v26.10.2

More routing options and Android automation

• Fragment routing: Optional TLS ClientHello fragmentation in Smart Routing and ordinary Custom Routing, off by default. Advanced Custom Routing can supply its own Fragment outbound and parameters.
• LAN proxy sharing: An optional HTTP/SOCKS5 proxy for other devices on a trusted network, with a configurable port. It is off by default, has no authentication, and applies when VPN is next started from OneXray. Complete Raw JSON keeps control of its own inbounds.
• Android automation: Allow trusted tools such as Tasker or Automate to start and stop VPN through token-protected broadcasts. The feature is off by default and reuses the last configuration generated by an in-app connection.
• Windows VPN integration: Updated Microsoft Store system-VPN integration to Vole, refined runtime cleanup and packaging, and corrected the oversized X in Start-menu and pinned MSIX icons. EXE/ZIP continue to use Xray native TUN.
• Configuration and connection handling: Updated Xray configuration compatibility, simplified import/save validation, and improved startup failure handling and cleanup.

Changes are based on v26.9.5 through v26.10.2. Existing connections and settings can be retained when updating; the new Fragment, LAN sharing and Android automation switches remain off until enabled.

LAN sharing follows the selected routing rules and is available only while its VPN runtime is running. Saving a sharing change does not change an existing listener; start VPN from the app to apply it. Widgets, tiles, automation and Apple on-demand starts reuse the last generated configuration. Apple does not support hosting proxy listeners in Packet Tunnel Providers; LAN sharing is not advertised as a supported Apple background-proxy service.

OneXray remains a bring-your-own-server client with no account, ads, or app analytics.

Update guide · Android automation · Source changes: v26.9.5 → v26.10.2

v26.9.5

Clearer subscriptions and smarter configuration tools

• Subscription plan information: View provider-reported traffic usage, quota, remaining data, and expiry when available. Lists show a summary; subscription details show the available fields and fetch time. These figures update with the subscription, not in real time, and do not replace current-connection traffic counters.
• JSON editing assistance: Common-field/value, tag, and installed GeoData suggestions for nodes, advanced Custom Routing, and Raw JSON. Syntax errors have line/column locations; reliable field errors can select the corresponding source. Core errors retain their explanation without guessing a location.
• Editor and save fixes: Improved copy/paste menus and shortcuts, useful import/save diagnostics, and preservation of newer draft edits when an earlier save finishes.
• Desktop local HTTP API: Opt in under Advanced > Xray > Local API to validate configurations or generate previews through the running app. The interface is off by default, listens only on IPv4 loopback, and requires a random Bearer token. The port is configurable; automatic Xray SOCKS/metrics ports avoid it even while the API is disabled. No separate CLI is required.
• Hysteria2 sharing: Restored import/export for supported authentication, IPv6, SNI, Salamander, and multi-port options. TLS verification is required; unsupported insecure and certificate-pinning semantics are rejected. Legacy VMessQrCode and Clash/Mihomo configurations remain unsupported.
• Platform improvements: Windows/Linux apply the selected outbound interface to supported UDP port-hopping sockets. Improved Windows packaging compatibility and configuration dependency handling.
• Steadier macOS menu bar: Removed changing speed text and redundant tray updates. Live speeds and current-session traffic remain on Connect; Android widget and notification statistics remain available.
• Optional donations: A Donate page provides a copyable Solana USDC/USDT address. No purchase is required to use OneXray.

Updating from 26.9.4 preserves configurations and preferences. Subscription plan details appear after a successful refresh when the provider supplies them. The local API does not import data or start VPN; successful validation does not prove server connectivity or VPN startup. Keep API tokens and returned configurations private.

OneXray remains a bring-your-own-server client with no account, ads, or app analytics.

Subscription guide · Local HTTP API · Source changes: v26.9.4 → v26.9.5

New Contributors

• @meoyawn made their first contribution in #203

v26.9.4

OneXray 26.9.4 Release Notes

GitHub Release

Live traffic at a glance, with quicker VPN controls

OneXray 26.9.4 brings an Android home-screen widget, traffic statistics in Android VPN notifications and the macOS menu bar, and a more native Mac window layout. iPhone and iPad also gain an optional setting to hide the VPN status-bar icon.

Android: traffic and VPN controls on your home screen

• Compact traffic widget: See connection status, live download/upload speeds, and traffic for the current connection. The widget targets a 4×2 layout and adapts to available space; its actual grid size depends on your launcher.
• One-tap start and stop: Use the widget's power button to control VPN. Tap its title or traffic area to open OneXray. Add it from Settings > Add traffic widget, or from your launcher's widget picker.
• Background quick start: The widget and Quick Settings tile can start VPN without opening the app when the previous connection configuration and required permissions are ready. If setup or permission is needed, they open OneXray instead.
• Traffic in VPN notifications: The existing VPN notification shows live speeds; expand it to see download/upload traffic for the current connection. Open-app and disconnect actions remain available.
• Fits your home screen: A translucent background, system light/dark themes, localized text, and right-to-left layouts keep the widget readable in a compact space.

Background quick start reuses the last generated connection configuration. After changing servers, routing, or tunnel settings, connect from the app to generate a new configuration before using the shortcut. It does not select new servers, run latency tests, or refresh subscriptions in the background.

Widget and notification statistics run with the Android VPN service, independently of the Flutter interface. Live refresh pauses when the screen is off. Traffic figures cover the current connection only, not an all-time total.

macOS: menu-bar traffic and a more native window

• Live menu-bar speeds: See download/upload rates while connected, even when the main window is hidden. Hover over the menu-bar icon to see traffic for the current connection. The display runs while OneXray remains open and stops when the app quits.
• Integrated window layout: An integrated title bar and translucent sidebar retain the native window buttons and follow the app's light/dark appearance.
• Window polish: Improved title-bar button interaction, full-screen and right-to-left layouts, and consistent sizing for server-page action buttons.

These improvements apply to both the Mac App Store edition and OneXraySE.

iPhone and iPad: optional VPN icon hiding

Open Advanced > VPN tunnel > Apple system VPN to find Hide VPN icon. It is off by default and takes effect only when Capture all traffic is off.

This is a route-based workaround, not a guarantee that every iOS version will hide the icon. Enabling it may affect network switching. Do not turn off required full traffic capture just to hide the icon; leave the option off if it causes connectivity problems.

Desktop and packaging improvements

• Refined desktop title-bar controls and matched the size and shape of server-page action buttons. Windows and Linux retain their separate window-control bar.
• Improved Windows package-manager manifest generation and validation.
• Fixed Android release network-security validation while keeping the cleartext exception limited to the local metrics endpoint.

Apple VPN settings · Installation guide · Source changes: v26.9.3 → v26.9.4

v26.9.3

Configuration backup and AI-ready routing

OneXray 26.9.3 adds single-file configuration backup, advanced Custom Routing JSON, FakeDNS, and navigation that keeps detail pages inside the current tab.

Back up your connection configurations

• Apple: Save to the OneXray iCloud Documents container on iPhone, iPad, Mac, and macOS System Extension.
• Android: Choose one backup file through the system file picker, including Google Drive when its document provider is available.
• Windows: Save to an existing OneDrive-synced folder. EXE, ZIP, and MSIX are supported. Linux does not expose this feature.
• Each backup replaces one OneXray-backup.json file. Automatic backup is enabled by default after destination confirmation, with its own 1-, 3-, or 7-day interval; the default is 3 days. Its setting is independent of GeoData updates. Checks run while the app is running, not as a guaranteed background job after it closes.
• Restore local nodes, subscription sources, ordinary and advanced Custom Routing, complete Raw JSON, Smart Routing options, and custom GeoData source records. Downloaded files, subscription node caches, device settings, and the app's final-exit selection are not backed up.
• Restore a readable backup without waiting for network downloads. Missing custom GeoData remains pending instead of blocking entry to the app; configurations that need those files report the missing dependency. Update restored subscriptions separately to fetch their nodes.
• Open Backup & restore from Settings or directly from the empty Connect and Servers pages. Restore previews replacement, does not merge data, and does not start VPN automatically.

Backups are not encrypted and may contain server credentials, subscription URLs, Age private keys, and HWID. The first write requires explicit confirmation. A successful provider write does not guarantee cloud synchronization has completed. This is not two-way configuration sync, version history, or support for old ZIP backups.

More flexible routing, without a heavier interface

• Advanced Custom Routing: Import, edit, and share JSON templates that reuse app-managed nodes while giving you control over supported DNS, routing, sniffing, FakeDNS pools, and additional inbounds. Ordinary and advanced routes share the existing three-configuration limit.
• FakeDNS: Enable it independently in Smart Routing and ordinary Custom Routing. It is off by default; direct-domain and real DNS resolution rules remain respected.
• More rule conditions: Ordinary Custom Routing adds protocol and local operating-system matching. Multiple populated conditions must all match.
• Complete Raw JSON: Existing tunIn entries retain their sniffing and other non-managed configuration. OneXray applies only the required platform-owned settings instead of replacing the entire inbound.
• AI configuration guides: The documentation includes prompts, complete machine-readable guides, and import examples for nodes, both Custom Routing formats, and complete Raw JSON. It also explains VPN Tunnel settings. Bring your own server credentials; there is no in-app AI service or configuration upload to OneXray.

Navigation and upgrading

• Detail pages and shared destinations stay within the originating tab. Back navigation returns to the page you came from.
• Updating from 26.9.2 preserves existing configurations and preferences through an in-place database upgrade. No reset or reinstall is required for a normal upgrade.
• Existing custom routes remain ordinary routes. FakeDNS stays off until enabled. The Raw JSON creation limit remains three; older entries above that limit remain usable.
• Backup destination confirmation is required before automatic writes. Restoring a backup is a separate, explicit replacement operation, not part of an ordinary app upgrade.

Backup & restore · AI configuration guide · Source changes: v26.9.2 → v26.9.3

v26.9.2

DNS control and faster everyday actions

OneXray 26.9.2 builds on the redesigned 26.9.1 interface with configurable DNS, optional subscription HWID, richer system menus, and more reliable startup and connection handling.

New options

• Local DNS: Smart Routing and each Custom Routing configuration can save their own direct DNS address. Proxy DNS stays at 8.8.8.8. All via VPN still creates no direct DNS server.
• Tunnel DNS: Edit the IPv4/IPv6 DNS addresses and the server name used for Apple DNS over TLS. These settings are separate from routing DNS and do not replace a Raw JSON configuration's own DNS addresses.
• Apple excluded networks: With Capture all traffic off, selected IPv4/IPv6 networks can bypass the system VPN. The list is empty by default; enabling full capture preserves but disables it. Network exclusions do not automatically configure split DNS.
• Optional subscription HWID: A default-off switch sends a stable random identifier unique to the subscription when required by its provider. No hardware or advertising identifier is read. The identifier survives edits and upgrades and is omitted from sharing; cross-origin redirects do not receive it. Provider device-limit and verification errors are shown explicitly.
• Mobile quick actions: Long-press the app icon for Start VPN, Stop VPN, Switch configuration, or Update subscriptions on iOS and Android. These are app-icon actions, not system Shortcuts automation.
• Desktop tray menus: Reconnect, choose servers or Raw JSON, switch traffic methods, and update subscriptions or routing data. Each data list shows up to 10 entries, with full lists still available in the app. An open menu is no longer replaced by background updates on macOS and Windows.

Reliability and usability

• Setup now has privacy confirmation and one configuration page, combining the optional direct region with the required Windows/Linux outbound-interface choice. Authorization is handled on entry to the main interface; server import happens afterward.
• Errors retain concrete configuration, network, permission, storage, and native causes. Connect actions show immediate progress while waiting for permissions or queued work. A tray start with no usable servers reports the reason without unnecessarily opening the window.
• VPN status follows native events on Apple/Android and process exits on Windows EXE/Linux. Only Windows MSIX polls system VPN status. Stale desktop queries cannot replace newer process watches or publish obsolete status.
• Current-connection traffic continues updating when a desktop window is visible but unfocused. Hidden windows and non-visible connection pages stop sampling.
• GeoData automatic updates run only while VPN is connected. Failure retains old files without stopping or reconnecting VPN. Manual updates and configuration-import dependency downloads remain independent.
• Node and configuration editing use stronger core construction checks. Actual VPN startup reports its own errors instead of running a second preflight instance. Desktop Core diagnostics are retained, including in MSIX.
• System sharing uses the originating control on supported platforms; Linux offers explicit copying. Dismissing the system share UI does not close the app's share page or claim delivery.
• Windows packages include the architecture-matched VC++ runtime. Desktop Core discovery, stop confirmation, Linux rendering, and Linux ARM64 language fallback have also been improved.

Updating from 26.9.1

• The in-place database upgrade preserves servers, subscriptions, cached measurements, routing, Raw JSON, and preferences. Existing subscriptions have HWID off until explicitly enabled.
• Existing routing and tunnel DNS values retain their previous defaults unless changed. Custom Routing shares store the local DNS address using the standard dns.servers entry tagged app-dns-direct.
• The three-configuration creation limits are unchanged; legacy Raw JSON entries above the limit remain usable.
• Windows EXE/ZIP and MSIX remain separate channels with separate data locations. Stop VPN and quit before updating a standalone installation. Do not treat changing channels as data migration.
• Linux Core exit monitoring requires kernel 5.3 or newer. Linux ARM64 uses English for Chinese/Japanese/Korean language requests while preserving the saved language preference.

Source changes: v26.9.1 → v26.9.2

v26.9.1

A simpler OneXray, with more control when you need it

OneXray 26.9.1 rebuilds the experience around Connect, Servers, Advanced, and Settings. Start with your own servers and Smart Routing, or choose custom rules and complete Raw JSON configurations.

Highlights

• New responsive phone, tablet, and desktop layouts with consistent navigation.
• Automatic server selection by subscription or location, latency/protocol labels, and edit/share/delete actions.
• Smart Routing with a single direct region, local-network and Apple/Microsoft service bypass, optional ad blocking, and 1–3 entry servers with load balancing and an optional final exit.
• Named Custom Routing with domain, IP, port, and network conditions, GeoData completion, and import/sharing independent of servers.
• Expert mode with complete Raw JSON selection, editing, import, and sharing.
• Simpler file, clipboard, QR, and subscription imports without a second confirmation for ordinary nodes. Initial setup can finish without waiting for latency tests.
• Queued latency tests with group cancellation, clear download/test progress, and safe subscription refreshes that retain existing data when no valid nodes are returned.
• Dedicated routing-data management and separate subscription/GeoData update schedules.
• Apple on-demand Wi-Fi connect/disconnect rules, iOS cellular/macOS Ethernet behavior, and Android per-app lists with icons and independent include/exclude selections.
• Windows EXE/ZIP packaging alongside the MSIX system VPN edition, native x64/ARM64 builds, and winget publishing support.
• System-following theme and language by default, with English, Simplified Chinese, Traditional Chinese, Russian, and Persian.
• More reliable startup checks, VPN state synchronization, and stop-before-reconnect handling.

Important changes from v26.8.4

• The old Simple Profile, Xray Profile, Full Config, and Rule/Global/Direct workflow is replaced by the new connection and routing model.
• Existing local nodes, subscriptions, and Raw JSON are retained by the database upgrade. Retired Profile/Full Config records are not available in the new interface; recreate needed routing in Custom Routing or use a compatible Raw JSON configuration.
• Running preferences are reset when upgrading from the old product model. Review your server selection, routing, and platform settings before connecting.
• Custom Routing allows three configurations. New Raw JSON is limited to three; existing Raw entries above that limit remain visible and usable.
• Traffic now shows only speeds and counters for the current connection. Historical/device totals and the traffic detail dialog are removed.
• App backup and backup import/restore are removed. Individual server, subscription, custom-route, and Raw JSON sharing remain.
• macOS OneXraySE does not expose file-log controls or log viewing.
• Windows EXE/ZIP and MSIX have separate data locations and are not interchangeable upgrade channels. MSIX Quit leaves the VPN running; use Quit and Stop VPN to disconnect before exiting. EXE/ZIP Quit stops it.

Before upgrading, keep independent copies of any configuration you need to recreate. Do not rely on importing an old backup archive in this version.

v26.8.4

OneXray v26.8.4 restores custom Ping URLs, makes download identity easier to
understand, and improves Windows launch-at-login and file handling.

What's Changed

• Restored Custom Ping URL support with absolute HTTP/HTTPS validation,
  persistence, and compatibility with valid legacy settings
  (#144).
• Made the OneXray User-Agent the default for subscription and GeoData
  downloads, while keeping the System option available.
• Added the resolved download User-Agent to General settings so the effective
  value is visible and selectable.
• Replaced Windows Run-registry launch-at-login with an app-owned Startup
  Folder shortcut and ownership-aware cleanup.
• Updated configuration, share, and backup import/export flows for the stable
  file picker APIs.
• Simplified the displayed app version by hiding the internal build number.
• Added operating-system-specific manual builds and moved Windows x64 builds
  to the Visual Studio 2026 runner.

Fixes

• Prevented invalid legacy Custom Ping URLs from being activated; their text is
  retained for editing while Ping safely falls back to Cloudflare.
• Fixed Windows permission-handler compilation with Visual Studio 2026.
• Updated Flutter, Android Gradle, Apple project, and supporting dependencies
  for platform compatibility and stability.

Upgrade Note

On Windows, launch at login now uses an app-owned Startup Folder shortcut.
Legacy Run-registry entries are not migrated or removed. If launch at login was
enabled before this update, disable or remove the old OneXray startup entry
before enabling the setting again in OneXray to avoid duplicate launches.

Installations without a saved User-Agent preference now use the OneXray
User-Agent. Select System in General settings if a browser-like User-Agent is
required.

Full Changelog:
v26.8.3...v26.8.4

v26.8.3

OneXray v26.8.3 adds secure subscription delivery, portable OneXray Links,
and expanded runtime settings, with fixes for Android VPN startup and Chinese
language display.

What's Changed

• Added optional age-encrypted subscriptions with X25519 and Mihomo-compatible
  Hybrid (ML-KEM-768 + X25519) key generation.
• Added onexray:// import and sharing for Outbound nodes, Xray Profiles,
  Full Configs, Raw Json, subscriptions, and GeoData.
• Added System and OneXray User-Agent options for subscription and GeoData
  downloads.
• Added advanced Apple network routing controls for includeAllNetworks and
  the related exclude policies.
• Updated Backup to v4 so age subscription key pairs can be restored. Backup
  ZIP files remain unencrypted and should be stored securely.
• Improved runtime config handling, subscription updates, and batch ping.

Fixes

• Fixed the first Android VPN connection failing after the system permission
  dialog (#136).
• Improved Simplified Chinese locale handling and Windows Chinese font
  fallback.
• Improved imported-config ping scheduling and VPN state handling during
  startup and reconnection.

Upgrade Note

After updating on iOS or macOS, open OneXray and reconnect once so the saved
VPN configuration uses the new runtime request format. Legacy VPN startup
snapshots are not supported.

New Contributors

• @ts0307 made their first contribution in
  #136.

Full Changelog:
v26.8.2...v26.8.3

v26.8.2

OneXray v26.8.2 is a maintenance release for the macOS outside App Store
(OneXraySE) build only. Other platforms are unaffected.

What's Changed

• Reverted the Apple VPN routing changes introduced in v26.8.1.
• Removed the Exclude Local Networks setting.
• Existing OneXraySE users should remove the OneXray VPN configuration from
  macOS System Settings, then reconnect so OneXray can create it again.

v26.8.1

OneXray v26.8.1 adds startup controls, custom Xray inbounds, faster batch
latency checks, and important Apple VPN improvements.

What's Changed

• Added desktop launch-at-login and quiet-start options, plus an optional
  Connect on App Launch setting across supported platforms.
• Added custom Xray Profile inbounds, including dokodemo-door.
• Reworked node latency checks to process configurations in batches of five.
• Added an Apple Exclude Local Networks setting.
• Added selectable Dock icons for macOS.
• Refined subscription loading indicators, dialogs, and toast notifications.
• Updated Xray-core to v26.7.28, Apple targets to Swift 6, and Android to AGP
  9.3.

Fixes

• Fixed Apple full-tunnel routing and improved iOS/macOS VPN connectivity.
• Prevented subscription Add actions while a download or update is active.
• Improved startup setting validation and cleanup behavior.
• Improved custom inbound validation and runtime configuration handling.
• Updated dependencies and general build reliability.