v0.95.0_rc2

[0.95.0_rc2] - 15092026

Proxy URI Parsing

• VLESS and VMess HTTP transports: type=tcp&headerType=http now produces Mihomo HTTP transport with http-opts; type=http produces H2 transport with h2-opts. Link path and host are passed to the matching transport options, and method is passed to http-opts when present.
• Certificate pinning: VLESS, VMess, and Trojan links now accept pcs as an alias for pinSHA256 and fingerprint.
• Reality ML-KEM: VLESS and VMess links emit support-x25519mlkem768 only when a Reality public key is present. Trojan links no longer emit this option.
• Parser state: Shared host-and-port parsing now returns its result to each protocol parser instead of writing global variables, including for bracketed IPv6 hosts.

Defaults & Configuration

• Mihomo core source: Fresh installations, configuration resets, and the standalone installer now use the slim kernel version by default. LuCI also offers the upstream repository as a preset and accepts custom username/repo entries. Existing repository selections remain unchanged on upgrade.

Logging

• Service logs: JustClash and piped Mihomo messages now use the OpenWrt system log only. The separate runtime log file is no longer written; the CLI and RPC log commands read system-log entries.

v0.95.0_rc1

[0.95.0_rc1] - 10092026

Features & Enhancements

• Unified traffic interception: A single Create nftables switch now enables interception for both client devices and traffic generated by the router. Client and router exclusions remain independently configurable.
• Reliable DNS recovery: JustClash now remembers the DNS settings it actually changed and restores that saved state before applying a new configuration. DNS recovery also works after DNS management is disabled or its listening port is changed.
• DNS restoration: Each JustClash DNS apply configures Mihomo as the only upstream. DNS servers added manually afterwards are preserved when JustClash restores the previous dnsmasq configuration.
• Mixed Port authentication: Fresh installations and configuration resets now create a default user with a random 64-character password. Existing installations keep their current authentication settings.
• Command-line interface: Commands are now grouped by purpose for resources, schedules, logs, versions, diagnostics, and configuration. Arguments are validated more strictly, and destructive actions require confirmation.
• RPC API: Diagnostics, hardware identity, configuration display, and resource updates now use a smaller, consistent set of methods. The RPC service is included with the main JustClash package, including installations without LuCI, and is reloaded automatically after package changes.
• LuCI JSON proxies: Object mode now accepts either one proxy object or an array containing exactly one proxy object and removes the array wrapper when saving. A new Add in bulk toolbar action imports an array into separate unsaved proxy entries for review before the configuration is saved or applied.

Security & Reliability

• Core downloads: HTTP errors, damaged archives, decompression failures, storage errors, and permission failures now stop an update instead of leaving an invalid file marked as executable.
• Installer checks: The standalone installer now uses the same strict download and archive checks while retaining checksum verification.
• DNS recovery: If the previous DNS configuration cannot be restored safely, JustClash stops before applying new DNS settings and preserves the saved state for manual recovery.
• Startup checks: JustClash now verifies all required routing, port-inspection, process-management, and archive tools before starting.
• Safer maintenance commands: Core removal and configuration reset prompt for confirmation; unattended scripts must confirm explicitly.
• Safer logs: Unsupported or invalid proxy links are identified by proxy name without writing the full link, which may contain credentials, to the service log.
• Service exit status: Startup and shutdown now report DNS restoration and core-stop failures instead of returning success after incomplete cleanup.

Bug Fixes

• Router traffic: Fixed configurations where router interception was enabled without the complete transparent-proxy and policy-routing path.
• IPv6 partial routing: Fixed interception of IPv6 Fake-IP traffic, destinations, and source networks for both clients and the router in partial routing mode.
• IP blocklists: Text-based IP blocklists are now included in partial interception, allowing their block actions to take effect.
• Local rulesets: Fixed local ruleset files being rejected after they were selected in routing or blocking settings.
• Provider identity spoofing: Fixed spoofed identity mode exposing real router information when custom fields were empty. Hardware ID, operating system, operating-system version, and device model can now be configured independently.
• Mixed Port: A saved but disabled Mixed Port no longer causes false port-conflict errors.
• Proxy group checks: LuCI and the backend now use the same health-check interval setting.
• VMess links: LuCI now accepts VMess links already supported by the backend.
• IPv6 proxy links: VMess, VLESS, Trojan, Hysteria2, SOCKS5, and Shadowsocks links preserve bracketed IPv6 server addresses. Ambiguous unbracketed IPv6 addresses are rejected with an error.
• Shadowsocks links: Fixed a parsing error that could make valid Shadowsocks nodes disappear.
• Generated configuration: Escaped backslashes and control sequences are preserved instead of being interpreted a second time while JSON is assembled.
• URI parsing: Temporary parser state no longer leaks from one parsed link into later operations.
• Diagnostics: Failed ping checks now return a failure status instead of appearing successful because logging completed.
• Time synchronization: LuCI now treats a missing time-synchronization setting as disabled, matching the existing service and reset defaults.
• Connection display: Mihomo connections with the Inner type are now shown as internal endpoints rather than ordinary address-and-port pairs.
• LuCI rendering: Fixed minor style-ordering issues on the rules, realtime log, and service log pages.
• LuCI proxy objects: Raw proxy objects are validated according to their Mihomo type, including WireGuard's simplified and multi-peer forms, endpointless proxy types, and Mieru port ranges.
• LuCI status: The status page no longer waits for Mihomo controller timeouts or opens monitoring sockets while the service is stopped.

Defaults & Configuration

• Firewall actions: The Reject choice was removed from QUIC, DoT, DoH, and DoQ firewall settings. Existing values are migrated to Drop. Mihomo routing and blocklist actions named REJECT are unchanged.
• IPv6 validation: An IPv6 Fake-IP range is now required when IPv6 interception is enabled.
• Direct proxy links: Generated direct proxy entries no longer enable TCP Fast Open automatically.
• User-Agent presets: The bundled desktop browser identity list has been refreshed, and fixed browser-version presets were removed from LuCI. Custom values remain supported.

Packaging, Migration & Documentation

• Automatic migration: The retired router-specific nftables switch is removed while the existing Create nftables value is preserved. If that remaining switch was enabled, it now covers both clients and the router.
• DNS backup migration: Complete dnsmasq backups created by earlier JustClash versions are restored and removed automatically when their active settings still match the legacy applied state; ambiguous or externally modified states remain untouched for manual recovery.
• Package dependencies: The main package and container build definitions now include the RPC service dependency, preventing incomplete backend installations.
• RPC package compatibility: The main package installs its RPC helper under the separate justclash-core object name, so it can coexist with the helper shipped by older LuCI packages during upgrades.
• CI and formatting: Automated checks now cover the current RPC location and the configuration migration script.
• Maintenance: Duplicate download paths, small one-purpose modules, and unnecessary wrappers were consolidated to reduce maintenance overhead without changing user configuration.
• Documentation: Updated the quick start, routing, DNS, rulesets, blocking, Mixed Port, security, updates, removal, command-line, configuration, and RPC documentation. LuCI translations were synchronized.
• Version: Both JustClash packages are now version 0.95.0_rc1.

Upgrade Notes

• No configuration reset is required. Existing settings are migrated automatically.
• Review router interception. If the former client Create nftables switch was enabled, it now enables interception for both clients and the router. A router-only legacy setting is not carried forward; review the unified switch and router exclusions before restarting.
• Review firewall actions. Restoring an older configuration backup may reintroduce retired Reject values; replace them with Drop in the four firewall settings.
• Review Mixed Port authentication. Existing credentials are intentionally unchanged. Generated credentials appear only on a fresh installation or after configuration reset.
• Update scripts and integrations. Scripts using the former flat command names and third-party clients using old RPC methods must be updated. See info/13_ubus-api.md for the current interface.
• Refresh LuCI in the browser after upgrading so updated pages and translations replace cached assets.

v0.92.0

[0.92.0] - 30082026

Features & Enhancements

• DNS enforcement: Added configurable handling for external client UDP DNS traffic with By rules, Drop, and Hijack modes. Hijack redirects requests to the router DNS service for both IPv4 and IPv6 while preserving router-local, private-network, excluded-interface, excluded-client, and excluded-port traffic.
• LuCI / DNS: Moved Mihomo DNS configuration out of the Proxy page into a dedicated top-level DNS page and navigation entry, keeping DNS settings easier to find and maintain.
• LuCI / Controller: Added an explicit unspecified controller-bind state for listening on all IPv4 interfaces while retaining logical-network selection for restricted access.
• Logging: Added a private runtime log at /tmp/justclash/justclash.log with directory ownership, symlink, and permission checks while continuing to mirror messages to OpenWrt syslog. The separate file preserves JustClash and Mihomo history during long uptimes within the current boot when OpenWrt logd evicts older entries from its bounded ring buffer.
• LuCI / Logs: Renamed System logs to Service logs, switched the page to the dedicated JustClash/Mihomo runtime log, and increased page retrieval from the CLI default of 40 to the most recent 400 lines.
• CLI / Logs: Split logs (log, l) for the dedicated runtime file from systemlogs for filtered OpenWrt syslog output, with an optional line-count argument for both commands.
• Routing UX: Added dynamic proxy, proxy-group, and provider choices to proxy-group editors and excluded the group currently being edited to prevent accidental self-references.
• YAML generation: Added multi-value support for repeated hosts and nameserver-policy matchers, deduplicating values and emitting valid arrays instead of overwriting earlier entries.
• YAML cache: Expanded regeneration tracking to include the generator revision, resolved controller address, dashboard URL settings, and built-in and user ruleset file contents, preventing stale YAML reuse after package or ruleset updates.

Security & Reliability

• Controller exposure: Invalid controller networks and selected networks without an IPv4 address now abort startup instead of silently exposing the API controller on every interface. Listening on all interfaces requires the explicit unspecified value.
• Controller regeneration: Refreshed network state before resolving the controller bind address and included that address in the runtime configuration hash, so the next service start or reload regenerates YAML after an address change instead of reusing a stale bind address.
• Custom rulesets: Strengthened location validation with length limits, control-character rejection, credential-free HTTP(S) URLs, safe absolute local paths, and file extensions appropriate for domain or IP-CIDR rulesets.
• Custom rulesets: Added length and control-character validation for Authorization values and normalized editable fields before validating and saving them.
• Custom rulesets: Replaced parallel two-file writes with sequential writes backed by both original files; a failed save now restores previous content and reports an incomplete rollback separately.
• Startup checks: Removed the option to skip environment checks so compatibility fixes and non-critical conflict detection always run before service startup.
• Core updates: Unsupported OpenWrt architectures now fail explicitly instead of falling back to an AMD64 download, and architecture validation happens before an existing Mihomo binary is removed.
• Installer: Applied the same strict architecture detection to the maintenance installer and update workflow.
• Downloads: Consolidated curl invocation and added an explicit option terminator so download URLs cannot be interpreted as command-line options.
• API TLS: Moved default controller certificate and key locations into the package-owned configuration directory and updated migration defaults accordingly.

Bug Fixes

• Routing: Removed the invalid no-resolve suffix from generated SRC-IP-CIDR rules so source-address routing is emitted in Mihomo-compatible form.
• Controller bind: Corrected the unspecified-network sentinel so it intentionally generates an all-IPv4 bind address instead of failing interface lookup.
• Firewall bypasses: Extended both full and partial interception paths with explicit bypasses for router-local destinations and private IPv6 ranges so this traffic does not fall through to TProxy processing. Private IPv4 ranges were already bypassed.
• YAML formatting: Fixed proxy-group indentation to match the surrounding generated document.
• LuCI / CIDR: Aligned the client bypass validator with its description by accepting either an IPv4 address or an IPv4 CIDR subnet.
• LuCI / Filters: Stopped splitting and compiling filter expressions on |, which is a valid regular-expression operator; validation now enforces only a length limit and rejects control characters.
• LuCI / Cron: Clarified that scheduled tasks accept a simple five-field cron form with only * or one numeric value per field, matching the implemented validator.
• LuCI / Geodata: Replaced copied descriptions with separate proxy, proxy-group, and block explanations and corrected the geodata auto-update description.
• LuCI / Clipboard: Localized connection summaries and switched byte formatting to IEC units that match the formatter's base-1024 calculations.
• LuCI / Text: Corrected built-in, GitHub, and dashboard naming; removed a duplicate sniffer CSS selector; and replaced a dynamically constructed gettext key with extractable preset labels.
• LuCI / Presets: Made numeric preset values visible alongside readable units and localized log-level choices without changing the stored values.
• Logging: Updated realtime-log level handling for localized option objects and kept file and syslog severity labels consistent.

Defaults & Configuration

• DNS defaults: Expanded bootstrap host records to retain multiple resolver addresses for one matcher and aligned DNS cache and Fake-IP defaults between UCI, runtime fallbacks, and LuCI.
• DNS policy: Expanded and reorganized resolver policies for Russian public, government, regulated, payment, fiscal, POS, and media services without exposing individual entries in release notes.
• Compatibility lists: Expanded and sorted Fake-IP and sniffer compatibility exclusions, mirrored applicable resolver-policy services into sniffer exclusions, and removed NTP/time entries from sniffer where protocol sniffing cannot use them.
• Runtime defaults: Changed the new-install defaults to a DNS cache size of 4096 entries, Fake-IP TTL of 10 seconds, GOGC=50, 15-second keep-alive idle time, and a 60-minute core NTP interval.
• Update defaults: Changed the default built-in ruleset refresh interval to 48 hours, geodata refresh interval to 24 hours, and delayed-start preset to 10 seconds.
• User-Agent: Refreshed the bundled desktop browser User-Agent snapshot and changed array construction so the random selector cannot target uninitialized entries.
• Translations: Rebuilt and cleaned the Russian, Simplified Chinese, and gettext template catalogs, including previously fuzzy or untranslated UI strings.

Packaging, Migration & Documentation

• Dependencies: Added the nftables NAT and FIB kernel modules required by DNS hijacking and local-destination checks to package and container-build dependencies.
• Conflicts: Declared Forkop service and LuCI packages as conflicts with JustClash transparent routing.
• Post-install: Removed duplicate legacy API-password randomization while preserving placeholder-based password generation through the shared configuration reset module for installation and migration.
• Migration: Added the UDP DNS mode with a safe By rules default, removed the deprecated environment-check bypass, and supplied package-owned TLS paths when those options are missing.
• Documentation: Updated routing, ruleset, UCI, CLI, security, log-page, installation, and upgrade documentation for the new DNS, controller, logging, and generated-YAML cache behavior.

Upgrade Notes

• Configuration: No UCI reset is required. Migration adds missing options and removes only the deprecated environment-check bypass; existing user-selected runtime values remain unchanged.
• Controller: Verify the selected controller network before upgrading. A missing or address-less selected network now blocks startup rather than broadening API exposure; choose the unspecified option only when listening on every IPv4 interface is intentional.
• Firewall: DNS hijack requires the newly declared nftables NAT and FIB dependencies. Package managers should install them automatically with the service package.
• LuCI: A browser hard refresh is recommended after upgrading because DNS navigation, translated labels, and the logs page changed.

v0.90.13_rc4

[0.90.13_rc4] - 14082026

Features & Enhancements

• Partial routing: Added source-address interception for manual per-proxy and proxy-group source CIDR rules, with dedicated IPv4 and IPv6 nftables sets populated from a generated source-IP cache.
• LuCI / Routing: Extended manual source and destination CIDR fields to accept both IPv4 and IPv6 networks and updated their labels, descriptions, and validation accordingly.
• LuCI / Service: Restored the Enable on boot / Disable on boot action on the Status page through dedicated RPC methods protected by the JustClash write ACL.

Bug Fixes

• LuCI / Nodes: Applied Mihomo mode changes consistently by normalizing mode values, suppressing duplicate change requests, closing existing connections after a successful switch, and refreshing node state.
• LuCI / Realtime logs: Prevented redundant log-stream reconnections and resets when the selected log level is empty or unchanged.

Refactoring & Maintenance

• Runtime: Added an atomically promoted, sorted, and deduplicated source-IP sidecar cache and included it in generated-workdir cache validation and nftables cold-start population.
• Translations: Synchronized Russian, Simplified Chinese, and template catalogs for the new routing and service controls.

Upgrade Notes

• Configuration: No UCI migration or configuration reset is required. The new source-IP runtime cache is generated automatically when the service configuration is rebuilt.
• LuCI: A browser hard refresh is recommended after upgrading to load the updated interface assets.

v0.90.13_rc3

[0.90.13_rc3] - 07082026

Features & Enhancements

• LuCI / Configuration: Restored Show Mihomo config and Show service config actions on the Status page.
• LuCI / Configuration: Added redacted configuration previews with Copy JSON, plus an explicit Copy JSON unsafe action that fetches the unredacted configuration only when requested and copies it without rendering it in the dialog.
• RPC / ACL: Added dedicated safe and unsafe configuration-dump RPC methods; redacted methods are available through the read ACL, while unredacted methods require the JustClash write ACL.
• Installer: Restricted release downloads to the expected JustClash service, LuCI, and selected translation packages instead of treating every release asset as installable.

Bug Fixes

• LuCI / Proxy providers: Fixed the provider delay-test button by using Mihomo's provider-specific per-proxy health-check endpoint and filtering out proxy types that cannot be tested.
• Installer: Fixed English/no-translation selection, propagated package download failures, and avoided continuing into installation after an incomplete download.
• Service: Replaced ambiguous proxy-provider name/subscription validation with an explicit condition and documented callback-only helper functions for ShellCheck.

Refactoring & Maintenance

• URI: Renamed the generic simple_proxy parser module to socks5 while preserving SOCKS/SOCKS5 URI behavior.
• Translations: Synchronized Russian, Simplified Chinese, and template catalogs for the restored configuration actions and unsafe-copy label.

Security & Upgrade Notes

• Unsafe config copy: The unredacted JSON may contain credentials and other secrets. It is restricted to the write ACL and is retrieved only after the explicit Copy JSON unsafe action.
• Upgrade: No UCI migration or configuration reset is required for these changes. A browser hard refresh is recommended after upgrading LuCI assets.

v0.90.13_rc2

[0.90.13_rc2] - 31072026

Features & Enhancements

• CI/CD: Pinned all GitHub Actions to full 40-character commit SHAs in release.yml for supply chain security (Second try).
• CI/CD: Added automated SHA256SUMS checksum generation for published .ipk and .apk release assets.
• Mihomo: Enhanced lib/nodes.js proxy normalization to merge provider nodes following upstream Mihomo /proxies API changes.
• LuCI: Restored the dedicated System logs (logread) view in pages/system_logs.js and reinstated its LuCI navigation menu item.
• RPC: Migrated system log retrieval to a native ubus RPC endpoint (justclash.systemlogs) with explicit rpcd exec plugin and ACL declarations.
• Config: Updated REST API password placeholder generation logic to ensure strong, unique credentials.

Bug Fixes

• LuCI: Fixed ReferenceError during connection list export in pages/connections.js by invoking connectionsModel.matchesFilters.
• LuCI: Fixed filtered rows copying and resolved ACL permissions for ubus/rpcd calls.
• LuCI: Fixed "Unknown nodes" info rendering following Mihomo core v1.19.28 API updates.
• Service: Refactored config_reset routine to guarantee proper configuration resets and clean fallback defaults.
• Docs: Updated OpenWrt version compatibility statements in README.md to explicitly declare support for both OpenWrt 25.x (APK) and OpenWrt 24.x (IPK).

Refactoring & Code Quality

• Architecture: Standardized domain function prefixing across all shell modules (str_*, sysinfo_*, val_*, file_*, fmt_*, preflight_*, core_*, _dnsmasq_*, nft_*, uri_*, user_agent_*, ntpd_*) to eliminate global function namespace pollution in BusyBox ash.
• Linting: Consolidated repetitive # shellcheck disable= directives across justclash.sh, helpers.sh, config.sh, and strings.sh.
• Translations: Synchronized translation catalogs (ru, zh_Hans) for System logs, RPC, and UI updates.

v0.90.13_rc1

[0.90.13_rc1] - 29072026

Features & Enhancements

• IPv6: Added end-to-end optional IPv6 support across DNS, Fake-IP, policy routing, TProxy interception, nftables sets, static IPs, and IP-CIDR rulesets.
• IPv6: Added IPv6-aware DNS validation and configuration controls, including a dedicated Fake-IP range and IPv4/IPv6 ruleset population.
• Routing: Added per-proxy, proxy-group, and proxy-provider IP version selection together with interface and routing-mark overrides.
• Routing: Changed the default routing mode from full interception to partial interception for new installations.
• URI: Added VMess URI support and substantially expanded Shadowsocks, Trojan, VLESS, Hysteria2, and plugin option compatibility with upstream parser behavior.
• URI: Added support for additional transports and TLS extensions, including WebSocket, gRPC, HTTP upgrade, Reality, ShadowTLS, ReTLS, JLS, ALPN, fingerprints, and packet encoding options.
• Headers: Added dynamic User-Agent presets for random popular browsers, JustClash, and Mihomo, plus real or spoofed provider HWID headers.
• Runtime: Added configurable GOMEMLIMIT, GOGC, and GOMAXPROCS controls for balancing router memory and CPU usage.
• Runtime: Raised the service process priority and improved startup environment variable naming and propagation through procd.
• API: Allowed local loopback clients to bypass mixed-port authentication while preserving authentication for remote clients.
• LuCI: Added IPv6 service, DNS, Fake-IP, outbound, group, and provider controls with client-side validation.
• LuCI: Redesigned status, connections, nodes, routing, rules, rulesets, and log views with responsive layouts and consistent styling.
• LuCI: Added connection detail export, provider traffic and expiry information, manual provider updates, WebSocket-backed live data, and clearer status summaries.
• LuCI: Added kernel tuning controls and standardized interval, timeout, cache, and memory presets.
• LuCI: Changed the default ruleset update interval to 24 hours.
• Release: Added _rcN prerelease tag support to the release workflow while keeping package versions synchronized with tags.
• Installer: Replaced release-channel discovery with exact release selection through --custom_version, avoiding the need to download and process the full release list.
• Service: Added the synthetic direct:// outbound parser as an isolated virtual_direct URI module.
• LuCI: Added a dedicated Override group for proxy-provider options and made the Mihomo User-Agent preset the default.
• LuCI: Renamed status actions to clearly distinguish active ruleset updates from built-in data updates.

Bug Fixes

• IPv6: Replaced the default ULA Fake-IP6 pool with the dedicated IPv6 benchmarking prefix to avoid dnsmasq rebind filtering and client routing failures.
• URI: Fixed dialer-proxy propagation for direct outbound links and aligned parser edge cases with supported Mihomo fields.
• Firewall: Fixed IPv6 nftables and policy-routing handling and simplified TProxy rule generation for dual-stack operation.
• Diagnostics: Expanded secret redaction for generated YAML and UCI output while preserving non-secret DNS diagnostics.
• Service: Prevented maintenance-only scheduling and update settings from unnecessarily invalidating the generated runtime configuration.

Refactoring

• Service: Replaced the legacy top-level TProxy port with explicit IPv4 and IPv6 listeners and simplified the associated nftables integration.
• Service: Simplified command dispatch, added the proxy-add command entry point, and removed obsolete standalone cron-management CLI commands.
• Service: Consolidated runtime variable naming, IPv6 resolver handling, diagnostic output, ruleset caches, and generated configuration buffers.
• Service: Split the main shell controller into focused configuration, runtime, YAML, URI, compatibility, and helper modules with shared constants and explicit entry points.
• LuCI: Reorganized views into pages, reusable lib, and backend api modules, reducing page-level coupling and duplicated lifecycle logic.
• LuCI: Centralized realtime and system log normalization, row creation, and bounded buffering in a shared log helper.

Packaging, Migration & Documentation

• Packaging: Added certificate bundle and timezone data dependencies to containerized IPK and APK builds and installed the shared User-Agent module with the service package.
• Migration: Added upgrade handling for IPv6 defaults, kernel tuning options, provider header renames, and the new real/spoofed HWID modes.
• Translations: Updated Russian, Simplified Chinese, and translation template catalogs for the expanded LuCI interface.
• Docs: Updated routing, UCI, CLI, and installer documentation, including exact stable and release candidate selection.

v0.73.0

[0.73.0] - 10072026

Bug Fixes

• Service: Fixed missing SAFE_PATHS registration for user-defined local rulesets and API TLS keys when startup configuration regeneration is skipped.

Refactoring

• Service: Centralized safe path resolution into a single startup routine (core_prepare_safe_paths) that dynamically resolves paths from UCI configurations and user ruleset databases on startup, removing redundant directory resolution logic from ruleset compilation.
• LuCI: Cleaned up the main status page layout by commenting out redundant section titles and description texts.

v0.72.13

[0.72.13] - 07072026

Features & Enhancements

• Service: Added support for Partial Interception Mode (Partial Route), selectively redirecting only Fake-IP ranges and matched IP-CIDR rulesets to the proxy.
• Service: Implemented an event-driven ruleset synchronizer using inotifywait to monitor changes in the ruleset cache folder and dynamically stream IP updates to active nftables sets in under 1ms.
• Service: Added physical symlink resolution support to the ruleset monitor to ensure inotify correctly tracks updates when persistent flash rulesets are enabled.
• Service: Added script-level checking to prevent starting multiple duplicate instances of justclash.sh start and recursive termination of background monitoring processes on stop.
• LuCI: Redesigned the realtime logs and system logs pages to cap terminal heights at 65vh with scroll-lock prevention logic.
• LuCI: Added "Routing mode" selector (Full vs. Partial Interception) in service settings and restructured interface option dependencies for router-level traffic rules.
• Service: Updated default ruleset URLs in rulesets.txt and block.rulesets.txt to explicitly target the @main branch on jsdelivr CDN.
• Service: Added support for configuring custom DNS hosts maps (hosts UCI list) in the proxy configuration and pre-populated bootstrap mappings for major DNS providers.
• Docs: Updated internal documentation guides and README compatibility statements to explicitly guarantee support only for OpenWrt 25.x or newer.
• Docs: Deprecated the standalone direct_rules configuration section, consolidating all direct bypass routing rules under the standard DIRECT outbound in the Routing tab.
• Service: Suppressed ShellCheck linting warnings (SC2086 and SC2181) inside the main controller script to ensure 100% clean static analysis.
• Service: Fixed /etc/openwrt_release and /etc/os-release sourcing warnings (SC1091) inside the maintenance utility script.

v0.60.0

[0.60.0] - 27062026

Features & Enhancements

• Service: Added full support for AGE encryption (parsing keys and injecting headers into provider requests).
• Service: Added customizable GeoData database download source URLs and options.
• Service: Added a scheduled start and stop feature governed by custom cron string configurations.
• Service: Refactored service start process: implemented validation check for port configurations and a dynamic waiting loop to check when busy ports become available.
• Service: Added package conflict resolution checks to automatically remove standard JSON processing tools before installing extended versions.
• Service: Rolled back per-section custom Fake-IP logic, removing obsolete parameters and introducing simplified global Fake-IP exclusions.
• Service: Added controlled Fake-IP generation logic based on excluded rulesets in the DNS configuration section.
• Service: Added default node fallback routing logic and controls for proxy groups.
• Service: Refactored and optimized request headers generation (supporting HWID, Authorization token, User-Agent, and AGE public keys).
• Service: Simplified temporary file and directory management in configuration generation.
• Service: Added base64 utility dependency validation to the required tools checks.
• Service: Optimized the diagnostic report viewer, adding detailed descriptions for other active DPI bypass tools.
• Helpers: Optimized list formatting in helpers to run completely in-memory without spawning subprocesses.
• URI: Optimized proxy link parsing by replacing external command subprocesses and forks with native shell string expansion methods.
• Logging: Aligned Mihomo log severity and facility levels directly with syslog priorities (user.info, user.warning, user.err, user.debug), formatting them to match the standard JustClash syslog style and enabling native LuCI status badge color mapping.
• Logging: Implemented a unified streaming pipeline log_piped supporting both logrus key-value formats (time="..." msg="...") and standard bracket formats (INFO[...]) for robust log parsing under any runtime mode.
• Logging: Added automatic error and warning keyword classification for fallback log lines.
• LuCI: Added user interface controls, input fields, and validation rules for AGE encryption keys.
• LuCI: Added new interface options for scheduled cron tasks (start, stop, and updates schedules).
• LuCI: Added input fields for custom GeoData database URLs in the service settings tab.
• LuCI: Added default node selection controls for proxy groups.
• LuCI: Added a group type selector for proxy group settings.
• LuCI: Redesigned the connections page layout: grouped control options on the left, changed test delay button color to green, and improved readability of the "Current" status badges.
• LuCI: Refactored main navigation tab positions and adjusted layout designs for consistency across screens.
• LuCI: Enhanced search logic and result matching filters on the rules tab.
• LuCI: Fixed mobile responsive layout rendering, aligning font sizes and visual elements for consistent viewing on mobile browsers.
• LuCI: Disabled inline editing for proxies, proxy providers, and proxy group names in routing tables to prevent accidental reference breaks.
• Makefile: Added zoneinfo-all dependency to ensure correct timezone and local time resolution inside the Go binary.
• Makefile: Corrected install filenames and file copy procedures.
• Migration: Added migrations to clean up reverted Fake-IP configurations and automatically remove obsolete UCI ruleset exclusions.
• Translations: Refactored translation scripts and updated Russian (ru) and Chinese (zh_Hans) translation files.
• Docs: Updated all documentation manuals, normalizing terminologies to refer to "generating" configurations rather than "compiling" them.

Bug Fixes

• Service: Fixed system log reading filters in diagnostics.
• Service: Fixed fake trigger checking logic for /etc/resolv.conf file changes.
• Service: Fixed incorrect exit behavior on nftables errors and resolved redundant firewall stop calls.
• Service: Resolved a "ruleset not found" warning message in configuration generation.
• InitD: Silenced console output verbosity during service stop commands.
• Makefile: Fixed /postrm post-removal script to ensure /tmp directories are cleaned up correctly.
• LuCI: Fixed a bug where a disabled state would get stuck in the nodes tab.
• LuCI: Fixed form input validators to properly allow empty/optional fields.
• LuCI: Fixed visibility conditional dependencies on the realtime logs page and preserved hidden GeoData/TLS configuration options on save.
• LuCI: Solved input validation bugs in the security tab.