v3.4.2

🚀 WireGuard Multi-Client, Panel Accessibility, Balancer Observatory & Hardened Settings

• 🔐 WireGuard goes multi-client — WireGuard inbounds are now first-class multi-client (native users), with a reworked client-config UX, a collapsible config card, configurable DNS, and client IPs allocated inside the existing peer subnet.
• ♿ Panel accessibility — screen-reader and keyboard accessibility were brought across the whole panel.
• ⚖️ Balancer Observatory — a tabbed Observatory / Burst Observatory form, validation that defers errors until a field is touched or saved, and a burst observer for random/roundRobin strategies with a fallbackTag.
• 🛡️ Hardened settings & restore — sensitive setting changes now require re-confirming 2FA, and the database-restore body-cap exemption was tightened.
• 🛰️ REALITY target scanner — a live REALITY target scanner with IP/CIDR discovery.
• 🧪 Dev channel from stable — opt into the rolling dev channel directly from a stable build.
• 🔗 Subscription & inbound polish — Host VLESS Route baked into subscription UUIDs, {{EMAIL}} shown on the first sub-body link only, a remark template applied to Export all inbound links, and legacy externalProxy converted to hosts on import.
• 🧰 Dev toolchain & deps — a canonical Makefile, golangci-lint v2, plus Ant Design 6.5 and xray-core v26.6.27.

ℹ️ Heads-up: WireGuard inbounds are now natively multi-client — existing single-peer inbounds migrate automatically to the clients model. The minimum eligible Xray version was raised (bundled core bumped to xray-core v26.6.27); update any custom cores accordingly. With 2FA enabled, sensitive setting changes now prompt for a fresh 2FA confirmation before they apply.

🆕 New

• feat(wireguard): multi-client support
• feat(wireguard): client config UX, collapsible config card, configurable DNS
• feat(a11y): screen-reader & keyboard accessibility across the panel (#5486, #5652) @nima1024m
• feat(reality): add live REALITY target scanner with IP/CIDR discovery
• feat(balancers): tabbed Observatory/Burst Observatory form (#5627) @nima1024m
• feat(update): allow opting into the dev channel from a stable build
• feat(groups): reset group traffic without touching client counters
• feat(inbounds): apply remark template to Export all inbound links
• feat(xhttp): default xmux maxConnections to 6
• feat(backup): prefix backup filenames with date and time (#5606) @NikanZeyaei
• feat: ldap skip tls verify (#5637) @NikanZeyaei
• feat(sidebar): add documentation link button

⚡ Update & improvement

• Bump minimum eligible Xray version
• chore(deps): bump xray-core to v26.6.27
• chore(deps): bump antd to 6.5 and migrate deprecated component props
• chore: add Makefile as canonical task runner
• style: adopt golangci-lint v2 and resolve all findings
• chore(ci): bump golangci-lint action to v9
• docs: add CLAUDE.md agent guides for root and frontend
• docs: correct false RTL claim and stale Vite version in CONTRIBUTING.md
• test(sub): align identity-token test with first-link-only EMAIL
• fix(lint): use errors.Is for io.EOF comparison in sys_linux

🐞 Bug fixed

• fix(node): stop the offline-sync toast firing on saves to online nodes
• fix(clients): re-enable depleted clients on API renewal (#5619)
• fix(xray): clean stale routing references when a balancer or outbound is deleted (#5648) @nima1024m
• fix(clients): hide WireGuard config after detaching the WG inbound
• fix(wireguard): allocate client IPs in the existing peer subnet
• fix(sync): mark node dirty inside the mutation transaction (atomic ConfigDirty) (#5611) @n0ctal
• fix(runtime): refresh cached node remotes on identity change (#5614) @n0ctal
• fix(settings): require re-2FA confirmation for sensitive setting changes (#5610) @n0ctal
• fix(web): tighten database restore body-cap exemption (#5609) @n0ctal
• fix(balancers): defer validation errors until touched or save (#5626) @nima1024m
• fix(balancers): create burst observer for random/roundRobin with fallbackTag
• fix(sub): bake Host VLESS Route into subscription UUIDs
• fix(sub): show {{EMAIL}} on first sub-body link only
• fix(inbound): convert legacy externalProxy to hosts on import
• fix(shadowsocks): send per-user Account for SS-2022 runtime AddUser
• fix(routing): write lowercase L4 network to xray config, display uppercase in UI
• fix(settings): normalize API token timestamps (#5599) @Tomilla
• fix(logger): prevent nil-deref panic in migrate/setting CLI paths

Reports

New Contributors

• @Tomilla made their first contribution in #5599

Full Changelog: v3.4.1...v3.4.2