* feat(tailscale): add global Tailscale tunnel, local MagicDNS resolution, and UI support for peer device, RTT, and config management * perf(tailscale): optimize Tailscale power efficiency and stability, scheduling WireGuard ticks on demand and improving UDP socket recreation * feat(masque): add MASQUE outbound proxy (H3 & H2 transport) with custom SNI/URI support, keepalive configuration, and logger gating * feat(tls): add TLS ClientHello fingerprinting support and profile selection UI * perf(network): optimize connection management for Mux, XHTTP, and Chain Sockets, supporting HTTP/2 graceful stream shutdown and resolving SOCKS5 UDP relay failures in chained proxy setups * fix(dns): restore Bonjour and DNS-SD service discovery over VPN, centralize query retry scheduling, and optimize IPv6 PTR local resolution * fix(ssh): avoid blocking multiplexed queues during handshake and correct UDPGW length calculations * fix(protocol): enhance Mieru user hints and Clash parsing, correct Hysteria 2 stream closure, fix AmneziaWG magic header processing, and guard OpenConnect config updates * perf(system): rewrite IPC message channel and encrypt status replies, fix WebKit runtime battery drain on iOS, unify HUD toasts, and add macOS/Catalyst certificate instructions * chore(i18n): clean up and merge localized strings in Localizable.strings Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(mieru): add support for Mieru traffic pattern obfuscation and fragmented timing * perf(tester): optimize concurrent url-test scheduling and interim updates for large groups * perf(tunnel): centralize DNS retry scheduling and add backoff retry for proxy binding * perf(udp): correct UDP rule rematch priority after DNS and centralize relay socket cleanup * perf(ssh): tune channel window adjustment * fix(udp): correct UDP rule rematch after DNS resolution * fix(rule): skip IP matching when IP is empty * fix(tuic): retry authenticate when QUIC cannot write immediately * fix(UI): fix table footer view layouts in macOS and QR scanner preview transitions Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(vless): enable compact stream buffers on iOS/tvOS to reduce concurrent memory usage * perf(tester): optimize group tester switch logic to compare current round results * perf(hysteria): stabilize upload pacing and congestion control for HYBBR * fix(dns): handle transient socket backpressure gracefully in DNS over QUIC/HTTP3 * fix(http3): fix egress write stalls and prevent assertions on HTTP/3 connections * fix(fallback): prevent application crash when falling back to string policy group placeholders * fix(xhttp): allow NSNumber values in options parsing to preserve numeric parameters Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(http): use dynamic browser User-Agent for HTTP2, HTTP3, and XHTTP requests * feat(clash): support parsing the port-range field in Clash proxy configurations * feat(config): support parsing xhttp transport options and nest them into obfsParam * refactor(rule): optimize QUIC traffic matching in logical rules by decoupling port constraints * perf(mieru): refine Mieru configuration parsing and URL import/export format * fix(tunnel): close local streams after terminal proxy responses and add handshake timeout * fix(ip): correct minimum length validation thresholds for IPv4 and IPv6 addresses * fix(mux): centralize stream removal on remote disconnect to fix HTTP/2 leaks Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(mieru): add support for Mieru protocol and its reliable UDP transport mode * refactor(ech): refine ECH mode detection and validate configurations * perf(widget): simplify Control Center widget status checking and toggle logic * fix(backend): fix parameter truncation error when parsing WebSocket Early Data paths Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* fix(tls): refine ECH mode detection and validate configurations * perf(vless): release vless vision after padding passthrough Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* fix(vless/xtls): resolve issues in handshake, partial data, read-flush, and non-ENC XTLS path * fix(xhttp): omit Session ID and correct path & default padding for stream-one mode * fix(net/crypto): resolve UDP zero-checksum, QUIC rule state sharing, TLS fragment, and UUID parsing alignment * perf(net): optimize memory allocations in hot paths and reduce vless buffer copying * fix(misc): support form-driven OpenConnect authentication, script notifications, widget refresh, group reorder layout, and translations Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* fix(udp): resolve QUIC blocking rule matching issue * fix(http2): resolve http2 dest ip for rule matching issue * fix(amneziawg): read junk packet keys from correct index Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

This update is one of the most significant version upgrades recently, adding support for various mainstream protocols and deeply optimizing the core transmission engine: 1. New Protocol Support * Mieru Protocol: Officially supports the Mieru transmission protocol, providing you with more stealthy connection options. * OpenConnect: Added support for the OpenConnect protocol, compatible with more office and enterprise network environments. * TrustTunnel: Supports the brand-new TrustTunnel protocol, further enhancing penetration capabilities in complex networks. 2. Core Protocol Optimization * VLESS Vision Enhancement: Improved support for VLESS XTLS Vision, significantly increasing camouflage and stability during high-performance transmission and reducing detection risks. * All-new DNS Engine: Reconstructed the DNS cache system, significantly shortening the initial webpage loading time. * HTTP/3 Optimization: Deeply optimized the transmission efficiency of HTTP/3 based on QUIC, making video playback smoother in high packet loss environments. 3. Transmission and Decryption Upgrade * More Stable HTTPS Decryption: Greatly improved the compatibility of MITM (Man-in-the-Middle decryption), providing script enthusiasts with more reliable Body modification and flow control capabilities. * Asymmetrical Download Support: Supports asynchronous download settings for XHTTP, allowing download and upload paths to be separated and optimizing transmission performance in specific networks. 4. UI and User Experience * QR Code Scanning Fix: Resolved the display abnormality of the QR code scanner during screen rotation. * List Management: Fixed the issue where moving positions in the server list during edit mode might fail. 5. Stability and Power Consumption * System-level Hardening: Fixed multiple issues that could lead to App crashes or deadlocks in the background, further reducing system resource usage. * Shortcuts: Optimized iOS Shortcuts integration, making VPN status retrieval faster and more accurate. Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* chore(task): add execution delay for background tasks * fix(config): optimize rule building to prevent crashes * fix(dns): resolve mDNS and DNS-SD query issues * fix(icon): resolve white artifact issue during app switcher animation * fix(mux): resolve AnyTLS pool mode and idle session management issues * fix(UI): resolve "More" button reset issue

* chore(server): display VLESS encryption in plain text * feat(http3): implement HTTP/3 support and optimize data reading * feat(naive): add UDP over TCP (UoT) support * fix(dns): resolve local FQDN query issue * fix(group): prevent crash from accessing deallocated weak references * fix(http2): resolve NaiveProxy padding length parsing issue * fix(log): resolve domain rejection with pre-matching issue * fix(mux): improve idle session cleanup logic * fix(mux): resolve session asynchronous handshake issue * fix(naive): resolve compatibility issues with older NaiveProxy HTTPS proxies * fix(scene): resolve default item issue in Scene * fix(server): resolve Hysteria URL parsing issue * fix(UI): resolve server obfuscation settings saving issue * fix(vless): resolve VLESS encryption issue when using Mux * fix(websocket): resolve implicit truncation issue in WebSocket * fix(widget): resolve server widget display issue * fix(wireguard): resolve WireGuard obfuscation editing issue

* chore(grpc): Resolve issues with custom gRPC headers. * chore(quic): Adjust QUIC max-idle and keep-alive timeouts. * chore(server): Include proxy pass failures in the server lookup log. * chore(server): Add show/hide function for subscription servers. * chore(shadowsocks): Optimize read packet handling for Shadowsocks UDP over TCP. * feat(AmneziaWG): Implement Junk Manager and refactor obfuscator. * feat(anytls): Implement session pool with idle cleanup. * feat(grpc): Support chunked gRPC data transmission to prevent stream pauses. * feat(intents): Enable VPN toggle/start/stop intents to run quietly. * feat(kcp): Add AES-128-GCM support for kcptun. * feat(script): Add WebView script engine support. * feat(server): Add duplicate handling strategies when adding servers. * feat(server): Support specifying HTTPS DNS for resolving subscription link domains. * feat(shortcuts): Add shortcuts for toggling TUN mode. * feat(vless): Add support for VLESS Post-Quantum encryption. * fix(anytls): Fix protocol handling bugs in AnyTLS sessions. * fix(backend): Remove recursive lock calls in TLS settings caching. * fix(backend): Resolve Naïve HTTPS handshake issues. * fix(config): Resolve configuration rule file synchronization issues. * fix(config): Fix crash during file synchronization and optimize checksum calculation. * fix(geoip): Resolve task interval issues. * fix(group): Resolve proxy group policy case-sensitivity issues. * fix(http2): Fix connection teardown when HTTP/2 sessions are idle. * fix(intents): Resolve issues with App Intents extension execution. * fix(intents): Resolve subscription updates over DoH. * fix(kcp): Fix null pointer dereference in the write loop. * fix(module): Resolve module installation issues. * fix(rule): Fix potential crashes caused by dangling pointers in rule results. * fix(script): Fix crash when script code is empty. * fix(script): Resolve script engine saving issues. * fix(script): Fix use-after-free (wild pointer) crash in script request tasks. * fix(script): Resolve potential wild pointer crash in script timer tasks. * fix(server): Resolve Easy Mode server update issues. * fix(server): Fix server chain lookup issues. * fix(server): Resolve ECH parsing issues in server URLs. * fix(server): Fix ShadowsocksR URL parsing issues. * fix(server): Resolve subscription server import issues. * fix(server): Fix saving issues for VMess xHTTP mode. * fix(server): Resolve YAML and configuration import issues. * fix(server): Fix expiration date issues for subscription servers. * fix(task): Fix background task completion and scheduling issues. * fix(task): Resolve background task execution timing issues. * fix(tcp): Prevent `os_unfair_lock` corruption crashes during deallocation. * fix(test): Resolve test result score calculation issues. * fix(TUIC): Fix TUIC crash due to retransmission of released stack data. * fix(UDP): Resolve heap buffer overflow in UDP socket packet generation. * fix(UI): Prevent crash in Code View when the title is nil. * fix(UI): Resolve permissions request logic issues. * fix(vless): Resolve issues with XTLS and Mux. * fix(vmess): Fix heap corruption in VMess backend decryption. * fix(websocket): Resolve VLESS WebSocket response parsing issues. * fix(widget): Resolve widget intent user activity handling issues. * fix(xhttp): Improve stability and connection reuse for HTTP/2. * fix(xhttp): Resolve HTTP/3 stream-up issues. * fix(xhttp): Fix HTTP/2 default mode issues in xHTTP. * fix(xudp): Resolve XUDP over XTLS-Vision issues. * perf(backend): Cache backend TLS settings using associated objects. * perf(kcp): Optimize update logic and timer management to reduce CPU overhead. * perf(mux): Optimize Mux socket performance and flow control. * perf(test): Adjust test result score calculator.

* fix(config): resolve invalid hyphen hostname parse issue * fix(intents): resolve intents extension execute issue * fix(macos): resolve statusItem button title color issue * fix(server): resolve server add by url scheme issue * fix(test): resolve server test task cancel issue * fix(mux): resolve VLESS/VMess mux frame parse issue * fix(websocket): resolve VLESS websocket response parse issue

* Feature(Config): Implemented automatic background updating for modules, ensuring components stay current without manual intervention. * Feature(UI): Added an App Intents Extension (e.g., for Siri/Shortcuts integration) to enable new voice and automation commands. * Fix(Backend): Resolved a critical issue concerning the handling of VLESS/VMess early data, improving connection reliability. * Fix(DNS): Corrected a bug where DNS over HTTPS (DoH) fallback mechanisms failed to execute properly. * Fix(GeoIP): Resolved an issue with the incorrect metadata database type in the GeoIP component. * Fix(Rule): Resolved an IP-CIDR match crash issue that occurred under specific routing conditions. * Fix(Rule): Corrected the MITM exclude hostname order, ensuring priority rules are applied correctly. * Fix(Rule): Fixed an issue where the rule resource URL update result was not correctly processed or displayed. * Fix(Server): Fixed a bug where the TLS 'Allow Insecure' setting was not correctly applied to server configurations. * Fix(Server): Resolved an issue with URL query parameter values not being encoded correctly during server operations.

What's New: Stability & Permissions This update significantly improves the reliability of the rule engine and introduces user controls for system permissions. * Core Stability Fix: Fixed a critical bug where the rule matching context could be prematurely freed during complex, nested asynchronous operations (involving rules, DNS lookups, and threading), preventing crashes and ensuring accurate routing. * Performance: Optimized the logical rule matching condition for faster execution. * User Control: Added new configuration switches to manage application permissions for Location, Pasteboard, and Notifications, giving you more control over your privacy.

What's New: Major Stability & Crash Fixes This is a critical stability update. We have resolved numerous race conditions and crashes to ensure a more robust and reliable experience across all platforms. * Critical Stability: Fixed multiple concurrency issues causing crashes in proxy groups, server management, MUX sessions, and ping timers. * Prevented Crashes: Resolved crashes caused by stack overflow (by limiting recursion depth), memory corruption (in proxy groups), and SIGABRT (in HTTP parser). * Networking Fixes: Resolved the Shadowsocks UDP relay issue and fixed a WireGuard session release bug. * Performance: Optimized rule matching and policy group interval parsing for faster performance.

What's New: Stability, macOS, and Reliability This update delivers a large number of bug fixes and optimizations, focusing on cross-platform stability and core features. - macOS Experience Enhanced: * Fixed critical UI bugs on Mac, including the broken multiple selection in server tables and issues with the menu bar and Dock icon. * Resolved system symbol display issues for earlier macOS versions. - Core Protocol Stability: * Fixed the Hysteria datagram session closure. * Improved XHTTP reliability by resolving conflicts with TLS fragmentation and fixing a packet issue. - Rules & Configuration: * Fixed various issues with Rule parsing, including backslashes in rewrite rules and handling of SSID/DNS case matching. * Resolved all known issues with GeoIP database importing and reloading. * Optimized module file read/write for better performance and corrected an async save bug. - UI & Other: * Added an alternate classic icon option.

What's New: Stability & Performance - Fixed Critical VPN Bugs: Resolved a major issue causing the VPN connection to stop unexpectedly. - Networking Reliability: Fixed issues with TLS parsing and Clash TLS fingerprint handling for stronger connections. - Rule & Automation Fixes: Restored Wi-Fi Scene Rules by fixing the SSID fetch issue. Corrected QUIC protocol rule matching. - Performance: Made server speed testing significantly faster. - Compatibility: Fixed Shortcuts failing to run and addressed UI issues on iOS 26.

* Critical Fixes: Resolved major issues with Shadowsocks UDP relay stability and fixed a bug that caused the VPN connection to unexpectedly stop. * Network & Rules: Improved handling for IPv6-only DNS scenarios and fixed a crucial bug in the QUIC protocol rule matching. * UI Refresh: Added a Search button to the navigation bar and refined default font sizes for a cleaner look.

We've focused on improving the app's core stability, security, and performance with a significant number of bug fixes and optimizations. - Key Updates: * Improved Stability & Reliability: We've resolved several critical issues to make your connections more stable and reliable. This includes fixes for stream closure and * retransmission issues in the QUIC protocol, ensuring seamless data transfer. * Enhanced Network Compatibility: The app now works flawlessly on IPv6-only networks. We've also added better support for various network protocols and address formats, * including IP4P, and improved URL handling. * Performance & Efficiency: We've optimized the app's performance by refining logical rule processing, improving the UDP handling for Shadowsocks, and enhancing the * efficiency of our debug logs. * UI & Usability Improvements: Enjoy a better user experience on macOS with corrected text selection. We've also enabled the new system-wide "Find" feature on text views and * refined the overall look and feel. * New Protocol Support: We've added support for modern network protocols, including new congestion control for Hysteria and the latest TLS fingerprints for enhanced security. * Bug Fixes: A wide range of other issues have been fixed, including problems with email composition, server URL handling, and various protocol-specific parsing and configuration bugs.

- What's New * Mocking - Map Local (Enhancement): Further refined the "Map Local" feature to ensure reliable mapping even when dealing with empty local data. * Rule Management: Batch Rules Deletion: Added the ability to delete multiple configuration rules at once, streamlining your workflow. * SSH Tunneling: Added a UDP Gateway feature for SSH, enabling the tunneling of UDP traffic over an SSH connection. - Bug Fixes * Clash Protocol: * Fixed an issue with parsing `obfs-password` in Hyteria2 YAML configurations. * Corrected the parsing of `ss-opts` for Trojan servers. * Configuration Handling: * Resolved parsing issues for "map local" rules defined within modules. * Ensured correct resolution from the hosts file even when global routing is set to proxy. * DNS: Corrected the `NXDOMAIN` flag in DNS answers to accurately reflect non-existent domains. * HTTP & TCP: * Resolved general HTTP message parsing failures. * Fixed an issue with the order of processing pending HTTP request data over TCP, improving reliability. * Corrected HTTP request path building when query strings are present. * Hysteria Protocol: Fixed an issue with parsing Hysteria server URLs that include embedded username and password credentials. * SSL/TLS: * Resolved a memory leak related to SSL context objects. * Fixed a memory release issue concerning TLS contexts in the backend. * Implemented an LRU cache for SSL sessions, improving performance and memory management. * Statistics: Resolved an issue with asynchronous saving of statistics data to the database, ensuring data reliability. * Task & Timer: * Resolved a critical crash that occurred during the submission of background tasks. * Fixed a potential memory leak associated with dispatch timers. * XHTTP Protocol: Corrected issues with setting up and initializing XHTTP server chains. * XTLS Protocol: Fixed an issue with packet number generation in the XTLS Vision writer.

* New Features & Improvements - Mocking - Map Local: Introduced a new "Map Local" feature, allowing you to serve responses directly from local files or custom data for specific requests. This greatly enhances development and testing workflows. - Module Management: Added support for batch deletion of modules, making it easier to manage and clean up multiple modules simultaneously. * Bug Fixes - Background Tasks: Resolved a critical crash that occurred during the submission of background tasks via BGTaskScheduler, improving app stability. - SSL/TLS: Fixed a memory management issue related to SSL/TLS session reference counts, preventing potential leaks and crashes.

Bug Fixes: * WireGuard Connection Optimization: Fixed an issue where WireGuard connections might fail to bind to the correct network interface. * QUIC Traffic Rule Matching Improvement: Resolved an issue where domain-based (SNI) rules might not correctly apply to QUIC (UDP) traffic, ensuring relevant network policies are accurately enforced.

New Features & Enhancements: * Added HTTP body rewriting support. * Added HTTP header rewriting support. * Added XHTTP transport support. Bug Fixes: 1: Core / Networking: * Resolved AnyTLS session read maximum length issue. * Fixed Brook WebSocket parsing issue. * Addressed Clash ECH configuration parsing issue. * Corrected DoH H3 fallback issue. * Fixed DoH over proxy write issue. * Resolved interface-only IPv6 change issue. * Fixed network usage reporting issue. * Corrected server chain case-insensitive issue. * Fixed server URL ECH issue. * Resolved TCP stream delay match issue. * Fixed WireGuard includeAllNetworks issue. 2: Configuration & Proxy Management: * Fixed config file editing issue. * Corrected config proxy server parsing issue. * Fixed module add and reload issue. * Resolved proxy policy parsing issue. * Fixed rule add and update issue. * Fixed server group update issue. * Resolved subscribe server proxy pass issue. 3: Scripting & Scene: * Fixed same script URL fetch issue. * Resolved scene SIM card issue. * Fixed script request early response issue.

* Added DOMAIN-WILDCARD rule type * Fixed AnyTLS padding update issue * Fixed Clash YAML AnyTLS parse issue * Fixed fake IPv4 Maped parse issue * Fixed IPv6 route address issue * Fixed Server HTTP URL parse issue * Fixed Shadowsocks URL parse issue * Fixed Socks URL parse issue * Fixed TLS cert pin SHA256 verfy issue * Fixed STUN IPv6 address parse issue * Fixed TLS reality set issue * Fixed UDP IPv4 Maped issue