sing-box: baixar versions anteriors

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
Important changes since 1.13:
- iOS and tvOS clients are back on the App Store 1
- Add OpenVPN client and server support 2
- Add OpenConnect client support 3
- Add Snell protocol support 4
- Add L3 forwarding support and bridge outbound 5
- Add network namespace support 6
- Introducing sing-box API service, Dashboard and remote control 7
- Add api command 8
- Add USB/IP services 9
- Add Hysteria Realm service and Hysteria2 NAT traversal support 10
- Add Chrome QUIC fingerprint parroting, BBR profile, hop interval randomization and gecko obfs for Hysteria2 11
- Add evaluate DNS rule action, Response Match Fields and parallel DNS response evaluation 12
- ip_version and query_type now also take effect on internal DNS lookups 13
- Correct undefined rule-set matching semantics 14
- Add optimistic DNS cache 15
- Add DNS query timeout options 16
- Add mDNS DNS server, preferred_by DNS rule item and search domain rule items 17
- Add source_mac_address and source_hostname rule items 18
- Allow customizing TUN DNS mode and hijack interface DNS by default 19
- Add new UDP NAT options 20
- Add sniff support for pre-match 21
- Unify HTTP client 22
- Unify HTTP/2 and QUIC parameters 23
- Refactor ACME support to certificate provider system 24
- Add Cloudflare Origin CA and Tailscale certificate providers 25
- Add TLS spoof 26
- Add Windows and Apple TLS engines and Apple HTTP engine 27
- Add Tailscale SSH server and Taildrop support 28
- Add JSON Schema support 29
- Add multiple tags and initial_path support to rule-sets 30
- Add package_name_regex route, DNS and headless rule item
- Add query_client_subnet and query_dnssec DNS rule items and remove_client_subnet DNS rule action option
- Add cipher, MAC, and key exchange algorithm options for SSH outbound
- Add cloudflared inbound
- Add include_mac_address and exclude_mac_address TUN options
- Add handshake_timeout TLS option
- Add listen_port, accept_search_domain options for Tailscale
- Preserve comments between formatting
- Remove Deprecated Features by agreement
- Introducing sing-box for Desktop for Windows and Linux 31
- Add iOS jailbreak release 32
- Apple/Android/Desktop: Add JSON editor completion, power report, report export encryption and updater improvements
- Add beta, testing and oldstable release tracks for Linux packages and Docker 33
- Drop support for go1.24 34
- Update quic-go to v0.61.0
- Update gVisor to 20260727.0
- Update Tailscale to v1.102.1
- Update uTLS to v1.8.7
- Update NaiveProxy to v150.0.7871.63-2
1:
Apple platform clients migrated to a new Apple developer account, and the iOS and tvOS clients are available on the App Store again as sing-box MT. Users of the previous App Store version (sing-box VT) need to install the new application.
Due to entitlement restrictions, SFM is no longer offered on the macOS App Store; use the standalone version instead. Its profiles and settings are not inherited from the previous application, see Migration.
2:
The new OpenVPN Client and OpenVPN Server endpoints are compatible with standard OpenVPN clients and servers, including static-key mode, legacy ciphers and digests, OpenVPN-compatible certificate checks, and options for tunnel addressing, MSS calculation, replay windows, timers, and TLS renegotiation. The new OpenVPN DNS server uses DNS options pushed by OpenVPN servers. Interactive client authentication is available through the sing-box graphical clients and Dashboard.
3:
The new OpenConnect Client endpoint supports Cisco AnyConnect, GlobalProtect, Fortinet, F5, Pulse Connect Secure, and Juniper Network Connect VPN servers, with SSO (single sign-on) for AnyConnect, existing authentication sessions, OIDC Bearer authentication, AnyConnect compression, and Fortinet host check via fortinet_host_check. The new OpenConnect DNS server uses pushed split-DNS resolvers. Interactive authentication is available through the sing-box graphical clients and Dashboard.
4:
Surge believes that being closed-source and not p

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Update naiveproxy to v150.0.7871.63-1
- Fixes and improvements

📝 Release Notes
- Remove client metadata from AnyTLS requests by default 1
- Fixes and improvements
1:
We found that the AnyTLS client implementation uploads metadata that is not used by the open-source server, and there are reports of vendors using it to profile and discriminate against users. We now leave it empty by default and allow you to customize it, see AnyTLS client metadata.

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Update naiveproxy to v148.0.7778.96-1
- Fixes and improvements

📝 Release Notes
- Fix process searcher failure introduced in 1.13.9
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Update naiveproxy to v147.0.7727.49-1
- Fix fake-ip DNS server should return SUCCESS when address type is not configured
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Add OpenWrt and Alpine APK packages to release 1
- Backport to macOS 10.13 High Sierra 2
- OCM service: Add WebSocket support for Responses API 3
- Fixes and improvements
1:
Alpine APK files use linux in the filename to distinguish from OpenWrt APKs which use the openwrt prefix:
- OpenWrt: sing-box_{version}_openwrt_{architecture}.apk
- Alpine: sing-box_{version}_linux_{architecture}.apk
2:
Legacy macOS binaries (with -legacy-macos-10.13 suffix) now support
macOS 10.13 High Sierra, built using Go 1.25 with patches
from SagerNet/go.
3:
See OCM.

Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
Important changes since 1.12:
- Add NaiveProxy outbound 1
- Add pre-match support for auto_redirect 2
- Improve auto_redirect 3
- Add Chrome Root Store certificate option 4
- Add new options for ACME DNS-01 challenge providers 5
- Add Wi-Fi state support for Linux and Windows 6
- Add curve preferences, pinned public key SHA256, mTLS and ECH query_server_name for TLS options 7
- Add kTLS support 8
- Add ICMP echo (ping) proxy support 9
- Add interface_address, network_interface_address and default_interface_address rule items 10
- Add preferred_by route rule item 11
- Improve local DNS server 12
- Add disable_tcp_keep_alive, tcp_keep_alive and tcp_keep_alive_interval options for listen and dial fields 13
- Add bind_address_no_port option for dial fields 14
- Add system interface and relay server options for Tailscale endpoint 15
- Add Claude Code Multiplexer service 16
- Add OpenAI Codex Multiplexer service 17
- Apple/Android: Refactor GUI
- Apple/Android: Add support for sharing configurations via QRS
- Android: Add support for resisting VPN detection via Xposed
- Drop support for go1.23 18
- Drop support for Android 5.0 19
- Update uTLS to v1.8.2 20
- Update quic-go to v0.59.0
- Update gVisor to v20250811
- Update Tailscale to v1.92.4
1:
NaiveProxy outbound now supports QUIC, ECH, UDP over TCP, and configurable QUIC congestion control.
Only available on Apple platforms, Android, Windows and some Linux architectures.
Each Windows release includes libcronet.dll —
ensure this file is in the same directory as sing-box.exe or in a directory listed in PATH.
See NaiveProxy outbound.
2:
auto_redirect now allows you to bypass sing-box for connections based on routing rules.
A new rule action bypass is introduced to support this feature. When matched during pre-match, the connection will bypass sing-box and connect directly.
This feature requires Linux with auto_redirect enabled.
See Pre-match and Rule Action.
3:
auto_redirect now rejects MPTCP connections by default to fix compatibility issues.
You can change it to bypass sing-box via the new exclude_mptcp option.
Adds a fallback iproute2 rule checked after system default rules (32766: main, 32767: default),
ensuring traffic is routed to the sing-box table when no route is found in system tables.
The rule index can be customized via auto_redirect_iproute2_fallback_rule_index (default: 32768).
See TUN.
4:
Adds chrome as a new certificate store option alongside mozilla.
Both stores filter out China-based CA certificates.
See Certificate.
5:
See DNS-01 Challenge.
6:
sing-box can now monitor Wi-Fi state on Linux and Windows to enable routing rules based on wifi_ssid and wifi_bssid.
See Wi-Fi State.
7:
See TLS.
8:
Adds kernel_tx and kernel_rx options for TLS inbound.
Enables kernel-level TLS offloading via splice(2) on Linux 5.1+ with TLS 1.3.
See TLS.
9:
sing-box can now proxy ICMP echo (ping) requests.
A new icmp network type is available for route rules.
Supported from TUN, WireGuard and Tailscale inbounds to Direct, WireGuard and Tailscale outbounds.
The reject action can also reply to ICMP echo requests.
10:
New rule items for matching based on interface IP addresses, available in route rules, DNS rules and rule-sets.
11:
Matches outbounds' preferred routes.
For Tailscale: MagicDNS domains and peers' allowed IPs. For WireGuard: peers' allowed IPs.
12:
The local DNS server now uses platform-native resolution:
getaddrinfo/libresolv on Apple platforms, systemd-resolved DBus on Linux.
A new prefer_go option is available to opt out.
See Local DNS.
13:
The default TCP keep-alive initial period has been updated from 10 minutes to 5 minutes.
See Dial Fields.
14:
Adds the Linux socket option IP_BIND_ADDRESS_NO_PORT support when explicitly binding to a source address.
This allows reusing the same source port for multiple connections, improving scalability for high-concurrency proxy scenarios.
See Dial Fields.
15:
Tailscale endpoint can now create a system TUN interface to handl

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Add fallback routing rule for auto_redirect 1
- Fixes and improvements
1:
Adds a fallback iproute2 rule checked after system default rules (32766: main, 32767: default),
ensuring traffic is routed to the sing-box table when no route is found in system tables.
The rule index can be customized via auto_redirect_iproute2_fallback_rule_index (default: 32768).

📝 Release Notes
- Update uTLS to v1.8.2 1
- Fixes and improvements
1:
This update fixes missing padding extension for Chrome 120+ fingerprints.
Also, documentation has been updated with a warning about uTLS fingerprinting vulnerabilities.
uTLS is not recommended for censorship circumvention due to fundamental architectural limitations;
use NaiveProxy instead for TLS fingerprint resistance.

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fix naive inbound
- Fixes and improvements
- Unfortunately, for non-technical reasons, we are currently unable to notarize the standalone version of the macOS client: because system extensions require signatures to function, we have had to temporarily halt its release.
We plan to fix the App Store release issue and launch a new standalone desktop client, but until then, only clients on TestFlight will be available (unless you have an Apple Developer Program and compile from source code).

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Update uTLS to v1.8.1 1
- Fixes and improvements
1:
This update fixes an critical issue that could cause simulated Chrome fingerprints to be detected, see refraction-networking/utls#375.

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
Important changes since 1.11:
- Refactor DNS servers 1
- Add domain resolver options2
- Add TLS fragment/record fragment support to route options and outbound TLS options 3
- Add certificate options 4
- Add Tailscale endpoint and DNS server 5
- Drop support for go1.22 6
- Add AnyTLS protocol 7
- Migrate to stdlib ECH implementation 8
- Add NTP sniffer 9
- Add wildcard SNI support for ShadowTLS inbound 10
- Improve auto_redirect 11
- Add control options for listeners 12
- Add DERP service 13
- Add Resolved service and DNS server 14
- Add SSM API service 15
- Add loopback address support for tun 16
- Improve tun performance on Apple platforms 17
- Update quic-go to v0.52.0
- Update gVisor to 20250319.0
- Update the status of graphical clients in stores 18
1:
DNS servers are refactored for better performance and scalability.
See DNS server.
For migration, see Migrate to new DNS server formats.
Compatibility for old formats will be removed in sing-box 1.14.0.
2:
Legacy outbound DNS rules are deprecated and can be replaced by the new domain_resolver option.
See Dial Fields and Route.
For migration,
see Migrate outbound DNS rule items to domain resolver.
3:
See Route Action and TLS.
4:
New certificate options allow you to manage the default list of trusted X509 CA certificates.
For the system certificate list, fixed Go not reading Android trusted certificates correctly.
You can also use the Mozilla Included List instead, or add trusted certificates yourself.
See Certificate.
5:
See Tailscale.
6:
Due to maintenance difficulties, sing-box 1.12.0 requires at least Go 1.23 to compile.
For Windows 7 users, legacy binaries now continue to compile with Go 1.23 and patches from MetaCubeX/go.
7:
The new AnyTLS protocol claims to mitigate TLS proxy traffic characteristics and comes with a new multiplexing scheme.
See AnyTLS Inbound and AnyTLS Outbound.
8:
See TLS.
The build tag with_ech is no longer needed and has been removed.
9:
See Protocol Sniff.
10:
See ShadowTLS.
11:
Now auto_redirect fixes compatibility issues between tun and Docker bridge networks, see Tun.
12:
You can now set bind_interface, routing_mark and reuse_addr in Listen Fields.
See Listen Fields.
13:
DERP service is a Tailscale DERP server, similar to derper.
See DERP Service.
14:
Resolved service is a fake systemd-resolved DBUS service to receive DNS settings from other programs (e.g. NetworkManager) and provide DNS resolution.
See Resolved Service and Resolved DNS Server.
15:
SSM API service is a RESTful API server for managing Shadowsocks servers.
See SSM API Service.
16:
TUN now implements SideStore's StosVPN.
See Tun.
17:
We have significantly improved the performance of tun inbound on Apple platforms, especially in the gVisor stack.
The following data was tested using tun_bench on M4 MacBook pro.
───────────┬──────┬─────┬──────┬────────
Version │Stack │MTU │Upload│Download
───────────┼──────┼─────┼──────┼────────
1.11.15 │gvisor│1500 │852M │2.57G
───────────┼──────┼─────┼──────┼────────
1.12.0-rc.4│gvisor│1500 │2.90G │4.68G
───────────┼──────┼─────┼──────┼────────
1.11.15 │gvisor│4064 │2.31G │6.34G
───────────┼──────┼─────┼──────┼────────
1.12.0-rc.4│gvisor│4064 │7.54G │12.2G
───────────┼──────┼─────┼──────┼────────
1.11.15 │gvisor│65535│27.6G │18.1G
───────────┼──────┼─────┼──────┼────────
1.12.0-rc.4│gvisor│65535│39.8G │34.7G
───────────┼──────┼─────┼──────┼────────
1.11.15 │system│1500 │664M │706M
───────────┼──────┼─────┼──────┼────────
1.12.0-rc.4│system│1500 │2.44G │2.51G
───────────┼──────┼─────┼──────┼────────
1.11.15 │system│4064 │1.88G │1.94G
───────────┼──────┼─────┼──────┼────────
1.12.0-rc.4│system│4064 │6.45G │6.27G
───────────┼──────┼─────┼──────┼────────
1.11.15 │system│65535│26.2G │17.4G
───────────┼──────┼─────┼──────┼────────
1.12.0-rc.4│system│65535│17.6G │21.0G
───────────┴──────┴─────┴──────┴────────
18:
We continue to experience issues updating our sing-box apps on the App Store and Play Store. Until we rewrite and resubmit the a

📝 Release Notes
- Fixes and improvements
We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we
violated the rules (TestFlight users are not affected).

📝 Release Notes
- Fixes and improvements
We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we
violated the rules (TestFlight users are not affected).

📝 Release Notes
- Fixes and improvements
We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we
violated the rules (TestFlight users are not affected).

📝 Release Notes
- Fixes and improvements
We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we
violated the rules (TestFlight users are not affected).

📝 Release Notes
- Undeprecate the block outbound 1
- Fixes and improvements
1:
Since we don’t have a replacement for using the block outbound in selectors yet, we decided to temporarily undeprecate the block outbound until a replacement is available in the future.
We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we
violated the rules (TestFlight users are not affected).

📝 Release Notes
- Fixes and improvements
We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we violated the rules (TestFlight users are not affected).

📝 Release Notes
- Improve auto_redirect 1
- Fixes and improvements
1:
Now auto_redirect fixes compatibility issues between TUN and Docker bridge networks, see Tun.
We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we violated the rules (TestFlight users are not affected).

📝 Release Notes
- Fixes and improvements
We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we violated the rules (TestFlight users are not affected).

📝 Release Notes
- Fixes and improvements
We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we violated the rules (TestFlight users are not affected).

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements
This version overwrites 1.11.2, as incorrect binaries were released due to a bug in the continuous integration process.

📝 Release Notes
- Fixes and improvements

:memo: Release Notes
Important changes since 1.10:
- Introducing rule actions 1
- Improve tun compatibility 3
- Merge route options to route actions 4
- Add network_type, network_is_expensive and network_is_constrainted rule items 5
- Add multi network dialing 6
- Add cache_capacity DNS option 7
- Add override_address and override_port route options 8
- Upgrade WireGuard outbound to endpoint 9
- Add UDP GSO support for WireGuard
- Make GSO adaptive 10
- Add UDP timeout route option 11
- Add more masquerade options for hysteria2 12
- Add rule-set merge command
- Add port hopping support for Hysteria2 13
- Hysteria2 ignore_client_bandwidth behavior update 14
1:New rule actions replace legacy inbound fields and special outbound fields,
and can be used for pre-matching 2.See Rule, Rule Action, DNS Rule and DNS Rule Action.For migration, see Migrate legacy special outbounds to rule actions, Migrate legacy inbound fields to rule actions and Migrate legacy DNS route options to rule actions.2:Similar to Surge's pre-matching.Specifically, new rule actions allow you to reject connections with TCP RST (for TCP connections) and ICMP port unreachable (for UDP packets) before connection established to improve tun's compatibility.See Rule Action.3:When gvisor tun stack is enabled, even if the request passes routing, if the outbound connection establishment fails, the connection still does not need to be established and a TCP RST is replied.4:Route options in DNS route actions will no longer be considered deprecated, see DNS Route Action.Also, now udp_disable_domain_unmapping and udp_connect can also be configured in route action, see Route Action.5:When using in graphical clients, new routing rule items allow you to match on network type (WIFI, cellular, etc.), whether the network is expensive, and whether Low Data Mode is enabled.See Route Rule, DNS Route Rule and Headless Rule.6:Similar to Surge's strategy.New options allow you to connect using multiple network interfaces, prefer or only use one type of interface, configure a timeout to fallback to other interfaces.See Dial Fields, Rule Action and Route.7:See DNS.8:See Rule Action and
Migrate destination override fields to route options.9:The new WireGuard endpoint combines inbound and outbound capabilities,
and the old outbound will be removed in sing-box 1.13.0.See Endpoint, WireGuard Endpoint
and Migrate WireGuard outbound fields to route options.10:For WireGuard outbound and endpoint, GSO will be automatically enabled when available, see WireGuard Outbound.For TUN, GSO has been removed, see Deprecated.11:See Rule Action.12:See Hysteria2.13:See Hysteria2.14:When up_mbps and down_mbps are set, ignore_client_bandwidth instead denies clients from using BBR CC.

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Add deprecated warnings
- Fix proxying websocket connections in HTTP/mixed inbounds
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Update quic-go to v0.47.0
- Fix direct dialer not resolving domain
- Fix no error return when empty DNS cache retrieved
- Fix build with go1.23
- Fix stream sniffer
- Fix bad redirect in clash-api
- Fix wireguard events chan leak
- Fix cached conn eats up read deadlines
- Fix disconnected interface selected as default in windows
- Update Bundle Identifiers for Apple platform clients 1
1:See Migration.We are still working on getting all sing-box apps back on the App Store, which should be completed within a week (SFI on the App Store and others on TestFlight are already available).

1.9.4
- Update quic-go to v0.46.0
- Update Hysteria2 BBR congestion control
- Filter HTTPS ipv4hint/ipv6hint with domain strategy
- Fix crash on Android when using process rules
- Fix non-IP queries accepted by address filter rules
- Fix UDP server for shadowsocks AEAD multi-user inbounds
- Fix default next protos for v2ray QUIC transport
- Fix default end value of port range configuration options
- Fix reset v2ray transports
- Fix panic caused by rule-set generation of duplicate keys for domain_suffix
- Fix UDP connnection leak when sniffing
:tired_face: Help neededDue to problems with our Apple developer account, sing-box apps on Apple platforms are temporarily unavailable for download or update. If your company or organization is willing to help us return to the App Store, please contact us.

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements
:new: Important changes since 1.8:
- domain_suffix behavior update 1
- process_path format update on Windows 2
- Add address filter DNS rule items 3
- Add support for client-subnet DNS options 4
- Add rejected DNS response cache support 5
- Add bypass_domain and search_domain platform HTTP proxy options 6
- Fix missing rule_set_ipcidr_match_source item in DNS rules 7
- Handle Windows power events
- Always disable cache for fake-ip DNS transport if dns.independent_cache disabled
- Improve DNS truncate behavior
- Update Hysteria protocol
- Update quic-go to v0.43.1
- Update gVisor to 20240422.0
- Mitigating TunnelVision attacks 8
1:See Migration.2:See Migration.3:The new DNS feature allows you to more precisely bypass Chinese websites via DNS leaks. Do not use plain local DNS
if using this method.See Address Filter Fields.Client example updated.4:See DNS, DNS Server and DNS Rules.Since this feature makes the scenario mentioned in alpha.1 no longer leak DNS requests,
the Client example has been updated.5:The new feature allows you to cache the check results of
Address filter DNS rule items until expiration.6:See TUN inbound.7:See DNS Rule.8:See TunnelVision.

:memo: Release Notes
- Fix hysteria2 panic
- Fixes and improvements

:memo: Release Notes
- Fix fake-ip mapping
- Fixes and improvements

:memo: Release Notes
- Now we have official APT and DNF repositories 1
- Fix packet MTU for QUIC protocols
- Fixes and improvements
1:Including stable and beta versions, see https://sing-box.sagernet.org/installation/package-manager/

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

:memo: Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

📝 Release Notes
- Fixes and improvements

Fixes and improvements

Fixes and improvements
Important changes since 1.7:
Migrate cache file from Clash API to independent options 1
Introducing Rule Set 2
Add sing-box geoip, sing-box geosite and sing-box rule-set commands 3
Allow nested logical rules 4
Independent source_ip_is_private and ip_is_private rules 5
Add context to JSON decode error message 6
Reject internal fake-ip queries 7
Add GSO support for TUN and WireGuard system interface 8
Add idle_timeout for URLTest outbound 9
Add simple loopback detect
Optimize memory usage of idle connections
Update uTLS to 1.5.4 10
Update dependencies 11
1:
See Cache File and Migration.
2:
Rule set is independent collections of rules that can be compiled into binaries to improve performance. Compared to legacy GeoIP and Geosite resources, it can include more types of rules, load faster, use less memory, and update automatically. See Route#rule_set, Route Rule, DNS Rule, Rule Set, Source Format and Headless Rule. For GEO resources migration, see Migrate GeoIP to rule sets and Migrate Geosite to rule sets.
3:
New commands manage GeoIP, Geosite and rule set resources, and help you migrate GEO resources to rule sets.
4:
Logical rules in route rules, DNS rules, and the new headless rule now allow nesting of logical rules.
5:
The private GeoIP country never existed and was actually implemented inside V2Ray. Since GeoIP was deprecated, we made this rule independent, see Migration.
6:
JSON parse errors will now include the current key path. Only takes effect when compiled with Go 1.21+.
7:
All internal DNS queries now skip DNS rules with server type fakeip, and the default DNS server can no longer be fakeip. This change is intended to break incorrect usage and essentially requires no action.
8:
See TUN inbound and WireGuard outbound.
9:
When URLTest is idle for a certain period of time, the scheduled delay test will be paused.
10:
Added some new fingerprints. Also, starting with this release, uTLS requires at least Go 1.20.
11:
Updated cloudflare-tls, gomobile, smux, tfo-go and wireguard-go to latest, quic-go to 0.40.1 and gvisor to 20231204.0

Fixes and improvements

Fix V2Ray transport path validation behavior 1
Fixes and improvements
1:
See V2Ray transport.

Fixes and improvements

Fixes and improvements

Fixes and improvements

Fixes and improvements

Fixes and improvements

Fixes and improvements

Important changes since 1.6:
Add exclude route support for TUN inbound
Add udp_disable_domain_unmapping inbound listen option 1
Add HTTPUpgrade V2Ray transport support 2
Migrate multiplex and UoT server to inbound 3
Add TCP Brutal support for multiplex 4
Add wifi_ssid and wifi_bssid route and DNS rules 5
Update quic-go to v0.40.0
Update gVisor to 20231113.0
1:
If enabled, for UDP proxy requests addressed to a domain, the original packet address will be sent in the response instead of the mapped domain.
This option is used for compatibility with clients that do not support receiving UDP packets with domain addresses, such as Surge.
2:
Introduced in V2Ray 5.10.0.
The new HTTPUpgrade transport has better performance than WebSocket and is better suited for CDN abuse.
3:
Starting in 1.7.0, multiplexing support is no longer enabled by default and needs to be turned on explicitly in inbound options.
4:
Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server, see TCP Brutal for details.
5:
Only supported in graphical clients on Android and iOS.

macOS: Add button for uninstall SystemExtension in the standalone graphical client
Fix missing UDP user context on TUIC/Hysteria2 inbounds
Fixes and improvements

Fixes and improvements

Fix crash if TUIC inbound authentication failed
Fixes and improvements

Fixes and improvements

iOS/Android: Fix profile auto update
Fixes and improvements

Fixes and improvements

Our Android client is now available in the Google Play Store
Fixes and improvements

Fixes and improvements

Important changes since 1.5:
Our Apple tvOS client is now available in the App Store
Update BBR congestion control for TUIC and Hysteria2 1
Update brutal congestion control for Hysteria2
Add brutal_debug option for Hysteria2
Update legacy Hysteria protocol 2
Add TLS self sign key pair generate command
Remove Deprecated Features by agreement
1:
None of the existing Golang BBR congestion control implementations have been reviewed or unit tested.
This update is intended to address the multi-send defects of the old implementation and may introduce new issues
2:
Based on discussions with the original author, the brutal CC and QUIC protocol parameters of the old protocol (Hysteria 1) have been updated to be consistent with Hysteria 2

Fix IPv6 auto_route for Linux 1
Add legacy builds for old Windows and macOS systems 2
Fixes and improvements
1:
When auto_route is enabled and strict_route is disabled, the device can now be reached from external IPv6 addresses.
2:
Built using Go 1.20, the last version that will run on Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High Sierra, 10.14 Mojave.

Fix Clash cache crash on arm32 devices
Fixes and improvements

Fix compatibility with Android 14
Fixes and improvements

Our Apple tvOS client is now available in the App Store 🍎
Fixes and improvements

Fixes and improvements

Fixes and improvements

Important changes since 1.4:
Add TLS ECH server support
Improve TLS TCH client configuration
Add TLS ECH key pair generator 1
Add TLS ECH support for QUIC based protocols 2
Add KDE support for the `set_system_proxy` option in HTTP inbound
Add Hysteria2 protocol support 3
Add `interrupt_exist_connections` option for Selector and URLTest outbounds 4
Add DNS01 challenge support for ACME TLS certificate issuer 5
Add `merge` command 6
Mark Deprecated Features
1:
Command: `sing-box generate ech-keypair <plain_server_name> [--pq-signature-schemes-enabled]`
2:
All inbounds and outbounds are supported, including Naiveproxy, Hysteria[/2], TUIC and V2ray QUIC transport
3:
See Hysteria2 inbound and Hysteria2 outbound
For protocol description, please refer to https://v2.hysteria.network
4:
Interrupt existing connections when the selected outbound has changed
Only inbound connections are affected by this setting, internal connections will always be interrupted
5:
Only Alibaba Cloud DNS and Cloudflare are supported, see ACME Fields and DNS01 Challenge Fields
6:
This command also parses path resources that appear in the configuration file and replaces them with embedded configuration, such as TLS certificates or SSH private key

Fixes and improvements

Fixed an improper authentication vulnerability in the SOCKS inbound
Fixes and improvements

Fixes and improvements

Fixes and improvements

Fixes and improvements

Fix bugs and update dependencies

Important Changes since 1.3:
Add TUIC support 1
Add udp_over_stream option for TUIC client 2
Add MultiPath TCP support
Add include_interface and exclude_interface options for tun inbound
Pause recurring tasks when no network or device idle
Improve Android and Apple platform clients
1:
See TUIC inbound
and TUIC outbound
2:
This is the TUIC port of the UDP over TCP protocol, designed to provide a QUIC stream based UDP relay mode that TUIC does not provide. Since it is an add-on protocol, you will need to use sing-box or another program compatible with the protocol as a server.
This mode has no positive effect in a proper UDP proxy scenario and should only be applied to relay streaming UDP traffic (basically QUIC streams).

Fixes and improvements

Fixes and improvements
Introducing our Apple tvOS client applications 1
Add per app proxy and app installed/updated trigger support for Android client
Add profile sharing support for Android/iOS/macOS clients
1:
Due to the requirement of tvOS 17, the app cannot be submitted to the App Store for the time being, and can only be downloaded through TestFlight.

Fixes and improvements
We're now on the App Store 🍎, always free! It should be noted that due to stricter and slower review, the release of Store versions will be delayed.
We've made a standalone version of the macOS 🍏 client (the original Application Extension relies on App Store distribution), which you can download as SFM-version-universal.zip in the release artifacts.

Fix bugs and update dependencies

Important Changes since 1.2:
Add FakeIP support 1
Improve multiplex 2
Add DNS reverse mapping support
Add rewrite_ttl DNS rule action
Add store_fakeip Clash API option
Add multi-peer support for WireGuard outbound
Add loopback detect
Add Clash.Meta API compatibility for Clash API
Download Yacd-meta by default if the specified Clash external_ui directory is empty
Add path and headers option for HTTP outbound
Perform URLTest recheck after network changes
Fix system tun stack for ios
Fix network monitor for android/ios
Update VLESS and XUDP protocol
Make splice work with traffic statistics systems like Clash API
Significantly reduces memory usage of idle connections
Improve DNS caching
Add independent_cache option for DNS
Reimplemented shadowsocks client
Add multiplex support for VLESS outbound
Automatically add Windows firewall rules in order for the system tun stack to work
Fix TLS 1.2 support for shadow-tls client
Add cache_id option for Clash cache file
Fix local DNS transport for Android
1:
See FAQ for more information.
2:
Added new h2mux multiplex protocol and padding multiplex option, see Multiplex.

Fix bugs and update dependencies

Fix bugs and update dependencies

Accept any outbound in dns rule 1
Fix bugs and update dependencies
1:
Now you can use the any outbound rule to match server address queries instead of filling in all server domains to the domain rule.

Fix missing default host in v2ray http transport`s request
Flush DNS cache for macOS when tun start/close
Fix tun's DNS hijacking compatibility with systemd-resolved

Fix bugs and update dependencies
Important changes since 1.1:
Introducing our new iOS client application
Introducing UDP over TCP protocol version 2
Add platform options for tun inbound
Add ShadowTLS protocol v3
Add VLESS server and vision support
Add reality TLS support
Add NTP service
Add DHCP DNS server support
Add SSH host key validation support
Add query_type DNS rule item
Add fallback support for v2ray transport
Add custom TLS server support for http based v2ray transports
Add health check support for http-based v2ray transports
Add multiple configuration support