v1.19.28

What's Changed

• ea19cda feat: add rematch outbound type and REMATCH-NAME rule type (#2862) by @peter Solomon
• d20e850 feat: support custom peer-info for openvpn outbound (#2926) by @Easy-Ez
• 1686d56 feat: convert support session-table and session-length for xhttp-opts fields (#2889) by @legiz-ru
• 01111ff feat: add handshake-timeout for masque by @wwqgtxx
• 1c4f7c4 feat: support shadow-tls for snell by @wwqgtxx
• 1f80d91 feat: support session-table and session-length for xhttp client by @wwqgtxx
• 2f510e8 feat: support tlsmirror for vmess by @wwqgtxx
• 7870f8f feat: add handshake-timeout for OpenVPN by @wwqgtxx
• 8c40e36 feat: support fallback-lazy-query for dns section by @wwqgtxx
• 8e2aba4 feat: support network: h3-l4proxy for masque outbound by @wwqgtxx
• a198581 feat: support mkcp for vmess by @wwqgtxx
• a1c09ad feat: support restls for shadowsocks listener by @wwqgtxx
• ad730ae feat: support listen-routing-mark for dns section by @wwqgtxx
• be9164e feat: add default-selected for select group by @wwqgtxx
• d67572b feat: support routing-mark for listeners except tun/redir/tproxy and top-level external-controller-routing-mark by @wwqgtxx
• e10a1a7 feat: support mekya for vmess by @wwqgtxx
• 85c1798 break(restful api): restore original Clash /proxies behavior by @xishang0128

BUG & Fix

• 1f93334 fix: udp WriteTo returned wrong count by @wwqgtxx
• 26edbaa fix: dualStackDialContext not close the fallback connection when the preferred IP family won by @kasumikira
• 2cd1443 fix: prevent snell pool from reusing unready connections (#2878) by @xream
• 4281001 fix: restore the original fallback concurrency behavior by @wwqgtxx
• 45ca4ae fix: preserve shadow-tls in-user for snell listeners (#2934) by @xream
• 578b881 fix: add missing json tags to raw config structs (#2939) by @chenx Dust
• 59ffb63 fix: scStreamUpServerSecs not working when xPaddingObfsMode is true by @wwqgtxx
• 5ab5eb3 fix: snell v2 listener can't pass test by @wwqgtxx
• 5b54b3a fix: panic when dial failed in masque by @wwqgtxx
• 63e4d5a fix: TUIC v5 fragmented UDP reads in quicStreamPacketConn.ReadFrom (#2942) by @aaron Chen
• 73740c7 fix: wrong realm resolver when only IPv6 is requested by @rumianoesa
• 793f61e fix: crash in AmneziaWG receive path with slice bounds out of range when S4 is larger than incoming packet by @wwqgtxx
• 94a7a3f fix: udp write in sing-mux by @wwqgtxx
• d08c885 fix: writeSem initiation in OpenVPN by @roy.lieu
• d924f1c fix: CVE-2026-42505 for crypto/tls by @wwqgtxx
• e3972e7 fix: apply TUIC v5 UDP relay size clamp when building server options (#2943) by @aaron Chen
• e64f58f fix: panic when rand.IntN calling on a nil slice by @wwqgtxx

Maintenance

• 02dd143 chore: relax version restrictions for the snell listener by @wwqgtxx
• 084a09e chore: export internal function for api user by @wwqgtxx
• 0daa3ff chore: allow overriding inbound listen config for api user by @wwqgtxx
• 1095055 chore: upgrade bbolt to 1.5.0 by @wwqgtxx
• 174cba4 chore: update sing-tun by @wwqgtxx
• 1e76df7 chore: better group config parsing by @wwqgtxx
• 24b6de7 chore: lazy init reality server cert by @wwqgtxx
• 26e3d22 chore: peer should set to expire unconditionally in tailscale-wireguard-go by @wwqgtxx
• 27efee2 chore: cleanup unused code in OpenVPN by @wwqgtxx
• 2c6ff72 chore: bump mieru version to 3.34.0 (#2899) by @enfein
• 38fd897 chore: sync common/maphash code by @wwqgtxx
• 3b85577 chore: make bbolt work on non-mmap supported platforms by @wwqgtxx
• 6414c56 chore: reduce one unnecessary slice copy operation by @wwqgtxx
• 7031b75 chore: update quic-go to 0.60.0 by @wwqgtxx
• 76bf840 chore: code cleanup by @wwqgtxx
• 85c2f6a chore: change the type of the internal value being passed by @wwqgtxx
• 93d33fa chore: increase REALITY target TLS record buffer to 16 KiB by @wwqgtxx
• acbc92f chore: better mieru inbound test implementation by @wwqgtxx
• aff8dc7 chore: adjust struct name by @wwqgtxx
• bcfd434 chore: update chi to 5.3.0 by @wwqgtxx
• cbd11db chore: converter map hysteria2 port hopping and realm URI (#2947) by @peter Solomon
• d41d757 chore: rename listener config to tlsmirror-config by @wwqgtxx
• da28fe3 chore: more code sharing by @wwqgtxx
• dc5c2ec chore: change http method from GET to POST in listener test by @wwqgtxx
• de51c4b chore: cleanup interop test code by @wwqgtxx
• e3d67b3 chore: strictly forbidden to fill in a proxy group for empty-fallback by @wwqgtxx
• eca44d0 chore: update tfo-go ready for go1.27 by @wwqgtxx
• f62ebd0 chore: cleanup interop test code by @wwqgtxx
• f74bd8b chore: adjust internal function return type by @wwqgtxx

Full Changelog: v1.19.27...v1.19.28