v3.0.0

New

• feat: Vue 3 migration — full frontend rewrite (#4198)
  • Stack: Vue 2 + Ant Design Vue 1 + Go HTML templates → Vue 3 + Ant Design Vue 4 + Vite 8 (multi-page bundles embedded into the Go binary via web/dist/)
  • Single-File Components with <script setup> and composables replacing global Vue.component() registrations and Vue 2 mixins
  • WebSocket-driven live updates across the panel (dashboard, inbounds, nodes) replace the legacy polling loop
  • Translation files migrated from TOML to JSON; vue-i18n 11 with per-locale code-split bundles for all 13 locales
  • Pages ported end-to-end: login, dashboard (with live status / xray / cpu-history / logs / backup / panel-update / custom-geo modals), settings (General / Security + 2FA / Telegram / Subscription), inbounds (list, search/filter, add/edit/delete/clone/reset, client modal + bulk-add, info + QR, expand-row), xray (Basics / Routing / Outbounds / Balancers / DNS / WARP / NordVPN), nodes
  • Inbound forms switched from raw JSON textareas to structured per-protocol/per-transport editors (an "Advanced" tab still exposes raw JSON for unsupported transports)
  • Multi-node deployment landed alongside the migration: new runtime/{local,manager,remote} layer, node_heartbeat_job + node_traffic_sync_job, central panel can deploy inbounds to remote node panels
  • Frontend bundle is split by route (login / xray / inbounds / settings / nodes) for faster initial load (LCP) on the dashboard
• feat(nodes): multi-node deployment with traffic-writer queue, full-mirror sync, and WebSocket event fixes
• feat(security): CSRF protection and security hardening across the application @farhadh
• feat(xray): add loopback outbound protocol
• feat(inbounds): mobile card layout for inbounds and clients
• feat(logs): mobile-friendly log modals with theme-aware colors
• feat(custom-geo): refresh index UI
• feat(xray/dns): expanded DNS settings with hosts editor, presets gallery, and Delete-All

Update & improvement

• refactor(websocket): split controller into service + thin controller
• refactor(fallbacks): share template, tighter UX, cleaner JSON
• refactor(xhttp): split fields by direction, expand outbound coverage
• refactor(vless): drop selectedAuth, expose two explicit auth buttons
• refactor(inbounds): reorder Inbound's Data tabs (client first, sub inline)
• perf(xray): bound Xray-version request and extend cache
• i18n: localize sidebar theme toggle, xray-status badge, and nodes menu
• avoid reset in QueryStatsRequest @samssh
• exclude virtual interfaces from network stats
• outbound: reverse Sniffing
• inbound: check transport in port conflict, allow tcp and udp on same port @pwnnex
• Reality: remove tesla.com because of blocking
• skip Xray 26.5.3 and bump version cutoff
• fix(scripts): harden server-IP detection with multi-provider + manual fallback
• Bump Go to 1.26.3
• Axios v1.16.0
• build frontend for CodeQL; remove release analyze job

Bug fixed

• fix(panel): make webBasePath work end-to-end in dev and prod
• fix(panel): silence update-check WARN spam when offline
• fix(panel-update): poll for restart, fix dark-mode version label
• fix(websocket): guard stale events and disconnect race in JS client
• fix(nodes): bind form-encoded posts and skip node inbounds in central xray
• fix(xray): align DNS outbound to spec and repair item-list rules UI
• fix(xray): clear outbound test state on delete to prevent result bleed @iAliF
• fix(xray): surface reverse tags in routing and balancer dropdowns
• fix(xray): silently ignored error when saving outbound test URL setting @hobostay
• fix(inbounds): remove stale reverse outbound tags after client deletion
• fix(tun): use single mtu number per Xray spec
• fix(vless): scope testseed to xtls-rprx-vision flow
• fix(warp): harden API client and frontend, bump to v0a4005
• fix(fail2ban): banning regression and Docker zero-jail issue
• fix(security): overly permissive file permissions (os.ModePerm) @hobostay
• fix(security): silently ignored errors in password migration seeder @hobostay
• fix(docker): include web/translation in frontend and final stages
• fix(x-ui.sh): pass silent flag to stop/start during IP SSL setup
• fix(arch): correct x-ui service path @odrawq
• fix(ui): mobile dashboard layout
• fix(ui): correct responsive breakpoints for inbound form and settings
• fix(ui): correct responsive breakpoints for add client form and bulk
• fix(ui): mobile filter view
• fix(outbound): mobile style
• fix: swap left/right classes for client table cells
• chore: fix shadowrocketUrl client @harryngne
• revert: Xray Core v26.5.3 (buggy — vless reverse broken)

Reports

Full Changelog: v2.9.4...v3.0.0