latest

🚀 Features

• (rules) Add per-rule outbound interface selection (#1485) by @ibigbug
• (proxy/smart) Async cache load, retry exclusion, and lock scope reduction (#1511) by @ibigbug
• (memory) Memory limit controller, DNS cache eviction, and jemalloc tuning (#1512) by @ibigbug
• (proxy/urltest) Forced fastest selection, name-based lock, and healthcheck concurrency (#1513) by @ibigbug

🐛 Bug Fixes

• Pass through CORS preflight requests in auth middleware (#1486) by @oseau
• Remove unused shadowquic git patch and fix release workflow (#1488) by @aaronjheng
• (inbound) Listener error recovery and panic hardening (#1506) by @ibigbug
• (transport) Datagram stream framing and partial I/O handling (#1507) by @ibigbug
• (memory) Closed_flows memory leak and statistics deadlock (#1508) by @ibigbug
• (dns) Fakeip bidirectional cache invariants and IP offset cycling (#1509) by @ibigbug
• (misc) Panic hardening, UI fallback, and AnyTLS buffer optimizations (#1525) by @ibigbug
• (hc) Use group.url for default latency test url in healthcheck (#864) (#1533) by @ibigbug
• (rules) Make domain rule matching case-insensitive (#621) (#1534) by @ibigbug
• (config) Preserve error details and log on config parse failure (#711) (#1535) by @ibigbug
• (api) Allow get_outbound and delay test to find provider proxies (#1394) (#1536) by @ibigbug
• (config) Make path and health-check optional for proxy providers (#1537) by @ibigbug
• Use portable_atomic::AtomicU64 for 32-bit platform compatibility (#1539) by @ibigbug

⚡ Performance

• (io) Cooperative stream copy yield to prevent CPU starvation (#1510) by @ibigbug

🛠️ Builds

• (deps) Bump the rust-dependencies group with 47 updates (#1494) by @dependabot[bot]
• (deps) Bump the npm-dependencies group in /clash-dashboard with 16 updates (#1493) by @dependabot[bot]
• (deps) Bump the actions-dependencies group with 3 updates (#1492) by @dependabot[bot]
• (deps) Bump brace-expansion from 5.0.7 to 5.0.9 in /clash-dashboard (#1495) by @dependabot[bot]
• (deps) Bump ip-address from 10.2.0 to 10.4.0 in /clash-dashboard (#1496) by @dependabot[bot]
• (deps) Bump js-yaml from 4.2.0 to 4.3.2 in /clash-dashboard (#1523) by @dependabot[bot]
• (deps) Bump browserslist from 4.28.2 to 4.28.9 in /clash-dashboard (#1518) by @dependabot[bot]
• (deps) Bump the rust-dependencies group across 1 directory with 45 updates (#1524) by @dependabot[bot]
• (deps) Hold tower-http at 0.6 to keep 32-bit builds green (#1529) by @ibigbug
• (deps) Bump the rust-dependencies group across 1 directory with 34 updates (#1531) by @dependabot[bot]
• (deps) Bump the npm-dependencies group in /clash-dashboard with 17 updates (#1532) by @dependabot[bot]
• (deps) Bump the rust-dependencies group across 1 directory with 35 updates (#1540) by @dependabot[bot]

⚙️ Miscellaneous Tasks

• (sq) Bump shadowquic version (#1505) by @spongebob888
• Remove zig from aarch64-unknown-linux-gnu target (#1527) by @ibigbug
• (dashboard) Consolidate npm security updates and configure grouped security PRs (#1528) by @ibigbug

New Contributors ❤️

• @aaronjheng made their first contribution in #1488
• @oseau made their first contribution in #1486

v0.10.8

🚀 Features

• Auto-reload local file rule/proxy-providers on change (#1465) by @Copilot
• (tun) Add FreeBSD tun support via FIB multi-table routing (#1475) by @lakako

🐛 Bug Fixes

• (config) Ignore unknown fields for forward-compatible parsing (#1471) by @Copilot
• (hysteria2) Refresh the UDP poller after port hops (#1482) by @cedar-otter-47
• (ws) Percent-encode spaces in WebSocket paths (#1480) by @cedar-otter-47
• (urltest) Honor tolerance and skip unavailable proxies (#1481) by @cedar-otter-47

🚜 Refactor

• (dispatcher,transport) Dedup tracked streams + TransportLayer enum (#1477) by @ibigbug

🛠️ Builds

• (deps) Bump the npm-dependencies group in /clash-dashboard with 17 updates (#1462) by @dependabot[bot]
• (deps) Bump the actions-dependencies group with 6 updates (#1461) by @dependabot[bot]
• (deps) Bump the rust-dependencies group with 32 updates (#1463) by @dependabot[bot]
• (deps) Bump cmov from 0.5.3 to 0.5.4 (#1469) by @dependabot[bot]
• (deps) Bump body-parser from 2.2.2 to 2.3.0 in /clash-dashboard (#1479) by @dependabot[bot]
• (deps) Bump brace-expansion from 5.0.6 to 5.0.7 in /clash-dashboard (#1478) by @dependabot[bot]
• (deps) Bump serde_with from 3.20.0 to 3.21.0 (#1474) by @dependabot[bot]

⚙️ Miscellaneous Tasks

• Bump shadowquic version (#1476) by @spongebob888
• Bump version to v0.10.8 by @github-actions[bot]

Other

• Add Hysteria2 inbound listener (#1466)

• Initial plan

• Add Hysteria2 inbound listener (issue #1460)

• Fix UdpPacket src_addr/inbound_user in Hysteria2InboundDatagram

• Refactor user watch-channel creation to use match with OR patterns

• fix(hysteria2 inbound): keep connection alive after auth; harden UDP/TCP paths

Address review findings on the Hysteria2 inbound listener.

• Keep the h3 server connection alive for the QUIC connection's lifetime.
  authenticate() previously dropped it on return, and h3's Drop closes the
  underlying QUIC connection — so every proxy stream/datagram failed
  immediately after a successful auth, making the inbound non-functional.
• Bounds-check the UDP packet decoder before split_to(addr_len); a malformed
  datagram with an oversized address length previously panicked the datagram
  task (a remote DoS under panic = "abort").
• Send the correct address in UDP reply datagrams: use the upstream source
  (src_addr), not the client's own address (dst_addr), so clients can
  correlate replies (e.g. DNS-over-Hysteria2).
• Evict per-session Defraggers: move fragment state into the session map so
  it is dropped when the session ends, instead of a separate map that grew
  unbounded per distinct session id.
• Use try_send on the per-session datagram channel so one stalled UDP
  destination cannot head-of-line-block every other session on the connection.
• Preserve payload bytes pipelined into the request frame via into_parts()
  instead of discarding the read buffer with into_inner().
• Reject empty auth passwords so a blank password cannot become an open relay.
• Guard Fragments against underflow/divide-by-zero when the advertised max
  datagram size is smaller than the frame header.
• Treat a request frame split across QUIC reads as "need more bytes" instead of
  a fatal decode error.
• Canonicalize the client address before the allow_lan check (dual-stack
  IPv4-mapped IPv6), matching the other inbounds.
• Remove a duplicate address parser; add regression tests for the UDP decode
  bounds check and partial-frame handling.

• style: fix typos spellcheck (avoid 'mis' fragment in comment)

• refactor(hysteria2): split inbound/outbound and share stream/codec/TLS helpers

Reorganize the hysteria2 module to match the shadowsocks layout and remove
duplication between the client and server sides:

• Move the outbound client implementation from mod.rs into outbound/mod.rs;
  mod.rs is now a thin module root that declares submodules and re-exports the
  outbound surface (Handler, HystOption, Obfs, SalamanderObfs).
• Add a shared stream.rs unifying the outbound HystStream and inbound
  HystServerStream into one HystStream (with an optional read prefix for the
  server's pipelined-bytes case).
• Merge the duplicate Hy2TcpRespMsg into Hy2TcpResp (Hy2TcpResp::ok()).
• Extract resolve_server_cert_and_key into common/tls.rs and use it from
  both the anytls and hysteria2 inbounds instead of copy-pasted load-or-generate
  cert logic.

• fix(hysteria2): correct test_utils path after outbound module move

• fix(hysteria2 inbound): bound request lengths, validate auth request

Address review feedback:

• Cap the client-supplied address and padding lengths in Hy2TcpReqCodec
  (MAX_ADDR_LEN / MAX_PADDING_LEN) so a bogus varint length can't force
  unbounded buffering (memory DoS).
• Validate the auth handshake is POST /auth and 404 anything else, so an
  unrelated first request isn't treated as authentication.
• Add codec unit tests: full-frame decode, oversized-length rejection, and
  response encode/decode round-trip.

• style: nightly rustfmt for test imports

---

Co-authored-by: copilot-swe-agent[bot] 198982749+Copilot@users.noreply.github.com
Co-authored-by: Yuwei B contact@yba.dev by @Copilot

New Contributors ❤️

• @cedar-otter-47 made their first contribution in #1481
• @lakako made their first contribution in #1475

Full Changelog: Watfaq-legacy/clash-rs@v0.10.7...v0.10.8

v0.10.7

🚀 Features

• Make all user configs statically typed in def.rs (#1436) by @Copilot
• Silently ignore unknown top-level/dns config fields; add --strict-config (#1452) by @Copilot

🐛 Bug Fixes

• Remove v6 dns config from wintun (#1437) by @spongebob888
• (socket) Skip SO_BINDTODEVICE on Android (#1442) by @masike0609
• Skip interface binding for loopback destinations (#1445) by @Copilot

🚜 Refactor

• (tuic) Use tuic-core re-exported quinn (#1429) by @Itsusinn
• Remove docker requirement of tuic (#1345) by @Itsusinn

🛠️ Builds

• Upgrade tuic-core to v1.8.4 (#1431) by @Itsusinn
• (deps) Bump the rust-dependencies group with 23 updates (#1448) by @dependabot[bot]
• (deps) Bump the npm-dependencies group in /clash-dashboard with 15 updates (#1447) by @dependabot[bot]
• (deps) Bump qs from 6.15.1 to 6.15.2 in /clash-dashboard (#1441) by @dependabot[bot]
• (deps) Bump brace-expansion from 5.0.5 to 5.0.6 in /clash-dashboard (#1430) by @dependabot[bot]
• (deps) Bump hono from 4.12.18 to 4.12.26 in /clash-dashboard (#1456) by @dependabot[bot]
• (deps-dev) Bump vite from 8.0.15 to 8.0.16 in /clash-dashboard (#1455) by @dependabot[bot]
• (deps) Bump js-yaml from 4.1.1 to 4.2.0 in /clash-dashboard (#1459) by @dependabot[bot]

⚙️ Miscellaneous Tasks

• Handle cache service rate limits (429) with exponential backoff (#1432) by @Itsusinn
• Bump workflows to v1.0.35, enable sccache & cross-rs integration (#1443) by @Itsusinn
• Bump version to v0.10.7 by @github-actions[bot]

Other

• Reject unknown config fields during deserialization (#1440) by @Copilot
• Handle wildcard CORS origins without panicking (#1458)

• Initial plan

• Handle wildcard CORS origins

• Warn on mixed wildcard CORS origins

• Polish wildcard CORS regression test

---

Co-authored-by: copilot-swe-agent[bot] 198982749+Copilot@users.noreply.github.com by @Copilot

New Contributors ❤️

• @masike0609 made their first contribution in #1442

Full Changelog: Watfaq-legacy/clash-rs@v0.10.6...v0.10.7

v0.10.6

🚀 Features

• (dashboard) Persist dashboard API secret across browser sessions for LAN deployments (#1409) by @Copilot
• (dns) Add respect-rules to route upstream DNS via the rule engine (#1427) by @ibigbug
• MTLS (mutual TLS) support for outbound proxies (#1424) by @Copilot

🐛 Bug Fixes

• Upgrade smoltcp to 0.13.1 to fix TCP sequence number underflow panic (#1406) by @ibigbug
• Timeout on hyper handshake and consolidate proxy state writes (#1404) by @xmh0511
• Shadowquic udp proxy (#1412) by @spongebob888
• (dns) DNS client rebuild resilience (#1410) by @xiguagua
• (tun) Bind interface on windows not valid for dualstack (#1413) by @spongebob888
• (dns) Skip caching NXDomain, ServFail, and all-unspecified responses (#1414) by @xiguagua
• Warn on proxy parse failure, harden group handlers against empty providers (#1420) by @Copilot
• (vless) CMD_PADDING_END must not trigger XTLS splice (#1417) by @Copilot
• (api) Store startup config path, fix dashboard reload (#1421) by @Copilot

🚜 Refactor

• Remove outer RwLock from ThreadSafeProxyProvider (#1407) by @ibigbug

⚙️ Miscellaneous Tasks

• Bump version to v0.10.6 by @github-actions[bot]

Other

• Guard tproxy UDP GRO chunking when stride is zero (#1416) by @Copilot

New Contributors ❤️

• @xmh0511 made their first contribution in #1404

Full Changelog: Watfaq-legacy/clash-rs@v0.10.5...v0.10.6

v0.10.5

🐛 Bug Fixes

• Remove ring from aws-lc-rs code path (~500KB-1MB binary savings) (#1397) by @ibigbug
• Tuic IPV6 rebind (#1398) by @Itsusinn
• (socket) Bind dual-stack UDP socket when interface is set (fixes Windows WSAEINVAL #1399) (#1401) by @ibigbug

🚜 Refactor

• Migrate hickory-client to hickory-net (#1396) by @ibigbug

⚙️ Miscellaneous Tasks

• Bump version to v0.10.5 by @github-actions[bot]

Full Changelog: Watfaq-legacy/clash-rs@v0.10.4...v0.10.5

v0.10.4

🐛 Bug Fixes

• Use child_token() instead of clone() for reload API server cancellation token (#1385) by @xiguagua
• (tun) Survive Wintun ring-buffer-full; make TcpStream notifications best-effort (#1383) by @Copilot
• (DNS) LRU cache to ensure entries are read back properly (#1389) by @codex
• (dispatcher) Canonicalize IPv4-mapped IPv6 UDP source to prevent EAFNOSUPPORT (#1391) by @ibigbug
• (ss-inbound) Canonicalize UDP src before storing control entry (#1392) by @ibigbug

🚜 Refactor

• refactor!: consolidate rustls forks via [patch.crates-io] (#1395) by @ibigbug

🛠️ Builds

• (deps) Bump fast-uri from 3.1.0 to 3.1.2 in /clash-dashboard (#1384) by @dependabot[bot]
• (deps) Bump the rust-dependencies group with 13 updates (#1377) by @dependabot[bot]

⚙️ Miscellaneous Tasks

• Bump version to v0.10.4 by @github-actions[bot]

New Contributors ❤️

• @codex made their first contribution in #1389

Full Changelog: Watfaq-legacy/clash-rs@v0.10.3...v0.10.4

v0.10.3

🚀 Features

• Netflow-like flows dashboard (#1357) by @ibigbug
• (dashboard) New proxies page and nav restructure (#1362) by @ibigbug
• (dashboard) Flows page improvements (#1361) by @ibigbug
• Expose commit SHA in /version API + update agent instructions (#1367) by @ibigbug
• (dashboard) Dark mode, theme toggle, test refresh fixes, group latency, batch test, rule match (#1368) by @ibigbug

🐛 Bug Fixes

• (api) Exempt /ui from secret authentication (#1359) by @ibigbug
• (dashboard) Use correct bulk endpoints for proxy latency tests (#1360) by @ibigbug
• UDP direct DNS failure causes panic ("JoinHandle polled after completion") (#1364) by @Copilot
• (dashboard) Group latency, provider healthcheck, rule provider API (#1365) by @ibigbug
• (dashboard) Widen navbar to prevent scroll (#1369) by @ibigbug
• Pin docker-publish workflow back to v1.0.12 (#1380) by @ibigbug

⚡ Performance

• Fix WebSocket data duplication, cache TLS connector, add TCP_NODELAY, fix H2 flow control (#1378) by @Copilot

🧪 Testing

• Run api_tests in parallel with dynamic port allocation (#1354) by @ibigbug

🛠️ Builds

• (deps) Bump the actions-dependencies group with 3 updates (#1355) by @dependabot[bot]
• (deps) Bump the rust-dependencies group with 32 updates (#1356) by @dependabot[bot]
• (deps) Bump ip-address and express-rate-limit in /clash-dashboard (#1370) by @dependabot[bot]
• (deps) Bump the npm-dependencies group in /clash-dashboard with 11 updates (#1376) by @dependabot[bot]
• (deps) Bump hickory-net from 0.26.0 to 0.26.1 (#1372) by @dependabot[bot]
• (deps) Bump hickory-proto from 0.26.0 to 0.26.1 (#1373) by @dependabot[bot]
• (deps) Bump hono from 4.12.15 to 4.12.18 in /clash-dashboard (#1371) by @dependabot[bot]

⚙️ Miscellaneous Tasks

• Reduce release binary size with line-tables-only debug info (#1366) by @ibigbug
• Add npm ecosystem to dependabot.yaml (#1375) by @Copilot
• Bump version to v0.10.3 by @github-actions[bot]
• Bump rust-proxy/workflows to v1.0.13 (#1379) by @ibigbug

Full Changelog: Watfaq-legacy/clash-rs@v0.10.2...v0.10.3

v0.10.2

🚀 Features

• Add AnyTLS inbound listener with multi-user support (#1349) by @ibigbug

🐛 Bug Fixes

• (udp) Full cone NAT — correct domain→orig_dest attribution for UDP sessions (#1346) by @claude

🚜 Refactor

• (clash-lib) Reduce nesting with if-let chains and guard clauses (#1350) by @Itsusinn

🛠️ Builds

• Install Node 20 in cross containers for dashboard build (#1352) by @ibigbug

⚙️ Miscellaneous Tasks

• Bump version to v0.10.2 by @github-actions[bot]

New Contributors ❤️

• @claude made their first contribution in #1346

Full Changelog: Watfaq-legacy/clash-rs@v0.10.1...v0.10.2

v0.10.1

🚀 Features

• (dns) Support proxy-server-nameserver (#1002) by @Itsusinn
• E2e throughput tests for SS outbound + transport Poll::Pending bug fixes (#1332) by @ibigbug
• API improvements - config reload, rule providers, log stability (#1343) by @ibigbug
• (test) E2e throughput tests for all proxy protocols (#1337) by @ibigbug
• Built-in web dashboard (#1342) by @ibigbug

🐛 Bug Fixes

• Rename user_hosts to use_hosts in DNS config (#1324) by @ibigbug
• (controller) Incorrect latency of groups (#1007) by @Itsusinn
• Ss2022 throughput, simple-obfs TLS state machine, MMDB path (#1330) by @ibigbug
• Verge compatibility part 2 (#1339) by @Itsusinn
• Verger compatibility part 3 (#1344) by @Itsusinn

🚜 Refactor

• (test) Run all docker integration tests in parallel (#1335) by @ibigbug

📚 Documentation

• (config) Audit test configs and add full.yaml reference (#1338) by @ibigbug
• README protocol support tables + built-in dashboard mention (#1340) by @ibigbug

🛠️ Builds

• (deps) Bump russh from 0.60.0 to 0.60.1 (#1329) by @dependabot[bot]

⚙️ Miscellaneous Tasks

• Bump version to v0.10.1 by @github-actions[bot]

Other

• Full endpoint coverage, mode PATCH bug fix, group delay off-by-one, provider delay serialization (#1328) by @Copilot

Full Changelog: Watfaq-legacy/clash-rs@v0.10.0...v0.10.1

v0.10.0

🚀 Features

• (anytls) Add dedicated AnyTLS outbound with native TCP/UDP and robust datagram framing (#1317) by @Copilot
• (tailscale) Add embedded tailscale-rs outbound with TCP and UDP support (#1315) by @Copilot

🐛 Bug Fixes

• (dispatcher) Canonicalize IPv4-mapped IPv6 UDP dst to prevent EINVAL on bind (#1312) by @ibigbug
• (ss-inbound) Propagate user key and client_session_id for multi-user SS2022 UDP responses (#1313) by @ibigbug
• Compat mode (#1319) by @Itsusinn
• field and centralize common proxy API fields for 0.9.7 client compatibility (#1321) by @Copilot
• Tun reliability (#1322) by @ibigbug

📚 Documentation

• Update copilot-instructions.md by @ibigbug
• Update readme (#1323) by @ibigbug

⚙️ Miscellaneous Tasks

• Bump version to v0.10.0 by @github-actions[bot]

Full Changelog: Watfaq-legacy/clash-rs@v0.9.7...v0.10.0