New Features • Hybrid proxies now support more SOCKS connection methods: added SOCKS4 and SOCKS4a support, and compatibility with SOCKS5 connections that use username-and-password authentication only. Improvements • Improved the accuracy of direct connection latency tests. • QR codes and share links can now import more proxy configurations: support for additional node formats, while preserving supported TLS, REALITY, and transport settings. Parameters that cannot be safely preserved will be rejected during import. Fixes • Improved Tailscale node version detection: the Tailscale admin console can now correctly identify Stash node versions and manage node settings. • Fixed StashLink device identity recovery: if identity credentials can’t be used, the app will try to obtain new ones and preserve existing valid credentials if renewal fails.

New Features • Added XHTTP padding options: When configuring a VLESS XHTTP proxy, you can set the padding mode, key, request headers, placement, and method. Improvements • Reduced memory usage for large sets of HTTP rewrite rules: This lowers the chance of the app exiting before the tunnel starts due to insufficient memory. • Display and download missing GeoIP databases: Undownloaded GeoIP databases now appear in the resource list and can be downloaded with a tap. Fixes • Improved Tailscale connections and address updates: Fixed version detection to prevent issues with connections and network address updates. • Allow startup when resource caching fails: If a cache file can’t be read, the original resource is used instead, preventing the issue from blocking network operation. • Improved Mieru connections: Connections can now be established without traffic features being configured, and connection resets in some network environments have been addressed. • Correctly read SSH node login usernames: SSH nodes imported in mihomo format no longer unexpectedly use root to log in. • Support servers with older certificates: When certificate verification is skipped or certificate pinning is enabled, you can connect to servers using X.509 v1 certificates, including MASQUE servers. • Improved SOCKS5 server compatibility: Relaxed restrictions on authentication and connection response formats to support more servers. • Keep measured results in latency tests: Previously measured latency remains visible if a later request times out or fails. • Prevent tunnel startup failures when iCloud sync is disabled: iCloud placeholder files no longer prevent the network from starting when iCloud configuration sync is turned off.

New Features • Added support for custom XHTTP request padding. Configure how and where padding is added to meet different server connection requirements. Fixes • Fixed connection failures with AnyTLS subscription nodes by correctly reading certificate fingerprints from subscriptions and preventing certificate validation errors.

· Protocols and Transports - Added the MASQUE protocol - Added VLESS Encryption: encrypts the stream without TLS underneath, and stacks with Vision flow control - Added the XHTTP transport with HTTP/1.1, HTTP/2 and HTTP/3; upload and download legs can be configured separately - Snell now supports v4, v5 and v6 (v6 in its unsafe-raw / unshaped / default modes) - REALITY is no longer limited to VLESS over TCP: it now works under VLESS WebSocket, H2, gRPC and HTTP-obfuscation transports, and under Trojan and VMess - VLESS and VMess support plaintext gRPC - VMess supports XUDP and packetaddr; VLESS and VMess gain the packet-encoding, xudp and packet-addr keys - TUIC lets you choose the congestion controller (congestion-controller: bbr / cubic / new_reno) - SOCKS5 outbound supports TLS (tls, sni, skip-cert-verify, alpn, server-cert-fingerprint) - SSH supports host-key pinning and host-key-algorithms - WebSocket transport supports Early Data (ws-opts.max-early-data, early-data-header-name, and the ?ed= marker in subscription links) · TLS and Security - Every TLS ClientHello now offers the X25519MLKEM768 post-quantum hybrid key exchange by default; REALITY can enable it with reality-opts.support-x25519mlkem768, and shadow-tls v3 carries it as well - MitM leaf certificates are reused per public suffix, so far fewer certificates are generated · Tailscale - Adding a Tailscale node automatically routes its MagicDNS suffix and every peer address to that node, with no hand-written rules; disable with auto-route-disabled: true - The runtime exit-node choice persists across restarts - The status API shows whether each peer is reached directly or through a DERP relay · StashLink - When underlying-proxy is left empty, the relay carrier is chosen automatically from the device's own proxies, and re-chosen after network changes or subscription updates - Device names resolve under the .stash suffix and route to the matching device automatically - The path a StashLink proxy is currently on is visible; direct paths are kept across network changes where possible · Rules and DNS - GEOIP and IP-ASN support UNKNOWN, matching addresses with no database entry - A rule that cannot be parsed is skipped with a warning instead of failing the whole configuration load - fake-ip-filter and nameserver-policy can reference rule-set: and geosite: - A nameserver-policy key can list several matchers separated by commas

Optimization • Optimized StashTun Fixes • Fixed an issue where switching networks could cause disconnection • Fixed a crash that might occur when iCloud syncs in the background

New Features • Added icon search • Added long-press option on Tailscale nodes to select Exit Node • Fully re-engineered StashTun — reaches up to 9Gbps on iPhone 17 Pro, about 6× faster than before • Added Tailscale Web login authentication • Added visual editor for local overrides • Optimized Tun performance when the network is unavailable • Visual editor now supports editing Hysteria2 obfuscation modes • Added local override editing • Added Tailscale support — documentation: https://stash.wiki/proxy-protocols/proxy-types#tailscale • Added support for VLESS-TCP-REALITY • Added Hysteria2 salamander obfuscation mode • Providers can now set custom request headers • DNS Nameserver Policy supports GEOSITE matching and concurrent access to multiple Nameservers • Added support for the TrustTunnel protocol • Added gecko obfuscation support for Hysteria2 Improvements • Added an action button at the top right of the Override page • Improved the override operation flow • Visual editor now supports Tailscale type • Improved status display for quick component toggles • Improved the display of the TLS protocol visual editor • Reorganized and refined the Settings page categories • Improved network change detection • Improved TUIC visual editing • Obfuscation modes in visual editing are now selectable options • Removed gVisor tunnel stack • Enhanced VLESS visual editing interactions • Optimized congestion control for the QUIC protocol • Added visual editing support for TrustTunnel and Hysteria2 Gecko • Tailscale visual editing no longer requires an auth-key • Improved iCloud read/write events • Improved TrustTunnel descriptions • Comprehensive localization improvements • Visual editor now supports AnyTLS • Enhanced Darwin Tun compatibility • Improved TUIC compatibility • Optimized StashLink resource usage • Stash DeviceID is now used as the default Tailscale hostname • Improved CORS support for Private Network • Optimized idle HTTP proxy requests • Improved Block QUIC handling • Refined speed test strategy and memory usage during network switching Fixes • Fixed an issue where the Start button could be hidden on iPadOS in certain cases • Improved reliability when switching overrides not taking effect • Fixed abnormal button styles on iOS 27 • Fixed possible freeze issues caused by iCloud in some situations • Fixed proxy page display errors in certain cases • Optimized subscription fetching • Fixed an issue where configuration might revert to Default when iCloud is unavailable • Fixed UDP fragmentation for the Hysteria v1 protocol • Fixed timing issues in VLESS UDP handshake • Fixed an issue where uTLS could not enable skip-cert-verify • Fixed an IPv6 CNAME configuration issue that could incorrectly return IPv4 records • Fixed a possible StashLink speed test freeze issue • Improved remote resource loading and fixed cases where failed downloads returned 0 • Improved Shadowsocks 2022 compatibility • Fixed a crash issue where Tailscale could fail during network switching • Fixed crash issues caused by invalid MRS resources • Improved IP → domain reverse lookup strategy • Tunnel traffic sniffing now activates earlier • Improved latency after policy group refresh • Fixed incorrect destination address when sending via WireGuard • Fixed incorrect destination address for VLESS XUDP • Fixed memory recycling delay in HTTP connectivity checks • Fixed reconnection issues for the WireGuard protocol under certain conditions

New Features • Added support for VLESS-TCP-REALITY Improvements • Improved compatibility with Shadowsocks 2022 Fixes • Fixed an issue where the Start button might disappear when using large fonts on iPadOS • Fixed an issue where StashLink speed tests might get stuck

Fixes • Fixed an issue where the start button might not appear when using large text on iPadOS • Fixed an issue where the visual editor AnyTLS might fail to save • Optimized TUIC compatibility

Fixes • Fixed an issue where the left-side interface on iPad could appear too small in some cases • Fixed an issue where settings or tools could not be tapped in windowing mode on iPadOS 26

• New Features - Added dialer-proxy, allowing upstream proxies to be specified in proxy configurations, with support for TCP and UDP relay. - Added support for AnyTLS. - Added a Script Persistent Data management page. - Added GeoSite Browser, allowing GEOSITE rules to be selected directly via a browser when adding GEOSITE-type rules, without manual input. - Providers now support custom paths, initialization via payload files, and synchronization through iCloud. - iPerf network bandwidth testing now supports chart visualization. - Added support for binding network requests to specific interfaces (Wi-Fi / Cellular) on iOS. - The Active Connections page now supports adding rules directly for current connections. - Rewrite URL / Header / Body / Mock now each have independent editors. • Optimizations & Improvements - Overall optimization of the Override interface. - Refactored the Third-Party Services page. - Refactored the HTTP engine to improve performance when handling multiple Rewrite scenarios. - Improved empty-state page display. - Remote devices now support swipe-left to delete. - Remote controller now shows proper prompts when remote devices disconnect. • Bug Fixes - Fixed an issue where filters were not displayed on iOS 26. - Fixed several multilingual description issues.

• Fixes - Fixed an issue where running iPadOS Stash using MacCatalyst would cause unexpected behavior - Fixed an issue where the navigation bar displayed incorrectly on iPadOS when using enlarged text - Fixed a layout issue on iPadOS 26

• Fixes - Fixed an issue where running iPadOS Stash using MacCatalyst would cause unexpected behavior - Fixed an issue where the navigation bar displayed incorrectly on iPadOS when using enlarged text

• Optimizations - Optimized the profile button style on the iOS 26 home page

• New - Added support for setting CNAME as hosts - Added proxy-hosts: you can configure proxy-hosts to specify the IP requested by a remote server - HTTP rewrite now supports Mock Configuration details: https://stash.wiki/http-engine/rewrite#mock - Added Collapsed Tile To provide more customization space for “Third-Party Service” checks, we added Collapsed Tile, which uses the same script API as Tile. Collapsed Tile will appear in “Availability” and “Long Press Proxy - Proxy Information”. We also provide sample Tiles, which will be prompted for download when updating to Stash 3.2. Details: https://stash.wiki/script/tile - Stash now generates a random API key upon first installation. All API operations require authentication via the HTTP header Authorization: Bearer ${secret}. The API key can be changed in “More Settings”. The API key is automatically synced via the user’s iCloud. When accessing other Stash devices under the same iCloud through “Tools” → “Remote Controller”, the API key will be filled in automatically. - Added “Network Quality Test” page to evaluate network status via DNS response latency. Remote Controller can also view network quality of other devices (requires remote device version ≥ 3.2.0) - “HTTP Inspection” page now supports showing request details before and after rewrite for easier debugging (remote debugging requires remote device version ≥ 3.2.0) - Proxy list now supports switching sorting method: “By Configuration File” or “By Benchmark Results” - Added long-press proxy information in Remote Controller (requires remote device version ≥ 3.2.0) - Redesigned Override interface - Transparent rewrite now supports regex parameters - Added filter to Connections page - Added filter to HTTP Inspection page - Added local override for policy group icons - Added background refresh for YAML configuration files - Added “Reset Settings” in “More Settings” to restore Stash to default configuration • Optimizations - Optimized Connections interface - Optimized HTTP Inspection interface - Optimized DNS Inspection interface - Optimized Override installation flow - Optimized iPerf - Optimized QUIC - UI improvements on several pages, added transition animations (requires iOS 17 or later) • Fixes - Fixed compatibility issues between WireGuard and IPv6 - Fixed XUDP IPv6 connections - Fixed Relay policy group not performing automatic speed tests in some cases - Fixed issue where pinging domain names in Enhanced Mode may return incorrect IPs - Fixed URL Transparent rewrite not correctly parsing parameters - Fixed DNS hijacking compatibility with non-standard DNS queries

• New - Added support for setting CNAME as hosts - Added proxy-hosts: you can configure proxy-hosts to specify the IP requested by a remote server - HTTP rewrite now supports Mock Configuration details: https://stash.wiki/http-engine/rewrite#mock - Added Collapsed Tile To provide more customization space for “Third-Party Service” checks, we added Collapsed Tile, which uses the same script API as Tile. Collapsed Tile will appear in “Availability” and “Long Press Proxy - Proxy Information”. We also provide sample Tiles, which will be prompted for download when updating to Stash 3.2. Details: https://stash.wiki/script/tile - Stash now generates a random API key upon first installation. All API operations require authentication via the HTTP header Authorization: Bearer ${secret}. The API key can be changed in “More Settings”. The API key is automatically synced via the user’s iCloud. When accessing other Stash devices under the same iCloud through “Tools” → “Remote Controller”, the API key will be filled in automatically. - Added “Network Quality Test” page to evaluate network status via DNS response latency. Remote Controller can also view network quality of other devices (requires remote device version ≥ 3.2.0) - “HTTP Inspection” page now supports showing request details before and after rewrite for easier debugging (remote debugging requires remote device version ≥ 3.2.0) - Proxy list now supports switching sorting method: “By Configuration File” or “By Benchmark Results” - Added long-press proxy information in Remote Controller (requires remote device version ≥ 3.2.0) - Redesigned Override interface - Transparent rewrite now supports regex parameters - Added filter to Connections page - Added filter to HTTP Inspection page - Added local override for policy group icons - Added background refresh for YAML configuration files - Added “Reset Settings” in “More Settings” to restore Stash to default configuration • Optimizations - Optimized Connections interface - Optimized HTTP Inspection interface - Optimized DNS Inspection interface - Optimized Override installation flow - Optimized iPerf - Optimized QUIC - UI improvements on several pages, added transition animations (requires iOS 17 or later) • Fixes - Fixed compatibility issues between WireGuard and IPv6 - Fixed XUDP IPv6 connections - Fixed Relay policy group not performing automatic speed tests in some cases - Fixed issue where pinging domain names in Enhanced Mode may return incorrect IPs - Fixed URL Transparent rewrite not correctly parsing parameters - Fixed DNS hijacking compatibility with non-standard DNS queries

• New Features - Support for VLESS XTLS-Vision - Support for VLESS XTLS-REALITY - Remote Rule Set now support MRS format rules - Shadowsocks / Shadowsocks2022 now support configuring udp-port - Shadowsocks / Shadowsocks2022 now support configuring udp-over-tcp v1 / v2 - Support for VLESS XUDP - Added "benchmark-disabled" option for individual proxy latency test; setting it to true completely disables latency testing - Proxy in the Visualization Editor now supports right-swipe to copy proxies - Support for importing stoverride files from other apps or Files into Stash • Optimizations - Optimized "HTTP Inspection" page - Improved display of long text - Matching rule and proxy are shown in the list - Can jump to the Connection Details page of the HTTP request - Search box remembers the last search - Optimized "Connections" page - Supports displaying more protocol types - Click on the hostname to jump to the related DNS query record - Optimized "DNS Inspection" page - Optimized "Remote Resources" page - Fixed inaccurate IP info display on the homepage - Optimized console.log in scripts — now supports logging objects, null, and undefined - Reduced memory usage when rewriting large requests with scripts - Refactored Remote Rule Set logic for improved performance and lower memory usage - Improved GEOSITE performance - Optimized latency test logic for Proxy Groups that include REJECT-DROP and REJECT type proxies - Improved Stash Core stability • Bug Fixes - Fixed an issue where UDP might mistakenly send Fake IPs - Fixed unnecessary DNS resolution under certain conditions - Fixed bad udp address error in VLESS network diagnostics - Fixed incorrect formatting of remote rule sets containing regex - Fixed UDP error in VMess under some conditions - Fixed request failures when using $httpClient in some scripts - Fixed issues with certain requests failing during script rewriting - Fixed inaccurate rule count statistics in some Remote Rule Set - Fixed UI misalignment in some parts - Fixed some crash

• New Features - Support for VLESS XTLS-Vision - Support for VLESS XTLS-REALITY - Remote Rule Set now support MRS format rules - Shadowsocks / Shadowsocks2022 now support configuring udp-port - Shadowsocks / Shadowsocks2022 now support configuring udp-over-tcp v1 / v2 - Support for VLESS XUDP - Added "benchmark-disabled" option for individual proxy latency test; setting it to true completely disables latency testing - Proxy in the Visualization Editor now supports right-swipe to copy proxies - Support for importing stoverride files from other apps or Files into Stash • Optimizations - Optimized "HTTP Inspection" page - Improved display of long text - Matching rule and proxy are shown in the list - Can jump to the Connection Details page of the HTTP request - Search box remembers the last search - Optimized "Connections" page - Supports displaying more protocol types - Click on the hostname to jump to the related DNS query record - Optimized "DNS Inspection" page - Optimized "Remote Resources" page - Fixed inaccurate IP info display on the homepage - Optimized console.log in scripts — now supports logging objects, null, and undefined - Reduced memory usage when rewriting large requests with scripts - Refactored Remote Rule Set logic for improved performance and lower memory usage - Improved GEOSITE performance - Optimized latency test logic for Proxy Groups that include REJECT-DROP and REJECT type proxies - Improved Stash Core stability • Bug Fixes - Fixed an issue where UDP might mistakenly send Fake IPs - Fixed unnecessary DNS resolution under certain conditions - Fixed bad udp address error in VLESS network diagnostics - Fixed incorrect formatting of remote rule sets containing regex - Fixed UDP error in VMess under some conditions - Fixed request failures when using $httpClient in some scripts - Fixed issues with certain requests failing during script rewriting - Fixed inaccurate rule count statistics in some Remote Rule Set - Fixed UI misalignment in some parts - Fixed some crash

- Fixed an issue where UDP might unintentionally send a Fake IP - Fixed compatibility issues between the HTTP Engine and certain servers - Fixed a problem where Reject might incorrectly performs a DNS query - Updated Social Media account information X (Twitter): @StashAppDev / https://x.com/StashAppDev Chat Group: @StashFans / https://t.me/StashFans Channel: @StashFeed / https://t.me/StashFeed

• New Features - Added support for the ShadowSocks2022 protocol - Added support for ShadowTLS - Added support for AND, OR, NOT logical rules - Added DOMAIN-WILDCARD rule - Added DOMAIN-REGEX rule - Added NETWORK rule with selectable values: tcp, udp - Added PROTOCOL rule with selectable values: TCP, HTTP, HTTPS, UDP, QUIC - Added URL-REGEX rule - Added USER-AGENT rule - Added body-rewrite feature, supporting: - request-jq, request-replace-regex, request-json-replace, request-json-add, request-json-del - response-jq, response-replace-regex, response-json-replace, response-json-add, response-json-del - Added support for sniffing TLS Client Hello to obtain SNI domain names - When establishing a UDP connection, the system now attempts to use the target proxy to perform DNS queries to determine the destination IP - Added support for sniffing QUIC / HTTP3 - The Connections page now displays more detailed TCP / UDP protocol information - DoH and DoH3 now support User-Agent configuration - Added BGP.Tools as an IP information provider - Rewrites now support reading the zstd compression algorithm - Visual editor: - Added support for reject-drop - Now supports modifying url-rewrite, header-rewrite, and body-rewrite - Now supports modifying scripts - Long press to copy icon URLs • Optimizations - Significantly improved power efficiency, especially under low-load scenarios - Optimized QUIC sniffing - Optimized performance for bulk remote resource updates - Optimized memory usage under high UDP concurrency - Optimized memory pool allocation strategy - Optimized long text display in the visual editor - Optimized ECH implementation • Bug Fixes - Fixed an issue where icons might fail to import on the second attempt - Fixed sorting issues in the visual editor

• New Features - Added support for the ShadowSocks2022 protocol - Added support for ShadowTLS - Added support for AND, OR, NOT logical rules - Added DOMAIN-WILDCARD rule - Added DOMAIN-REGEX rule - Added NETWORK rule with selectable values: tcp, udp - Added PROTOCOL rule with selectable values: TCP, HTTP, HTTPS, UDP, QUIC - Added URL-REGEX rule - Added USER-AGENT rule - Added body-rewrite feature, supporting: - request-jq, request-replace-regex, request-json-replace, request-json-add, request-json-del - response-jq, response-replace-regex, response-json-replace, response-json-add, response-json-del - Added support for sniffing TLS Client Hello to obtain SNI domain names - When establishing a UDP connection, the system now attempts to use the target proxy to perform DNS queries to determine the destination IP - Added support for sniffing QUIC / HTTP3 - The Connections page now displays more detailed TCP / UDP protocol information - DoH and DoH3 now support User-Agent configuration - Added BGP.Tools as an IP information provider - Rewrites now support reading the zstd compression algorithm - Visual editor: - Added support for reject-drop - Now supports modifying url-rewrite, header-rewrite, and body-rewrite - Now supports modifying scripts - Long press to copy icon URLs • Optimizations - Significantly improved power efficiency, especially under low-load scenarios - Optimized QUIC sniffing - Optimized performance for bulk remote resource updates - Optimized memory usage under high UDP concurrency - Optimized memory pool allocation strategy - Optimized long text display in the visual editor - Optimized ECH implementation • Bug Fixes - Fixed an issue where icons might fail to import on the second attempt - Fixed sorting issues in the visual editor

Happy New Year! - Fixed an issue where certain service provider configurations could cause crashes

• New Features - iOS 18 Control Widget - Added REJECT-DROP Policy - Added GEOIP database updates during Stash runtime - Added basic rewrite editing via a visual editor - Added ip.im IP information provider - Icons adapted for iOS 18 Dark and Tinted modes • Improvements - When updating remote resources, Stash will now use ETag for cache negotiation. If the resource hasn't changed, Stash won't re-download it, saving bandwidth for both users and rule set providers. - When setting server-cert-fingerprint, there's no need to set skip-cert-verify to true - Improved multilingual translations - Optimized system DNS • Fixes - Fixed an issue where configuration file names would occasionally appear abnormal

- Fixed an issue in version 2.6.5 where YAML whitespace could cause configuration file recognition errors - Optimized QUIC

- Optimized Sniffing When connecting to a domain, Stash will initiate a TCP handshake for all resolved results simultaneously and use the connection that succeeds the fastest. Upon sniffing a domain, Stash triggers a DNS resolution to perform the above function. If the domain has no resolution in public DNS servers, it may cause a connection error. This version improves compatibility with unresolved domains. - Enhanced HTTP Engine Compatibility for Hosts with Ports - Happy Eyeballs Dual Stack Moved from Experimental to Stable. Enabling this will improve compatibility between IPv4 and IPv6 dual stack. - Support for setting benchmark-url and benchmark-timeout in Proxy Providers - Fixed Unexpected Jumping in Some UI Lists

• New Features - Support for Hysteria 2 port hopping feature - Added support for SSH protocol - Added support for Juicity protocol - Shortcuts now support match_geosite syntax - MitM feature will automatically disable when CA certificate is untrusted - Ability to delete created certificates in the MitM settings page - Added support for Russian language • Improvements - Optimized QUIC protocol 0-RTT - Enhanced script Header compatibility - Improved interaction on the Skip Proxy / Skip Tun page - Reduced app size - Optimized CA certificate logic, with issued certificates now valid for 10 years - Improved interaction logic for installing CA certificates • Fixes - Fixed potential UI misalignment issue during drag-and-drop sorting in visual editing - Fixed excessive space usage by cached files in some cases