EN Changelog

Changelog

• Fixed CI publish-version validation to read the canonical product version from Directory.Build.props, matching repository/release tooling instead of requiring a forbidden project-local <Version> in Shadowsocks.WinUI.csproj. The release-ready source archive now includes and validates GitHub workflow files so this contract cannot drift outside the packaged source.

• Fixed localization release validation to use the same ordinal, case-sensitive key semantics as the runtime catalog. Exact duplicate English keys are still rejected, while intentional case-distinct keys such as Active / ACTIVE remain valid; stale case-only UI keys were canonicalized and unused duplicates removed.

• Fixed a PowerShell runtime-semantic regression in Validate-Repository.ps1: XML/package helpers no longer use return if (...), which PowerShell treats as an attempt to invoke a command named if. A validator self-check now rejects direct return operands that are statement keywords.

• Fixed the release validator under PowerShell Set-StrictMode -Version Latest: empty success-path collections no longer use synthetic .FullName/.Name member enumeration while formatting diagnostics; packaging scripts project names explicitly before joining them, and validation now rejects the unsafe pattern.

• DNSCrypt first-use defaults and tests are now separated correctly: active runtime routing still defaults through Shadowsocks and requires a valid local SOCKS5 endpoint, while offline/direct test fixtures opt out explicitly; resolver-catalog TOML ignores the active runtime proxy preference because it only reads the pre-seeded signed cache.

• 5.2.31 analyzer hotfix: online-config selection recovery now accepts the concrete List<Server> already provided by Configuration.configs, clearing CA1859 without suppression or behavior changes.

• 5.2.31 compile hotfix: the empty-server editor state no longer assigns IsEnabled to a WinUI Border; availability is applied to the actual editor controls, and the repository validator now rejects IsEnabled assignments to known non-Control container/visual types.

• Final routing hardening excludes incomplete legacy/damaged profiles from Balancing/High Availability, tray selection and server hotkeys; HA and SIP003 process tracking keep same-endpoint profiles distinct. TCP strategy connections use the timeout of the actually selected server, and subscription refresh preserves selection without colliding with a local profile at the same host/port.

• 5.2.31 hotfix: removed the synthetic empty Server 1; zero servers is now a valid state and incomplete drafts do not unlock server-dependent features.

• DNS, PAC and enabling the Windows system proxy are disabled until a complete Shadowsocks server exists; removing the last usable server disables effective proxy/DNS/capture activity but preserves the saved DNS policy for reuse when a working server is added.

• Added non-blocking busy feedback for Start on Boot, Administrator capture/UAC transitions and update operations.

• Fresh DNSCrypt configuration enables every first-use option except IPv6. Existing persisted DNSCrypt settings are preserved exactly; schema v3 does not migrate or overwrite them.

• WinUI navigation, Logs and UAC/Administrator glyphs now use explicit Windows 10-compatible Segoe MDL2 Assets.

• 5.2.31 hotfix: DNSCrypt Minisign verification now supports the official resolver catalog's legacy Ed signature format as well as modern pre-hashed ED, preserving full payload and trusted-comment authentication.

• Self-update handoff now resumes the live shell state captured at update time instead of the process's original startup argument, so a window opened or hidden after launch keeps that state across an application update.

• Reboot/session restore now preserves the real shell state: Start with Windows and Restart Manager remain mutually exclusive, but use --start-visible / --start-hidden to restore an open window as open and a tray-only session as tray-only. WM_QUERYENDSESSION snapshots the state before Windows closes the HWND, and both restore markers bypass plain second-launch handling so redirected system restore cannot surface the already-running dialog.

• Fixed the DNSCrypt release validator StrictMode failure caused by an uninitialized $controllerPath.

• Cleared the final DNSCrypt TOML CA1859 diagnostics by using the already-materialized concrete Dictionary type in private static-resolver serialization and its test helper; analyzer rules remain enabled.

• DNSCrypt component GitHub release discovery and ZIP/Minisign downloads now use Cloudflare DoH over Shadowsocks with Google DoH fallback; redirect hosts are re-resolved through the same tunnel, and failures are logged before rollback instead of surfacing a raw api.github.com system-DNS error.

• Fixed the DNSCrypt resolver-catalog bootstrap deadlock: Cloudflare DoH over Shadowsocks is primary, Google DoH over Shadowsocks is fallback, resolver-list HTTPS also stays inside the tunnel, Minisign is verified before publication, and dnscrypt-proxy consumes only an offline local cache (urls = [], bootstrap_resolvers = [], ignore_system_dns = true).

• Completed a full WinUI localization/accessibility/context-state audit: the selected app locale now controls the built-in Settings navigation entry, indirect Hotkey action labels and registration-status tooltips; Forward Proxy field labels are localized in all seven shipped locales; and selection/dirty/busy state now consistently gates actions across Servers, PAC/GeoSite, Online Config, Plugins, Games, Hotkeys, Sharing, Traffic and Updates.

• Tightened contextual UI behavior: invalid persisted Online PAC URLs are corrected before activation from either page or tray, GeoSite refresh shows progress and blocks conflicting edits, duplicate Add actions are disabled, update operations lock conflicting controls, Plugin=None hides plugin-only fields without destructively clearing unsaved values, and the obsolete generated Local PAC editor action is removed in favor of user-rule.txt.

• Fixed four first-use/UI gaps: ss:// imports now offer installation of missing known catalog plugins, first DNSCrypt installation keeps animated progress visible, Local PAC exposes user-rule.txt, and Local managed-routing cards are hidden in Online PAC mode.

• Fixed stale legal-resource tests to assert the current Adblock Plus-derived network routing notice wording, and made fake GitHub plugin release payloads byte-stable so SHA-256 verification is deterministic and anti-downgrade tests reach the intended version gate.

Fork-specific changes are tracked here. Historical upstream Shadowsocks for Windows changes remain in CHANGES.

[Unreleased]

[5.2.31] - 2026-08-23

• Final release audit: persisted DNSCrypt compatibility values are no longer rewritten during configuration processing or when visible DNSCrypt settings are applied; Administrator-mode DNSCrypt interception still enforces effective fail-closed protection. Saving mixed local/subscription servers also preserves the selected server across grouping/sort reordering.

• Fixed built-in QTun installation from GitHub releases: the Windows selector now follows the upstream x86_64-pc-windows-msvc ZIP naming convention instead of the windows-native Actions artifact label.

• Fixed UDP load-balancing selection for negative endpoint hash codes; server indexing now uses unsigned modulo and cannot produce a negative list index.

• Fixed the WinUI DNS resolver-selection compile regression left by the cancellation-ownership refactor: switching away from manual resolver selection now cancels latency probing through _cancelResolverLatency instead of referencing the removed _resolverLatencyCancellation field.

• Completed the WinUI analyzer/lifetime follow-up: App, DnsPage and LogsPage have explicit shutdown ownership, cached pages are disposed before the controller, DNS cancellation sources remain owned by their async operations, Logs serializes settings writes through a non-disposable .NET Lock, and the remaining CA1725/CA1822/CA1834/CA1305/CA1806/CA1859 findings were corrected without production-wide suppression.

• Added managed background SIP003 catalog updates: trusted built-in packages auto-check once per day, in-use packages are deferred, failed checks remain retryable, per-plugin automatic updates can be disabled, and the Plugins page exposes an explicit Check updates action. Manual imports never auto-update; arbitrary repository input remains a TODO pending a dedicated trust/asset-selection design.

• Hardened plugin package promotion with release provenance, optional GitHub SHA-256 asset-digest verification, bounded download/extraction, Windows-ADS/path rejection, staging/rollback and transient-directory cleanup.

• Replaced the non-terminating traffic-statistics thread/public mutable queue with a cancellation-aware task and locked snapshot API, eliminating the WinUI traffic/log race.

• Cleared the Visual Studio strict-build follow-up diagnostics: fixed the TrafficPage local-variable casing compile regression; applied concrete private hot-path types and .NET 10 argument helpers; modernized test TaskCompletionSource bridges and pointer/culture handling; and changed DNSCrypt/WinDivert security-pin tests to read runtime constant metadata. Test-only CA1707/CA1861 are intentionally disabled for Method_Scenario_Result names and local literal fixtures, while production analyzers remain enabled.

• Finalized Variant B managed routing: Local GeoSite + EasyList/ABP routing is exclusively C# FilterEngine in User and Administrator paths. Removed abp.js, compiled-PAC compatibility, the historical backend selector, and executable custom abp.txt; Local PAC is only the minimal Windows proxy funnel. Removed settings are pruned by schema migration. Online PAC remains a separate explicit external-PAC mode.

• Centralized product versioning in Directory.Build.props, removed duplicated project <Version> values, and aligned release metadata validation around the canonical version.

• Replaced the oversized source-token release validator with compact structural, localization, packaging, PowerShell-parser and supply-chain checks; behavioral routing/update/DNS contracts remain enforced by unit/integration tests.

• Added complete English and Russian user guides alongside the existing Simplified Chinese guide, corrected the Shadowsocks.Windows.WinUI dependency graph, synchronized all three root README mirrors, and documented the final managed-routing architecture.

• Standardized WinUI shell namespaces and enabled the .NET 10 recommended analyzer ruleset during builds.

• Final compile/analyzer cleanup corrected the DNSCrypt resolver-array length check, removed meaningless protected members from the sealed controller, and made UDPRelay explicitly IDisposable.

• About → License and Third-party notices now use the selected UI language for explanatory text in EN/RU/zh-CN/zh-TW/JA/KO/FR, while authoritative license wording remains embedded in its original language.

• Corrected the release version after the previous RC was mistakenly numbered 2.2.31. All product/assembly/manifest/package/test/documentation metadata now uses 5.2.31 / 5.2.31.0, so normal numeric version ordering correctly treats 5.2.22 as older.

• Fixed stale startup-copy version detection in automatic update: installed 5.2.31 now rejects 5.2.22/5.2.31 even if an older LocalAppData startup copy is running; updater mode also performs a final target FileVersion anti-downgrade check immediately before replacement. Regression tests cover stale-copy, downgrade/equal rejection and 5.2.32 acceptance.

• Restored canonical English, Russian and Simplified Chinese README files in the application repository root while keeping synchronized Wiki mirrors; refreshed their DNS documentation for the current 5.2.31 implementation and kept the separate classic-style Chinese usage guide.

• Corrected stale DNS documentation: Administrator Mode currently implements transparent UDP/TCP 53 routing for System, Direct, Proxy, CustomDoh and DnsCrypt; the older pre-5.2.31 limitation is historical only.

• Moved long-form Markdown documentation into the dedicated GitHub Wiki while retaining the three localized root README files. .github remains functional in Git for workflows/templates but .git and .github are excluded from distributed source archives; legal notices are embedded from THIRD-PARTY-NOTICES.txt.

• Added a complete Simplified Chinese usage page (Shadowsocks Windows 使用说明) and linked it from Home, English, Russian and the Wiki sidebar.

• Fixed duplicate Start-with-Windows instances by restoring stale Run-entry deduplication and adding a process-wide single-instance guard independent of unpackaged WinUI executable identity; legacy-only Run entries are migrated, disabling autostart removes stale entries too, and hidden startup activations no longer raise the already-running dialog.

• Disabled Fody-generated FodyWeavers.xsd schema files, removed stale copies, and removed noNamespaceSchemaLocation references from both FodyWeavers.xml files so Visual Studio no longer requests a missing generated schema.

• Fixed the final false-positive updater release-validator regex: automatic update stream disposal is now guarded by the Windows regression test instead of brittle source formatting. The self-update handoff was verified successfully with a previous-version to newer-version test build.

• Fixed automatic update download promotion on Windows: the temporary .download stream is fully disposed before File.Move, eliminating the sharing violation observed during previous-version to newer-version update tests. SHA-256 sidecars now accept both standard sha256sum format and a plain 64-hex digest.

• Fixed DNSCrypt loopback-port allocation on Windows/GitHub Actions hosts where TCP and UDP dynamic/excluded ranges differ: allocation is now UDP-first, verifies the same numeric port over TCP, falls back to a dual-bind application-port candidate when needed, and preserves the last socket failure for diagnostics.

• Relaxed the Bouncy Castle Bzip2 notice validator to verify the legal contract (modified Bzip2 + Apache License 2.0) instead of one obsolete wording.

• Fixed the Phase 10 NetworkService version release-validator check after version response ownership moved from Program.cs to NetworkServiceResponses.cs; validation now also requires the versioned-ping regression test.

• Fixed invalid multiline PowerShell boolean expressions in Validate-DnsCrypt.ps1; the release parser gate now passes this DNSCrypt validation block instead of stopping before repository validation.

• Fixed a release-validator PowerShell interpolation parser error and added a CI/release PowerShell parser gate for every packaging/*.ps1 script.

• Synchronized the living Markdown documentation with the final 5.2.31 implementation: updater integrity/UAC handoff, release security gates, current selectable RichTextBlock Logs contract, storage architecture and release verification are now documented consistently.

• Fixed the release validator after the Logs viewer migration from ListView to selectable RichTextBlock: validation now enforces IsTextSelectionEnabled = true instead of the retired ListViewSelectionMode.None implementation token.

• Fixed a release-blocking self-updater compilation regression: UpdateChecker now resolves SelfUpdater from the service namespace, and launching the installed updated executable uses a valid explicit Process.Start null check instead of an invalid standalone null-coalescing expression.

• Fixed the DNSCrypt TOML test so odoh_servers = false is no longer mistaken for a doh_servers = false line, and added the missing resolver-filter translation in every shipped locale.

• Kept the automatic updater contract release-safe: canonical Shadowsocks-win-x64.zip/.sha256 verification, PID handoff, rollback, replacement of the primary product EXE, relaunch, and cleanup remain required by repository validation.

• Synchronized the product version across Core, Windows infrastructure, WinUI integration, NetworkService, manifests and ApplicationInfo so all shipped assemblies identify as 5.2.31 / 5.2.31.0.

• Strengthened release validation around updater compilation invariants, ss:// protocol-command quoting, single-file packaging and Windows 10 build 19041 compatibility metadata.

• Refreshed release workflow defaults, packaging commands, checklist examples and third-party notice metadata for 5.2.31.

• Raised the release SDK security floor to .NET SDK 10.0.303 (runtime 10.0.11), made NuGet audit availability/vulnerability findings NU1900-NU1904 fail CI/release restores, and verify the final Shadowsocks.exe FileVersion exactly matches 5.2.31.0 before packaging.

• Hardened automatic update handoff against local staged-payload tampering: the verified updater is held read-only/non-deletable across Process.Start/UAC, its SHA-256 is carried as an internal handoff argument, and the updater re-verifies its own staged image before replacing the installed executable.

Development snapshot — network/update hardening — 2026-08-21

• Replaced the legacy SOCKS5 forward-proxy handshake with an RFC 1928/1929 implementation: username/password authentication now works, domain-name replies are accepted, and fragmented socket reads/writes are handled correctly.
• Replaced the stale browser impersonation User-Agent in HTTP CONNECT with the product User-Agent, made CONNECT writes/header reads fragmentation-safe, preserved tunnel bytes received with the proxy response, and added forward-proxy regression tests.
• Hardened the UDP relay: SOCKS5 UDP destinations now participate in server-strategy selection, malformed/fragmented datagrams are rejected, failed associations can be recreated, encryptors are disposed deterministically, and the borrowed generic LRU cache was replaced with a purpose-built bounded association cache.
• Replaced the download-to-Explorer update flow with a strict automatic single-file self-updater: canonical GitHub ZIP/SHA-256 assets are verified, the new EXE performs a PID handoff with rollback, replaces the product binary, launches the installed copy and is then removed by that new copy.
• Start-with-Windows now records the primary product EXE in the Run command so an automatic update launched from the stable LocalAppData startup copy updates the real product binary instead of only the startup copy.
• Removed retired executable-side configuration/PAC/cache migration, pre-SIP002 URL handling, unmanaged plugin PATH/absolute-path fallback, old IPC/thread utility code and stale updater compatibility fallbacks; release validation rejects their return.
• Rebuilt the embedded product license and third-party notices for the actual dependency set of that development snapshot; About now reads validated non-empty legal resources through EmbeddedResources.
• Fixed ss:// protocol registration so Windows quotes both the product executable path and the imported URL placeholder; associations now remain valid when Shadowsocks.exe is installed in a path containing spaces, and release validation prevents the unsafe command from returning.
• Locked WinUI release validation to the intended compatibility contract: compile against the Windows 26100 SDK while keeping SupportedOSPlatformVersion and TargetPlatformMinVersion at Windows 10 build 19041 for both WinUI projects, with the Windows 10/11 manifest compatibility declaration required.

DNS and servers

• DNS page now starts with live Windows DNS status (active adapters, configured DNS servers, selected Shadowsocks DNS policy and transparent-interception state), adds localized tooltips/accessibility help for DNS controls, and shows only the settings relevant to the currently selected DNS mode.
• DNSCrypt Automatic resolver selection now resolves a concrete DNSCrypt/DoH server from the signed catalog using the configured DNSSEC, no-log, unfiltered and address-family constraints. It prefers a resolver in the active Shadowsocks server country, falls back to the best compatible catalog entry, and refreshes the choice when the active server/strategy changes.
• Added DNS privacy diagnostics and a self-test that verifies DNSCrypt health, Administrator DNS interception, fail-closed/system-DNS isolation, active-runtime bootstrap settings, filtered Automatic resolver pinning and the current secure transport.
• Server list labels now show the friendly server name plus a country flag and no longer append the server IP/hostname. Country metadata is resolved best-effort over HTTPS and cached in memory.
• Added a DNS-page Test DNSCrypt health-check action for the currently running local DNSCrypt listener.
• Added built-in DoH provider presets for Cloudflare, Google Public DNS, Quad9 (secure/unfiltered), AdGuard DNS (default/unfiltered) and Mullvad while retaining a custom HTTPS endpoint option.
• Added a Show DNS Logs logging option, disabled by default; DNS lifecycle/upstream events follow this switch, while raw dnscrypt-proxy resolver probes/RTT diagnostics additionally require Verbose Logging, and application-level DNS errors remain visible.
• Restored severity-aware log highlighting in the WinUI log viewer while keeping selectable text, wrapping control and horizontal scrolling.
• NetworkService helper extraction now uses a stable version/SHA-256 path instead of a PID/GUID path, preventing Windows Firewall from treating every Admin Mode start as a different executable.
• Direct DNS can now use primary/fallback IPv4/IPv6 resolver presets or custom addresses and can optionally route those selected DNS endpoints through the local Shadowsocks SOCKS5 path; with no explicit server, the original DNS destination can also be routed through Shadowsocks.
• Custom DoH now has an independent option to route its HTTPS upstream through the local Shadowsocks SOCKS5 endpoint.
• DNSCrypt resolver UX now shows the active Automatic resolver immediately, keeps ODoH disabled, exposes DNSCrypt/DoH protocol plus country/address-family/privacy filters for manual catalog browsing, measures manual-list latency in the background without blocking the UI, and replaces the active resolver's estimate with DNSCrypt Proxy's actual RTT when available.
• DNSCrypt settings changes are debounced and applied without locking the page; failed manual resolver changes use a bounded rollback and surface the last dnscrypt-proxy upstream error instead of an indefinite loading state.
• DNSCrypt resolver country metadata is derived exclusively from resolver endpoint IPs via batched GeoIP lookup; resolver names/descriptions are never used as geographic hints, and Anycast is neither represented as a pseudo-country nor guessed from description text.
• Final DNS regression pass reuses the verified resolver-source cache for temporary catalog/settings validation processes, removes duplicate DNS-page refreshes during background RTT probing, normalizes legacy manual resolver selections to supported DNSCrypt/DoH entries, and prevents stale manual resolver metadata from being persisted.
• Log rendering now keeps warning/error emphasis on multiline continuation and stack-trace lines and emphasizes the severity token while retaining theme-aware colors.
• DNSCrypt resolver mode is now stored explicitly instead of being inferred from serverNames; legacy stale manual selections migrate to Automatic, manual DNSCrypt/DoH selections are health-validated before persistence, and Automatic resolves a concrete server from the signed catalog using the configured DNSSEC, no-log, unfiltered and address-family filters instead of bypassing those filters with a Cloudflare-only pin.
• Show Plugin Output no longer reloads Shadowsocks or restarts SIP003; plugin stdout/stderr is captured asynchronously and filtered dynamically, plugin shutdown waits are bounded, and logging-level toggles no longer restart the network stack.
• DNSCrypt install/update candidate validation now verifies the exact candidate version first, then resolves an eligible resolver from that candidate's signed catalog before its runtime health check, so Automatic mode remains provider-neutral without breaking first install or component upgrades.

Release and localization

• Completed the Russian localization audit, corrected misplaced license translations, and added repository validation that rejects CJK/Japanese/Korean text accidentally placed in the ru-RU column.

Development snapshot — DNSCrypt/Admin DNS — 2026-08-18

• Logs page responsiveness: logging-only switches no longer trigger full page refreshes; log file I/O is background/coalesced and RichTextBlock rendering is capped to prevent UI hangs under verbose/plugin output.

DNS and privacy

• Fixed an Administrator Mode DNSCrypt leak window: classic UDP/TCP 53 is now fail-closed before DNSCrypt startup, never falls back to plaintext system DNS, and Shadowsocks/SIP003 DNS queries no longer bypass DNSCrypt interception.
• Added signed, managed DNSCrypt Proxy installation from the official DNSCrypt/dnscrypt-proxy Windows x64 releases, with SHA-256/Minisign verification, safe extraction, resolver selection and rollback-safe activation.
• Added health-checked DNSCrypt runtime lifecycle with dynamic loopback ports, non-blocking normal startup, prepared-version -check validation, crash recovery, Job Object cleanup and optional routing through the local Shadowsocks SOCKS5 endpoint.
• Added the DNS page and tray controls for System, Direct, DNS-through-Shadowsocks and Custom DoH/DNSCrypt policies, plus install/update/reinstall/remove, DNSSEC/no-log/no-filter/IPv6, resolver selection and automatic component updates. Administrator-mode DNSCrypt interception enforces fail-closed behavior as a runtime security invariant rather than a user toggle.
• Added Administrator Mode transparent UDP/TCP port 53 policy routing through WinDivert for Proxy, Custom DoH and DNSCrypt, while Direct remains direct; DNSCrypt runtime also remains available in User Mode for Shadowsocks-managed hostname resolution.
• Added automatic DNSCrypt update maintenance with a persisted minimum 24-hour check interval; the first component installation remains an explicit user action.
• Added bootstrap recursion protection for DNSCrypt-over-Shadowsocks and hardened WinDivert/CaptureChild fault propagation, UDP/TCP relay lifecycle, runtime rollback and process supervision.

Release and maintenance

• Added DNSCrypt Clean Mode integration tests and release validators that reject bundled dnscrypt-proxy, native Minisign/libsodium helpers, invalid DNS policy values and missing third-party notices.
• Added embedded project and third-party license notices for the one-file executable, including Bouncy Castle and its modified Bzip2 component.
• Hardened WinDivert acquisition to the fixed official GitHub 2.2.2-A release asset with bounded streaming download, exact x64 archive paths, pinned SHA-256 verification for both x64 runtime payloads and PE architecture validation before loading.
• Added fragment-safe transparent routing: fragmented datagrams that require DNS/proxy rewriting are dropped as a whole instead of partially rewriting the first fragment, while direct fragment flows remain direct.
• Added a read-only WinDivert FLOW-layer ownership observer so new TCP/UDP endpoints are attributed to their process ID before NETWORK-layer routing; IP Helper lookup remains a safe fallback for pre-existing or ambiguous flows.
• Hardened automatic-update clock handling against implausible future timestamps and added a testable Clean Mode session lifecycle with exclusive lock ownership and deterministic tree cleanup.
• Suspend/shutdown now cancels active and queued DNSCrypt management transactions before WinDivert/DNSCrypt teardown and resumes the coordinator only on the next controller start lifecycle.

Development snapshot — SIP003/plugins — 2026-08-18

Storage

• Added managed SIP003 plugin storage below the active Plugins directory; normal mode uses %LOCALAPPDATA%\Shadowsocks\Plugins and Clean Mode uses its disposable Temp session.
• Replaced the application Registry settings backend with atomic settings.json / settings.backup.json under %LOCALAPPDATA%\Shadowsocks; old Shadowsocks Registry configuration is intentionally ignored.
• Localization now uses only the embedded i18n.csv; external LocalAppData overrides are no longer loaded or migrated.
• Added Rufus-style Clean Mode: an executable stem ending in p redirects all writable application state to a disposable %TEMP%\Shadowsocks\Clean\... session and cleans it on Quit.
• Added explicit LocalAppData/Clean Mode folder actions to Settings and disabled Start with Windows in Clean Mode at UI, tray, and backend levels.

Fixed

• Replaced the legacy second-launch Win32 MessageBox with a localized Fluent WinUI ContentDialog owned by the already-running instance; the existing window is restored/foregrounded first, with an InfoBar fallback if another modal dialog is active.
• Fixed global hotkey modifier detection on the WinUI/.NET 10 frontend by using the Win32 key-state path.
• Main-window User/Admin traffic controls now apply immediately like tray commands; Administrator mode carries the UAC shield affordance.
• Product single-file publish removes PDB files copied from referenced projects before validating the one-EXE release layout; normal build symbols remain unchanged.
• Restored historical lower-case percent escapes when generating SIP002 ss:// links for compatibility with existing URL tests/links.

Changed

• Added a Plugins page with built-in xray-plugin, v2ray-plugin and qtun installation plus manual ZIP/TAR.GZ import; Servers now selects installed plugins from a dropdown and shows Server Name above Server IP.
• Added localized WinUI tooltips and matching accessibility help text across navigation, server management, traffic, Game Mode, PAC/GeoSite, online configuration, hotkeys, sharing, logs, settings and update controls.
• Completed all six non-English localization columns (ru-RU, zh-CN, zh-TW, ja, ko, fr) for every active embedded UI key and added release validation that rejects missing translations or placeholder mismatches.
• Moved Verbose Logging and Show Plugin Output to the Logs page, and Check for Updates at Startup to About & updates.
• Updated the pinned dependency graph to Windows App SDK 2.4.0, Microsoft.WindowsAppSDK.WinUI 2.3.6, NLog 6.2.0, Fody 6.9.3, Google.Protobuf 3.35.1, Newtonsoft.Json 13.0.4, System.Drawing.Common 10.0.11, Microsoft.NET.Test.Sdk 18.9.0, Windows SDK BuildTools 10.0.28000.2526, WinUIEx 2.9.3, ZXing.Net 0.16.11, MSTest 4.3.3 and System.Management 10.0.11.
• Updated NLog file archiving to the NLog 6 ArchiveSuffixFormat configuration.
• Start with Windows now uses a SHA-256-verified copy at %LOCALAPPDATA%\Shadowsocks\Startup\Shadowsocks.exe; legacy Run entries are migrated and the copy is refreshed when a newer product EXE is launched manually.
• Game Mode keeps manual rules and adds optional discovery suggestions from Steam, Epic Games, GOG and Xbox installations.
• Password reveal is hidden for servers imported from ss:// links or online configuration sources; manual server entries retain the option.
• Logs toolbar is always visible; the Font command and Show toolbar preference were removed.
• Tray colors were refined for clearer/professional state separation: graphite (Disabled), bronze (Local PAC), forest teal (Online PAC), navy (Global), with muted activity accents.

Known limitation

• Historical limitation in this development snapshot: DNS policy values existed in configuration/IPC, but transparent DNS interception/routing was not yet implemented. This limitation was resolved later; current 5.2.31 Administrator Mode implements transparent UDP/TCP 53 routing.

Reborn modernization baseline — 2026-08-15

Platform and UI

• Migrated the product to .NET 10, x64 and WinUI 3 / Windows App SDK.
• Retired the legacy WinForms/WPF presentation layer after functional parity was reached.
• Added the Windows 11 Fluent shell, tray-first lifecycle, AppInstance single-instance activation, Mica, navigation, native dialogs/status UI and theme support.
• Migrated localization to ILocalizationService backed by the existing seven-column CSV format.

Traffic and networking

• Replaced Privoxy with the managed HTTP/HTTPS forwarding path.
• Replaced external sysproxy helpers with Windows integration.
• Added User/Admin traffic modes and transparent TCP/UDP Admin capture through WinDivert.
• Added automatic Game Mode and per-application Proxy, Direct, Block routing.
• Added live NetworkService/WinDivert/TCP/UDP capture status in the WinUI Traffic page.
• Preserved PAC/GeoSite, Online Config, SIP003 plugins, QR workflows, hotkeys and UDP relay.

Storage and deployment

• Moved persistent configuration away from executable-side gui-config.json; the current backend is ISettingsStore / JsonFileSettingsStore under LocalAppData.
• Added file-backed rollback snapshots and one-time migration backups under %LOCALAPPDATA%\Shadowsocks\Migration.
• Centralized all normal-mode application-owned writable state under %LOCALAPPDATA%\Shadowsocks; Clean Mode redirects the same logical tree to a disposable %TEMP%\Shadowsocks\Clean\... session.
• Removed portable-mode storage semantics that wrote mutable data beside the EXE.
• Added global per-user single-instance behavior to protect shared Windows integration and storage state.
• Embedded the self-contained single-file NetworkService helper into the product and materialized it only on Admin activation with SHA-256 validation, extraction serialization, version handshake and cleanup.
• Added unpackaged, self-contained, win-x64, single-file release packaging with a strict final layout of one Shadowsocks.exe.
• Added repository/release validators, CI packaging checks, storage/deployment tests and read-only/removable-drive validation rules.

Known limitation

• Historical limitation in this modernization baseline: DNS policy values existed in configuration/IPC, but transparent DNS interception/routing was not yet implemented. This limitation was resolved later; current 5.2.31 Administrator Mode implements transparent UDP/TCP 53 routing.