xray-rust v0.6.0-rc.1

• Prepared the source candidate for exact-commit pre-device verification.
  Publication remains gated on CI, performance and physical-device evidence.

• Added the generated supported-configuration contract, exact parser-backed
  config check with JSON reports/stdin/resource directories, and canonical
  config example exports. Parser and tooling share recognized field sets;
  CI guards fixture parity, contract freshness and CLI behavior.

• Extracted DNS and stream/security parsing along existing ownership boundaries
  without changing config acceptance or the C ABI.

• Added bounded XHTTP downloadSettings for packet-up/stream-up: independently
  addressed and protected HTTP/1.1, HTTP/2, HTTP/3 or REALITY download carriers,
  separate pools, shared session identity and cancellation. Recursive stacks,
  security downgrades, stream-one and chaining combinations fail closed.

• Extracted XHTTP config normalization and core carrier compilation, added a
  pinned configuration/application oracle and download lifecycle regressions.

• Started 0.6.0-dev.0 development against the retained, exact Xray-core
  v26.7.28 contract. Published v0.5.0 core/mobile artifacts remain pinned.

• Added canonical routing IPOnDemand with ordered lazy DNS, all-address
  matching, a fail-closed 256-candidate work limit, shared managed cache and
  cancellation, and one atomic policy revision per selection. A common
  23-case Go/Rust oracle checks compatibility with the pinned reference.

• Added ipOnDemand to schema-1 routing snapshots and both Swift/Kotlin
  decoders without changing C ABI symbols or layouts. Extracted routing
  parsing and evaluation from the larger config/outbound modules.

• Added bounded VLESS mlkem768x25519plus 1-RTT/0-RTT,
  native/xorpub/random, one-to-eight mixed X25519/ML-KEM-768 relay keys,
  configurable padding, raw/WS/HTTPUpgrade/gRPC/XHTTP carriers, and optional
  Vision. Vision Direct retains outer security/carriers and random header
  masking. TCP, UDP, and XUDP use the shared encryption boundary.

• Replaced the Rust VlessUser.encryption string with typed
  VlessEncryption, extracted VLESS parsing, and redacted crypto config/wire
  diagnostics. The public plaintext-server guard follows the first selected
  user. Added pinned Go primitive/live interop checks, cancellation/replay/
  corruption coverage, and a narrowly patched BLAKE3 byte-context API. Swift
  and Kotlin import errors redact key-bearing encryption values.

• Added equivalent Swift/Kotlin bounded share-link import with common Rust
  validation/projection fixtures. Reject malformed ML-KEM coefficients before
  dialing. Added dedicated handshake/record fuzz drivers and full pinned Xray
  none/TLS/REALITY interoperability with a local cover origin.

• Added a memory-only 0-RTT ticket cache that publishes after authenticated
  padding, invalidates on failed/cancelled resumption, and never automatically
  retries early data. The exact Go oracle distinguishes real resumed handshakes
  and covers mixed relay chains, configured padding, expiry, and cold recovery.

• Expanded encrypted full-Xray interop to 540 application flows across 204
  profiles, including inner TLS/Vision Direct, both gRPC encodings, XHTTP H1/H2/H3,
  mixed keys, session reuse, UDP and UDP/443. Swift/Kotlin encrypted raw/XHTTP
  share links preserve both Vision flows, with shared projection fixtures.

xray-rust v0.5.0

Highlights

• Promotes the reviewed v0.5.0-rc.1 implementation to stable without runtime code changes.
• Adds managed encrypted DNS and bounded caching, health-aware selectors, connection management, validated TCP chaining, structured TUN diagnostics, and atomic routing-policy replacement.
• Keeps the documented pre-1.0 API and security maturity boundary.

Verification

The complete automated release matrix passed, including pinned Xray-core interoperability, ASan/Miri/Loom hardening, bounded fuzzing, controlled-loss transport tests, exact-revision performance budgets, Apple builds, and the four-ABI Android AAR.

This release accepts the completed Apple H2/REALITY and memory rehearsals plus the Android H2/H3/REALITY, transition, recovery, memory, and cancellation rehearsals as physical-device evidence. The previously planned clean six-hour Apple and Android campaigns were not run and are not claimed.

The separately packaged Apple/Android SDK release follows in xray-rust-mobile v0.5.0.

Full Changelog: v0.4.0...v0.5.0

xray-rust v0.5.0-rc.1

• Added blocking v0.5 host-hardening release gates: eight one-minute ASan fuzz
  campaigns now include SOCKS/HTTP inbound parsing, QUIC Initial sniffing,
  XHTTP framing, and TUN queues; selected library/FFI tests run under ASan and
  Miri; and Loom exhaustively models atomic routing-policy publication.
• Added a pinned-Xray Linux tc netem RC gate covering full-duplex WebSocket,
  HTTPUpgrade, gRPC, and XHTTP H1/H2/H3 plus two-minute held-open H2/H3
  stream-one sessions under controlled delay, jitter, and packet loss.
• Completed the focused v0.5 credential-boundary review. Config and wire debug
  output now redact VLESS UUIDs and REALITY short IDs, FFI error allocations
  are cleared before release, and QUIC Initial derived secrets and keys have
  bounded zeroizing lifetimes. The documented residual lifetime of credentials
  required by active VLESS/JSON state is not presented as an independent
  security audit.
• Added capability-gated routing-policy hot replacement in C ABI 1.4 and the
  Swift/Kotlin adapters. Hosts can compile a scoped routing JSON document,
  including geosite/geoip matchers from the handle's configured geodata
  generation, and atomically publish it for new flows while existing flows,
  outbound topology, and shared transport pools remain untouched. Invalid
  outbound/balancer references or topology changes retain the previous
  revision; a redacted schema-versioned snapshot reports the active revision,
  rule count, and domain strategy.
• Added a clean five-run v0.5 pre-device performance gate. A new
  phase2-probe measures production selector/chaining, atomic switching,
  health/selection snapshots, DNS caching, live connection inventory,
  accounting/close, structured TUN diagnostics, and TUN statistics. The macOS
  runner also replays v0.4.0 routing, DNS-selector, process-RSS, TCP, and
  inherited-fd TUN anchors under explicit budgets and rejects dirty or
  mixed-revision evidence before the physical Apple/Android campaign. The
  first clean candidate gate passed and records the remaining 1,000-flow RSS
  headroom as an explicit device-profiling risk.
• Restored small-rule routing performance lost before v0.5 when the shared
  domain and IP indexes replaced linear matchers. Domain sets of at most eight
  entries now retain a linear fast path while geosite-sized sets keep their
  compiled hash/automaton indexes; single IP ranges and empty inverse sets also
  avoid the generic range search. On the same release probe, 4096-rule DNS
  selector last-hit latency fell from 91.5 to 26.4 microseconds without
  regressing the 4096-matcher indexed path, and the 64-rule IP route probe fell
  from 472 to 367 nanoseconds.
• Started the v0.5 development line with additive C ABI minor-version and
  capability discovery. The canonical Swift and Kotlin adapters expose the
  loaded ABI version and capability mask and reject incompatible major or
  insufficient minor revisions before allocating a core handle.
• Split outbound topology, lazy handler construction, and routing policy into
  an immutable OutboundGraph, a shared OutboundFactory, and
  OutboundRouter. Each Core now owns one graph/factory before start, so
  future selector and health state can reuse transport pools without rebuilding
  the core.
• Added Xray-compatible selector groups: routing.balancers expands tag
  prefixes into sorted graph nodes, balancerTag rules support random,
  round-robin, and fallback selection, and a shared atomic override/snapshot
  API switches new flows without rebuilding handlers or their transport pools.
• Added the bounded Xray-compatible observatory subset and health-backed
  selection. Lifecycle-owned HTTP(S) URL probes publish typed, redacted health
  snapshots; random and round-robin skip known-dead candidates, while
  leastPing deterministically selects the lowest healthy delay and falls back
  when no healthy candidate remains. Explicit overrides remain authoritative.
  leastLoad uses a 16-result rolling health window, Xray-compatible
  deviation/average/failure ordering, bounded top-N distribution, RTT and
  failure-rate filters, duration baselines, and literal tag costs. Regex costs
  fail closed; non-TCP chaining shapes remain.
• Extended C ABI 1.2 with capability-gated atomic selector override/clear and
  two-pass, schema-versioned JSON snapshots for selection and redacted health
  state. The Swift and Kotlin adapters expose equivalent typed APIs; SwiftPM
  tests and the four-ABI Android JNI/AAR build cover the shared wire contract.
• Added validated transport-layer TCP outbound chaining through Xray
  proxySettings. The immutable graph resolves tag edges and rejects missing
  targets or cycles before core start; Freedom/VLESS carriers retain shared
  handler pools and apply TLS/WebSocket/HTTPUpgrade/gRPC/TCP-backed XHTTP over
  the nested protected stream. Protocol-layer/UDP/DNS, REALITY, and XHTTP
  HTTP/3 chain shapes fail closed while those lifecycle boundaries remain
  unsupported.
• Added core-owned connection management for routed SOCKS TCP/UDP, HTTP TCP,
  and TUN TCP/UDP flows. ABI 1.3 plus equivalent Swift/Kotlin models expose
  revisioned opening/active inventory, addressable close, and cumulative
  per-outbound accounting. Swift and Kotlin also expose the seven typed TUN
  diagnostic queues under the existing diagnostic capability bit.
• Added managed encrypted DNS transports for strict routed tls:// DoT,
  routed/provider-local HTTP/2 DoH (https:// / https+local://), and
  provider-local quic+local:// DoQ. All use
  non-recursive bootstrap resolution, certificate/name verification, bounded
  operations, and mobile preflight pinning; the TUN anchor supports both UDP
  and length-prefixed TCP clients. DoH and DoQ currently open one connection
  per exchange; DoQ uses exact ALPN doq and one bidirectional stream.
• Added a typed 30-second NXDOMAIN/NODATA cache and optional bounded
  stale-while-revalidate for positive destination answers. Global Xray
  disableCache, serveStale, and serveExpiredTTL fields are supported;
  transport failures are never cached, refreshes remain single-flight, and an
  explicit 1-through-86400-second stale window is required.
• Added managed platform-resolver injection for Rust embeddings. The new
  constructors retain dns.hosts, configured servers, routed query transport,
  and cache ownership; System uses the dependency only for no-server
  destination fallback and non-recursive endpoint bootstrap, while
  StaticOnly ignores it and remains fail-closed. Runtime startup preserves
  the same dependency instead of silently restoring getaddrinfo.
• Expanded the blocking pinned-Xray oracle matrix for v0.5. The live suite now
  proves round-robin traffic reaches both Xray VLESS members and a two-hop
  transport-layer chain reaches its final echo target without local domain
  resolution. The RC gate also submits one shared Phase 2 balancer/chaining/
  observatory/encrypted-DNS/cache config to xray run -test, then explicitly
  runs DoT/DoH/DoQ framing and failover, configured-DNS policy/bootstrap, and
  cache/singleflight/stale-refresh oracle filters.
• Added Android VLESS share-link import parity for the portable Apple subset:
  raw/TCP REALITY and XHTTP/SplitHTTP with none, TLS, or REALITY security. The
  Kotlin API emits the same mobile TUN topology, rejects duplicate or
  unsupported security-critical fields, bounds XHTTP extra to 64 KiB and one
  compatibility decode, and keeps unsupported secret values out of errors.
• Extended the test-only Android physical-device harness with owner-controlled
  canonical JSON import through an overwrite-and-delete private pending file
  and per-protocol bounded stress counts. A physical Android 15 rehearsal
  passed a pinned-certificate VLESS XHTTP stream-one endpoint over exact H3,
  including a Mac preflight oracle, 660/660 device HTTP attempts, stable
  repeated-cycle recovery memory, and disconnect/reconnect recovery. The
  short dirty-revision run remains diagnostic and does not replace the clean
  six-hour Android release report.

xray-rust v0.4.1-rc.4

• Fixed an XHTTP/2 stream-up deadlock where a concurrent downlink poll could
  cancel the uplink's pending flow-control reservation and strand a sustained
  upload. Added deterministic split read/write coverage and an 8 MiB live
  Xray-core interoperability regression.
• Added safe pre-commit HTTP/2 GOAWAY retry handling plus regression coverage
  for non-replay after commitment and request/buffer ownership across
  cancellation.
• Accepted an HTTP/3 H3_NO_ERROR request reset only after every declared
  fixed-length request byte was delivered, while preserving failure for
  unknown-length or premature resets; added transport and full-load interop
  regressions.
• Added weekly broad pinned Xray-core interoperability and resource gates plus
  a warning-only upstream-main compatibility smoke check.
• Scoped the RC4 REALITY/Vision comparator omission to the measured stable
  sing-box v1.13.20 evidence: Xray-core v26.7.28's default minClientVer
  26.3.27 rejects that build's REALITY ClientVer 1.8.1. RC4 records
  --skip-sing-box and publishes xray-rust/Xray-core results only for those
  two workloads, while the generic harness retains sing-box REALITY support
  for compatible or patched binaries. The fixture and timeout remain
  unchanged.
• Published fresh five-run RC4 evidence against exact Xray-core v26.7.28 and
  stable sing-box v1.13.20: 139 validated series and 695 embedded results with
  exact revisions, binary hashes, a deterministic raw-archive digest, and new
  dated charts/tables. The publication records the reviewed sing-box
  gRPC/full-duplex/32 nondeterministic timeout and Xray-core H3 pressure/32
  reset/timeout boundaries without substituting isolated diagnostics.
• Made the benchmark publication depth-limit policy test portable across
  Python JSON decoders, and constrained JFrog-token secret-scan exemptions to
  the two reviewed dated benchmark replay records containing binary SHA-256s.
• Corrected roadmap, implementation-status, verification, configuration,
  migration, benchmark, and release documentation for RC4.
• Routing ip matchers are compiled once at load time into a shared sorted
  range index (xray-routing::IpRangeSet/IpMatcherSet), also used by DNS
  expectedIPs/unexpectedIPs filters. Outbound selection cost no longer
  grows with the size of a geoip: list (route-probe, 16 rules x 5000 CIDRs:
  ~152 us -> ~0.5 us per selection).
• Routing IP matching now follows Xray-core HeuristicIPMatcher exactly, as
  the DNS filters already did: IPv4-mapped IPv6 targets (::ffff:a.b.c.d) are
  matched as IPv4; an inverse matcher only applies to targets of an address
  family it has networks for, so !10.0.0.0/8 no longer matches an IPv6
  target; a doubly negated matcher is treated as positive (not expressible in
  configuration, so parsed configs are unaffected).
• CIDR prefixes longer than the address family width are rejected with an
  error at every construction site instead of being clamped.
• xray-bench route-probe --cidrs-per-rule N generates N distinct
  non-merging CIDRs per rule to expose per-matcher routing cost; 0 is
  rejected.

xray-rust v0.4.1-rc.3

• Made the blocking RC interoperability gate self-contained on a clean runner:
  it now builds the xray-rust CLI in the release profile and passes that
  exact binary to the benchmark harness while keeping implicit builds disabled.
  A hermetic clean-target regression test prevents stale target/debug
  artifacts from masking this release-gate failure again.

xray-rust v0.4.0

Highlights

• Added Apple VLESS share-link import for xhttp/splithttp with plaintext,
  TLS, or REALITY transport security. The importer preserves supported
  security fields, handles bounded single- or double-percent-encoded extra
  JSON, and rejects unsupported non-empty certificate-pin/ECH settings instead
  of silently downgrading them.
• Implemented Xray-compatible one-level XHTTP extra replacement semantics,
  while keeping outer host, path, and mode. The removed
  scMaxConcurrentPosts field remains import-compatible but is ignored rather
  than being misread as scMaxBufferedPosts.
• Reduced plaintext HTTP/1.1 XHTTP packet-up memory pressure. Uplink buffers
  now grow in 8 KiB steps only when data is available and reuse their actual
  allocation instead of reserving or cloning the configured maximum POST size
  for every active flow.
• Added an exact legacy-profile RSS benchmark with held-flow, 16 KiB control,
  settle, and ACK-gated rollover phases. The recorded 16-flow macOS run showed
  a 96 KiB median RSS delta between a 500000-byte max-POST profile and the
  otherwise identical 16384-byte control.
• Updated h2 to 0.4.16 for its upstream RustSec fix and refreshed the
  transitive chacha20 lock entry to 0.10.2 after 0.10.1 was yanked.

Compatibility boundary

This release supports XHTTP share links with VLESS encryption=none and no
Vision flow. Effective XHTTP downloadSettings, non-empty modern TLS
certificate-pin/ECH fields that the current Rust model cannot honor, and
non-none VLESS encryption remain fail-closed.

The separately packaged Apple/Android SDK release will follow in
xray-rust-mobile v0.4.0.

xray-rust v0.3.2

Highlights

• Preserve an omitted VLESS flow when importing Apple share links instead of silently enabling xtls-rprx-vision.
• Match the share-link and server-side client semantics, preventing an early EOF when the server client is configured without a flow.
• Keep explicit xtls-rprx-vision and xtls-rprx-vision-udp443 imports supported.

The C ABI major remains 1.

xray-rust v0.3.1

Highlights

• Advertise the implemented Xray-core 26.7.28 compatibility version in REALITY handshakes, fixing rejection by current servers that use the default minClientVer of 26.3.27.
• Synchronize the fingerprint namespace and eleven-profile ModernFingerprints pool with Xray-core v26.7.28. Explicit hellochrome_133, hellofirefox_148, and hellosafari_26_3 names are supported; older profiles remain available explicitly.
• Add optional Android XrayCore.create(fileLoggingDirectory = ...) support for bounded, host-controlled diagnostic exports.

The C ABI major remains 1.

xray-rust v0.3.0

Highlights

• Added production VLESS WebSocket, HTTPUpgrade, gRPC, and XHTTP transports.
• Added XHTTP packet-up, stream-up, and stream-one over HTTP/1.1, HTTP/2, and protected HTTP/3.
• Hardened browser-shaped TLS/uTLS and VLESS REALITY Vision interoperability.
• Improved gRPC/XHTTP pooling, cancellation, gzip handling, and HTTP/3 stream cancellation.
• Made fd-backed TUN recovery resilient, kept Apple IPv6 full-tunnel routing fail-closed, and preserved FFI v1 prefix compatibility.
• Added live xray-core interoperability matrices and transport benchmark workloads.

Compatibility

• Embedders using the removed free select_* functions must retain a long-lived OutboundRouter and call its methods.
• HTTP/3 is phase one: QUIC v1, static receive windows, Quinn BBR approximation, and one active HTTP request per QUIC connection. Unsupported H3 features fail closed.
• This is a source-only release; no binary, AAR, XCFramework, or crates.io assets are published.

Verification

• GitHub CI: Rust, Go oracles, Apple, Android, secret scan, and supply-chain policy.
• Live xray-core: WS 3/3, HTTPUpgrade 3/3, gRPC 5/5, XHTTP 15/15, REALITY/Vision 21/21.
• Raw TCP VLESS REALITY Vision A/B: unchanged 13.380 Gbps median throughput; CPU improved from 830 to 820 ms/GiB.

See the full changelog.

xray-rust v0.2.0

Highlights

• Fixed file logging initialization inside the iOS Network Extension sandbox. xray_core_new failed with "Operation not permitted" because runtime log files were opened by walking every ancestor directory with read access, which the sandbox denies outside the app-group container. Apple platforms now resolve the log path with a single O_NOFOLLOW_ANY open, which keeps rejecting symlinks in any path component; other unix targets keep the hardened directory walk.

Compatibility

No API or configuration changes; existing integrations are unaffected. The Apple log-file path now uses O_NOFOLLOW_ANY, which requires iOS 14.5+ / macOS 11.3+ at runtime — within the package's iOS 15 deployment target, but note that macOS 11.0–11.2 is no longer supported for file logging.

This repository release contains source code only.