomainSet build by @wwqgtxx
• f295ba6 chore: update mipstack for api adjustment by @wwqgtxx
• f6a038c chore: add some benchmark code for new DomainMap by @wwqgtxx
• fe22fdd chore: update mieru version (#3119) by @enfein

Full Changelog: v1.19.30...v1.19.31

What's Changed

• e889b68 feat: support H2C and QUICv2 sniffing (#3036) by @kosta
• 05b5334 feat: add handshake-timeout for hysteria2 by @wwqgtxx
• 1265cb9 feat: add ip-stack option for masque outbound by @wwqgtxx
• 4ad27d8 feat: add ip-stack option for ZeroTier by @wwqgtxx
• 8453e58 feat: support AmneziaWG v3.0 by @wwqgtxx
• 8b76447 feat: add ip-stack option for wireguard outbound by @wwqgtxx
• 8c56780 feat: support AmneziaWG v3.1 by @wwqgtxx
• b082515 feat: add Zerotier outbound support by @wwqgtxx
• b27c659 feat: add client-metadata configuration to anytls and DON'T sent by default by @wwqgtxx
• bb80689 feat: support bbr3 for mipstack by @wwqgtxx
• d46944f feat: add ip-stack option for openvpn outbound by @wwqgtxx
• e40b596 feat: add rate-limit for restls listener by @wwqgtxx

BUG & Fix

• 25ccc4d fix: handle zerotier network lifecycle events correctly by @wwqgtxx
• 2e8a04c fix: tailscale failed to recover after the network was restored by @wwqgtxx
• 3315457 fix: CVE-2026-56862 for crypto/tls by @wwqgtxx
• 3a779dd fix: typo in uplinkHTTPMethod (#3029) by @kosta
• 4fcf9ae fix: track QUIC crypto stream coverage without repeated range sorting by @wwqgtxx
• 5e3cb10 fix: avoid reserved TLS suffixes in JLS FakeRandom by @wwqgtxx
• 63f15f2 fix: keep connections open after initial sniffing failures by @wwqgtxx
• 69a3142 fix: apply default uplink chunk size for xhttp (#3061) by @vanbujhm
• 7ac597b fix: domain resolve logic in zerotier outbound by @wwqgtxx
• 8d1b661 fix: avoid unnecessary waits in HTTP/2 sniffing by @wwqgtxx
• 8d71008 fix: typo in error string (#3090) by @rye Sears
• 9574a46 fix: truncate udp dns replies to the client's advertised buffer size (#3043) by @TWO666
• 95f7a0c fix: remove incorrect quic error wrapping by @wwqgtxx
• 978d25a fix: enforce ShadowQUIC JLS authentication in QUIC layer by @wwqgtxx
• 98f1200 fix: panic when UDP is not supported in dns_dialer by @wwqgtxx
• 9b9dc8a fix: survive server-initiated soft reset and rekey for openvpn (#3109) by @ayanami-desu
• 9d901dc fix: prevent CUBIC ACKs from reducing cwnd for gvisor by @wwqgtxx
• a2c9556 fix: HTTP/2 read loop spinning on underlying StreamError by @wwqgtxx
• a939fc1 fix: compilation errors under specific circumstances by @wwqgtxx
• ac017cd fix: initialize DNS before NTP (#3103) by @xyx
• ace2037 fix: echo edns0 opt in dns replies when the request carries one (#3041) by @TWO666
• afeb072 fix: trim trailing newline from Tailscale VersionDotTxt in IPNVersion (#3079) by @胡威
• b989445 fix: reduce PROTOCOL_VIOLATION errors on masque dialing by setting ConnectionIDLength by @wwqgtxx
• c1603f4 fix: coordinate TCP sniffers on overlapping ports by @wwqgtxx
• c7089c0 fix: include the upstream tailscale version for standardization (#3074) by @Feng.YJ
• cd05b74 fix: harden zerotier runtime synchronization by @wwqgtxx
• e18ef3a fix: harden ShadowQUIC JLS camouflage forwarding by @wwqgtxx
• ea9c544 fix: avoid unnecessary waits in TLS and QUIC sniffing by @wwqgtxx
• f298cd2 fix: normalize HTTP hosts and avoid unnecessary sniffing delays by @wwqgtxx
• f5fddd3 fix: preserve WebSocket 0-RTT data order by @wwqgtxx
• f83a072 fix: let QUIC sniffer handle Retry key changes by @wwqgtxx
• fb00221 fix: tun dns hijack sending zero-filled or stale packets when PackBuffer reallocates (#3037) by @TWO666

Maintenance

• 09b0ff3 chore: reduce interface differences between gVisor and mipstack by @wwqgtxx
• 0ba9f2f chore: remove dohMaxConnsPerHost & dohMaxIdleConns (#3048) by @ayanamist
• 1af24e9 chore: update tailscale to v1.102.2 by @wwqgtxx
• 1ef16c7 chore: harden TCP pacing and handshake state handling by @wwqgtxx
• 26c635f chore: avoid string reversal allocation in DomainSet.Has (#3049) by @ember Moth
• 2bade29 chore: allow the sniffer to read more data if possible by @wwqgtxx
• 2ea5461 chore: adjust internal dialQuic api by @wwqgtxx
• 3c16aaf chore: update quic-go to 0.61.0 by @wwqgtxx
• 3cac869 chore: reduce ZeroTier wire data-path overhead by @wwqgtxx
• 4859d14 chore: let quic sniffer handle coalesced packets and larger client hello by @wwqgtxx
• 49a5419 chore: update tailscale to v1.102.0 by @wwqgtxx
• 63024e3 chore: remove unused imports in test by @wwqgtxx
• 669db1b chore: harden QUIC Initial packet processing by @wwqgtxx
• 6bb8b98 chore: strictly verify the syntax for Clash-style domain wildcards by @wwqgtxx
• 7259bbb chore: update mipstack for api adjustment by @wwqgtxx
• 73b061a chore: split internal dns server handler by @wwqgtxx
• 770800e chore: reduce packet-path and TCP allocation overhead by @wwqgtxx
• 7ee0b05 chore: allow override IV_VER by peer-info for OpenVPN by @wwqgtxx
• 7ff6544 chore: improve ZeroTier reliability and throughput under load by @wwqgtxx
• 8df9462 chore: update mipstack for api adjustment by @wwqgtxx
• 944e8e1 chore: align MIPS TCP keepalive defaults with sing-wireguard behavior by @wwqgtxx
• 94a89fb chore: reject oversized sniff reads before filling the buffer by @wwqgtxx
• 97cbdc5 chore: update gvisor by @wwqgtxx
• 99ce79c chore: reduce packet queue contention and socket allocation churn by @wwqgtxx
• 9a9c4c6 chore: improve zerotier event diagnostics by @wwqgtxx
• a52c00b chore: expand datagram and raw IP socket support for mipstack by @wwqgtxx
• b9faf97 chore: improve internal sharing mechanism for dnsClient by @wwqgtxx
• c235dc1 chore: let the sniffer assemble client hello across TLS records by @wwqgtxx
• c807c9a chore: let the HTTP/2 sniffer assemble header blocks across continuation frames by @wwqgtxx
• cb8e990 chore: let sniffer support multi-round reading by @wwqgtxx
• cf98d2d chore: align ZeroTier link configuration and multicast state by @wwqgtxx
• d8fbf85 chore: update bart by @wwqgtxx
• dd7bc4c chore: reduce ZeroTier packet processing overhead by @wwqgtxx
• dfd7e89 chore: align congestion control with Linux by @wwqgtxx
• e183c58 chore: stabilize equal-quality peer path selection for ZeroTier by @wwqgtxx
• e9f6297 chore: improve ZeroTier packet bridge throughput by @wwqgtxx
• ee2db89 chore: let gVisor allow HandleLocal working with PromiscuousMode by @wwqgtxx
• efd63d8 chore: extract bitmap handling from QUIC crypto reassembly by @wwqgtxx
• f5fbe0c chore: update mieru version (#3046) by @enfein

Full Changelog: v1.19.29...v1.19.30

What's Changed

• bd749c6 feat: sync anytls v0.0.13 (#2990) by @anytls
• e26714a feat: support TLS rekey fix, data-ciphers negotiation, tls-crypt-v2 for OpenVPN (#2989) by @Lanlan13-14
• 0e7c3c7 feat: support restls for anytls outbound and listener by @wwqgtxx
• 2b2bdf6 feat: support jls for shadowsocks outbound and listener by @wwqgtxx
• 5677fd3 feat: add name-cert-verify to support separate certificate verification name by @wwqgtxx
• 611a448 feat: support jls for vmess/vless/trojan outbound and listener by @wwqgtxx
• 6d96163 feat: support override-expr for proxy provider override by @wwqgtxx
• 769ea6f feat: support restls for vmess/vless/trojan outbound and listener by @wwqgtxx
• 76d8088 feat: add support for TLSAuth for Openvpn (#2969) by @lyaaz
• 8fe7f74 feat: support jls for anytls outbound and listener by @wwqgtxx
• 9ab7543 feat: support restls/jls for snell outbound and listener by @wwqgtxx
• aea5ce4 feat: support shadowquic outbound and listener by @wwqgtxx
• bc0e5aa feat: support shadowtls for anytls outbound and listener by @wwqgtxx
• bfa9ea1 feat: support brutal for shadowquic (mihomo private extension) by @wwqgtxx
• c015694 feat: support shadowtls for vmess/vless/trojan outbound and listener by @wwqgtxx

BUG & Fix

• 02dfcf2 fix: incorrect alphabet size used in session-table for predefined tables in xhttp-config by @SaltyMonkey
• 0ee5841 fix: reconnect OpenVPN on server soft reset (#2978) by @freephilx
• 12c30af fix: wireguard per-peer reserved ignored (#2958) by @AaronChen0
• 2b0d841 fix: make shadowtls v2 read deadlines recoverable by @wwqgtxx
• 2c7309e fix: listener duplicate-name check (#2948) by @AaronChen0
• 3766a08 fix: set global CA pool and NTP time for restls by @wwqgtxx
• 4154923 fix: stop reaper goroutine busy-looping after context cancel (#2964) by @AaronChen0
• 45f7930 fix: CNAME query matching a hosts domain-entry returns an empty answer (#2965) by @AaronChen0
• 75a3ea8 fix: leaked openStreams on failure in TUIC client (#2959) by @AaronChen0
• 7a3c37c fix: make shadowtls v3 read deadlines recoverable by @wwqgtxx
• 8507c1e fix: missing override shadow-tls-opts and restls-opts in xhttp download-settings by @wwqgtxx
• 8698483 fix: the incorrect tls stack was used in shadowtls tests by @wwqgtxx
• 975389a fix: intermittent timeouts during the soak test by @wwqgtxx
• 9a7e726 fix: performance regression caused by unnecessary wrapping in stream encryption by @wwqgtxx
• 9ae1cc2 fix: shadowquic JLS pre-flight fallback handle by @wwqgtxx
• a35045d fix: consume CachedConn data in ReadCached by @wwqgtxx
• a5167fa fix: allow JLS fallback before the server flight by @wwqgtxx
• a70af27 fix: remove unnecessary quinn-jls compatibility behavior by @wwqgtxx
• ba5c45b fix: anytls listener config parsing by @wwqgtxx
• c079b0c fix: panic on full-width IP-SUFFIX rules (#2975) by @AaronChen0
• c583439 fix: DOMAIN-WILDCARD ignores sniffed hostname (#2956) by @AaronChen0
• cb8cde8 fix: missing override jls-opts in xhttp download-settings by @wwqgtxx
• e8ab2d0 fix: alpnAwareRoundTripper behavior in mekya client by @wwqgtxx
• f86bc22 fix: align HelloRetryRequest handling with JLS v3 by @wwqgtxx

Maintenance

• 1d1b370 chore: remove redundant writeFull in snell v4 by @wwqgtxx
• 2d45f9e chore: using new net/http api in mekya client by @wwqgtxx
• 309cfbd chore: reimplement shadowtls by @wwqgtxx
• 3b73922 chore: cleanup shadowquic code by @wwqgtxx
• 3f22309 chore: respect the incoming context during JLS fallback by @wwqgtxx
• 4236116 chore: better UserFromConn implementation by @wwqgtxx
• 44dd834 chore: preserve jls in-user for shadowsocks listeners by @wwqgtxx
• 46f9b78 chore: export internal OverrideExpr for api user by @wwqgtxx
• 4d7ef85 chore: sync logic to legacy shadowsocks listener by @wwqgtxx
• 5c1b8bf chore: authenticate JLS ServerHello using its wire encoding by @wwqgtxx
• 6a52d23 chore: do not force trailing path / when both sessionID and seq are placed elsewhere for xhttp by @Medium1992
• 75eeba4 chore: significantly trim unnecessary code from tailscale by @wwqgtxx
• 8413f50 chore: skip frequently failed tests on windows go1.20 by @wwqgtxx
• 94409eb chore: remove redundant writeFull in sudoku by @wwqgtxx
• 95af34a chore: remove redundant writeFull in shadowquic by @wwqgtxx
• 9729296 chore: sync to sudoku v0.4.8 (#2966) by @saba-futai
• 9cece13 chore: add test for alpnAwareRoundTripper in mekya client by @wwqgtxx
• b6ed8e2 chore: rewrite the internal mutual exclusion logic of the listener by @wwqgtxx
• b75a776 chore: clean up duplicate helpers in tests by @wwqgtxx
• bc5976f chore: sync internal logic by @wwqgtxx
• cf8545d chore: stabilize traffic wait timing in tlsmirror test by @wwqgtxx
• da5a3e5 chore: rewrite the internal mutual exclusion logic of the outbound by @wwqgtxx
• dc4d4fc chore: allow jls with utls client-fingerprint by @wwqgtxx
• e3c1ea0 chore: better handshakeRecorderConn impl by @wwqgtxx
• e911985 chore: change the brutal negotiation in shadowquic to be asynchronous by @wwqgtxx
• ee80e8d chore: more comprehensive interop test by @wwqgtxx
• f23e43e chore: remove redundant writeFull in gost relay by @wwqgtxx

Full Changelog: v1.19.28...v1.19.29

What's Changed

• ea19cda feat: add rematch outbound type and REMATCH-NAME rule type (#2862) by @peter Solomon
• d20e850 feat: support custom peer-info for openvpn outbound (#2926) by @Easy-Ez
• 1686d56 feat: convert support session-table and session-length for xhttp-opts fields (#2889) by @legiz-ru
• 01111ff feat: add handshake-timeout for masque by @wwqgtxx
• 1c4f7c4 feat: support shadow-tls for snell by @wwqgtxx
• 1f80d91 feat: support session-table and session-length for xhttp client by @wwqgtxx
• 2f510e8 feat: support tlsmirror for vmess by @wwqgtxx
• 7870f8f feat: add handshake-timeout for OpenVPN by @wwqgtxx
• 8c40e36 feat: support fallback-lazy-query for dns section by @wwqgtxx
• 8e2aba4 feat: support network: h3-l4proxy for masque outbound by @wwqgtxx
• a198581 feat: support mkcp for vmess by @wwqgtxx
• a1c09ad feat: support restls for shadowsocks listener by @wwqgtxx
• ad730ae feat: support listen-routing-mark for dns section by @wwqgtxx
• be9164e feat: add default-selected for select group by @wwqgtxx
• d67572b feat: support routing-mark for listeners except tun/redir/tproxy and top-level external-controller-routing-mark by @wwqgtxx
• e10a1a7 feat: support mekya for vmess by @wwqgtxx
• 85c1798 break(restful api): restore original Clash /proxies behavior by @xishang0128

BUG & Fix

• 1f93334 fix: udp WriteTo returned wrong count by @wwqgtxx
• 26edbaa fix: dualStackDialContext not close the fallback connection when the preferred IP family won by @kasumikira
• 2cd1443 fix: prevent snell pool from reusing unready connections (#2878) by @xream
• 4281001 fix: restore the original fallback concurrency behavior by @wwqgtxx
• 45ca4ae fix: preserve shadow-tls in-user for snell listeners (#2934) by @xream
• 578b881 fix: add missing json tags to raw config structs (#2939) by @chenx Dust
• 59ffb63 fix: scStreamUpServerSecs not working when xPaddingObfsMode is true by @wwqgtxx
• 5ab5eb3 fix: snell v2 listener can't pass test by @wwqgtxx
• 5b54b3a fix: panic when dial failed in masque by @wwqgtxx
• 63e4d5a fix: TUIC v5 fragmented UDP reads in quicStreamPacketConn.ReadFrom (#2942) by @aaron Chen
• 73740c7 fix: wrong realm resolver when only IPv6 is requested by @rumianoesa
• 793f61e fix: crash in AmneziaWG receive path with slice bounds out of range when S4 is larger than incoming packet by @wwqgtxx
• 94a7a3f fix: udp write in sing-mux by @wwqgtxx
• d08c885 fix: writeSem initiation in OpenVPN by @roy.lieu
• d924f1c fix: CVE-2026-42505 for crypto/tls by @wwqgtxx
• e3972e7 fix: apply TUIC v5 UDP relay size clamp when building server options (#2943) by @aaron Chen
• e64f58f fix: panic when rand.IntN calling on a nil slice by @wwqgtxx

Maintenance

• 02dd143 chore: relax version restrictions for the snell listener by @wwqgtxx
• 084a09e chore: export internal function for api user by @wwqgtxx
• 0daa3ff chore: allow overriding inbound listen config for api user by @wwqgtxx
• 1095055 chore: upgrade bbolt to 1.5.0 by @wwqgtxx
• 174cba4 chore: update sing-tun by @wwqgtxx
• 1e76df7 chore: better group config parsing by @wwqgtxx
• 24b6de7 chore: lazy init reality server cert by @wwqgtxx
• 26e3d22 chore: peer should set to expire unconditionally in tailscale-wireguard-go by @wwqgtxx
• 27efee2 chore: cleanup unused code in OpenVPN by @wwqgtxx
• 2c6ff72 chore: bump mieru version to 3.34.0 (#2899) by @enfein
• 38fd897 chore: sync common/maphash code by @wwqgtxx
• 3b85577 chore: make bbolt work on non-mmap supported platforms by @wwqgtxx
• 6414c56 chore: reduce one unnecessary slice copy operation by @wwqgtxx
• 7031b75 chore: update quic-go to 0.60.0 by @wwqgtxx
• 76bf840 chore: code cleanup by @wwqgtxx
• 85c2f6a chore: change the type of the internal value being passed by @wwqgtxx
• 93d33fa chore: increase REALITY target TLS record buffer to 16 KiB by @wwqgtxx
• acbc92f chore: better mieru inbound test implementation by @wwqgtxx
• aff8dc7 chore: adjust struct name by @wwqgtxx
• bcfd434 chore: update chi to 5.3.0 by @wwqgtxx
• cbd11db chore: converter map hysteria2 port hopping and realm URI (#2947) by @peter Solomon
• d41d757 chore: rename listener config to tlsmirror-config by @wwqgtxx
• da28fe3 chore: more code sharing by @wwqgtxx
• dc5c2ec chore: change http method from GET to POST in listener test by @wwqgtxx
• de51c4b chore: cleanup interop test code by @wwqgtxx
• e3d67b3 chore: strictly forbidden to fill in a proxy group for empty-fallback by @wwqgtxx
• eca44d0 chore: update tfo-go ready for go1.27 by @wwqgtxx
• f62ebd0 chore: cleanup interop test code by @wwqgtxx
• f74bd8b chore: adjust internal function return type by @wwqgtxx

Full Changelog: v1.19.27...v1.19.28

What's Changed

• 90b1066 feat: add ping keepalive support for OpenVPN (#2859) by @puppywang
• fd2112e feat: add built-in proxy PASS-RULE (#2873) by @echsfxy
• 1e62d55 feat: add empty-fallback to group options allows for customization instead of hardcoding COMPATIBLE by @wwqgtxx
• 317bfc2 feat: add allow-insecure config to anytls/trojan/vless listeners for nginx/caddy front users by @wwqgtxx
• 358fa5e feat: add age-secret-key for proxy-provider and -age-secret-key for cmdline to support age armor format config decryption by @wwqgtxx
• bd72c65 feat: remove global-client-fingerprint, please set client-fingerprint directly on the proxy instead by @wwqgtxx
• e928ef5 feat: add path-in-bundle to rule-providers to support extract from BundleMRS.7z when the local file does not exist by @wwqgtxx

BUG & Fix

• 1184850 fix: quic sniffer out-of-bounds read causes process crash via single UDP packet by @guanni Qu
• 1abd126 fix: validation error handling for age-secret-key by @wwqgtxx
• 5184081 fix: socks4 readUntilNull unbounded memory allocation by @guanni Qu
• 5bdb1cc fix: trojan protocol WaitReadFrom panic via oversized UDP relay length field by @guanni Qu
• 9761bcd fix: exchangeQUIC not fully respecting context by @wwqgtxx
• c710025 fix: readMsg in doq out-of-bounds access by @wwqgtxx
• dafdd06 fix: variable capture in dns outbound by @wwqgtxx
• dbaf85b fix: vision TLS filter out-of-bounds read via crafted session_id length by @guanni Qu

Maintenance

• 01edf45 chore: improve internal api by @wwqgtxx
• 316f5df chore: add WithDialer option to component/http for api user by @wwqgtxx
• ab56858 chore: sync sudoku v0.4.7 optimizations (#2879) by @saba-futai
• b60e687 chore: support convert age-secret-key to age-public-key for build-in age tool by @wwqgtxx
• d7ac7b5 chore: support std input/output for age encrypt/decrypt tool by @wwqgtxx
• f99d4e1 chore: adjust internal age component api by @wwqgtxx

Full Changelog: v1.19.26...v1.19.27

What's Changed

• 52edebd feat: add snell version 4/5 outbound and inbound (#2817) by @xream
• 7a6a650 feat: support OpenVPN CBC ciphers (#2818) by @romanov Caesar
• ff98700 feat: support CHACHA20-POLY1305 data cipher for OpenVPN (#2798) by @Lanlan13-14
• fc8c5a2 feat: support comp-lzo for OpenVPN (#2841) by @zhiqiang Zhang
• 2dd7d59 feat: support MD5/SHA384/SHA512 OpenVPN auth methods by @wwqgtxx
• f1c3656 feat: support AES-192-GCM/AES-192-CBC OpenVPN data ciphers by @wwqgtxx
• f30a64f feat: support hysteria2 gecko obfs by @wwqgtxx

BUG & Fix

• 03e1f44 fix: interface structs do not copy correctly by @wwqgtxx
• 301d580 fix: compile issue of tailscale-wireguard-go dependency by @wwqgtxx
• 3809a03 fix: stack panic after dispatcher attach nil by @wwqgtxx
• 38cb06d fix: hysteria2 realm stun domain resolve by @wwqgtxx
• 4065583 fix: masque retry condition by @wwqgtxx
• 5639e93 fix: improve OpenVPN transport reliability (#2824) by @romanov Caesar
• 8c26d61 fix: tproxy did not pass the additions correctly by @wwqgtxx
• a2aca02 fix: pinger in tailscale not under our control by @wwqgtxx
• a52a27e fix: errors.ErrUnsupported backport by @wwqgtxx
• a531449 fix: missing param passing in vless listener config by @wwqgtxx
• b230c90 fix: shadowtls v3 client HMAC handling for TLS 1.3 HelloRetryRequest by @wwqgtxx
• d2fcf71 fix: tailscale panic when working with dialer-proxy by @wwqgtxx
• f69331f fix: config struct not exported by @wwqgtxx

Maintenance

• 060711f chore: more netip.AddrPort using in tproxy by @wwqgtxx
• 0ddf4bb chore: update sing-tun by @wwqgtxx
• 0dec35e chore: always dial tcp on netstack for tailscale by @wwqgtxx
• 31ece04 chore: upgrade the embedded xsync.Map to v4.5.0 by @wwqgtxx
• 5b28a0e chore: optimize sudoku packed hot paths (#2833) by @saba-futai
• 6e15299 chore: remove AF_ALG in tailscale-wireguard-go by @wwqgtxx
• 72f133f chore: more logging for tailscale debug by @wwqgtxx
• 8f2d84f chore: update mieru version to v3.33.0 (#2840) by @enfein
• a05c94b chore: make the proxydialer module no longer directly depend on the tunnel module by @wwqgtxx
• b1a07d2 chore: remove unnecessary member variables added by xsync/v3 by @wwqgtxx
• cb652dd chore: make the handler-related SNAT key in NewPacket by @wwqgtxx
• d27f320 chore: use pre-go1.27 tls.QUICConfig.ClientHelloInfoConn API for quic-go to avoid cloning tls.Config by @wwqgtxx
• d60b336 chore: use mihomo name & ver to tailscale reported ver to avoid update prompts (#2801) by @ayanamist
• d610afe chore: clear parameter passing by @wwqgtxx
• e9e23c4 chore: tailscale must be compiled under the with_gvisor build tag by @wwqgtxx
• f2da5b7 chore: reduce internal circular dependencies by @wwqgtxx

Full Changelog: v1.19.25...v1.19.26

What's Changed

• 571925d feat: add Tailscale outbound support (#2786) by @汐殇
• 7af9eeb feat: add OpenVPN outbound support (#2785) by @romanov Caesar
• 6ea4373 feat: support auth-user-pass and AES-256-GCM for OpenVPN (#2787) by @ekko
• 5e22035 feat: add GOST relay outbound proxy type (#2795) by @ztywyj
• 98aa7e6 feat: support realm-opts for hysteria2 outbound and listener by @wwqgtxx
• 787dbfc feat: support setting realm-opts.proxy for hysteria2 listener by @wwqgtxx
• 2ffd962 feat: support hysteria2-realm listener by @wwqgtxx
• 8b8eae5 feat: support simple-obfs for shadowsocks listener by @wwqgtxx

BUG & Fix

• 0003e14 fix: trusttunnel listener panic by @wwqgtxx
• 17bed79 fix: tsnet panic for tailscale by @wwqgtxx
• 2f51cb0 fix: conn maybe not closed in error handling by @wwqgtxx
• 2f6ce20 fix: tailscale not use configured dialer for captive detection by @wwqgtxx
• 35d5d4e fix: CVE-2026-39825 for net/http by @wwqgtxx
• 388d958 fix: remove unstable warning for tailscale by @wwqgtxx
• 5df45b2 fix: typo in default alpn by @wwqgtxx
• 7a646e8 fix: correctly configure the HTTP/2 scheduled ping parameters in masque h2 mode by @wwqgtxx
• 802b0b2 fix: netlink permission denied on android for tailscale by @wwqgtxx
• 8a28dce fix: validate Linux process netlink matches by @xream
• 95946a5 fix: net/http.Transport's UnencryptedHTTP2 does not work TLS without ALPN by @wwqgtxx
• 98aa42e fix: convert place disguise host in h2-opts.host for legacy base64-JSON VMess (#2739) by @wangwei354
• 9e97dc0 fix: tailscale not use configured dialer for netstack forwardTCP by @wwqgtxx
• aae5812 fix: net/http.Server's UnencryptedHTTP2 does not work TLS without ALPN by @wwqgtxx
• b3104a5 fix: panic in vless xhttp h3 mode when quic dial fails (#2736) by @beck
• cc376ac fix: skip TTL update for OPT records by @wwqgtxx
• d2acf45 fix: hysteria2 realm server reaper loop by @wwqgtxx
• e933ca8 fix: netlink permission denied on android for tailscale by @wwqgtxx
• f5cfb8d fix: convert emit HTTP2Options-shaped h2-opts for share-link HTTP/2 transport (#2737) by @wangwei354
• fd31419 fix: wrong function call in SetWriteDeadline (#2790) by @aaron Chen
• ffe6e42 fix: conn maybe not closed in error handling by @wwqgtxx

Maintenance

• 00e6df5 chore: close http2 connections when closing client in doh by @wwqgtxx
• 028b480 chore: remove unused http server code by @wwqgtxx
• 163ce6a chore: add mlkem768x25519-sha256 key exchange algorithm to ssh outbound by @wwqgtxx
• 1fea551 chore: verify adapter can parse convert's result in its test by @wwqgtxx
• 263d06d chore: allow passing tunnel when creating the proxy by @wwqgtxx
• 2a8da25 chore: handle the possibility of multiple ClientTrace.GotConn calls by @wwqgtxx
• 2d94970 chore: using new net/http api in masque h2 mode by @wwqgtxx
• 2f11d96 chore: use our internal DNS resolution logic for tailscale by @wwqgtxx
• 3d3af1f chore: respect outbound dns prefer when resolve UDP by @wwqgtxx
• 3fb93bd chore: using new net/http api in gun and xhttp listener by @wwqgtxx
• 44c9423 chore: code cleanup by @wwqgtxx
• 81bea65 chore: using new net/http api in vmess h2 client by @wwqgtxx
• 82621cd chore: always safe UUID generation by @wwqgtxx
• 8bc7d3e chore: using new net/http api in doh client by @wwqgtxx
• 8d53952 chore: remove unused xhttp options in download-settings by @wwqgtxx
• 8f69ad9 chore: better uuid generation by @wwqgtxx
• 993d1b6 chore: add stun retry and lazy server start for realm by @wwqgtxx
• a1c68a4 chore: using new net/http api in reality client fallback by @wwqgtxx
• ac6f6d0 chore: tailscale using ListenPacket for UDP by @wwqgtxx
• b03aa5d chore: remove race code in wireguard implementation by @wwqgtxx
• b8b4439 chore: using new net/http api in trusttunnel listener by @wwqgtxx
• bb2f57b chore: using new net/http api in xhttp client by @wwqgtxx
• c27446a chore: using new net/http api in gun client by @wwqgtxx
• c59c99a chore: handle context cancellation in xhttp client dialing by @wwqgtxx
• c98e67a chore: using new net/http api in trusttunnel client by @wwqgtxx
• df1c5e5 chore: relax sudoku user configuration (#2757) by @saba-futai
• f333359 chore: move magic close http2 connections function to own fork by @wwqgtxx
• f5f9e59 chore: update sing-tun by @wwqgtxx
• faa58f2 chore: add some comments for using the new net/http API by @wwqgtxx

Full Changelog: v1.19.24...v1.19.25