Hiddify V5 Full change logs

[hiddify-com]

Hiddify v5.5.0

This release note covers everything that changed since Hiddify v4 (v4.0.4 to v4.1.2), through the
v5.2, v5.3 and v5.4 releases, up to v5.5.0, plus the fixes and additions made after the v5.5.0
tag (hiddify-app 5.5.1, hiddify-core 5.5.5). It is built on hiddify-core and
hiddify-sing-box v5, the Hiddify fork of sing-box 1.15.

The v5 line is the largest update in Hiddify's history: a new core with more than twenty new
protocols and transports, a rebuilt WARP, a smart DNS layer, IPv6 that is verified per proxy, a
redesigned home screen and proxy list, tools for very large subscriptions, and a new macOS VPN.

📖 Read the docs. Every new protocol, transport, DNS and group feature has its own page in
English and Persian, with how it gets past filtering, a config example and every option:
Hiddify sing-box docs · فارسی.
Bug fixes are listed one by one in the v5 bug fix log, and app and
panel developers should read the app considerations.

---

Highlights

• A new core. hiddify-sing-box v5 is rebased on sing-box 1.15 and adds Xray's newest features
  (XHTTP, mKCP, XDRIVE, finalmask, VLESS encryption), with more than 130 bug fixes on top.
• New ways through censorship. DNS tunnels (DNSTT, MasterDNS), Psiphon, GooseRelay over
  Google Apps Script, a video call tunnel, Sudoku, Mieru, TrustTunnel, Bond and more.
• WARP, rebuilt. WARP over WireGuard, AmneziaWG or MASQUE, an auto mode that races all
  three, an endpoint scanner that remembers each network, and noise presets that mimic DNS, QUIC
  and SIP.
• Extra Security and Unblocker chains. Put WARP or Psiphon in front of or behind your proxy,
  choose the tunnel per hop, and see each hop's state on the home screen.
• Big profiles made fast. Keep only the fastest N proxies, pick by hand which ones run, and
  test upload and download speed through each proxy.
• IPv6 done right. Off by default, and when turned on, verified per proxy so IPv6-first sites
  no longer break through proxies that have no IPv6.
• A new home screen and proxy list. A connect button that shows traffic, animated status for
  every proxy, a connection rail with each step, and a signal-style ping view.
• Updates outside the stores. The app now finds new releases and installs them itself on
  Android, Windows, Linux and macOS.
• macOS packet tunnel system extension and a Mac App Store build without root.
• Android TV. Add a subscription from your phone by scanning a QR code on the TV.
• Soar. A new DNS tunnel that finds its own resolvers, with a steadier lowest-delay pick.

---

New protocols

• WARP endpoint (all-in-one). Cloudflare WARP with free account registration, over
  WireGuard, AmneziaWG or MASQUE, chosen by mode (wg, awg, masque or auto). auto
  races one handshake per tunnel and keeps the fastest. Registered devices are kept in a pool in
  the cache file and reused, so a restart does not register again. A device is replaced only when
  Cloudflare says it is gone, disabled or out of quota.
• WARP over MASQUE. WARP over HTTP/3, HTTP/2 or both (vhttp), with a fallback from HTTP/3
  when UDP is blocked, MASQUE in MASQUE, and masque:// share links (MahsaNG format included)
  that carry an already enrolled device, so Cloudflare's often blocked API is not needed.
• AmneziaWG. WireGuard with junk packets, padded handshakes and custom message types, which
  defeats WireGuard fingerprinting. AmneziaWG 3.x settings are supported (header protection key,
  content padding, timers, random trailers, QUIC masquerade), and the s3, s4 and h1–h4
  ranges work.
• WireGuard additions. Noise packets before handshakes, per-peer user names, socket recovery
  when the network goes bad, MTU discovery and UDP fragmentation on by default. The legacy
  WireGuard outbound that upstream removed is kept, so old configs still load.
• VLESS encryption. Xray's post-quantum VLESS encryption, with Vision on top even without
  TLS.
• Soar. Carries TCP connections inside DNS queries through recursive resolvers, each
  resolver a path with its own loss and congestion handling. It uses the smart resolver pool and
  finds resolvers itself when none are given. soar:// links are read, and the app's region
  fills the discovery country.
• DNSTT. Carries traffic inside DNS queries through public resolvers, which it finds by
  itself. It reads VayDNS, NoizDNS and SlipNet profiles.
• MasterDNS. The MasterDnsVPN tunnel over public resolvers: a small header, packet
  duplication over several resolvers and MTU tests. In socks5 mode it needs no proxy behind it.
• Psiphon. Connect through the Psiphon network with no server of your own, and pick the exit
  country.
• GooseRelay. Sends traffic through Google Apps Script to your own server, so the network
  sees only HTTPS to Google.
• Call tunnel. Carries proxy traffic inside a video call on VK, Telemost, Dion, WB Stream or
  Bitrix24, so it looks like a call to an allowed domestic service (experimental, build tag
  with_call).
• Sudoku. An encrypted TCP proxy whose bytes look like text or have low randomness, with
  optional HTTP tunnels.
• Mieru. A fully encrypted, padded proxy over TCP or UDP port ranges with no fixed pattern.
• TrustTunnel. Proxy traffic as HTTP CONNECT streams over HTTP/2 or HTTP/3.
• SSH. An SSH server inbound for port forwarding, UDP over TCP, and a background connection
  for the SSH outbound.
• Bond. Splits each connection over several outbounds at once and joins it on the server,
  to add up throttled connections.
• Tunnel. A reverse tunnel that reaches machines behind NAT through a public server.
• AnyTLS and Snell links are now read.

New transports and anti-censorship features

• XHTTP. Xray's XHTTP transport with all its modes, padding, placements, XMUX and split
  download. An empty or auto mode now picks the same mode Xray's client does.
• mKCP. Xray 26's mKCP over UDP for lossy or TCP-throttled networks, hidden by finalmask UDP
  masks.
• XDRIVE. A VLESS connection carried in files on Google Drive, S3 or another storage
  service, so the client never contacts the server.
• finalmask. Xray's masks (fragment, noise, header-custom, xdns over UDP, TCP or DoH,
  udphop, merge, oob and more) on every connection an outbound dials.
• TLS fragment. Splits the ClientHello into small pieces with pauses, so DPI cannot read the
  server name. It now works on REALITY too, and a subscription can tune it with a header.
• TLS tricks. A mixed-case server name and a padding extension in the ClientHello, now for
  uTLS clients as well.
• REALITY. The post-quantum key share and a key_share option.
• Fingerprints. The uTLS fork now ships Firefox 148 and Safari 26.3. Xray's versioned names
  such as hellochrome_120 are accepted. TLS without a fingerprint uses the system's TLS when
  available, or Chrome's uTLS.
• Raw transport and custom gRPC paths, so configs converted from Xray load as they are.
• Shadowsocks simple-obfs server with a decoy page when obfs or login fails.
• rmux, one more multiplex protocol next to smux, yamux and h2mux.
• PROXY protocol. Inbounds read the PROXY protocol header and the direct outbound sends it.

WARP

• Endpoint scanner. Finds a WARP endpoint that works on the current network and keeps a
  score per network. On a network change it checks the current endpoint first and only rescans
  if it fails. The network is named through cdn-cgi/trace, so no location permission is
  needed.
• Noise modes and presets. Named presets (DNS, QUIC, SIP, random) and "WG Mimic" templates
  make the handshake look like other traffic. The scanner can also search for a noise preset that
  gets through.
• Extra Security WARP is simpler. It offers only its tunnel, licence and MTU, and takes the
  endpoint Cloudflare assigned. The Unblocker keeps every option.
• MASQUE no longer registers WARP devices itself, and a restart during a network change no
  longer crashes the process.
• Choose the noise preset in settings, from a list of named presets.
• WARP behind a group moves at once when you change a selector, and follows a URL test or
  balancer through a new tunnel that replaces the old one only once it connects.
• WARP behind a detour (WARP in WARP) stops searching, keeps its port, and falls back to an
  IPv6 WARP address.
• Registration fallback. If registration through the detour fails, it is tried through the
  other outbounds.
• The proxy list shows the endpoint the scanner chose behind a magnifier icon.

Extra Security and Unblocker chains

• Chains. A proxy can now run with an extra hop. Extra Security sends your traffic through
  WARP or Psiphon after your proxy, so the proxy server cannot see it. Unblocker puts WARP or
  Psiphon in front, to reach a proxy that is blocked.
• Choose the tunnel per hop. WARP over WireGuard, AmneziaWG, MASQUE or auto, or Psiphon.
  The Unblocker's scanner finds the rest.
• Selectable mode. Both hops can be "Selectable": a group named after the hop where you pick
  "Lowest" or a specific WARP tunnel or Psiphon, and change it while connected.
• Edit the WARP settings of each hop: where the peer comes from (assigned, scanned or a
  custom address), MTU, scanner, MASQUE, AmneziaWG and noise.
• Psiphon license flow and unified license keys for the chain.
• Subscriptions control it. The old enable-warp and enable-psiphon headers are merged
  into one extra-security header.
• Remote DNS behind Extra Security. Your own remote DNS is kept behind the hop, with DoH
  through the profile as a fallback.
• Home screen. The chain hop is a badge on the connect button (a seal for Extra Security, an
  opening door for the Unblocker), and the hop row names what it runs and what it is doing.
• Connectivity. The app shows Connected as soon as a proxy works, whatever the hop does, and
  explains it when the selected proxy or the hop is down.

DNS

• DNS group. Ask several DNS servers at once, in turn, or stick to the one that works, and
  drop poisoned answers. TCP servers are tried first in the remote group.
• bypass_if_failed. When a DNS rule's server fails, the query goes on to the next rule.
• Smart resolver pool. Each DNS tunnel (DNSTT, MasterDNS) runs its own pool of resolvers,
  with auto resolvers, saved scores, and DoT and DoH resolvers.
• DNSCrypt. The sdns server sends encrypted queries to a DNSCrypt resolver given by its
  stamp.
• Shared resolver discovery. smart_pool.discovery is shared by DNSTT, MasterDNS and Soar,
  and the pool refills as resolvers die.
• sslip.io names resolve to the address written in the name.
• Local DNS on Linux falls back when systemd-resolved is incompatible.

IPv6

• Off by default, with an explained opt-in. Most proxy exits have no IPv6, and a connection
  the proxy cannot carry dies after it opened, which browsers never retry. The routing page now
  explains this.
• Verified per proxy when on. Each proxy's URL test is followed once per run by the same URL
  over IPv6. IPv6 goes only through proxies known to carry it.
• IPv6 fallback. An IPv6 connection through a proxy not known yet is carried over IPv4
  inside, so no app sees it die.
• Subscriptions and links can declare it. An ipv6-mode subscription header turns IPv6 on
  for a profile, and a share link can say ipv6=1 or ipv6=0.
• The IPv6 setting is now a preference, and the TUN stack defaults to "Sing 15".

Groups, balancing and monitoring

• Balancer. Spreads connections by round robin, lowest delay, consistent hashing, sticky
  sessions or a sticky pool. The strategy can be chosen in the app, with a short description after
  each pick.
• Steadier lowest delay. The lowest-delay pick stays 30 seconds after a switch, uses a
  relative tolerance, and a ping cached from the last run only orders the list: it is never
  shown and decides nothing. Each proxy has one URL test at a time, and proxy tags stay stable
  across subscription updates.
• Default proxy for the select group. Until you pick a proxy, the group starts on the
  balancer; settings also offer the lowest ping or the profile's first proxy.
• Stable balancer. Lowest delay keeps its member until another one is clearly faster, with a
  100 ms and 10 % tolerance. A faster member only takes new connections, so calls and downloads
  are no longer cut on every test round.
• Fallback group. Tries members in order and skips one that failed for a while.
• URL test. More test URLs, a failover mode, and a move to another member on the first
  failed connection, without closing live connections.
• Unified delay. URL tests time one HTTP round trip on an open connection, so delays compare
  fairly across protocols.
• Monitoring. Background tests of every proxy for delay and exit IP. The proxy you tap or
  select is tested at once, in stages, so its ping shows quickly.
• Exit IP from the last run. Every proxy shows the exit IP and country of the last run until
  this run confirms them. Such an IP is shown faded.
• Why a proxy failed. The proxy details show a "Why it failed" box with the error of its
  last test, or why it is not ready, such as a refused WARP registration or a MASQUE tunnel that
  does not connect. The text can be copied, and display types no longer repeat the status.
• Proxy status from the core. Every proxy reports Ready, Connecting, Reconnecting, Searching,
  Registering or Failed, and the app shows it.
• Custom IP lookup. A subscription can set its own ipinfo-url for exit IP lookups.

Home screen

• A new connect button with a ring, ripples and an error text. Traffic is drawn as an
  eclipse around it, the label fades calmly between states, and the "H" lights up like signal
  bars.
• Hot reload. Most settings now apply without a reconnect, and the button shows when the
  core is reloading.
• The proxy card is Material 3 with the chain band. Its connection is shown as steps on a
  rail: the server and each hop have their own state, flag and ping.
• "Switch to fastest" in the ping row, offered when a proxy was picked by hand.
• Unavailable proxy. One capsule shows the proxy that is down and the way out. A tap tests it
  again.
• Connection check sheet explains a failed or slow connection.
• Haptic feedback fires on a verified ping, not just on "Connected".
• Failed starts are explained, including when another VPN holds the TUN device or when VPN
  mode needs administrator rights.
• Small screens and TVs. The connect button scales on short screens, and TV remote focus
  shows a ring instead of a grey face.
• Weak phones. Animations no longer repaint the whole page.

Proxies page

• A redesigned proxy row with animated status for every state: loading, ping, failed ping,
  connecting, registering, searching, reconnecting, and gave up.
• Signal style. The ping shows as a number or as the Hiddify logo lit like signal bars. A
  long press switches the style, and the choice is kept.
• Tap a ping to test only that proxy.
• Proxy info dialog with flag, type, status, IP, country, organization, server, ping and
  speeds, each tested on a tap and updated live.
• Two columns on a normal window, so names fit.
• Persistent sort, including by upload or download speed.

Big profiles and speed tests

• Keep the fastest N. A profile with more than 20 proxies asks once how many of its fastest
  proxies should run (3 to 30, or all). A subscription's keep-top header can set it.
• Choose the proxies that run. A picker lists all proxies with ping and speeds, sorts by
  ping, download or upload, and filters by chosen, answering, paused, protocol and country.
  "Use these N" applies the choice.
• Upload and download speed tests through each proxy. Choose download, upload or both, how
  much data (1, 5, 10 or 50 MB), and how many of the fastest to test. The dialog shows how much
  data it will use first.
• Speeds are kept between runs and shown faded until tested again, with a "Clear saved
  results" action.

Profiles and subscriptions

• More import formats. Xray JSON, sing-box JSON and YAML, Clash, WireGuard .conf files,
  AmneziaWG options, and zip files (one profile per file, or one profile named after the zip).
• Subscriptions inside subscriptions. A profile can list other subscriptions, and inner
  links in base64 subscriptions are found.
• New link types: masterdns://, slipnet://, dnst://, masque://, XDRIVE, and
  patterniha's finalmask links. Xray's cipherSuites and links with & are read.
• Import from a file, and read a QR code from an image in the scanner dialog.
• Pin profiles above the sorted list, and the sort choice is kept.
• Update status on each profile tile, and one toast that sums up a bulk update.
• Provider links shown as a cycling chip.
• Dead subscriptions stop updating by themselves after 3 days of failures. A manual update
  still runs.
• Subscription headers. total=0 means unlimited, malformed subscription-userinfo and
  invalid update intervals are tolerated, and profile names are read from every documented source.
• Safer deep links. Adding a profile from a deep link asks first and names the real host.
  Links not on a trusted list hold back the open button.

Routing

• System services rule. Follows the platform: Apple services on iOS and macOS, Microsoft on
  Windows, Android services and push on Android, distro updates on Linux. It is off by default.
• Built-in rules replace the predefined ones. They are read-only, marked with a lock, and can
  be duplicated and copied. An Apple services rule is added.
• App-based routing has its own section, with app logos, a switch apart from its mode, and
  search by package name.
• Auto selection. The app picks which apps go direct for your region. It turns off when you
  change the region or mode, or edit by hand. Auto picks are tagged in the app list.
• Pick package names from installed apps, with chips to hide system apps and restore auto
  picks.
• Share and import rules and app lists, with a preview, through the clipboard or deep links.
• Region. Detected from the time zone and locale, shown as a chip in the app bar.
• Each new rule gets a numbered name, and IP CIDR fields accept IPv6.

Local proxy, LAN sharing and Android TV

• Local proxy without a password by default, since browsers and the system proxy cannot send
  one. "Require password" turns it on and says which apps cannot use it.
• LAN sharing with its own port (12338 by default) that always asks for a generated secret.
  A Material 3 QR dialog shows the details to copy.
• Inbound settings in groups: local proxy, local network sharing and other ports. TProxy,
  redirect and direct ports are off by default and shown only where the platform has them.
• Proxy mode is manual, with a guide on pointing apps at the local proxy.
• Android TV. The add profile sheet shows a QR code. A phone on the same Wi-Fi scans it,
  pastes a subscription link and sends it. The TV imports it only when you press Import. The page
  uses a new 6-digit code each time and locks after 10 wrong tries.
• TV remote arrow keys no longer change pickers by accident.

Platforms

macOS

• Packet tunnel system extension for VPN mode, with the approval shown as a permission
  prompt.
• Mac App Store build in a sandbox that leaves out everything that asks for root. It starts in
  VPN mode.
• VPN without root for Developer ID builds through hiddify-core's tunnel service.
• Universal builds, notarization, a clearer bundle name, and a DMG background with the
  quarantine steps in English and Persian.

iOS

• Native swipe-back gesture.
• The app no longer shows Disconnected after reopening while the tunnel is still up.
• The packet tunnel always runs with the memory limit.
• Log export through the share sheet works.
• Liquid Glass app icon on iOS and macOS.

Windows and Linux

• VPN service for Windows and Linux with an elevated background service, so TUN works
  without running the app as administrator.
• The installer manages the service, and builds are signed.
• Microsoft Store package as "Hiddify ProxyVPN".
• A taskbar status dot and desktop status badge for the connection state.
• AppImage: raw AppImage, deep links, localized desktop entry and update keys, and Arch Linux
  compatibility.
• The Windows portable package is a real zip.
• The tunnel comes back on startup if you left it running.

Android

• Always-on VPN toggle.
• The service notification updates live.
• The VPN service keeps working when the app's front core restarts.
• Start waits for permission dialogs before it answers.

Updates

• Download and install updates outside a store. The app checks once a day, and "Update now"
  installs the APK for your device, the Windows setup, the AppImage, the Debian package or the
  macOS disk image. You can skip a release. Store builds never offer a download.

Logs, diagnostics and privacy

• A rebuilt logs page with three categories, one level filter, and both filters kept between
  runs.
• The log file is kept across runs and holds only errors.
• Crash reports. After a crash, the next run offers to send one diagnostics zip with the
  crash reports, core logs and goroutines. It is also in the logs share menu.
• Reports leave out sensitive data. They no longer include the configuration or open
  connections, and logs are scrubbed of IP addresses, proxy links, DNS stamps, URL paths, UUIDs,
  emails and secrets.

Security

• mTLS between the app and the core. The gRPC channel uses mutual TLS with client
  certificates on every platform.
• MPTCP is off unless asked, so no inbound listens on Multipath TCP by surprise.
• SSRF guard on deep-link profile imports.

Translations

• All new texts are translated into Arabic, Chinese (Simplified and Traditional), French,
  Indonesian, Persian, Portuguese (Brazil), Russian, Spanish and Turkish. The Russian locale is
  polished.

Bug fixes

More than 130 core bugs are fixed on top of sing-box 1.15, and many in the app. Each core fix,
with what happened and its commit, is in the v5 bug fix log. The most
noticeable:

• Connections cut on every test round by the balancer and URL test no longer happen.
• Proxies stuck on "waiting" after a hot reload or an idle half hour keep being tested.
• IPv6-first sites no longer fail through proxies without IPv6.
• WARP no longer gets stuck in auto mode, torn down behind a URL test, or crashed by a bad
  profile, and WireGuard through a detour connects reliably.
• Psiphon connects ("domain not resolved" is fixed), restarts after its core stops, and runs
  more than one at a time.
• MASQUE connects through Shadowsocks, VLESS and Trojan, over IPv6, and in MASQUE.
• DNS no longer stalls the whole tunnel, a hanging server no longer fails every query, and
  duplicate queries after a failure are gone.
• TUN no longer refuses new TCP connections after a listener error, and a failed handshake no
  longer crashes the process.
• Shadowsocks 2022 "bad request salt" is fixed, and QUIC works through Shadowsocks.
• XHTTP no longer leaks goroutines, ignores deadlines, or loops in its padding generator.
• Rule sets retry a failed download in seconds, not after a day.
• Profiles list shows even when one profile cannot be read.
• The core restarts cleanly when a stop is still in progress.
• The app reconnects to the core after returning from the background, with closed old
  channels and backoff.
• A memory leak from an animation created on every rebuild is fixed.
• The connect button no longer shows the last run's proxies or throws duplicate keys.
• Fake DNS no longer stops the core at Connecting.
• The system proxy listens on the IPv4 loopback only.
• A reconnect is no longer logged as a stream error, and on Android core log lines are no
  longer logged twice.
• The main list shows a spreading balancer's fastest member.
• The service notification on Android updates with the connection state.
• Shared subscription links keep their port, and imported names survive config edits.

Notes for providers and advanced users

Before changing configs, read the app considerations and the
feature pages in the Hiddify sing-box docs.

• IPv6 is off by default. Use the ipv6-mode: prefer_ipv4 subscription header to turn it on
  for a profile.
• WireGuard with an awg block must now use "type": "awg". The block was silently ignored
  before.
• sdns accepts only DNSCrypt stamps. Convert DoH, DoT and plain stamps to https, tls or
  udp servers.
• The smart_dns_pool service is removed. Set smart_pool on the DNSTT or MasterDNS
  outbound instead.
• A WARP profile given by id and auth_token now needs its private_key.
• XHTTP over REALITY with an empty mode now uses stream-one. Set packet-up explicitly if
  you relied on it.
• Every build has the same protocols, macOS VPN mode included: MASQUE, mKCP, XDRIVE, Sudoku,
  Bond, the call tunnel, OpenVPN, OpenConnect and Tor, plus the V2Ray API.
• Tailscale is no longer in any build.
• "Use xray-core when possible" is removed. A saved value is ignored, and subscriptions are
  downloaded with the plain HiddifyNext user agent.
• Reports are no longer encrypted. They leave out the configuration and scrub sensitive data
  instead.
• New subscription headers: extra-security, fragment, keep-top, ipv6-mode and
  ipinfo-url.

[tgworlds]

Why can't I extract the socks protocol