• Fixed QUIC protocol sniffing for modern browsers and QUIC libraries, whose ClientHello spans multiple packets. Domain-based ACL rules now apply to their QUIC traffic
• sniff.timeout now only applies to TCP
• Upgraded TUN mode to the latest upstream sing-tun (v0.9.6)
• Removed the TUN route.strict option, which no longer had any effect
• Updated Chrome QUIC fingerprint parroting to match Chrome 154
• Fixed the client log reporting ECH as not accepted when Chrome parroting is enabled
• Updated quic-go to v0.63.0

• 修复 QUIC 协议嗅探无法识别将 ClientHello 分多个包发送的现代浏览器和 QUIC 库的问题。基于域名的 ACL 规则现可正常作用于这些 QUIC 流量
• sniff.timeout 现在仅对 TCP 生效
• TUN 模式升级至最新上游 sing-tun (v0.9.6)
• 移除了 TUN 的 route.strict 选项，此选项不再有任何作用
• Chrome QUIC 指纹模仿更新至 Chrome 154
• 修复启用 Chrome 指纹模仿时，客户端日志始终显示 ECH 未开启的问题
• quic-go 更新至 v0.63.0

• Added hysteria ech subcommand to generate ECH keys and client configuration
• Fixed plain HTTP transfers through the HTTP proxy being cut off after 10 seconds
• Fixed Linux port-hopping rules incorrectly redirecting outbound UDP traffic, which could break Realms connections and other UDP traffic on the same machine
• Updated quic-go to v0.62.0

• 新增 hysteria ech 子命令，用于生成 ECH 密钥和客户端配置
• 修复通过 HTTP 代理模式传输明文 HTTP 连接时，连接会在 10 秒后断开的问题
• 修复 Linux 端口跳跃规则错误重定向出站 UDP 流量的问题。此问题可能导致 Realms 和其他 UDP 连接失败
• quic-go 更新至 v0.62.0

• Added a quic.disableStatelessReset server option to turn off the QUIC stateless resets introduced in 2.12.1
• Masquerade proxy mode now supports Unix sockets
• Fixed IPv6 connectivity for mimic

• 新增服务端 quic.disableStatelessReset 选项，可用于关闭 2.12.1 加入的 QUIC stateless reset
• Masquerade 代理模式现已支持 Unix socket
• 修复 mimic IPv6 连接问题

• Added Porkbun, Namecheap and Njalla as ACME DNS providers
• Fixed slow reconnection after the client has been idle or asleep, most noticeable on mobile devices. The server now sends QUIC stateless resets, so a client holding a stale connection reconnects immediately instead of waiting out its idle timeout
• Fixed mimic refusing to start when its optional kernel module is not loaded
• Various dependency updates

• 新增 Porkbun、Namecheap 与 Njalla ACME DNS 服务商支持
• 修复客户端空闲或休眠后重连缓慢的问题，在移动端上尤为明显。服务端现在会发送 QUIC 无状态重置（stateless reset），使持有失效连接的客户端能够立即重连，不再等待超时
• 修复未加载可选内核模块时 mimic 拒绝启动的问题
• 若干依赖更新

• Added mimic integration, which disguises the connection as TCP for networks that restrict UDP (Linux only, requires mimic to be installed separately)
• Improved the accuracy of Chrome QUIC fingerprint parroting
• Fixed a BBR panic on paths with a small MTU, introduced in 2.11.0 by Chrome parroting
• Various dependency updates

• 新增 mimic 集成，可将连接伪装成 TCP，用于限制 UDP 的网络环境（仅限 Linux，需另行安装 mimic）
• 提升 Chrome QUIC 指纹模仿的准确度
• 修复了小 MTU 下一个 BBR panic 问题，由 2.11.0 的 Chrome 指纹模仿引入
• 若干依赖更新

• Added Chrome QUIC fingerprint parroting: the client's QUIC handshake now looks like Google Chrome's. Enabled by default, but can be turned off with the quic.disableChromeParrot option
• Modernized the ACME stack (CertMagic, ACMEz and the libdns providers)
• Removed the namedotcom ACME DNS provider, as it has not been updated for the new libdns API
• Updated quic-go to v0.61.0

• 新增 Chrome QUIC 指纹模仿：将客户端 QUIC 握手调整至与 Google Chrome 一致。默认启用，可通过 quic.disableChromeParrot 选项关闭
• 更新 ACME 相关依赖（CertMagic, ACMEz, libdns 等）
• 移除了 namedotcom ACME DNS 服务商，由于其未针对新的 libdns API 进行更新
• quic-go 更新至 v0.61.0

• Added Encrypted Client Hello support
• Added a bandwidth.disableLossCompensation option for disabling Brutal congestion control's loss compensation mechanism, which can improve stability in some cases
• Various dependency updates and minor bug fixes

• 新增 Encrypted Client Hello 支持
• 新增 bandwidth.disableLossCompensation 选项，用于关闭 Brutal 的速率补偿机制，可以在一些情况下提升稳定性
• 若干依赖更新与小修复

• Added Hysteria Realms UPnP/NAT-PMP port mapping support for easier NAT traversal
• Added a Hysteria Realms ipMode option to restrict connections to IPv4 or IPv6 only
• Updated quic-go to v0.60.0
• Fixed + in the authentication credentials being corrupted to a space when parsing hysteria2:// sharing links
• Fixed the HTTP proxy rejecting valid Basic authentication credentials
• Fixed the HTTPS proxy outbound using host:port instead of the hostname as the TLS SNI
• Fixed a data race in the client's HTTP/SOCKS5 listener multiplexer
• Fixed nftables redirect failure when the server binds to a specific IPv6 address
• DNS resolver now limits CNAME chain length to prevent unbounded recursion

• 为 Hysteria Realms 新增 UPnP/NAT-PMP 支持以加强 NAT 穿透能力
• 为 Hysteria Realms 新增 ipMode 选项，可将连接限制为仅使用 IPv4 或 IPv6
• quic-go 更新至 v0.60.0
• 修复了解析 hysteria2:// 分享链接时密码中的 + 被错误转换为空格的问题
• 修复了 HTTP 代理拒绝有效 Basic 验证凭据的问题
• 修复了 HTTPS 代理出站将 host:port 而非主机名用作 TLS SNI 的问题
• 修复了客户端 HTTP/SOCKS5 监听多路复用器中的线程安全问题
• 修复了服务端绑定指定 IPv6 地址时 nftables 重定向失效的问题
• DNS 解析器增加 CNAME 链长度限制，防止无限递归

This release contains important security fixes and we strongly encourage everyone to upgrade.

• Added Gecko obfuscation: a new experimental obfuscation layer that fragments QUIC handshake packets
• Fixed a security issue where UDP packets could bypass ACL
• Fixed a potential server OOM caused by incomplete or oversized HTTP requests during sniff
• Fixed an ACL bypass via trailing dots in domain names (e.g. example.com.)
• Fixed incorrect destination handling in the SOCKS5 UDP outbound
• Fixed https:// prefix detection in the DoH resolver
• Outbound rules now reject invalid port values
• Minor performance improvements

此版本包含重要安全修复，强烈建议更新

• 新增 Gecko：一种实验性的新混淆实现，会对 QUIC 握手包进行分片处理
• 修复了 UDP 包可绕过 ACL 的安全问题
• 修复了启用 sniff 时，不完整或超大 HTTP 请求可能导致服务端 OOM 的问题
• 修复了通过在域名末尾添加点（如 example.com.）绕过 ACL 的问题
• 修复了 SOCKS5 UDP 出站中目标地址处理错误的问题
• 修复了 DoH 解析器对 https:// 前缀的判断错误
• outbound 规则现在会拒绝无效端口号
• 小幅性能改进

No public IP? No problem. Hysteria Realms punches through your NAT to let you host a Hysteria server from home, a cellular network, or even a coffee shop. Clients connect directly, peer-to-peer. No port forwarding, no relay.

• Fixed an issue where the client failed to connect to a server behind symmetric NAT, improving hole punching success rate
• The hysteria cert command now includes sniGuard: disable in its sample server config, so self-signed certs work with Realms out of the box

没有公网 IP 也没问题！Hysteria Realms 通过 NAT 打洞，让你从家宽、手机流量甚至咖啡店都能运行 Hysteria 服务端。与客户端 P2P 连接，无需配置端口转发或中转。

• 修复了一个导致服务端位于对称 NAT 后时客户端无法连接的问题，提升打洞成功率
• hysteria cert 命令现在会在示例服务端配置中包含 sniGuard: disable，让自签名证书在 Realms 模式下能正常使用