v2.0.1

What's Changed

• Stats: target site traffic, tracked per client and for the whole panel, with a table on the dashboard and in the client stats drawer (#270) @mengxia0831
• Basics: a Debug block under Experimental for sing-box's pprof listen address, memory_limit and gc_percent
• Notifications: clients are named "name (description)" in Telegram, webhook, SMTP and bot messages, and the bot's search matches descriptions
• Subscriptions: a subRemarkPrefix setting to leave the client remark out of node names (#282)
• Subscriptions: realm-aware Hysteria2 subscriptions (#282)
• Security: frame-ancestors, X-Frame-Options, nosniff and Referrer-Policy headers on the panel (#282)
• Security: s-ui.sh installs and updates from release tags instead of the main branch, and install.sh refuses an archive it cannot verify (#282)

Bug Fixes

• Fix saving clients, editing inbounds and starting the core failing with "malformed JSON" on newer SQLite (#274)
• Fix the Inbounds field of a client disappearing after its only inbound was deleted (#273)
• Fix routed connections losing sing-box's fast copy path while traffic history was on (#281)
• Fix failed key generation being saved as a key or certificate
• Fix self-signed TLS and ECH being generated without a usable SNI
• Fix a bad debug value in the base config leaving the core down after saving
• Fix control characters in the subscription Profile-Title header (#282)
• Fix the admin password being echoed and unquoted in set_admin and the installer (#282)

Chores

• Update to sing-box 1.14.4 and Go 1.27.3
• Docker images take libcronet from the version pinned in go.mod (#282)
• Update Go dependencies (#271, #276)
• Update frontend dependencies (#272, #278)
• Update docker/login-action (#263)

Full Changelog: v1.9.3...v2.0.1

Reports