v1.6.23

What's Changed

feat(cascade): Cascade links work on Xray 26.10

Xray 26.10 refuses to start VLESS without encryption when the next hop is a public address. On 1.6.22 a core update stopped on the config already on the node (vless without TLS or other encryption is prohibited) and the binary was not swapped.

• Reverse links use VLESS Reverse Proxy. VMess is forward-only; saving a reverse link as VMess turns it into VLESS. The tunnel domain field is ignored.
• Security None gets VLESS Encryption. The panel derives the keys per link. Forward VMess still uses VMess auto. A TLS tunnel uses the panel certificate, with no allowInsecure.
• Both ends need a new enough core: Xray 25.9.11 for reverse, 25.9.5 for forward VLESS with None, 26.6.1 for mKCP. The panel will not deploy a link onto an older core, and will not offer such a version in a single or bulk Xray update.
• The update tests the config it is about to deploy, not the file already on disk. Moving a cascade node to 26.10.31 no longer fails on the old plaintext VLESS outbound.
• Links deployed by the previous panel are redeployed on both ends the first time either of their nodes is synced. A link that could not be redeployed shows an error on the network map.

fix(subscription): Self-signed nodes no longer rely on allowInsecure

Current Xray rejects a profile that still contains allowInsecure. xray-json and v2ray-json subscriptions now send the certificate SHA-256 (pinnedPeerCertSha256) for a self-signed certificate and for Hysteria without a domain. The hash is read at Auto Setup and when the node config is synced. Users with nodes assigned directly, and Marzban-compatible subscriptions, get the same field.

A node that is already running gets the pin on its next config sync or Auto Setup. Until then the subscription has no hash to send.
Panel-side only; no agent update is needed on the nodes.

CC Agent binaries

Lightweight Go agent for managing Xray on nodes.
Downloaded automatically during node auto-setup from the panel.

File	Architecture
cc-agent-linux-amd64	x86_64 (most VPS)
cc-agent-linux-arm64	ARM64

Celerity Probe binaries

External diagnostic probe. Installed by the operator on their own
host; holds only client subscription credentials and no node access.
The install command with a single-use token is generated in the panel.

File	Platform
celerity-probe-linux-amd64	Linux x86_64
celerity-probe-linux-arm64	Linux ARM64
celerity-probe-linux-mipsle	OpenWRT MIPS little-endian (ramips, mt7621)
celerity-probe-linux-mips	OpenWRT MIPS big-endian (ath79)
celerity-probe-darwin-amd64	macOS Intel
celerity-probe-darwin-arm64	macOS Apple Silicon
celerity-probe-windows-amd64.exe	Windows x86_64
celerity-probe-windows-arm64.exe	Windows ARM64

Panel source code is distributed via Docker Hub: clickdevtech/hysteria-panel

Full Changelog: v1.6.22...v1.6.23