Prerelease-Alpha

Release created at Mon Aug 17 10:12:10 CST 2026
Synchronize Alpha branch code updates, keeping only the latest version


我应该下载哪个文件? / Which file should I download?
二进制文件筛选 / Binary file selector
查看文档 / Docs

Full Changelog: v1.19.30...Prerelease-Alpha

v1.19.30

What's Changed

• e889b68 feat: support H2C and QUICv2 sniffing (#3036) by @kosta
• 05b5334 feat: add handshake-timeout for hysteria2 by @wwqgtxx
• 1265cb9 feat: add ip-stack option for masque outbound by @wwqgtxx
• 4ad27d8 feat: add ip-stack option for ZeroTier by @wwqgtxx
• 8453e58 feat: support AmneziaWG v3.0 by @wwqgtxx
• 8b76447 feat: add ip-stack option for wireguard outbound by @wwqgtxx
• 8c56780 feat: support AmneziaWG v3.1 by @wwqgtxx
• b082515 feat: add Zerotier outbound support by @wwqgtxx
• b27c659 feat: add client-metadata configuration to anytls and DON'T sent by default by @wwqgtxx
• bb80689 feat: support bbr3 for mipstack by @wwqgtxx
• d46944f feat: add ip-stack option for openvpn outbound by @wwqgtxx
• e40b596 feat: add rate-limit for restls listener by @wwqgtxx

BUG & Fix

• 25ccc4d fix: handle zerotier network lifecycle events correctly by @wwqgtxx
• 2e8a04c fix: tailscale failed to recover after the network was restored by @wwqgtxx
• 3315457 fix: CVE-2026-56862 for crypto/tls by @wwqgtxx
• 3a779dd fix: typo in uplinkHTTPMethod (#3029) by @kosta
• 4fcf9ae fix: track QUIC crypto stream coverage without repeated range sorting by @wwqgtxx
• 5e3cb10 fix: avoid reserved TLS suffixes in JLS FakeRandom by @wwqgtxx
• 63f15f2 fix: keep connections open after initial sniffing failures by @wwqgtxx
• 69a3142 fix: apply default uplink chunk size for xhttp (#3061) by @vanbujhm
• 7ac597b fix: domain resolve logic in zerotier outbound by @wwqgtxx
• 8d1b661 fix: avoid unnecessary waits in HTTP/2 sniffing by @wwqgtxx
• 8d71008 fix: typo in error string (#3090) by @rye Sears
• 9574a46 fix: truncate udp dns replies to the client's advertised buffer size (#3043) by @TWO666
• 95f7a0c fix: remove incorrect quic error wrapping by @wwqgtxx
• 978d25a fix: enforce ShadowQUIC JLS authentication in QUIC layer by @wwqgtxx
• 98f1200 fix: panic when UDP is not supported in dns_dialer by @wwqgtxx
• 9b9dc8a fix: survive server-initiated soft reset and rekey for openvpn (#3109) by @ayanami-desu
• 9d901dc fix: prevent CUBIC ACKs from reducing cwnd for gvisor by @wwqgtxx
• a2c9556 fix: HTTP/2 read loop spinning on underlying StreamError by @wwqgtxx
• a939fc1 fix: compilation errors under specific circumstances by @wwqgtxx
• ac017cd fix: initialize DNS before NTP (#3103) by @xyx
• ace2037 fix: echo edns0 opt in dns replies when the request carries one (#3041) by @TWO666
• afeb072 fix: trim trailing newline from Tailscale VersionDotTxt in IPNVersion (#3079) by @胡威
• b989445 fix: reduce PROTOCOL_VIOLATION errors on masque dialing by setting ConnectionIDLength by @wwqgtxx
• c1603f4 fix: coordinate TCP sniffers on overlapping ports by @wwqgtxx
• c7089c0 fix: include the upstream tailscale version for standardization (#3074) by @Feng.YJ
• cd05b74 fix: harden zerotier runtime synchronization by @wwqgtxx
• e18ef3a fix: harden ShadowQUIC JLS camouflage forwarding by @wwqgtxx
• ea9c544 fix: avoid unnecessary waits in TLS and QUIC sniffing by @wwqgtxx
• f298cd2 fix: normalize HTTP hosts and avoid unnecessary sniffing delays by @wwqgtxx
• f5fddd3 fix: preserve WebSocket 0-RTT data order by @wwqgtxx
• f83a072 fix: let QUIC sniffer handle Retry key changes by @wwqgtxx
• fb00221 fix: tun dns hijack sending zero-filled or stale packets when PackBuffer reallocates (#3037) by @TWO666

Maintenance

• 09b0ff3 chore: reduce interface differences between gVisor and mipstack by @wwqgtxx
• 0ba9f2f chore: remove dohMaxConnsPerHost & dohMaxIdleConns (#3048) by @ayanamist
• 1af24e9 chore: update tailscale to v1.102.2 by @wwqgtxx
• 1ef16c7 chore: harden TCP pacing and handshake state handling by @wwqgtxx
• 26c635f chore: avoid string reversal allocation in DomainSet.Has (#3049) by @ember Moth
• 2bade29 chore: allow the sniffer to read more data if possible by @wwqgtxx
• 2ea5461 chore: adjust internal dialQuic api by @wwqgtxx
• 3c16aaf chore: update quic-go to 0.61.0 by @wwqgtxx
• 3cac869 chore: reduce ZeroTier wire data-path overhead by @wwqgtxx
• 4859d14 chore: let quic sniffer handle coalesced packets and larger client hello by @wwqgtxx
• 49a5419 chore: update tailscale to v1.102.0 by @wwqgtxx
• 63024e3 chore: remove unused imports in test by @wwqgtxx
• 669db1b chore: harden QUIC Initial packet processing by @wwqgtxx
• 6bb8b98 chore: strictly verify the syntax for Clash-style domain wildcards by @wwqgtxx
• 7259bbb chore: update mipstack for api adjustment by @wwqgtxx
• 73b061a chore: split internal dns server handler by @wwqgtxx
• 770800e chore: reduce packet-path and TCP allocation overhead by @wwqgtxx
• 7ee0b05 chore: allow override IV_VER by peer-info for OpenVPN by @wwqgtxx
• 7ff6544 chore: improve ZeroTier reliability and throughput under load by @wwqgtxx
• 8df9462 chore: update mipstack for api adjustment by @wwqgtxx
• 944e8e1 chore: align MIPS TCP keepalive defaults with sing-wireguard behavior by @wwqgtxx
• 94a89fb chore: reject oversized sniff reads before filling the buffer by @wwqgtxx
• 97cbdc5 chore: update gvisor by @wwqgtxx
• 99ce79c chore: reduce packet queue contention and socket allocation churn by @wwqgtxx
• 9a9c4c6 chore: improve zerotier event diagnostics by @wwqgtxx
• a52c00b chore: expand datagram and raw IP socket support for mipstack by @wwqgtxx
• b9faf97 chore: improve internal sharing mechanism for dnsClient by @wwqgtxx
• c235dc1 chore: let the sniffer assemble client hello across TLS records by @wwqgtxx
• c807c9a chore: let the HTTP/2 sniffer assemble header blocks across continuation frames by @wwqgtxx
• cb8e990 chore: let sniffer support multi-round reading by @wwqgtxx
• cf98d2d chore: align ZeroTier link configuration and multicast state by @wwqgtxx
• d8fbf85 chore: update bart by @wwqgtxx
• dd7bc4c chore: reduce ZeroTier packet processing overhead by @wwqgtxx
• dfd7e89 chore: align congestion control with Linux by @wwqgtxx
• e183c58 chore: stabilize equal-quality peer path selection for ZeroTier by @wwqgtxx
• e9f6297 chore: improve ZeroTier packet bridge throughput by @wwqgtxx
• ee2db89 chore: let gVisor allow HandleLocal working with PromiscuousMode by @wwqgtxx
• efd63d8 chore: extract bitmap handling from QUIC crypto reassembly by @wwqgtxx
• f5fbe0c chore: update mieru version (#3046) by @enfein

Full Changelog: v1.19.29...v1.19.30

v1.19.29

What's Changed

• bd749c6 feat: sync anytls v0.0.13 (#2990) by @anytls
• e26714a feat: support TLS rekey fix, data-ciphers negotiation, tls-crypt-v2 for OpenVPN (#2989) by @Lanlan13-14
• 0e7c3c7 feat: support restls for anytls outbound and listener by @wwqgtxx
• 2b2bdf6 feat: support jls for shadowsocks outbound and listener by @wwqgtxx
• 5677fd3 feat: add name-cert-verify to support separate certificate verification name by @wwqgtxx
• 611a448 feat: support jls for vmess/vless/trojan outbound and listener by @wwqgtxx
• 6d96163 feat: support override-expr for proxy provider override by @wwqgtxx
• 769ea6f feat: support restls for vmess/vless/trojan outbound and listener by @wwqgtxx
• 76d8088 feat: add support for TLSAuth for Openvpn (#2969) by @lyaaz
• 8fe7f74 feat: support jls for anytls outbound and listener by @wwqgtxx
• 9ab7543 feat: support restls/jls for snell outbound and listener by @wwqgtxx
• aea5ce4 feat: support shadowquic outbound and listener by @wwqgtxx
• bc0e5aa feat: support shadowtls for anytls outbound and listener by @wwqgtxx
• bfa9ea1 feat: support brutal for shadowquic (mihomo private extension) by @wwqgtxx
• c015694 feat: support shadowtls for vmess/vless/trojan outbound and listener by @wwqgtxx

BUG & Fix

• 02dfcf2 fix: incorrect alphabet size used in session-table for predefined tables in xhttp-config by @SaltyMonkey
• 0ee5841 fix: reconnect OpenVPN on server soft reset (#2978) by @freephilx
• 12c30af fix: wireguard per-peer reserved ignored (#2958) by @AaronChen0
• 2b0d841 fix: make shadowtls v2 read deadlines recoverable by @wwqgtxx
• 2c7309e fix: listener duplicate-name check (#2948) by @AaronChen0
• 3766a08 fix: set global CA pool and NTP time for restls by @wwqgtxx
• 4154923 fix: stop reaper goroutine busy-looping after context cancel (#2964) by @AaronChen0
• 45f7930 fix: CNAME query matching a hosts domain-entry returns an empty answer (#2965) by @AaronChen0
• 75a3ea8 fix: leaked openStreams on failure in TUIC client (#2959) by @AaronChen0
• 7a3c37c fix: make shadowtls v3 read deadlines recoverable by @wwqgtxx
• 8507c1e fix: missing override shadow-tls-opts and restls-opts in xhttp download-settings by @wwqgtxx
• 8698483 fix: the incorrect tls stack was used in shadowtls tests by @wwqgtxx
• 975389a fix: intermittent timeouts during the soak test by @wwqgtxx
• 9a7e726 fix: performance regression caused by unnecessary wrapping in stream encryption by @wwqgtxx
• 9ae1cc2 fix: shadowquic JLS pre-flight fallback handle by @wwqgtxx
• a35045d fix: consume CachedConn data in ReadCached by @wwqgtxx
• a5167fa fix: allow JLS fallback before the server flight by @wwqgtxx
• a70af27 fix: remove unnecessary quinn-jls compatibility behavior by @wwqgtxx
• ba5c45b fix: anytls listener config parsing by @wwqgtxx
• c079b0c fix: panic on full-width IP-SUFFIX rules (#2975) by @AaronChen0
• c583439 fix: DOMAIN-WILDCARD ignores sniffed hostname (#2956) by @AaronChen0
• cb8cde8 fix: missing override jls-opts in xhttp download-settings by @wwqgtxx
• e8ab2d0 fix: alpnAwareRoundTripper behavior in mekya client by @wwqgtxx
• f86bc22 fix: align HelloRetryRequest handling with JLS v3 by @wwqgtxx

Maintenance

• 1d1b370 chore: remove redundant writeFull in snell v4 by @wwqgtxx
• 2d45f9e chore: using new net/http api in mekya client by @wwqgtxx
• 309cfbd chore: reimplement shadowtls by @wwqgtxx
• 3b73922 chore: cleanup shadowquic code by @wwqgtxx
• 3f22309 chore: respect the incoming context during JLS fallback by @wwqgtxx
• 4236116 chore: better UserFromConn implementation by @wwqgtxx
• 44dd834 chore: preserve jls in-user for shadowsocks listeners by @wwqgtxx
• 46f9b78 chore: export internal OverrideExpr for api user by @wwqgtxx
• 4d7ef85 chore: sync logic to legacy shadowsocks listener by @wwqgtxx
• 5c1b8bf chore: authenticate JLS ServerHello using its wire encoding by @wwqgtxx
• 6a52d23 chore: do not force trailing path / when both sessionID and seq are placed elsewhere for xhttp by @Medium1992
• 75eeba4 chore: significantly trim unnecessary code from tailscale by @wwqgtxx
• 8413f50 chore: skip frequently failed tests on windows go1.20 by @wwqgtxx
• 94409eb chore: remove redundant writeFull in sudoku by @wwqgtxx
• 95af34a chore: remove redundant writeFull in shadowquic by @wwqgtxx
• 9729296 chore: sync to sudoku v0.4.8 (#2966) by @saba-futai
• 9cece13 chore: add test for alpnAwareRoundTripper in mekya client by @wwqgtxx
• b6ed8e2 chore: rewrite the internal mutual exclusion logic of the listener by @wwqgtxx
• b75a776 chore: clean up duplicate helpers in tests by @wwqgtxx
• bc5976f chore: sync internal logic by @wwqgtxx
• cf8545d chore: stabilize traffic wait timing in tlsmirror test by @wwqgtxx
• da5a3e5 chore: rewrite the internal mutual exclusion logic of the outbound by @wwqgtxx
• dc4d4fc chore: allow jls with utls client-fingerprint by @wwqgtxx
• e3c1ea0 chore: better handshakeRecorderConn impl by @wwqgtxx
• e911985 chore: change the brutal negotiation in shadowquic to be asynchronous by @wwqgtxx
• ee80e8d chore: more comprehensive interop test by @wwqgtxx
• f23e43e chore: remove redundant writeFull in gost relay by @wwqgtxx

Full Changelog: v1.19.28...v1.19.29

v1.19.28

What's Changed

• ea19cda feat: add rematch outbound type and REMATCH-NAME rule type (#2862) by @peter Solomon
• d20e850 feat: support custom peer-info for openvpn outbound (#2926) by @Easy-Ez
• 1686d56 feat: convert support session-table and session-length for xhttp-opts fields (#2889) by @legiz-ru
• 01111ff feat: add handshake-timeout for masque by @wwqgtxx
• 1c4f7c4 feat: support shadow-tls for snell by @wwqgtxx
• 1f80d91 feat: support session-table and session-length for xhttp client by @wwqgtxx
• 2f510e8 feat: support tlsmirror for vmess by @wwqgtxx
• 7870f8f feat: add handshake-timeout for OpenVPN by @wwqgtxx
• 8c40e36 feat: support fallback-lazy-query for dns section by @wwqgtxx
• 8e2aba4 feat: support network: h3-l4proxy for masque outbound by @wwqgtxx
• a198581 feat: support mkcp for vmess by @wwqgtxx
• a1c09ad feat: support restls for shadowsocks listener by @wwqgtxx
• ad730ae feat: support listen-routing-mark for dns section by @wwqgtxx
• be9164e feat: add default-selected for select group by @wwqgtxx
• d67572b feat: support routing-mark for listeners except tun/redir/tproxy and top-level external-controller-routing-mark by @wwqgtxx
• e10a1a7 feat: support mekya for vmess by @wwqgtxx
• 85c1798 break(restful api): restore original Clash /proxies behavior by @xishang0128

BUG & Fix

• 1f93334 fix: udp WriteTo returned wrong count by @wwqgtxx
• 26edbaa fix: dualStackDialContext not close the fallback connection when the preferred IP family won by @kasumikira
• 2cd1443 fix: prevent snell pool from reusing unready connections (#2878) by @xream
• 4281001 fix: restore the original fallback concurrency behavior by @wwqgtxx
• 45ca4ae fix: preserve shadow-tls in-user for snell listeners (#2934) by @xream
• 578b881 fix: add missing json tags to raw config structs (#2939) by @chenx Dust
• 59ffb63 fix: scStreamUpServerSecs not working when xPaddingObfsMode is true by @wwqgtxx
• 5ab5eb3 fix: snell v2 listener can't pass test by @wwqgtxx
• 5b54b3a fix: panic when dial failed in masque by @wwqgtxx
• 63e4d5a fix: TUIC v5 fragmented UDP reads in quicStreamPacketConn.ReadFrom (#2942) by @aaron Chen
• 73740c7 fix: wrong realm resolver when only IPv6 is requested by @rumianoesa
• 793f61e fix: crash in AmneziaWG receive path with slice bounds out of range when S4 is larger than incoming packet by @wwqgtxx
• 94a7a3f fix: udp write in sing-mux by @wwqgtxx
• d08c885 fix: writeSem initiation in OpenVPN by @roy.lieu
• d924f1c fix: CVE-2026-42505 for crypto/tls by @wwqgtxx
• e3972e7 fix: apply TUIC v5 UDP relay size clamp when building server options (#2943) by @aaron Chen
• e64f58f fix: panic when rand.IntN calling on a nil slice by @wwqgtxx

Maintenance

• 02dd143 chore: relax version restrictions for the snell listener by @wwqgtxx
• 084a09e chore: export internal function for api user by @wwqgtxx
• 0daa3ff chore: allow overriding inbound listen config for api user by @wwqgtxx
• 1095055 chore: upgrade bbolt to 1.5.0 by @wwqgtxx
• 174cba4 chore: update sing-tun by @wwqgtxx
• 1e76df7 chore: better group config parsing by @wwqgtxx
• 24b6de7 chore: lazy init reality server cert by @wwqgtxx
• 26e3d22 chore: peer should set to expire unconditionally in tailscale-wireguard-go by @wwqgtxx
• 27efee2 chore: cleanup unused code in OpenVPN by @wwqgtxx
• 2c6ff72 chore: bump mieru version to 3.34.0 (#2899) by @enfein
• 38fd897 chore: sync common/maphash code by @wwqgtxx
• 3b85577 chore: make bbolt work on non-mmap supported platforms by @wwqgtxx
• 6414c56 chore: reduce one unnecessary slice copy operation by @wwqgtxx
• 7031b75 chore: update quic-go to 0.60.0 by @wwqgtxx
• 76bf840 chore: code cleanup by @wwqgtxx
• 85c2f6a chore: change the type of the internal value being passed by @wwqgtxx
• 93d33fa chore: increase REALITY target TLS record buffer to 16 KiB by @wwqgtxx
• acbc92f chore: better mieru inbound test implementation by @wwqgtxx
• aff8dc7 chore: adjust struct name by @wwqgtxx
• bcfd434 chore: update chi to 5.3.0 by @wwqgtxx
• cbd11db chore: converter map hysteria2 port hopping and realm URI (#2947) by @peter Solomon
• d41d757 chore: rename listener config to tlsmirror-config by @wwqgtxx
• da28fe3 chore: more code sharing by @wwqgtxx
• dc5c2ec chore: change http method from GET to POST in listener test by @wwqgtxx
• de51c4b chore: cleanup interop test code by @wwqgtxx
• e3d67b3 chore: strictly forbidden to fill in a proxy group for empty-fallback by @wwqgtxx
• eca44d0 chore: update tfo-go ready for go1.27 by @wwqgtxx
• f62ebd0 chore: cleanup interop test code by @wwqgtxx
• f74bd8b chore: adjust internal function return type by @wwqgtxx

Full Changelog: v1.19.27...v1.19.28

v1.19.27

What's Changed

• 90b1066 feat: add ping keepalive support for OpenVPN (#2859) by @puppywang
• fd2112e feat: add built-in proxy PASS-RULE (#2873) by @echsfxy
• 1e62d55 feat: add empty-fallback to group options allows for customization instead of hardcoding COMPATIBLE by @wwqgtxx
• 317bfc2 feat: add allow-insecure config to anytls/trojan/vless listeners for nginx/caddy front users by @wwqgtxx
• 358fa5e feat: add age-secret-key for proxy-provider and -age-secret-key for cmdline to support age armor format config decryption by @wwqgtxx
• bd72c65 feat: remove global-client-fingerprint, please set client-fingerprint directly on the proxy instead by @wwqgtxx
• e928ef5 feat: add path-in-bundle to rule-providers to support extract from BundleMRS.7z when the local file does not exist by @wwqgtxx

BUG & Fix

• 1184850 fix: quic sniffer out-of-bounds read causes process crash via single UDP packet by @guanni Qu
• 1abd126 fix: validation error handling for age-secret-key by @wwqgtxx
• 5184081 fix: socks4 readUntilNull unbounded memory allocation by @guanni Qu
• 5bdb1cc fix: trojan protocol WaitReadFrom panic via oversized UDP relay length field by @guanni Qu
• 9761bcd fix: exchangeQUIC not fully respecting context by @wwqgtxx
• c710025 fix: readMsg in doq out-of-bounds access by @wwqgtxx
• dafdd06 fix: variable capture in dns outbound by @wwqgtxx
• dbaf85b fix: vision TLS filter out-of-bounds read via crafted session_id length by @guanni Qu

Maintenance

• 01edf45 chore: improve internal api by @wwqgtxx
• 316f5df chore: add WithDialer option to component/http for api user by @wwqgtxx
• ab56858 chore: sync sudoku v0.4.7 optimizations (#2879) by @saba-futai
• b60e687 chore: support convert age-secret-key to age-public-key for build-in age tool by @wwqgtxx
• d7ac7b5 chore: support std input/output for age encrypt/decrypt tool by @wwqgtxx
• f99d4e1 chore: adjust internal age component api by @wwqgtxx

Full Changelog: v1.19.26...v1.19.27

v1.19.26

What's Changed

• 52edebd feat: add snell version 4/5 outbound and inbound (#2817) by @xream
• 7a6a650 feat: support OpenVPN CBC ciphers (#2818) by @romanov Caesar
• ff98700 feat: support CHACHA20-POLY1305 data cipher for OpenVPN (#2798) by @Lanlan13-14
• fc8c5a2 feat: support comp-lzo for OpenVPN (#2841) by @zhiqiang Zhang
• 2dd7d59 feat: support MD5/SHA384/SHA512 OpenVPN auth methods by @wwqgtxx
• f1c3656 feat: support AES-192-GCM/AES-192-CBC OpenVPN data ciphers by @wwqgtxx
• f30a64f feat: support hysteria2 gecko obfs by @wwqgtxx

BUG & Fix

• 03e1f44 fix: interface structs do not copy correctly by @wwqgtxx
• 301d580 fix: compile issue of tailscale-wireguard-go dependency by @wwqgtxx
• 3809a03 fix: stack panic after dispatcher attach nil by @wwqgtxx
• 38cb06d fix: hysteria2 realm stun domain resolve by @wwqgtxx
• 4065583 fix: masque retry condition by @wwqgtxx
• 5639e93 fix: improve OpenVPN transport reliability (#2824) by @romanov Caesar
• 8c26d61 fix: tproxy did not pass the additions correctly by @wwqgtxx
• a2aca02 fix: pinger in tailscale not under our control by @wwqgtxx
• a52a27e fix: errors.ErrUnsupported backport by @wwqgtxx
• a531449 fix: missing param passing in vless listener config by @wwqgtxx
• b230c90 fix: shadowtls v3 client HMAC handling for TLS 1.3 HelloRetryRequest by @wwqgtxx
• d2fcf71 fix: tailscale panic when working with dialer-proxy by @wwqgtxx
• f69331f fix: config struct not exported by @wwqgtxx

Maintenance

• 060711f chore: more netip.AddrPort using in tproxy by @wwqgtxx
• 0ddf4bb chore: update sing-tun by @wwqgtxx
• 0dec35e chore: always dial tcp on netstack for tailscale by @wwqgtxx
• 31ece04 chore: upgrade the embedded xsync.Map to v4.5.0 by @wwqgtxx
• 5b28a0e chore: optimize sudoku packed hot paths (#2833) by @saba-futai
• 6e15299 chore: remove AF_ALG in tailscale-wireguard-go by @wwqgtxx
• 72f133f chore: more logging for tailscale debug by @wwqgtxx
• 8f2d84f chore: update mieru version to v3.33.0 (#2840) by @enfein
• a05c94b chore: make the proxydialer module no longer directly depend on the tunnel module by @wwqgtxx
• b1a07d2 chore: remove unnecessary member variables added by xsync/v3 by @wwqgtxx
• cb652dd chore: make the handler-related SNAT key in NewPacket by @wwqgtxx
• d27f320 chore: use pre-go1.27 tls.QUICConfig.ClientHelloInfoConn API for quic-go to avoid cloning tls.Config by @wwqgtxx
• d60b336 chore: use mihomo name & ver to tailscale reported ver to avoid update prompts (#2801) by @ayanamist
• d610afe chore: clear parameter passing by @wwqgtxx
• e9e23c4 chore: tailscale must be compiled under the with_gvisor build tag by @wwqgtxx
• f2da5b7 chore: reduce internal circular dependencies by @wwqgtxx

Full Changelog: v1.19.25...v1.19.26

v1.19.25

What's Changed

• 571925d feat: add Tailscale outbound support (#2786) by @汐殇
• 7af9eeb feat: add OpenVPN outbound support (#2785) by @romanov Caesar
• 6ea4373 feat: support auth-user-pass and AES-256-GCM for OpenVPN (#2787) by @ekko
• 5e22035 feat: add GOST relay outbound proxy type (#2795) by @ztywyj
• 98aa7e6 feat: support realm-opts for hysteria2 outbound and listener by @wwqgtxx
• 787dbfc feat: support setting realm-opts.proxy for hysteria2 listener by @wwqgtxx
• 2ffd962 feat: support hysteria2-realm listener by @wwqgtxx
• 8b8eae5 feat: support simple-obfs for shadowsocks listener by @wwqgtxx

BUG & Fix

• 0003e14 fix: trusttunnel listener panic by @wwqgtxx
• 17bed79 fix: tsnet panic for tailscale by @wwqgtxx
• 2f51cb0 fix: conn maybe not closed in error handling by @wwqgtxx
• 2f6ce20 fix: tailscale not use configured dialer for captive detection by @wwqgtxx
• 35d5d4e fix: CVE-2026-39825 for net/http by @wwqgtxx
• 388d958 fix: remove unstable warning for tailscale by @wwqgtxx
• 5df45b2 fix: typo in default alpn by @wwqgtxx
• 7a646e8 fix: correctly configure the HTTP/2 scheduled ping parameters in masque h2 mode by @wwqgtxx
• 802b0b2 fix: netlink permission denied on android for tailscale by @wwqgtxx
• 8a28dce fix: validate Linux process netlink matches by @xream
• 95946a5 fix: net/http.Transport's UnencryptedHTTP2 does not work TLS without ALPN by @wwqgtxx
• 98aa42e fix: convert place disguise host in h2-opts.host for legacy base64-JSON VMess (#2739) by @wangwei354
• 9e97dc0 fix: tailscale not use configured dialer for netstack forwardTCP by @wwqgtxx
• aae5812 fix: net/http.Server's UnencryptedHTTP2 does not work TLS without ALPN by @wwqgtxx
• b3104a5 fix: panic in vless xhttp h3 mode when quic dial fails (#2736) by @beck
• cc376ac fix: skip TTL update for OPT records by @wwqgtxx
• d2acf45 fix: hysteria2 realm server reaper loop by @wwqgtxx
• e933ca8 fix: netlink permission denied on android for tailscale by @wwqgtxx
• f5cfb8d fix: convert emit HTTP2Options-shaped h2-opts for share-link HTTP/2 transport (#2737) by @wangwei354
• fd31419 fix: wrong function call in SetWriteDeadline (#2790) by @aaron Chen
• ffe6e42 fix: conn maybe not closed in error handling by @wwqgtxx

Maintenance

• 00e6df5 chore: close http2 connections when closing client in doh by @wwqgtxx
• 028b480 chore: remove unused http server code by @wwqgtxx
• 163ce6a chore: add mlkem768x25519-sha256 key exchange algorithm to ssh outbound by @wwqgtxx
• 1fea551 chore: verify adapter can parse convert's result in its test by @wwqgtxx
• 263d06d chore: allow passing tunnel when creating the proxy by @wwqgtxx
• 2a8da25 chore: handle the possibility of multiple ClientTrace.GotConn calls by @wwqgtxx
• 2d94970 chore: using new net/http api in masque h2 mode by @wwqgtxx
• 2f11d96 chore: use our internal DNS resolution logic for tailscale by @wwqgtxx
• 3d3af1f chore: respect outbound dns prefer when resolve UDP by @wwqgtxx
• 3fb93bd chore: using new net/http api in gun and xhttp listener by @wwqgtxx
• 44c9423 chore: code cleanup by @wwqgtxx
• 81bea65 chore: using new net/http api in vmess h2 client by @wwqgtxx
• 82621cd chore: always safe UUID generation by @wwqgtxx
• 8bc7d3e chore: using new net/http api in doh client by @wwqgtxx
• 8d53952 chore: remove unused xhttp options in download-settings by @wwqgtxx
• 8f69ad9 chore: better uuid generation by @wwqgtxx
• 993d1b6 chore: add stun retry and lazy server start for realm by @wwqgtxx
• a1c68a4 chore: using new net/http api in reality client fallback by @wwqgtxx
• ac6f6d0 chore: tailscale using ListenPacket for UDP by @wwqgtxx
• b03aa5d chore: remove race code in wireguard implementation by @wwqgtxx
• b8b4439 chore: using new net/http api in trusttunnel listener by @wwqgtxx
• bb2f57b chore: using new net/http api in xhttp client by @wwqgtxx
• c27446a chore: using new net/http api in gun client by @wwqgtxx
• c59c99a chore: handle context cancellation in xhttp client dialing by @wwqgtxx
• c98e67a chore: using new net/http api in trusttunnel client by @wwqgtxx
• df1c5e5 chore: relax sudoku user configuration (#2757) by @saba-futai
• f333359 chore: move magic close http2 connections function to own fork by @wwqgtxx
• f5f9e59 chore: update sing-tun by @wwqgtxx
• faa58f2 chore: add some comments for using the new net/http API by @wwqgtxx

Full Changelog: v1.19.24...v1.19.25

v1.19.24

What's Changed

• cacd01a feat: add h3 mode support for xhttp client (#2686) by @Hanahime
• 61dc7b1 feat: add http1.1 mode support for xhttp client by @wwqgtxx
• 2337d70 feat: support xhttp new options for bypassing CDN's potential detection by @wwqgtxx
• 6791df1 feat: support h-keep-alive-period to xhttp reuse-settings by @wwqgtxx
• 700e25f feat: support sc-max-buffered-posts for xhttp listener by @wwqgtxx
• f109b8b feat: support range format for xhttp sc-max-each-post-bytes by @wwqgtxx
• ad91303 feat: support upload packet merging in packet-up mode and sc-min-posts-interval-ms settings for xhttp transport by @wwqgtxx
• a847246 feat: convert support new xhttp-opts fields (#2734) by @legiz-ru
• 80072eb feat: support range format for hysteria2 hop-interval by @wwqgtxx
• 1b2ea14 feat: support ipv6 dual stack fallback for masque/trusttunnel/xhttp h3 mode by @wwqgtxx
• 808c0d6 feat: support ipv6 dual stack fallback for hysteria2 by @wwqgtxx
• fdafea3 feat: support ipv6 dual stack fallback for tuic by @wwqgtxx
• 885244a feat: support network: h2 for masque outbound by @wwqgtxx
• db25932 feat: support bbr-profile for hysteria2/tuic/trusttunnel/masque by @wwqgtxx
• d701d1c feat: add -post-up and -post-down flags for cmdline by @wwqgtxx
• 8a029da feat: add /storage endpoint with Get, Put, and Delete methods for restful api by @Zephyruso

BUG & Fix

• 0495d29 fix: convert normalize VLESS share-link transport mapping (#2694) by @slackworker
• 0f71808 fix: masque h2 conn lifecycle management by @wwqgtxx
• 299a63f fix: quic underlay packetConn maybe not closed in doh3/doq by @wwqgtxx
• 299fd33 fix: race in websocket with early data by @wwqgtxx
• 2fbed16 fix: don't add ":80" to Host for vmess http obfs by @wwqgtxx
• 4387c67 fix: race for hysteria2 salamander by @wwqgtxx
• 4f927ca fix: CVE-2026-33814 for net/http by @wwqgtxx
• 6fb9d9e fix: max payload size estimation on datagram queueing for quic-go by @wwqgtxx
• 83ac220 fix: convert accept obfs/obfs-host as aliases for mode/host in ss v2ray-plugin URL (#2712) by @beck
• 9613f02 fix: random panic by race in proxy id init by @wwqgtxx
• 96a6962 fix: quic underlay packetConn maybe not closed in masque by @wwqgtxx
• acc4f62 fix: quic underlay packetConn not closed in trusttunnel h3 mode by @wwqgtxx
• b00c985 fix: race in h2mux read by @wwqgtxx
• d4b3d23 fix: race in trusttunnel read by @wwqgtxx
• db63ffb fix: quic underlay packetConn not closed in xhttp h3 mode by @wwqgtxx
• e4099f0 fix: prevert body not close where conn is already closed before setup for sing-mux and trusttunnel by @wwqgtxx
• ec664a5 fix: option name typo in listener by @wwqgtxx
• f0ad835 fix: BBR scale window for datagram size by @wwqgtxx
• fcbcd10 fix: race in quic get congestion by @wwqgtxx

Maintenance

• 0325361 chore: add test for xhttp over vless encryption by @wwqgtxx
• 0e0265f chore: simplify gotConn handling by @wwqgtxx
• 1bee590 chore: reduce data copy in read packet for masque by @wwqgtxx
• 20cb280 chore: simplify error handling code by @wwqgtxx
• 2247c0e chore: async xhttp RoundTrip to let some CDN/reverse proxy happy (#2719) by @kyber1024
• 2cfff83 chore: let xhttp server passing stream-one and stream-up mode test under http1 by @wwqgtxx
• 37942ce chore: remove unused timeout in socks5 over tls by @wwqgtxx
• 3d6add3 chore: align internal logic by @wwqgtxx
• 3f2b0ba chore: test dialer should be created by test tunnel by @wwqgtxx
• 4814c72 chore: add mode restrictions test back by @wwqgtxx
• 4985802 chore: add test for packet upload queue by @wwqgtxx
• 5b013f2 chore: code cleanup by @wwqgtxx
• 6b07683 chore: better DialQuic interface by @wwqgtxx
• 6c407f0 chore: rebuild upload queue logic by @wwqgtxx
• 7ab4eed chore: handling edge cases where the transport may dial more than once in test by @wwqgtxx
• 7abf290 chore: update quic congestion pacer by @wwqgtxx
• 7b73775 chore: add short circuit logic for dual stack dial to decrease unnecessary goroutine by @wwqgtxx
• 7e83399 chore: update comments to clarify why need retry in TestDialer by @wwqgtxx
• 8c1b1a3 chore: check sc-max-each-post-bytes greater than zero if set by @wwqgtxx
• a450080 chore: skip sudoku http mask test on windows again by @wwqgtxx
• ab3746a chore: update mieru version (#2687) by @enfein
• b0ea75b chore: using NewClientConn directly instead of the built-in connection pool for masque h2 mode by @wwqgtxx
• c39b680 chore: remove unused limit on concurrent dialing in xhttp client by @wwqgtxx
• cac4891 chore: add deadline wrapper for trusttunnel server by @wwqgtxx
• d4c4b28 chore: allow overriding sing-mux internal tcpTimeout value for testing by @wwqgtxx
• d801e6b chore: align with trusttunnel's official session reuse logic (#2683) by @maxim
• d8cb32b chore: move tuic special types to a new package by @wwqgtxx
• d9c447a chore: remove unneeded copy in uploadQueue by @wwqgtxx
• df6a5d3 chore: add TestDialer to retry when dial fails for local testing by @wwqgtxx
• dfc888d chore: update default headers in xhttp by @wwqgtxx
• e0a42d4 chore: remove strict timeout restrictions in test for slow github action by @wwqgtxx
• e1bdfba chore: update dlclark/regexp2 by @wwqgtxx
• e38aa82 chore: don't force bind interface when using fd for tun by @wwqgtxx
• ebc41ea chore: update mieru version (#2721) by @enfein
• f425c81 chore: read as much data as possible from the reader by @wwqgtxx
• f5183da chore: correct the xhttp reuse-settings item order by @wwqgtxx
• fa081fb chore: rebuild masque h2 conn read logic by @wwqgtxx
• fe7f3d6 chore: rebuild max-connections logic in reuse-settings by @wwqgtxx

Full Changelog: v1.19.23...v1.19.24

v1.19.23

What's Changed

• d131991 feat: add reuse-settings support for vless xhttp (aka xmux) (#2670) by @Nemu-x
• f3b0581 feat: convert support xhttp subscriptions (#2671) by @legiz-ru
• 4f5ad97 feat: convert support xhttp reuse-settings (aka xmux) (#2675) by @legiz-ru
• 7709554 feat: add max-connections, min-streams and max-streams options to grpc-opts by @wwqgtxx
• 7f6ac1d feat: support sc-stream-up-server-secs and no-sse-header for xhttp listener by @wwqgtxx
• 8b37e99 feat: support sc-max-each-post-bytes for xhttp client and listener by @wwqgtxx
• caacf7a feat: add max-connections, min-streams and max-streams options to trusttunnel client by @wwqgtxx
• Updated to the Golang 1.26.2 toolchain, fixing some security CVEs.

BUG & Fix

• 49e5854 fix: CVE-2026-32283 for crypto/tls by @wwqgtxx
• 5d8e2d2 fix: gun reader error handling by @wwqgtxx

Maintenance

• 0cb5141 chore: respect mode restrictions for xhttp listener by @wwqgtxx
• 3db64d0 chore: add get tls connection state function in component/tls by @wwqgtxx
• 428b7ad chore: remove unneeded io.ReadFull in gun reader by @wwqgtxx
• 4730f67 chore: update sing-tun by @wwqgtxx
• 5e8bd85 chore: skip kcptun test on windows go1.20 by @wwqgtxx
• 6687ae1 chore: better stream-up server implement by @wwqgtxx
• 6a2b0db chore: optimized sudoku read/write performance (#2678) by @saba-futai
• 78e4b84 chore: remove unused code in h2ConnWrapper by @wwqgtxx
• 7923f1a chore: rebuild reuseManager code by @wwqgtxx
• 871e6d1 chore: rebuild xhttp inbound test by @wwqgtxx
• 979305d chore: cleanup condition for authentication by @wwqgtxx
• 97c526f chore: add TLSConn interface and not depend on *tls.Conn type for our net/http fork by @wwqgtxx
• 98b2499 chore: align internal logic by @wwqgtxx
• 9f38a26 chore: follow upstream server's keepalive settings for http proxy by @wwqgtxx
• c48f592 chore: merge duplicate code by @wwqgtxx
• e5f05aa chore: don't need to close connection if content length is positive numbers for http proxy by @wwqgtxx

Full Changelog: v1.19.23...v1.19.22

v1.19.22

What's Changed

• 18fcfc3 feat: support parsing mierus subscription link (#2657) by @enfein
• 357f1ad feat: implement xhttp stream-up and download-settings support (#2655) by @Nemu-x
• 530c6b4 feat: add xhttp transport support (#2645) by @Nemu-x
• 56379b7 feat: implement download-settings for packet-up mode by @wwqgtxx
• 61c1358 feat: add ping-interval to grpc-opts by @wwqgtxx

BUG & Fix

• 0a05ef8 fix: custom grpc-user-agent not working (#2620) by @alex
• 2d34ecf fix: panic on trojan dial error by @wwqgtxx
• 3148643 fix: close conn after peek failed in mixed listener (#2621) by @hunshcn
• 416f769 fix: default xhttp padding to 100-1000 when not set (#2647) by @Nemu-x
• 576a442 fix: remove unused sc-max-concurrent-posts option (#2654) by @Nemu-x
• 60f3205 fix: conceal the h2-special typed error for gun server by @wwqgtxx
• 719d3eb fix: prevent deadlock in gun.Conn.Close when initReader is in progress (#2651) by @beck
• 7e6a7d7 fix: incorrect use the request context in trusttunnel client by @wwqgtxx
• 7fdc122 fix: remove incomplete xhttp config options (#2648) by @Nemu-x
• 809aee8 fix: crash on armv7 synology's linux by @wwqgtxx
• ba42eb4 fix: multiple hosts unsupported by net/url after go1.26 by @wwqgtxx
• c36090a fix: download servername override by @wwqgtxx
• d0f3312 fix: incorrect OPT RR filter order (#2634) by @woaihsw
• dd3a149 fix: transport not closed in xhttp client by @wwqgtxx
• e28fe24 fix: incorrect use of hyphen by @wwqgtxx
• f82a365 fix: correct inverted error check in getTunnelName (#2659) by @rulong Chen（陈汝龙）

Maintenance

• 0120b1d chore: add logging for get tun name from fd by @wwqgtxx
• 018a291 chore: better lifecycle management by @wwqgtxx
• 08a3aaa chore: rebuild gun code by @wwqgtxx
• 132800e chore: more code sharing by @wwqgtxx
• 29fed6e chore: rebuild packet up writer by @wwqgtxx
• 3a3a5b6 chore: move xhttp configuration checks to proxy created by @wwqgtxx
• 4500802 chore: update proxygroup interface by @wwqgtxx
• 45587c5 chore: adjust sing-mux test by @wwqgtxx
• 6517d2a chore: align with legacy behavior by @wwqgtxx
• 73465fe chore: align to sudoku v0.4.0 (#2661) by @saba-futai
• 77a4cc4 chore: code cleanup by @wwqgtxx
• 7d6ee8d chore: move sharing code to common/httputils by @wwqgtxx
• 7fd9860 chore: unify internal coding style by @wwqgtxx
• 8795cd6 chore: clean up unused function args by @wwqgtxx
• 8c6c6d5 chore: align the way of getting addr and deadline in conn by @wwqgtxx
• 9664ca2 chore: add procfs fallback for android findProcess (#2639) by @alexandr Andreev
• ae374f6 chore: remove unreachable code by @wwqgtxx
• b3c8160 chore: reduce the inherent 1rtt in httpmask mode for sudoku (#2610) by @saba-futai
• c3dc85e chore: rebuild xhttp stream-up and download-settings code by @wwqgtxx
• c9bc2d3 chore: don't modify msg when getting minimalTTL by @wwqgtxx
• db36787 chore: update patch file for goissue77975 by @wwqgtxx
• dd4eb63 chore: avoid the request context never being canceled in trusttunnel client by @wwqgtxx

Full Changelog: v1.19.21...v1.19.22