v1.1.4

Zagros v1.1.4 (stable)

Image (GHCR only):

docker pull ghcr.io/zagrosgm/zagros:v1.1.4

Install / update on a VPS (stable releases move the floating latest image tag, which the installer runs by default):

# Fresh install:
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/main/zagros.sh)" -- install

# Existing host (refreshes CLI / host agent / compose, then updates the panel):
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/main/zagros.sh)" -- update

# Pin this exact release instead (also how pre-releases are installed):
sudo env ZAGROS_SCRIPTS_REF=v1.1.4 bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/v1.1.4/zagros.sh)" -- update --version v1.1.4

Curated change notes live in the release notes.

Full Changelog: v1.1.3...v1.1.4

v1.1.3

Routing fixes — v1.1.3 re-release (2026-10-21)

This replaces the initial v1.1.3 cut, whose routing enforcement was broken.

Fixed

• Deployed Xray rules and managed outbounds now survive config rebuilds and core restarts.
• Node policy is applied through the native Xray/sing-box drivers; a failure in the separate host policy plane no longer suppresses native routing.
• Node config sync no longer ships the master's decorated, master-local loopback outbounds. Node-managed outbounds replace stale same-tag entries, and policy survives agent restart and re-sync.
• Node-scoped routing/outbound coverage and core capability reporting are retained by the API.

Verified

• Master: route to Blackhole blocks; route to relay exits via 51.44.187.221; the route remains after Xray restart.
• Node (requires agent v0.3.7): Blackhole blocks; relay exits via 51.44.187.221; behavior remains after node sync and agent restart.
• CI: 1,325 passed, 8 skipped. Full node release: zagros-node v0.3.7.

Install

docker pull ghcr.io/zagrosgm/zagros:v1.1.3

On an existing installation, update to this tag with the Zagros installer/CLI. Upgrade nodes to v0.3.7 for node-side route enforcement.

v1.1.2

Zagros v1.1.2 (stable)

Image (GHCR only):

docker pull ghcr.io/zagrosgm/zagros:v1.1.2

Install / update on a VPS (stable releases move the floating latest image tag, which the installer runs by default):

# Fresh install:
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/main/zagros.sh)" -- install

# Existing host (refreshes CLI / host agent / compose, then updates the panel):
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/main/zagros.sh)" -- update

# Pin this exact release instead (also how pre-releases are installed):
sudo env ZAGROS_SCRIPTS_REF=v1.1.2 bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/v1.1.2/zagros.sh)" -- update --version v1.1.2

Curated change notes live in the release notes.

Full Changelog: v1.1.1...v1.1.2

v1.1.1

Zagros v1.1.1 (stable)

Image (GHCR only):

docker pull ghcr.io/zagrosgm/zagros:v1.1.1

Install / update on a VPS (stable releases move the floating latest image tag, which the installer runs by default):

# Fresh install:
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/main/zagros.sh)" -- install

# Existing host (refreshes CLI / host agent / compose, then updates the panel):
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/main/zagros.sh)" -- update

# Pin this exact release instead (also how pre-releases are installed):
sudo env ZAGROS_SCRIPTS_REF=v1.1.1 bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/v1.1.1/zagros.sh)" -- update --version v1.1.1

Curated change notes live in the release notes.

Full Changelog: v1.1.0...v1.1.1

v1.1.0

v1.0.5...v1.1.0 — Single-Database Consolidation, Single-File Backups & Migration-Safe Imports

Compare changes

🚀 Enhancements

• dbmerge: Fold the legacy database into the main database automatically on boot — marker-driven and idempotent, the four colliding tables renamed (legacy_users, legacy_admins, legacy_nodes, legacy_next_plans) and the old database kept untouched as a built-in rollback copy (ad8d706)
• backup: ONE standard database member (db/database.sqlite3) — a single SQLite snapshot carries both layers once merged, db_layout is recorded in the manifest, and previous multi-member archives still restore unchanged (ad8d706)
• restore: Accept the panel's own raw platform database (bare zagros.db, a zip holding it, or a SQL dump) as a row-level import; imported users keep their ORIGINAL creation date and historical traffic (ad8d706)
• subscriptions (migration): After a Marzban/Pasarguard restore the SOURCE panel's signing secret is installed alongside ours, so users' existing subscription links keep working — no secret overwrite, no restart; 3x-ui imports state honestly that its separate unsigned sub server cannot be served here (ad8d706)
• application platform: First-class application identity and build system — application API, config grants, connection leases, build workers/SDK sources/artifacts (ad8d706)
• admin: Per-admin permission model with dashboard permission mapping (ad8d706)

🩹 Fixes

• restore/preflight: Non-archive uploads no longer crash inspect with a 500 — they preview as imports and refuse with a clear message; datetime values from platform sources (DATETIME expire_at strings) parse robustly alongside epochs (ad8d706)
• security: Access-log redaction and device authority hardening (ad8d706)

💅 Refactors

• core-drivers: Consolidated driver lifecycle, delivery and platform runtime updates carried from the deployment line (ad8d706)

🏡 Chore

• release: Align the application version with v1.1.0 (ad8d706)

Zagros v1.0.5

v1.0.4...v1.0.5 — Node Core Reliability & Portal Fixes

Compare changes

🚀 Enhancements

• nodes: Add a single start_after lifecycle decision so install/update can synchronize configuration and either start once or remain stopped as requested (b646542)
• nodes/xray: Transport validated TLS certificate material through the existing signed node request and reject synchronization when the node does not advertise support, keeping rolling upgrades safe (45cd5b0)

🩹 Fixes

• sing-box: Gate the running state on public and control listeners plus a real StatsService query; repair persisted node binaries that lack with_v2ray_api and refuse silent accounting degradation (b646542, 45cd5b0)
• softether: Remove the factory TCP 443 listener when SSTP is disabled, discover the correct local management endpoint, bootstrap persistent server authority and the primary hub, and treat already-absent listener responses idempotently (b646542, 45cd5b0)
• core-runtime: Persist validated driver settings after start/restart so recovered binaries and provisioned SoftEther authority survive subsequent restarts (45cd5b0)
• dashboard: Prevent overlapping node-core actions, pass the install/start choice through one lifecycle request, and close the uninstall dialog after successful completion (b646542, 45cd5b0)
• users: Preserve the canonical empty inbound selection as “all current inbounds” when editing a user instead of excluding every inbound (b646542)
• xray/delivery: Fall back to the public subscription host when a new Xray inbound has no legacy Host row, preventing valid links from being withheld (b646542)
• portal: Replace invalid nested interactive markup so the built-in Show QR control works consistently across browsers (b646542)

💅 Refactors

• core-drivers: Move Xray and sing-box RAW/TCP camouflage defaults into their runtime drivers so standalone node rendering no longer imports the panel-only Studio wizard (b646542)

🏡 Chore

• release: Align the application version and OCI image default with v1.0.5 (b646542)

vendored sing-box v1.13.16 (stats-enabled)

Zagros-vendored stats-enabled sing-box v1.13.16

• source: https://github.com/SagerNet/sing-box/tree/v1.13.16 (exact tag, depth-1 clone)
• build tags: the Makefile TAGS ?= release list of that exact tag, plus with_v2ray_api
• toolchain: Go from the tag's own go.mod (actions/setup-go go-version-file)
• CGO_ENABLED=0, -trimpath, stripped; per-arch smoke check: sing-box check on a v2ray_api config

The panel installer prefers these assets and verifies the digests in sha256sums.txt before extraction.
Without with_v2ray_api there is NO per-user traffic accounting in sing-box — that is why this vendor release exists.

vendored sing-box v1.12.4 (stats-enabled)

Zagros-vendored stats-enabled sing-box v1.12.4

• source: https://github.com/SagerNet/sing-box/tree/v1.12.4 (exact tag, depth-1 clone)
• build tags: the Makefile TAGS ?= release list of that exact tag, plus with_v2ray_api
• toolchain: Go from the tag's own go.mod (actions/setup-go go-version-file)
• CGO_ENABLED=0, -trimpath, stripped; per-arch smoke check: sing-box check on a v2ray_api config

The panel installer prefers these assets and verifies the digests in sha256sums.txt before extraction.
Without with_v2ray_api there is NO per-user traffic accounting in sing-box — that is why this vendor release exists.

v1.0.4

🚀 Zagros v1.0.4 — Release Notes

We’re excited to announce the release of Zagros v1.0.4.

This release includes several improvements, new management features, and fixes for reported issues to provide a more stable and powerful experience.

✨ What's New

📊 Statistics

«Added a new Statistics system to monitor usage and view detailed service information.»

🔒 IP Limit

«Added IP Limit functionality to control and restrict the number of allowed IP addresses per user.»

🆔 HWID

«Added HWID support for device identification and management.»

🐛 Bug Fixes

«Fixed reported bugs and improved the overall stability, reliability, and performance of the panel.»

📦 Release Information

Version: "v1.0.4"
Status: "Stable" ✅

━━━━━━━━━━━━━━━━━━━━

🔗 Zagros — Next Generation VPN Panel

💬 For bug reports, feedback, and feature requests, please contact us through our official channels.

Telegram Channel:

https://t.me/zagrosgm

Telegram Group:

https://t.me/zagrosgm_group

v1.0.3

Zagros v1.0.3 (stable)

Image (GHCR only):

docker pull ghcr.io/zagrosgm/zagros:v1.0.3

Install / update on a VPS (stable releases move the floating latest image tag, which the installer runs by default):

# Fresh install:
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/main/zagros.sh)" -- install

# Existing host (refreshes CLI / host agent / compose, then updates the panel):
sudo bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/main/zagros.sh)" -- update

# Pin this exact release instead (also how pre-releases are installed):
sudo env ZAGROS_SCRIPTS_REF=v1.0.3 bash -c "$(curl -fsSL https://raw.githubusercontent.com/ZagrosGM/zagros-scripts/v1.0.3/zagros.sh)" -- update --version v1.0.3

Curated change notes live in the release notes.

Full Changelog: v1.0.2...v1.0.3