• Fixes - Fixed an issue where running iPadOS Stash using MacCatalyst would cause unexpected behavior - Fixed an issue where the navigation bar displayed incorrectly on iPadOS when using enlarged text

• Optimizations - Optimized the profile button style on the iOS 26 home page

• New - Added support for setting CNAME as hosts - Added proxy-hosts: you can configure proxy-hosts to specify the IP requested by a remote server - HTTP rewrite now supports Mock Configuration details: https://stash.wiki/http-engine/rewrite#mock - Added Collapsed Tile To provide more customization space for “Third-Party Service” checks, we added Collapsed Tile, which uses the same script API as Tile. Collapsed Tile will appear in “Availability” and “Long Press Proxy - Proxy Information”. We also provide sample Tiles, which will be prompted for download when updating to Stash 3.2. Details: https://stash.wiki/script/tile - Stash now generates a random API key upon first installation. All API operations require authentication via the HTTP header Authorization: Bearer ${secret}. The API key can be changed in “More Settings”. The API key is automatically synced via the user’s iCloud. When accessing other Stash devices under the same iCloud through “Tools” → “Remote Controller”, the API key will be filled in automatically. - Added “Network Quality Test” page to evaluate network status via DNS response latency. Remote Controller can also view network quality of other devices (requires remote device version ≥ 3.2.0) - “HTTP Inspection” page now supports showing request details before and after rewrite for easier debugging (remote debugging requires remote device version ≥ 3.2.0) - Proxy list now supports switching sorting method: “By Configuration File” or “By Benchmark Results” - Added long-press proxy information in Remote Controller (requires remote device version ≥ 3.2.0) - Redesigned Override interface - Transparent rewrite now supports regex parameters - Added filter to Connections page - Added filter to HTTP Inspection page - Added local override for policy group icons - Added background refresh for YAML configuration files - Added “Reset Settings” in “More Settings” to restore Stash to default configuration • Optimizations - Optimized Connections interface - Optimized HTTP Inspection interface - Optimized DNS Inspection interface - Optimized Override installation flow - Optimized iPerf - Optimized QUIC - UI improvements on several pages, added transition animations (requires iOS 17 or later) • Fixes - Fixed compatibility issues between WireGuard and IPv6 - Fixed XUDP IPv6 connections - Fixed Relay policy group not performing automatic speed tests in some cases - Fixed issue where pinging domain names in Enhanced Mode may return incorrect IPs - Fixed URL Transparent rewrite not correctly parsing parameters - Fixed DNS hijacking compatibility with non-standard DNS queries

• New - Added support for setting CNAME as hosts - Added proxy-hosts: you can configure proxy-hosts to specify the IP requested by a remote server - HTTP rewrite now supports Mock Configuration details: https://stash.wiki/http-engine/rewrite#mock - Added Collapsed Tile To provide more customization space for “Third-Party Service” checks, we added Collapsed Tile, which uses the same script API as Tile. Collapsed Tile will appear in “Availability” and “Long Press Proxy - Proxy Information”. We also provide sample Tiles, which will be prompted for download when updating to Stash 3.2. Details: https://stash.wiki/script/tile - Stash now generates a random API key upon first installation. All API operations require authentication via the HTTP header Authorization: Bearer ${secret}. The API key can be changed in “More Settings”. The API key is automatically synced via the user’s iCloud. When accessing other Stash devices under the same iCloud through “Tools” → “Remote Controller”, the API key will be filled in automatically. - Added “Network Quality Test” page to evaluate network status via DNS response latency. Remote Controller can also view network quality of other devices (requires remote device version ≥ 3.2.0) - “HTTP Inspection” page now supports showing request details before and after rewrite for easier debugging (remote debugging requires remote device version ≥ 3.2.0) - Proxy list now supports switching sorting method: “By Configuration File” or “By Benchmark Results” - Added long-press proxy information in Remote Controller (requires remote device version ≥ 3.2.0) - Redesigned Override interface - Transparent rewrite now supports regex parameters - Added filter to Connections page - Added filter to HTTP Inspection page - Added local override for policy group icons - Added background refresh for YAML configuration files - Added “Reset Settings” in “More Settings” to restore Stash to default configuration • Optimizations - Optimized Connections interface - Optimized HTTP Inspection interface - Optimized DNS Inspection interface - Optimized Override installation flow - Optimized iPerf - Optimized QUIC - UI improvements on several pages, added transition animations (requires iOS 17 or later) • Fixes - Fixed compatibility issues between WireGuard and IPv6 - Fixed XUDP IPv6 connections - Fixed Relay policy group not performing automatic speed tests in some cases - Fixed issue where pinging domain names in Enhanced Mode may return incorrect IPs - Fixed URL Transparent rewrite not correctly parsing parameters - Fixed DNS hijacking compatibility with non-standard DNS queries

• New Features - Support for VLESS XTLS-Vision - Support for VLESS XTLS-REALITY - Remote Rule Set now support MRS format rules - Shadowsocks / Shadowsocks2022 now support configuring udp-port - Shadowsocks / Shadowsocks2022 now support configuring udp-over-tcp v1 / v2 - Support for VLESS XUDP - Added "benchmark-disabled" option for individual proxy latency test; setting it to true completely disables latency testing - Proxy in the Visualization Editor now supports right-swipe to copy proxies - Support for importing stoverride files from other apps or Files into Stash • Optimizations - Optimized "HTTP Inspection" page - Improved display of long text - Matching rule and proxy are shown in the list - Can jump to the Connection Details page of the HTTP request - Search box remembers the last search - Optimized "Connections" page - Supports displaying more protocol types - Click on the hostname to jump to the related DNS query record - Optimized "DNS Inspection" page - Optimized "Remote Resources" page - Fixed inaccurate IP info display on the homepage - Optimized console.log in scripts — now supports logging objects, null, and undefined - Reduced memory usage when rewriting large requests with scripts - Refactored Remote Rule Set logic for improved performance and lower memory usage - Improved GEOSITE performance - Optimized latency test logic for Proxy Groups that include REJECT-DROP and REJECT type proxies - Improved Stash Core stability • Bug Fixes - Fixed an issue where UDP might mistakenly send Fake IPs - Fixed unnecessary DNS resolution under certain conditions - Fixed bad udp address error in VLESS network diagnostics - Fixed incorrect formatting of remote rule sets containing regex - Fixed UDP error in VMess under some conditions - Fixed request failures when using $httpClient in some scripts - Fixed issues with certain requests failing during script rewriting - Fixed inaccurate rule count statistics in some Remote Rule Set - Fixed UI misalignment in some parts - Fixed some crash

• New Features - Support for VLESS XTLS-Vision - Support for VLESS XTLS-REALITY - Remote Rule Set now support MRS format rules - Shadowsocks / Shadowsocks2022 now support configuring udp-port - Shadowsocks / Shadowsocks2022 now support configuring udp-over-tcp v1 / v2 - Support for VLESS XUDP - Added "benchmark-disabled" option for individual proxy latency test; setting it to true completely disables latency testing - Proxy in the Visualization Editor now supports right-swipe to copy proxies - Support for importing stoverride files from other apps or Files into Stash • Optimizations - Optimized "HTTP Inspection" page - Improved display of long text - Matching rule and proxy are shown in the list - Can jump to the Connection Details page of the HTTP request - Search box remembers the last search - Optimized "Connections" page - Supports displaying more protocol types - Click on the hostname to jump to the related DNS query record - Optimized "DNS Inspection" page - Optimized "Remote Resources" page - Fixed inaccurate IP info display on the homepage - Optimized console.log in scripts — now supports logging objects, null, and undefined - Reduced memory usage when rewriting large requests with scripts - Refactored Remote Rule Set logic for improved performance and lower memory usage - Improved GEOSITE performance - Optimized latency test logic for Proxy Groups that include REJECT-DROP and REJECT type proxies - Improved Stash Core stability • Bug Fixes - Fixed an issue where UDP might mistakenly send Fake IPs - Fixed unnecessary DNS resolution under certain conditions - Fixed bad udp address error in VLESS network diagnostics - Fixed incorrect formatting of remote rule sets containing regex - Fixed UDP error in VMess under some conditions - Fixed request failures when using $httpClient in some scripts - Fixed issues with certain requests failing during script rewriting - Fixed inaccurate rule count statistics in some Remote Rule Set - Fixed UI misalignment in some parts - Fixed some crash

- Fixed an issue where UDP might unintentionally send a Fake IP - Fixed compatibility issues between the HTTP Engine and certain servers - Fixed a problem where Reject might incorrectly performs a DNS query - Updated Social Media account information X (Twitter): @StashAppDev / https://x.com/StashAppDev Chat Group: @StashFans / https://t.me/StashFans Channel: @StashFeed / https://t.me/StashFeed

• New Features - Added support for the ShadowSocks2022 protocol - Added support for ShadowTLS - Added support for AND, OR, NOT logical rules - Added DOMAIN-WILDCARD rule - Added DOMAIN-REGEX rule - Added NETWORK rule with selectable values: tcp, udp - Added PROTOCOL rule with selectable values: TCP, HTTP, HTTPS, UDP, QUIC - Added URL-REGEX rule - Added USER-AGENT rule - Added body-rewrite feature, supporting: - request-jq, request-replace-regex, request-json-replace, request-json-add, request-json-del - response-jq, response-replace-regex, response-json-replace, response-json-add, response-json-del - Added support for sniffing TLS Client Hello to obtain SNI domain names - When establishing a UDP connection, the system now attempts to use the target proxy to perform DNS queries to determine the destination IP - Added support for sniffing QUIC / HTTP3 - The Connections page now displays more detailed TCP / UDP protocol information - DoH and DoH3 now support User-Agent configuration - Added BGP.Tools as an IP information provider - Rewrites now support reading the zstd compression algorithm - Visual editor: - Added support for reject-drop - Now supports modifying url-rewrite, header-rewrite, and body-rewrite - Now supports modifying scripts - Long press to copy icon URLs • Optimizations - Significantly improved power efficiency, especially under low-load scenarios - Optimized QUIC sniffing - Optimized performance for bulk remote resource updates - Optimized memory usage under high UDP concurrency - Optimized memory pool allocation strategy - Optimized long text display in the visual editor - Optimized ECH implementation • Bug Fixes - Fixed an issue where icons might fail to import on the second attempt - Fixed sorting issues in the visual editor

• New Features - Added support for the ShadowSocks2022 protocol - Added support for ShadowTLS - Added support for AND, OR, NOT logical rules - Added DOMAIN-WILDCARD rule - Added DOMAIN-REGEX rule - Added NETWORK rule with selectable values: tcp, udp - Added PROTOCOL rule with selectable values: TCP, HTTP, HTTPS, UDP, QUIC - Added URL-REGEX rule - Added USER-AGENT rule - Added body-rewrite feature, supporting: - request-jq, request-replace-regex, request-json-replace, request-json-add, request-json-del - response-jq, response-replace-regex, response-json-replace, response-json-add, response-json-del - Added support for sniffing TLS Client Hello to obtain SNI domain names - When establishing a UDP connection, the system now attempts to use the target proxy to perform DNS queries to determine the destination IP - Added support for sniffing QUIC / HTTP3 - The Connections page now displays more detailed TCP / UDP protocol information - DoH and DoH3 now support User-Agent configuration - Added BGP.Tools as an IP information provider - Rewrites now support reading the zstd compression algorithm - Visual editor: - Added support for reject-drop - Now supports modifying url-rewrite, header-rewrite, and body-rewrite - Now supports modifying scripts - Long press to copy icon URLs • Optimizations - Significantly improved power efficiency, especially under low-load scenarios - Optimized QUIC sniffing - Optimized performance for bulk remote resource updates - Optimized memory usage under high UDP concurrency - Optimized memory pool allocation strategy - Optimized long text display in the visual editor - Optimized ECH implementation • Bug Fixes - Fixed an issue where icons might fail to import on the second attempt - Fixed sorting issues in the visual editor

Happy New Year! - Fixed an issue where certain service provider configurations could cause crashes

• New Features - iOS 18 Control Widget - Added REJECT-DROP Policy - Added GEOIP database updates during Stash runtime - Added basic rewrite editing via a visual editor - Added ip.im IP information provider - Icons adapted for iOS 18 Dark and Tinted modes • Improvements - When updating remote resources, Stash will now use ETag for cache negotiation. If the resource hasn't changed, Stash won't re-download it, saving bandwidth for both users and rule set providers. - When setting server-cert-fingerprint, there's no need to set skip-cert-verify to true - Improved multilingual translations - Optimized system DNS • Fixes - Fixed an issue where configuration file names would occasionally appear abnormal

- Fixed an issue in version 2.6.5 where YAML whitespace could cause configuration file recognition errors - Optimized QUIC

- Optimized Sniffing When connecting to a domain, Stash will initiate a TCP handshake for all resolved results simultaneously and use the connection that succeeds the fastest. Upon sniffing a domain, Stash triggers a DNS resolution to perform the above function. If the domain has no resolution in public DNS servers, it may cause a connection error. This version improves compatibility with unresolved domains. - Enhanced HTTP Engine Compatibility for Hosts with Ports - Happy Eyeballs Dual Stack Moved from Experimental to Stable. Enabling this will improve compatibility between IPv4 and IPv6 dual stack. - Support for setting benchmark-url and benchmark-timeout in Proxy Providers - Fixed Unexpected Jumping in Some UI Lists

• New Features - Support for Hysteria 2 port hopping feature - Added support for SSH protocol - Added support for Juicity protocol - Shortcuts now support match_geosite syntax - MitM feature will automatically disable when CA certificate is untrusted - Ability to delete created certificates in the MitM settings page - Added support for Russian language • Improvements - Optimized QUIC protocol 0-RTT - Enhanced script Header compatibility - Improved interaction on the Skip Proxy / Skip Tun page - Reduced app size - Optimized CA certificate logic, with issued certificates now valid for 10 years - Improved interaction logic for installing CA certificates • Fixes - Fixed potential UI misalignment issue during drag-and-drop sorting in visual editing - Fixed excessive space usage by cached files in some cases

- Optimized the stability of WireGuard connections - Improved the compatibility of Hysteria2 0-RTT on certain networks - Enhanced the runtime MitM certificate generation process, reducing redundant calculations, improving performance, and saving power consumption - Improved WireGuard using underlying-proxy to automatically recover from connection errors - Fixed the issue where scripts could not run on systems below version 15.4

- Fixed the issue where $persistentStore might not save correctly in certain situations.

• New - Stash is now optimized for sniffing, supporting more STOverrides under "Tunnel Proxy Only" mode. - Now supports sniffing possible HTTP requests in TCP connections, including Method, Host, and URL. - Supports DNS over HTTP/3. - Supports Server Certificate Fingerprint Pinning for proxy servers, verifying the server certificate's SHA256 fingerprint during the TLS handshake when enabled. - Added Script Hub to the tools. - Supports collapsing policy groups by clicking on the policy group icon. • Optimization - Optimized script performance and memory usage, significantly improving script performance. - Optimized performance based on the QUIC protocol. - Optimized the speed when disconnecting VPN connections. • Fixes - Fixed the issue where QR codes could not be scanned on iPads. - Fixed a potential crash in the visual editor. - Fixed a recent issue with delayed memory release in scripts. - Fixed incorrect exception handling in script $httpClient. - Fixed the issue where $persistentStore.write could not save when the value passed was null or undefined. - Fixed the issue where the status might not refresh after toggling switches in the Today Widget. - Fixed script timeout exceptions. - Fixed issues causing some scripts to fail execution.

• New Features - Added support for iOS 17 Interactive Widget - Replaced JavaScript engine with a new engine that supports WebAPI - Added support for DNS query following rules - Added support for classical text rule sets - Added support for one-click update for all overrides - Added override categorization - Added override icons - Added support for proxying "Apple Push Notifications", "Wi-Fi Calling, MMS, SMS", "AirPlay, AirDrop" - Script $environment now supports device-model - Script $httpClient now supports parameters: timeout, insecure, auto-cookie, auto-redirect • Enhancements - Enhanced UDP compatibility - Optimized Script memory usage - Optimized override previews - Optimized script $httpClient compatibility, fixing potential communication issues with some servers - Enhanced visual DNS editing, now accessible from the homepage • Fixes - Fixed an issue with DNS over QUIC response timeouts - Corrected the behavior of script $argument parameters; when not set, $argument is now undefined - Addressed potential inaccuracies in matching with some large rule sets - Fixed potential disconnection issues with doq - Corrected an issue where connections from Stash internals were not properly recognized - Fixed unresponsive import configuration issue - Fixed a policy group crash - Fixed an issue where overrides with the same name couldn't be installed

- Fixed an issue where the toggle button state was incorrect in some cases - Fixed an issue where some converted scripts could not be installed - Corrected issues with concurrent scripts behaving abnormally in certain situations - Optimized script memory usage - The script's setTimeout() now supports parameters: setTimeout(function, delay, param1, param2, /* …, */ paramN)

- Fixed the issue of memory anomalies causing disconnections when using scripts in the previous version

- Fix some potential crashes - Fix scripts not running in some cases

- Fixed a minor probability of crash in Network Extension. - Fixed the issue where scheduled scripts may not run on time. - Fixed the issue where switching configurations on the settings page might not refresh the homepage information. - Fixed the issue where the homepage rules could not be accessed in certain cases. - Fixed the issue of repeated notifications for automatic configuration updates in some cases.

- Fix Hysteria 2 timeout in some cases - Bug fixes and improvements

- Enhanced Tun performance - Added support for Hysteria 2 - Fixed GEOSITE - Addressed roaming issues with the WireGuard protocol - When switching from cellular data to Wi-Fi, protocols based on QUIC will now attempt to roam to Wi-Fi - DoH/DoQ will re-establish connections when transitioning from cellular data to Wi-Fi to ensure more accurate DNS query records - Stash now automatically blocks QUIC traffic that hits the MitM list, allowing it to fall back to HTTP1/2 - Fixed issues with delayed updating of information on the home page - Resolved crashes related to the routing table under IPv6 environments - Experimentally introduced Happy Eyeballs Dual Stack When it enabled, IPv6 and IPv4 are treated with equal priority. For instance, in concurrent mode, Stash initiates TCP handshakes for all A and AAAA records of a domain, connecting to the fastest successful handshake.

- Enhanced Tun performance - Added support for Hysteria 2 - Fixed GEOSITE - Addressed roaming issues with the WireGuard protocol - When switching from cellular data to Wi-Fi, protocols based on QUIC will now attempt to roam to Wi-Fi - DoH/DoQ will re-establish connections when transitioning from cellular data to Wi-Fi to ensure more accurate DNS query records - Stash now automatically blocks QUIC traffic that hits the MitM list, allowing it to fall back to HTTP1/2 - Fixed issues with delayed updating of information on the home page - Resolved crashes related to the routing table under IPv6 environments - Experimentally introduced Happy Eyeballs Dual Stack When it enabled, IPv6 and IPv4 are treated with equal priority. For instance, in concurrent mode, Stash initiates TCP handshakes for all A and AAAA records of a domain, connecting to the fastest successful handshake.