v3.2.6

New

• feat(outbounds): pick dialerProxy from other outbound tags for proxy chaining
• feat(nodes): add per-node TLS verification mode for self-signed certs (#4757)
• feat(inbounds): support Unix domain socket path in Listen field (#4429)
• feat(x-ui.sh): support Cloudflare API Token for DNS SSL (menu 20) (#4595)
• feat(x-ui.sh): add PostgreSQL management menu

Update & improvement

• perf(clients): batch bulk attach/detach to cut per-item DB work
• docs(readme): revamp README and sync all translations
• chore(generated): sync node types/zod with TLS verification fields (#4757)
• chore(ui): remove cards jump on hover (#4755) @fgsfds
• Replace static label with translation for downlink stats (#4762) @ckun52880
• Remove .svg extension from shields URLs in READMEs

Bug fixed

• fix(migrate): copy composite-key tables without FindInBatches (#4787)
• fix(node): suppress unavoidable InsecureSkipVerify alert for cert pinning
• fix(node): capture node cert via VerifyConnection for fingerprint fetch
• fix(clients): keep Add Client modal in viewport with internal scroll
• fix(xray): clear dirty state after saving unchanged config
• fix(job): skip fail2ban IP limit when disabled (#4581) @Mayurifag
• fix(fallbacks): allow free-form dest entries for external servers (#4748)
• fix(raw): complete the HTTP header section for inbound and outbound
• fix(x-ui.sh): preserve 2FA on credential reset (#4758)
• fix(inbounds): allow port 0 for UDS inbounds (#4783)
• fix(warp): persist client_id so WARP outbound gets reserved bytes (#4781)
• fix(nodes): sum client traffic across nodes instead of overwriting
• fix(hysteria): use pinSHA256 for pinned cert and emit ech in share links
• fix(sub): source Userinfo total/expiry from client config in multi-node (#4645)
• fix(db): make password-hash migration idempotent to prevent lock-out (#4612)
• fix(outbound): add None option to uTLS fingerprint in TLS form (#4760)
• fix(outbound): carry ALPN, fingerprint and UDP mask when importing a Hysteria2 link (#4760)
• fix(sockopt): rename interfaceName to interface so xray honors it
• fix(sub): ensure unique Clash proxy names (#4641)
• fix(settings): enforce trafficDiff max of 100 in UI (#4769)
• fix(outbound): fill encryption and pqv when importing VLESS link
• fix(docker): grant NET_ADMIN/NET_RAW so fail2ban IP-limit bans apply
• Fix IP limit enforcement and clarify related comments (#4699) @aloky
• fix(sub): Add Clash subscription profile filename header (#4743) @xiaoxiyao

Reports

Full Changelog: v3.2.5...v3.2.6