Xray-core: vanhemmat versiot ja versiohistoria

Finalmask, mKCP, Hysteria, XHTTP, REALITY, TLS ECH, WireGuard, VLESS Reverse Proxy, HTTP headers' browser masquerading, Others
本̶次̶重̶点̶更̶新̶内̶容̶过̶多̶
- 从双重标准到“大新闻”：浅谈代理协议设计与实现上的一些本质问题与优先级区别
- XTLS/BBS#21 (comment)
- BlancVPN 正式成为赞助方之一，依̶旧̶面̶向̶俄̶罗̶斯̶人̶，这家默默赞助几个月了，还赞助了些其它开源项目
Finalmask
- 新增 header-custom (TCP & UDP)、Sudoku (TCP & UDP)，拷贝了 Direct/Freedom 出站的 fragment (TCP)、noise (UDP)，最终的自定义流量外观拥有了更多可能，且均支持通过 fm 参数分享，基于 Xray-core 的 GUI 应尽快更新 Finalmask（类似 XHTTP extra）
- 支持了 dialer-proxy，补上了 XHTTP/3，加上一众 TCP 协议/传输层，至此 Xray 产生的所有代理流量均能被 Finalmask
- 修复了 XICMP、XDNS 潜在的 panic，XDNS 相较于 DNSTT/Slipstream 可以通过更多 DNS，且支持代理 UDP
mKCP
- 修复了 ACKs 可能超出 MTU 限制的问题，使 XDNS 更加稳定
- 将 TTI 限制由 10~100 毫秒改为了 10~5000 毫秒
- #716 分享链接标准新增 mtu、tti 两项，还̶是̶为̶了̶ ̶X̶D̶N̶S̶
Hysteria
- 新增 Hysteria 2 入站与传输层，至̶此̶ ̶X̶r̶a̶y̶ ̶支̶持̶了̶完̶整̶的̶ ̶H̶y̶s̶t̶e̶r̶i̶a̶ ̶2̶，̶甚̶至̶ ̶F̶i̶n̶a̶l̶m̶a̶s̶k̶ ̶不̶只̶有̶ ̶S̶a̶l̶a̶m̶a̶n̶d̶e̶r̶
- 注意若要使用端口跳跃，入站应当只监听一个端口，并使用 iptables 转发其它端口的流量
- 将 congestion、brutalUp、brutalDown、udpHop 等 QUIC 参数移到了 Finalmask 的 quicParams
XHTTP
- XHTTP/3 拥塞控制改为默认 BBR ，同样支持通过 Finalmask 的 quicParams 设置 "force-brutal"、udpHop 等
- 修复了上个版本新增 obfuscations 所引入的一些问题，比如 broken Browser Dialer，以及一些增强
- 优化了一些代码与内存占用，测̶测̶ ̶i̶O̶S̶
REALITY
- 基于前段时间的经验，非 443 端口、“偷苹果”极易导致服务器 IP 被封锁，故对这两个行为输出警告信息
- 服务端启动时对 target 的 maxUselessRecords 进行四档自动探测并应用于自身，默认 32
- 其它一些修复，比如修复了服务端进入双向拷贝状态后，服务端与 target 间可能未及时关闭连接的问题
TLS ECH
- 避免了 WSS & HUS 的 outer ALPN 仍为 http/1.1，虽̶然̶这̶一̶行̶为̶与̶浏̶览̶器̶不̶同̶但̶ ̶A̶L̶P̶N̶ ̶h̶t̶t̶p̶/̶1̶.̶1̶ ̶会̶被̶重̶点̶关̶照̶所̶以̶
- 修改了 echForceQuery 的默认值为 "full"，即默认只允许以 ECH 发起连接
- 顺便升级了 uTLS 库更新了新版 Firefox、Safari 指纹，支持 X25519MLKEM768，就像 Chrome
WireGuard
- 支持了 UDP FullCone，提醒一下结合 Finalmask 后它拥有比其它 WireGuard 变种更强大的伪装能力
- 修复了出站 multi-peer 不可用的问题
- 修复了入站潜在的路由问题
VLESS Reverse Proxy
- VLESS 出站的 reverse（实际上是一个入站）添加完整的 sniffing 配置项与功能支持
- VLESS 入站建立新的反向 mux 连接（可能同时新建出站）后立即检查 burstObservatory
HTTP headers' browser masquerading
- 上个版本加的“Xray-core HTTP 请求的 User-Agent 均由 Go 改为动态 Chrome”扩展到了更多 headers
- XHTTP、WS、HU、gRPC 传输层可设置 headers User-Agent 来指定 "chrome"/"firefox"/"edge"
Others
- 该版本升级了一些依赖，并使用 Go 1.26.1 拉满 inline 编译，已 tag v1.260327.0
- 其它一些改进与修复，感谢所有贡献者，详见下方完整 change log
Sponsors
Remnawave
Happ
BlancVPN
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
What's Changed
- Build: Remove Windows ARM 32-bit build by @KobeArthurScofield in #4584
- Chore: Migrate to Go 1.26 by @Fangliding in #5680
- core/core.go: Replace "Custom" with vcs info if available by @Fangliding in #5665
- HTTPUpgrade server: Fix certain stuck in Handle() by @Fangliding in #5661
- Proxy: Add Hysteria 2 inbound & transport (supports listening port range, Salamander finalmask) by @LjhAUMEM in #5679
- gRPC client: Strip "grpc-go/version" suffix from User-Agent header by @RPRX in #5689
- README.md: Add NetProxy-Magisk to Magisk & Android Clients by @Fanju6 @RPRX in #5708
- README.md: Add GenyConnect to Windows & Linux & Android Clients by @thecompez in #5713
- README.md: Add XrayFA to Android Clients by @Q7DF1 in #5715
- VLESS config: Remove "with no flow" warning for now by @M03ED in #5671
- VLESS Encryption: Check 171̶7̶0̶0̶0̶ ̶-̶>̶ ̶C̶h̶e̶c̶k̶ ̶1̶7̶16640 by @OneMiny in #5698
- Routing: Add webhook to rules by @kastov in #5722
- API: Fix Online Map by @kastov in #573

XHTTP transport: New options for bypassing CDN's potential detection #5414 & Finalmask: Add XICMP, XDNS (relies on mKCP, like DNSTT), header-*, mkcp-*
为了捍卫通信自由，本次重点更新内容：
1. XHTTP 新增了一些选项以对绕过潜在的 CDN 检测（尚未定型，不建议第三方实现现在跟进），详见 #5414
2. Xray-core HTTP 请求的 User-Agent 均由 Go 改为动态 Chrome（可被 headers 等配置覆写），详见 #5658
3. Finalmask UDP 新增了 XICMP、XDNS、header-*、mkcp-*，分享链接标准 #716 已更新 fm、pcs、vcn
4. Finalmask UDP 支持了 WireGuard、SS AEAD/2022 等代理层协议产生的 UDP 流量，详见 #5643
5. TLS 移除了 allowInsecure 配置项，请使用 pinnedPeerCertSha256 和 verifyPeerCertByName 代替，详见 2c92339
6. 进一步降低了 Xray-core 启动时的瞬时内存占用 #5581 ，对于 iOS/router 请测试 #5505
7. v26.2.6 包含一些 v26.1.23 新增功能的配置项变更、重要修复，请及时升级 Xray-core 以及 GUI 客户端
> https://t.me/projectXtls/1464 此外我们将于下个月推出 XDRIVE 传输层与 XICMP 伪装层，前者可利用网盘、S3 stores 等服务传输数据，不需要自有公网 IP，而是通过潜在的白名单 IP 进行代理，或̶者̶境̶外̶能̶访̶问̶到̶境̶内̶的̶服̶务̶也̶行̶
> https://t.me/projectXtls/1473 定义已经清晰，“最终伪装层”是最底层的一个“不可靠的传输层”，比如对于 UDP 它只做每个包的伪装而不会确保可靠传输（依赖上层 mKCP/QUIC/WG，或者代理协议就是想要原生 UDP 特性），另一方面它放的那些东西天马行空、不具备抗检测的鲁棒性但可能就是有奇效，比如现在已有的 XICMP、XDNS、header-*、mkcp-*、Salamander，后续还会把 TCP/TLS fragment、UDP noises 移过来，它们都支持分享，以及据称有用的 ASCII、gfw-killer 想要的在 TCP 流开头加自定义数据等，还̶可̶能̶加̶ ̶M̶C̶ ̶等̶游̶戏̶伪̶装̶，如果你有天马行空的 idea 也可以提出
>
> 分两种情况，一种是只加 header 一种是真的通过那个东西传输数据，第一种会被命名为 header-*，第二种会被命名为 X*，懒̶得̶起̶名̶了̶，另外 TCP 的那些伪装可以通过 VLESS fallbacks offload 给别的程序
> https://t.me/projectXtls/1478 不在乎主动探测的话其实最简单的方法就是 REALITY 加随便填 SNI，服务端允许的值和客户端填写的值对得上就行，不需要自签再 pin 那么麻烦，且几乎所有客户端都支持 REALITY 及其分享，这̶不̶比̶自̶签̶强̶吗̶
> https://t.me/projectXtls/1490 为了给少数机场一些迁移时间，今天的版本将 allowInsecure 设为了延时自动禁用（UTC 2026.6.1 00:00），请联系你的机场主为 allowInsecure 的订阅配置加上 pcs/vcn，即可同时兼容新旧版本
>
> 这和明文 HTTP 面板一样是 *ray 一开始就有的安全设计问题，可以允许自签但从一开始就不该给出完全不验证证书的选项，然后又错误地被越来越多的代理软件学去，GFW 一个主动探测就知道你能被 MITM
>
> 毕竟现在的代理已经越来越多地转向 VLESS、Trojan、Hy2 等内层明文、依赖 TLS 层安全的协议，所以在已知 GFW 拥有完备的 MITM 能力且在其它国家进行过大规模尝试后，这个问题必须得到纠正
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.7 拉满 inline 编译，已 tag v1.260206.0，感谢所有贡献者，详见下方 change log
What's Changed
- TUN inbound: Disable RACK/TLP recovery to fix connection stalls by @KiGamji in #5600
- TUN inbound: Enhance Darwin interface support by @Owersun in #5598
- Hysteria transport: Support range & random for interval in udphop as well by @LjhAUMEM in #5603
- Geodat: Reduce peak memory usage by @Meo597 in #5581
- TUN inbound: Add iOS support by @evozi-team in #5612
- VMess inbound: Optimize replay filter by @Fangliding in #5562
- README.md: Add Egern & Quantumult X to Others by @nasaboy in #5624
- Upgrade gVisor to latest version v0.0.0-20260122175437-89a5d21be8f0 by @RPRX in 9c46a2d
- TLS config: allowInsecure->pinnedPeerCertSha256; verifyPeerCertInNames->verifyPeerCertByName by @RPRX in 2c92339
- Commands: Print leaf cert's SHA256 in tls ping by @Fangliding @RPRX in #5628
- MPH domian matcher: Support building & using cache directly (instead of building from geosite.dat when Xray starts) by @hossinasaadi in #5505
- XHTTP transport: New options for bypassing CDN's potential detection by @paqx @Fangliding in #5414
- Finalmask: Add XDNS (relies on mKCP, like DNSTT), header-*, mkcp-* by @LjhAUMEM in #5560
- XHTTP transport: Fix "auto" mode with REALITY by @paqx in #5638
- Finalmask: Add XICMP (relies on mKCP/QUIC or Wire

XHTTP transport: New options for bypassing CDN's potential detection #5414 & Finalmask: Add XICMP, XDNS (relies on mKCP, like DNSTT), header-*, mkcp-*
为了捍卫通信自由，本次重点更新内容：
1. XHTTP 新增了一些选项以对绕过潜在的 CDN 检测（尚未定型，不建议第三方实现现在跟进），详见 #5414
2. Finalmask UDP 新增了 XICMP、XDNS、header-*、mkcp-*，分享链接标准 #716 已更新 fm、pcs、vcn
3. TLS 移除了 allowInsecure 配置项，请使用 pinnedPeerCertSha256 和 verifyPeerCertByName 代替，详见 2c92339
4. 进一步降低了 Xray-core 启动时的瞬时内存占用 #5581 ，对于 iOS/router 请测试 #5505
> https://t.me/projectXtls/1464 此外我们将于下个月推出 XDRIVE 传输层与 XICMP 伪装层，前者可利用网盘、S3 stores 等服务传输数据，不需要自有公网 IP，而是通过潜在的白名单 IP 进行代理，或̶者̶境̶外̶能̶访̶问̶到̶境̶内̶的̶服̶务̶也̶行̶
> https://t.me/projectXtls/1473 定义已经清晰，“最终伪装层”是最底层的一个“不可靠的传输层”，比如对于 UDP 它只做每个包的伪装而不会确保可靠传输（依赖上层 mKCP/QUIC/WG，或者代理协议就是想要原生 UDP 特性），另一方面它放的那些东西天马行空、不具备抗检测的鲁棒性但可能就是有奇效，比如现在已有的 XICMP、XDNS、header-*、mkcp-*、Salamander，后续还会把 TCP/TLS fragment、UDP noises 移过来，它们都支持分享，以及据称有用的 ASCII、gfw-killer 想要的在 TCP 流开头加自定义数据等，还̶可̶能̶加̶ ̶M̶C̶ ̶等̶游̶戏̶伪̶装̶，如果你有天马行空的 idea 也可以提出
>
> 分两种情况，一种是只加 header 一种是真的通过那个东西传输数据，第一种会被命名为 header-*，第二种会被命名为 X*，懒̶得̶起̶名̶了̶，另外 TCP 的那些伪装可以通过 VLESS fallbacks offload 给别的程序
> https://t.me/projectXtls/1478 不在乎主动探测的话其实最简单的方法就是 REALITY 加随便填 SNI，服务端允许的值和客户端填写的值对得上就行，不需要自签再 pin 那么麻烦，且几乎所有客户端都支持 REALITY 及其分享，这̶不̶比̶自̶签̶强̶吗̶
> https://t.me/projectXtls/1490 为了给少数机场一些迁移时间，今天的版本将 allowInsecure 设为了延时自动禁用（UTC 2026.6.1 00:00），请联系你的机场主为 allowInsecure 的订阅配置加上 pcs/vcn，即可同时兼容新旧版本
>
> 这和明文 HTTP 面板一样是 *ray 一开始就有的安全设计问题，可以允许自签但从一开始就不该给出完全不验证证书的选项，然后又错误地被越来越多的代理软件学去，GFW 一个主动探测就知道你能被 MITM
>
> 毕竟现在的代理已经越来越多地转向 VLESS、Trojan、Hy2 等内层明文、依赖层 TLS 安全的协议，所以在已知 GFW 拥有完备的 MITM 能力且在其它国家进行过大规模尝试后，这个问题必须得到纠正
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.6 拉满 inline 编译，已 tag v1.260204.0，感谢所有贡献者，详见下方 change log
What's Changed
- TUN inbound: Disable RACK/TLP recovery to fix connection stalls by @KiGamji in #5600
- TUN inbound: Enhance Darwin interface support by @Owersun in #5598
- Hysteria transport: Support range & random for interval in udphop as well by @LjhAUMEM in #5603
- Geodat: Reduce peak memory usage by @Meo597 in #5581
- TUN inbound: Add iOS support by @evozi-team in #5612
- VMess inbound: Optimize replay filter by @Fangliding in #5562
- README.md: Add Egern & Quantumult X to Others by @nasaboy in #5624
- Upgrade gVisor to latest version v0.0.0-20260122175437-89a5d21be8f0 by @RPRX in 9c46a2d
- TLS config: allowInsecure->pinnedPeerCertSha256; verifyPeerCertInNames->verifyPeerCertByName by @RPRX in 2c92339
- Commands: Print leaf cert's SHA256 in tls ping by @Fangliding @RPRX in #5628
- MPH domian matcher: Support building & using cache directly (instead of building from geosite.dat when Xray starts) by @hossinasaadi in #5505
- XHTTP transport: New options for bypassing CDN's potential detection by @paqx @Fangliding in #5414
- Finalmask: Add XDNS (relies on mKCP, like DNSTT), header-*, mkcp-* by @LjhAUMEM in #5560
- XHTTP transport: Fix "auto" mode with REALITY by @paqx in #5638
- Finalmask: Add XICMP (relies on mKCP/QUIC or WireGuard) by @LjhAUMEM in #5633
- Chore: Generate *.pb.go files with protoc v6.33.5 by @RPRX in d14767d
- Commands: Print CA cert's SHA256 in tls ping by @Fangliding in #5644
- Finalmask UDP: Support WireGuard & Shadows

XHTTP transport: New options for bypassing CDN's potential detection #5414 & Finalmask: Add XICMP, XDNS (relies mKCP, like DNSTT), header-*, mkcp-*
为了捍卫通信自由，本次重点更新内容：
1. XHTTP 新增了一些选项以对绕过潜在的 CDN 检测（尚未定型，不建议第三方实现现在跟进），详见 #5414
2. Finalmask 新增了 XICMP、XDNS、header-*、mkcp-*，分享链接标准 #716 已更新 fm、pcs、vcn
3. TLS 移除了 allowInsecure 配置项，请使用 pinnedPeerCertSha256 和 verifyPeerCertByName 代替，详见 2c92339
4. 进一步降低了 Xray-core 启动时的瞬时内存占用 #5581 ，对于 iOS/router 请测试 #5505
> https://t.me/projectXtls/1464 此外我们将于下个月推出 XDRIVE 传输层与 XICMP 伪装层，前者可利用网盘、S3 stores 等服务传输数据，不需要自有公网 IP，而是通过潜在的白名单 IP 进行代理，或̶者̶境̶外̶能̶访̶问̶到̶境̶内̶的̶服̶务̶也̶行̶
> https://t.me/projectXtls/1473 定义已经清晰，“最终伪装层”是最底层的一个“不可靠的传输层”，比如对于 UDP 它只做每个包的伪装而不会确保可靠传输（依赖上层 mKCP/QUIC/WG，或者代理协议就是想要原生 UDP 特性），另一方面它放的那些东西天马行空、不具备抗检测的鲁棒性但可能就是有奇效，比如现在已有的 XICMP、XDNS、header-*、mkcp-*、Salamander，后续还会把 TCP/TLS fragment、UDP noises 移过来，它们都支持分享，以及据称有用的 ASCII、gfw-killer 想要的在 TCP 流开头加自定义数据等，还̶可̶能̶加̶ ̶M̶C̶ ̶等̶游̶戏̶伪̶装̶，如果你有天马行空的 idea 也可以提出
>
> 分两种情况，一种是只加 header 一种是真的通过那个东西传输数据，第一种会被命名为 header-*，第二种会被命名为 X*，懒̶得̶起̶名̶了̶，另外 TCP 的那些伪装可以通过 VLESS fallbacks offload 给别的程序
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.6 拉满 inline 编译，已 tag v1.260202.0，感谢所有贡献者，详见下方 change log
What's Changed
- TUN inbound: Disable RACK/TLP recovery to fix connection stalls by @KiGamji in #5600
- TUN inbound: Enhance Darwin interface support by @Owersun in #5598
- Hysteria transport: Support range & random for interval in udphop as well by @LjhAUMEM in #5603
- Geodat: Reduce peak memory usage by @Meo597 in #5581
- TUN inbound: Add iOS support by @evozi-team in #5612
- VMess inbound: Optimize replay filter by @Fangliding in #5562
- README.md: Add Egern & Quantumult X to Others by @nasaboy in #5624
- Upgrade gVisor to latest version v0.0.0-20260122175437-89a5d21be8f0 by @RPRX in 9c46a2d
- TLS config: allowInsecure->pinnedPeerCertSha256; verifyPeerCertInNames->verifyPeerCertByName by @RPRX in 2c92339
- Commands: Print leaf cert's SHA256 in tls ping by @Fangliding @RPRX in #5628
- MPH domian matcher: Support building & using cache directly (instead of building from geosite.dat when Xray starts) by @hossinasaadi in #5505
- XHTTP transport: New options for bypassing CDN's potential detection by @paqx @Fangliding in #5414
- Finalmask: Add XDNS (relies mKCP, like DNSTT), header-*, mkcp-* by @LjhAUMEM in #5560
- XHTTP transport: Fix "auto" mode with REALITY by @paqx in #5638
- Finalmask: Add XICMP (relies mKCP/QUIC or WireGuard) by @LjhAUMEM in #5633
New Contributors
- @KiGamji made their first contribution in #5600
- @evozi-team made their first contribution in #5612
- @nasaboy made their first contribution in #5624
- @paqx made their first contribution in #5414
Full Changelog: v26.1.23...v26.2.2

XHTTP transport: New options for bypassing CDN's detection #5414 & Finalmask: Add XDNS (relies mKCP, like DNSTT), header-*, mkcp-* #5560
为了捍卫通信自由，本次重点更新内容：
1. XHTTP 新增了一些选项以绕过潜在的 CDN 检测（尚未定型，不建议第三方实现现在跟进），详见 #5414
2. Finalmask 新增了 XDNS、header-*、mkcp-*，详见 #5560 ，分享链接标准 #716 已更新 fm、pcs、pcn
3. TLS 移除了 allowInsecure 配置项，请使用 pinnedPeerCertSha256 和 verifyPeerCertByName 代替，详见 2c92339
4. 进一步降低了 Xray-core 启动时的瞬时内存占用 #5581 ，对于 iOS/router 请测试 #5505
> https://t.me/projectXtls/1464 此外我们将于下个月推出 XDRIVE 传输层与 XICMP 伪装层，前者可利用网盘、S3 stores 等服务传输数据，不需要自有公网 IP，而是通过潜在的白名单 IP 进行代理，或̶者̶境̶外̶能̶访̶问̶到̶境̶内̶的̶服̶务̶也̶行̶
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.6 拉满 inline 编译，已 tag v1.260131.0，感谢所有贡献者，详见下方 change log
What's Changed
- TUN inbound: Disable RACK/TLP recovery to fix connection stalls by @KiGamji in #5600
- TUN inbound: Enhance Darwin interface support by @Owersun in #5598
- Hysteria transport: Support range & random for interval in udphop as well by @LjhAUMEM in #5603
- Geodat: Reduce peak memory usage by @Meo597 in #5581
- TUN inbound: Add iOS support by @evozi-team in #5612
- VMess inbound: Optimize replay filter by @Fangliding in #5562
- README.md: Add Egern & Quantumult X to Others by @nasaboy in #5624
- Upgrade gVisor to latest version v0.0.0-20260122175437-89a5d21be8f0 by @RPRX in 9c46a2d
- TLS config: allowInsecure->pinnedPeerCertSha256; verifyPeerCertInNames->verifyPeerCertByName by @RPRX in 2c92339
- Commands: Print leaf cert's SHA256 in tls ping by @Fangliding @RPRX in #5628
- MPH domian matcher: Support building & using cache directly (instead of building from geosite.dat when Xray starts) by @hossinasaadi in #5505
- XHTTP transport: New options for bypassing CDN's detection by @paqx @Fangliding in #5414
- Finalmask: Add XDNS (relies mKCP, like DNSTT), header-*, mkcp-* by @LjhAUMEM in #5560
New Contributors
- @KiGamji made their first contribution in #5600
- @evozi-team made their first contribution in #5612
- @nasaboy made their first contribution in #5624
- @paqx made their first contribution in #5414
Full Changelog: v26.1.23...v26.1.31

Proxy: Add TUN inbound for Windows & Linux, including Android #5464 #5509 & Proxy: Add Hysteria outbound & transport (version 2, udphop) and Salamander udpmask #5508
新年好！2026 第一版 Xray-core 重点更新内容：
1. 新增 TUN 入站（Windows、Linux、Android、macOS）#5464 ，默认 UDP FullCone 与 XUDP UoT Migration #5509
2. 新增 process 路由规则（Windows、Linux），匹配进程名/绝对路径/文件夹，支持任何入站 #5496
3. 新增 Hysteria 2 出站、Hysteria 2 传输层（支持端口跳跃）、Salamander 伪装层，完整配置示例详见 #5508
4. 新增“最终伪装层”概念 https://t.me/projectXtls/1354 ，比 TLS/QUIC 更底层，下一步计划 #5508 (comment)
5. TLS 客户端使用 pinnedPeerCertSha256 取代原有两项参数 #5154 #5532 760223a ，分享链接标准 #716 已更新 pcs
6. REALITY 客户端收到目标网站的真证书时打印出更加明确的警报（potential MITM or redirection）#5427
7. 为废弃特性/过时协议提醒迁移 cd8aab9 ，创建了 SECURITY.md 1cf5662 以明确安全漏洞/协议识别问题提交途径
为了使用 TUN，配置文件需要以下修改，以 Windows 为例：
1. 配置文件加一个 "tun" 入站，无需 settings，加一个 "direct" 作为默认出站
2. 为所有出站设置 sockopt "interface": "WLAN" 或 "以太网" 防止出站回流 Xray-core
3. 设置 routing 比如 "process": ["NatTypeTester.exe"] 导向代理协议出站
4. 浏览器会有 QUIC，注意设置路由 block UDP/443，或为 sniffing 启用 "quic"
TUN 尚未支持“自动修改系统路由表”，目前需要手动设置：
5. 以管理员权限启动 Xray-core，静置数秒等 Windows 自动为 TUN 分配 IP
6. 执行 ipconfig 与 route print 查看 Xray TUN 的 IPv4 地址与 interface ID
7. 以管理员权限执行 route add 0.0.0.0 mask 0.0.0.0 *.*.*.* if ** 新增系统路由
感谢 @Owersun @yuhan6665 @Fangliding @KobeArthurScofield @RPRX @osypai 为支持 TUN 所作出的贡献！
@Meo597 将 https://xtls.github.io/ 升级至了 VitePress，本次更新内容也会陆续更新至文档中
由于伊朗目前完全断网，致力于内存优化的贡献者 @hossinasaadi 已有十天没有活动，盼望他早日回归！
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.6 拉满 inline 编译，已 tag v1.260123.0，感谢所有贡献者，详见下方 change log
What's Changed
- Chore: Remove all double gonet import by @Fangliding in #5402
- Wireguard: Decouple server endpoint DNS from address option by @Meo597 in #5417
- VLESS inbound: Print invalid UUID string by @xtlsee @RPRX in #5426
- REALITY client: Clearer log when receiving real certificate by @ari-ahm @RPRX in #5427
- TLS ECH: Increase DOH timeout by @patterniha @Fangliding in #5455
- Tunnel/Dokodemo: Fix stats conn unwrap by @Fangliding in #5440
- DomainMatcher: Prevent illegal rules from causing core startup failures by @Meo597 in #5430
- common/uuid: fix panic when parsing 32-len invalid UUID string. by @ari-ahm in #5468
- API: Add GetAllOnlineUsers RPC to StatsService for retrieving online users by @mr1cloud in #5080
- Geofiles: Implement mmap in filesystem to reduce ram usage by @hossinasaadi in #5480
- Remove redundant stats in mux and bridge dispatcher by @yuhan6665 in #5466
- XHTTP server: Fix ScStreamUpServerSecs' non-default value by @fanymagnet in #5486
- Routing config: Add processName by @Fangliding in #5489
- README.md: Re-add 3X-UI to Web Panels by @RPRX in b38a412
- Routing: Reduce peak memory usage by @hossinasaadi in #5488
- DNS: Fix parse domain and geoip by @hossinasaadi in #5499
- README.md: Add TX-UI to Web Panels by @Incognito-Coder in #4981
- transport/pipe/impl.go: Remove runtime.Gosched() in WriteMultiBuffer() by @Fangliding in #5467
- Routing config: Replace processName with process (full-name/abs-path/abs-folder) by @Fangliding in #5496
- GitHub Actions: Add wintun.dll into Windows zips; Workflow refinement by @KobeArthurScofield in #5501
- Proxy: Add TUN inbound for Windows & Linux, includi

Proxy: Add TUN inbound for Windows & Linux, including Android #5464 #5509 & Proxy: Add Hysteria outbound & transport (version 2, udphop) and Salamander udpmask #5508
新年好！2026 第一版 Xray-core 重点更新内容：
1. 新增 TUN 入站（Windows、Linux、Android、macOS）#5464 ，默认 UDP FullCone 与 XUDP UoT Migration #5509
2. 新增 process 路由规则（Windows、Linux），匹配进程名/绝对路径/文件夹，支持任何入站 #5496
3. 新增 Hysteria 出站、Hysteria 2 传输层（支持端口跳跃）、Salamander 伪装层，完整配置示例详见 #5508
4. 新增“最终伪装层”概念 https://t.me/projectXtls/1354 ，比 TLS/QUIC 更底层，下一步计划 #5508 (comment)
5. TLS 客户端使用 pinnedPeerCertSha256 取代原有两项参数 #5154 #5532 760223a ，分享链接标准 #716 已更新 pcs
6. REALITY 客户端收到目标网站的真证书时打印出更加明确的警报（potential MITM or redirection）#5427
7. 为废弃特性/过时协议提醒迁移 5836f36 ，创建了 SECURITY.md 1cf5662 以明确安全漏洞/协议识别问题提交途径
为了使用 TUN，配置文件需要以下修改，以 Windows 为例：
1. 配置文件加一个 "tun" 入站，无需 settings，加一个 "direct" 作为默认出站
2. 为所有出站设置 sockopt "interface": "WLAN" 或 "以太网" 防止出站回流 Xray-core
3. 设置 routing 比如 "process": ["NatTypeTester.exe"] 导向代理协议出站
4. 浏览器会有 QUIC，注意设置路由 block UDP/443，或为 sniffing 启用 "quic"
TUN 尚未支持“自动修改系统路由表”，目前需要手动设置：
5. 以管理员权限启动 Xray-core，静置数秒等 Windows 自动为 TUN 分配 IP
6. 执行 ipconfig 与 route print 查看 Xray TUN 的 IPv4 地址与 interface ID
7. 以管理员权限执行 route add 0.0.0.0 mask 0.0.0.0 *.*.*.* if ** 新增系统路由
感谢 @Owersun @yuhan6665 @Fangliding @KobeArthurScofield @RPRX @osypai 为支持 TUN 所作出的贡献！
@Meo597 将 https://xtls.github.io/ 升级至了 VitePress，本次更新内容也会陆续更新至文档中
由于伊朗目前完全断网，致力于内存优化的贡献者 @hossinasaadi 已有十天没有活动，盼望他早日回归！
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.6 拉满 inline 编译，已 tag v1.260118.0，感谢所有贡献者，详见下方 change log
What's Changed
- Chore: Remove all double gonet import by @Fangliding in #5402
- Wireguard: Decouple server endpoint DNS from address option by @Meo597 in #5417
- VLESS inbound: Print invalid UUID string by @xtlsee @RPRX in #5426
- REALITY client: Clearer log when receiving real certificate by @ari-ahm @RPRX in #5427
- TLS ECH: Increase DOH timeout by @patterniha @Fangliding in #5455
- Tunnel/Dokodemo: Fix stats conn unwrap by @Fangliding in #5440
- DomainMatcher: Prevent illegal rules from causing core startup failures by @Meo597 in #5430
- common/uuid: fix panic when parsing 32-len invalid UUID string. by @ari-ahm in #5468
- API: Add GetAllOnlineUsers RPC to StatsService for retrieving online users by @mr1cloud in #5080
- Geofiles: Implement mmap in filesystem to reduce ram usage by @hossinasaadi in #5480
- Remove redundant stats in mux and bridge dispatcher by @yuhan6665 in #5466
- XHTTP server: Fix ScStreamUpServerSecs' non-default value by @fanymagnet in #5486
- Routing config: Add processName by @Fangliding in #5489
- README.md: Re-add 3X-UI to Web Panels by @RPRX in b38a412
- Routing: Reduce peak memory usage by @hossinasaadi in #5488
- DNS: Fix parse domain and geoip by @hossinasaadi in #5499
- README.md: Add TX-UI to Web Panels by @Incognito-Coder in #4981
- transport/pipe/impl.go: Remove runtime.Gosched() in WriteMultiBuffer() by @Fangliding in #5467
- Routing config: Replace processName with process (full-name/abs-path/abs-folder) by @Fangliding in #5496
- GitHub Actions: Add wintun.dll into Windows zips; Workflow refinement by @KobeArthurScofield in #5501
- Proxy: Add TUN inbound for Windows & Linux, including

Proxy: Add TUN inbound for Windows & Linux, including Android #5464 #5509 & Proxy: Add Hysteria outbound & transport (version 2, udphop) and Salamander udpmask #5508
新年好！2026 第一版 Xray-core 重点更新内容：
1. 新增 TUN 入站（Windows、Linux、Android）#5464 ，默认 UDP FullCone 与 XUDP UoT Migration #5509
2. 新增 process 路由规则（Windows、Linux），匹配进程名/绝对路径/文件夹，支持任何入站 #5496
3. 新增 Hysteria 出站、Hysteria 2 传输层（支持端口跳跃）、Salamander 伪装层，完整配置示例详见 #5508
4. 新增“最终伪装层”概念 https://t.me/projectXtls/1354 ，比 TLS/QUIC 更底层，下一步计划 #5508 (comment)
5. TLS 客户端使用 pinnedPeerCertSha256 取代原有的两项 pinned 参数 #5154 #5532
6. REALITY 客户端收到目标网站的真证书时打印出更加明确的警报（potential MITM or redirection）#5427
7. 进一步降低了 Xray-core 启动时的峰值内存占用 #5480 #5488 ，利好 iOS 客户端，下一步计划 #5505
为了使用 TUN，配置文件需要以下修改，以 Windows 为例：
1. 配置文件加一个 "tun" 入站，无需 settings，加一个 "direct" 作为默认出站
2. 为所有出站设置 sockopt "interface": "WLAN" 或 "以太网" 防止出站回流 Xray-core
3. 设置 routing 比如 "process": ["NatTypeTester.exe"] 导向代理协议出站
4. 浏览器会有 QUIC，注意设置路由 block UDP/443，或为 sniffing 启用 "quic"
TUN 尚未支持“自动修改系统路由表”，目前需要手动设置：
5. 以管理员权限启动 Xray-core，静置数秒等 Windows 自动为 TUN 分配 IP
6. 执行 ipconfig 与 route print 查看 Xray TUN 的 IPv4 地址与 interface ID
7. 以管理员权限执行 route add 0.0.0.0 mask 0.0.0.0 *.*.*.* if ** 新增系统路由
感谢 @Owersun @yuhan6665 @Fangliding @KobeArthurScofield @RPRX 为支持 TUN 所作出的贡献！
@Meo597 将 https://xtls.github.io/ 升级至了 VitePress，本次更新内容也会陆续更新至文档中
由于伊朗目前完全断网，致力于内存优化的贡献者 @hossinasaadi 已有几天没有上线，期待他的回归
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.5 拉满 inline 编译，已 tag v1.260113.0，感谢所有贡献者，详见下方 change log
What's Changed
- Chore: Remove all double gonet import by @Fangliding in #5402
- Wireguard: Decouple server endpoint DNS from address option by @Meo597 in #5417
- VLESS inbound: Print invalid UUID string by @xtlsee @RPRX in #5426
- REALITY client: Clearer log when receiving real certificate by @ari-ahm @RPRX in #5427
- TLS ECH: Increase DOH timeout by @patterniha @Fangliding in #5455
- Tunnel/Dokodemo: Fix stats conn unwrap by @Fangliding in #5440
- DomainMatcher: Prevent illegal rules from causing core startup failures by @Meo597 in #5430
- common/uuid: fix panic when parsing 32-len invalid UUID string. by @ari-ahm in #5468
- API: Add GetAllOnlineUsers RPC to StatsService for retrieving online users by @mr1cloud in #5080
- Geofiles: Implement mmap in filesystem to reduce ram usage by @hossinasaadi in #5480
- Remove redundant stats in mux and bridge dispatcher by @yuhan6665 in #5466
- XHTTP server: Fix ScStreamUpServerSecs' non-default value by @fanymagnet in #5486
- Routing config: Add processName by @Fangliding in #5489
- README.md: Re-add 3X-UI to Web Panels by @RPRX in b38a412
- Routing: Reduce peak memory usage by @hossinasaadi in #5488
- DNS: Fix parse domain and geoip by @hossinasaadi in #5499
- README.md: Add TX-UI to Web Panels by @Incognito-Coder in #4981
- transport/pipe/impl.go: Remove runtime.Gosched() in WriteMultiBuffer() by @Fangliding in #5467
- Routing config: Replace processName with process (full-name/abs-path/abs-folder) by @Fangliding in #5496
- GitHub Actions: Add wintun.dll into Windows zips; Workflow refinement by @KobeArthurScofield in #5501
- Proxy: Add TUN inbound for Windows & Linux, including Android by @Owersun @yuhan6665 in #546

XTLS Vision：Add testpre (outbound pre-connect) and testseed (outbound & inbound) #5270
本次重点更新内容：
1. XTLS Vision 加了试验性的“预连接”以消除延迟，开放用户自定义配置最关键的四个 padding 相关参数，详见 #5270
2. 服务端 sockopt 加了 trustedXForwardedFor 以防止 XHTTP、WS、HU 客户端伪造源 IP，详见 #5331
3. VLESS inbound 开了 Reverse Proxy 的 UUID 将默认被拒绝使用正向代理，更加安全，详见 #5101 (comment)
4. @Meo597 对 DNS 和路由模块进行了一些重构、优化、功能新增，详见下方 change log
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
• TRX(Tron)/USDT/USDC：TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
• TON：UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
• BTC：1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
• XMR：4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
• SOL/USDT/USDC：3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
• ETH/USDT/USDC：0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
• Project X NFT：https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
• VLESS NFT：https://opensea.io/collection/vless
• REALITY NFT：https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
• Related links：VLESS Post-Quantum Encryption, XHTTP：Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.5 拉满 inline 编译，已 tag v1.251208.0，感谢所有贡献者，详见下方 change log
What's Changed
• REALITY config：Return error when short id is too long by @Fangliding @RPRX in #5276
• Fix wireguard not discarding broken connection on android by @Exclude0122 in #5304
• README.md：Add Remnawave & Happ to Sponsors by @RPRX in 4e8ee30
• README.md：Add TRX & TON & BTC & XMR & SOL to Donation & NFTs by @RPRX in 8a4b0a9
• README.md：Add v2rayN to macOS & Linux Clients by @alen420 in #5271
• Socks：Fix buffer full panic when encoding large UDP packets by @vemneyy @Fangliding in #5252
• Docker：Use more aggressive inlining for higher efficiency by @Meo597 in #5242
• Refactor WrapLink logic by @Fangliding in #5288
• HTTP outbound：Read negotiated protocol from uTLS by @hax0r31337 in #5251
• DNS：Fix wrong protocol parse by @vanserox @Fangliding in #5232
• refactor(dns)：enhance cache safety, optimize performance, and refactor query logic by @Meo597 in #5248
• perf(GeoIPMatcher)：faster heuristic matching with reduced memory usage by @Meo597 in #5289
• perf(router)：adjust the order of rules to optimize performance by @Meo597 in #5267
• perf(dns)：cache network capability check by @Meo597 in #5244
• feat(dns)：add optimistic caching by @Meo597 in #5237
• feat(dns)：add parallel query by @Meo597 in #5239
• Router：Remove the deprecated UseIP option by @Meo597 in #5323
• Sockopt config：Add trustedXForwardedFor (for XHTTP, WS, HU inbounds) by @RPRX in #5331
• VLESS Reverse Proxy：Forbid reverse-proxy UUID using forward-proxy, enabled by default by @RPRX in a83253f
• fix(dns)：inheritance issue with disableCache by @Meo597 in #5351
• XTLS Vision：Check TLS record isComplete by @yuhan6665 in #5179
• XTLS Vision：Add testpre (outbound pre-connect) and testseed (outbound & inbound) by @RPRX @Fangliding in #5270
• XTLS Vision：Fix IsCompleteRecord() by @Fangliding in #5365
• XTLS Vision：Discard expired pre-connect conn automatically by @RPRX in c123f16
• XTLS Vision：Fix enabled uplink splice flag by mistake by @yuhan6665 in #5391
• XTLS Vision：LogInfo() → LogDebug() by @RPRX in bd7503d
• Chore：Remove ctlcmd and leftover envvar by @KobeArthurScofield in #5392
New Contributors
• @Exclude0122 made their first contribution in #5304
• @alen420 made their first contribution in #5271
• @vemneyy made their first contribution in #5252
• @vanserox made their first contribution in #5232

XTLS Vision: Add testpre (outbound pre-connect) and testseed (outbound & inbound) #5270
本次重点更新内容：
1. XTLS Vision 加了试验性的“预连接”以消除延迟，开放用户自定义配置最关键的四个 padding 相关参数，详见 #5270
2. 服务端 sockopt 加了 trustedXForwardedFor 以防止 XHTTP、WS、HU 客户端伪造源 IP，详见 #5331
3. VLESS inbound 开了 Reverse Proxy 的 UUID 将默认被拒绝使用正向代理，更加安全，详见 #5101 (comment)
4. @Meo597 对 DNS 和路由模块进行了一些重构、优化、功能新增，详见下方 change log
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.4 拉满 inline 编译，已 tag v1.251202.0，感谢所有贡献者，详见下方 change log
What's Changed
- REALITY config: Return error when short id is too long by @Fangliding @RPRX in #5276
- Fix wireguard not discarding broken connection on android by @Exclude0122 in #5304
- README.md: Add Remnawave & Happ to Sponsors by @RPRX in 4e8ee30
- README.md: Add TRX & TON & BTC & XMR & SOL to Donation & NFTs by @RPRX in 8a4b0a9
- README.md: Add v2rayN to macOS & Linux Clients by @alen420 in #5271
- Socks: Fix buffer full panic when encoding large UDP packets by @vemneyy @Fangliding in #5252
- Docker: Use more aggressive inlining for higher efficiency by @Meo597 in #5242
- Refactor WrapLink logic by @Fangliding in #5288
- HTTP outbound: Read negotiated protocol from uTLS by @hax0r31337 in #5251
- DNS: Fix wrong protocol parse by @vanserox @Fangliding in #5232
- refactor(dns): enhance cache safety, optimize performance, and refactor query logic by @Meo597 in #5248
- perf(GeoIPMatcher): faster heuristic matching with reduced memory usage by @Meo597 in #5289
- perf(router): adjust the order of rules to optimize performance by @Meo597 in #5267
- perf(dns): cache network capability check by @Meo597 in #5244
- feat(dns): add optimistic caching by @Meo597 in #5237
- feat(dns): add parallel query by @Meo597 in #5239
- Router: Remove the deprecated UseIP option by @Meo597 in #5323
- Sockopt config: Add trustedXForwardedFor (for XHTTP, WS, HU inbounds) by @RPRX in #5331
- VLESS Reverse Proxy: Forbid reverse-proxy UUID using forward-proxy, enabled by default by @RPRX in a83253f
- fix(dns): inheritance issue with disableCache by @Meo597 in #5351
- XTLS Vision: Check TLS record isComplete by @yuhan6665 in #5179
- XTLS Vision: Add testpre (outbound pre-connect) and testseed (outbound & inbound) by @RPRX @Fangliding in #5270
- XTLS Vision: Fix IsCompleteRecord() by @Fangliding in #5365
- XTLS Vision: Discard expired pre-connect conn automatically by @RPRX in c123f16
New Contributors
- @Exclude0122 made their first contribution in #5304
- @alen420 made their first contribution in #5271
- @vemneyy made their first contribution in #5252
- @vanserox made their first contribution in #5232
Full Changelog: v25.10.15...v25.12.2

XTLS Vision: Add testpre (outbound pre-connect) and testseed (outbound & inbound) #5270
本次重点更新内容：
1. XTLS Vision 加了试验性的“预连接”以消除延迟，开放用户自定义配置最关键的四个 padding 相关参数，详见 #5270
2. 服务端 sockopt 加了 trustedXForwardedFor 以防止 XHTTP、WS、HU 客户端伪造源 IP，详见 #5331
3. VLESS inbound 开了 Reverse Proxy 的 UUID 将默认被拒绝使用正向代理，更加安全，详见 #5101 (comment)
4. @Meo597 对 DNS 和路由模块进行了一些重构、优化、功能新增，详见下方 change log
Sponsors
Remnawave
Happ
Sponsor Xray-core
Donation & NFTs
Collect a Project X NFT to support the development of Project X!
Project X NFT
- TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
- TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
- BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
- XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
- SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
- ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
- Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
- VLESS NFT: https://opensea.io/collection/vless
- REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
- Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X
该版本升级了一些依赖，并使用 Go 1.25.4 拉满 inline 编译，已 tag v1.251201.0，感谢所有贡献者，详见下方 change log
What's Changed
- REALITY config: Return error when short id is too long by @Fangliding @RPRX in #5276
- Fix wireguard not discarding broken connection on android by @Exclude0122 in #5304
- README.md: Add Remnawave & Happ to Sponsors by @RPRX in 4e8ee30
- README.md: Add TRX & TON & BTC & XMR & SOL to Donation & NFTs by @RPRX in 8a4b0a9
- README.md: Add v2rayN to macOS & Linux Clients by @alen420 in #5271
- Socks: Fix buffer full panic when encoding large UDP packets by @vemneyy @Fangliding in #5252
- Docker: Use more aggressive inlining for higher efficiency by @Meo597 in #5242
- Refactor WrapLink logic by @Fangliding in #5288
- HTTP outbound: Read negotiated protocol from uTLS by @hax0r31337 in #5251
- DNS: Fix wrong protocol parse by @vanserox @Fangliding in #5232
- refactor(dns): enhance cache safety, optimize performance, and refactor query logic by @Meo597 in #5248
- perf(GeoIPMatcher): faster heuristic matching with reduced memory usage by @Meo597 in #5289
- perf(router): adjust the order of rules to optimize performance by @Meo597 in #5267
- perf(dns): cache network capability check by @Meo597 in #5244
- feat(dns): add optimistic caching by @Meo597 in #5237
- feat(dns): add parallel query by @Meo597 in #5239
- Router: Remove the deprecated UseIP option by @Meo597 in #5323
- Sockopt config: Add trustedXForwardedFor (for XHTTP, WS, HU inbounds) by @RPRX in #5331
- VLESS Reverse Proxy: Forbid reverse-proxy UUID using forward-proxy, enabled by default by @RPRX in a83253f
- fix(dns): inheritance issue with disableCache by @Meo597 in #5351
- XTLS Vision: Check TLS record isComplete by @yuhan6665 in #5179
- XTLS Vision: Add testpre (outbound pre-connect) and testseed (outbound & inbound) by @RPRX @Fangliding in #5270
New Contributors
- @Exclude0122 made their first contribution in #5304
- @alen420 made their first contribution in #5271
- @vemneyy made their first contribution in #5252
- @vanserox made their first contribution in #5232
Full Changelog: v25.10.15...v25.12.1

VLESS Reverse Proxy: Transfer real Source & Local (IP & port), enabled by default #5101 (comment)
本次重点更新内容：
1. VLESS Reverse Proxy 默认加了传递公网端的 Source & Local (IP & port) 到内网端，详见 #5101 (comment)
2. 升级了 uTLS 库以修复 Chrome 指纹的问题，客户端应当尽快升级，详见 #5230 (comment)
3. 看到很多小白不会配置 XHTTP XMUX 还抱怨测速不理想，索性把 maxConcurrency 默认改为了 1 试试
4. @KobeArthurScofield 参考 VLESS 出站简化了所有协议的出站配置，并且现在每个出站只能有一个 end point 和 user
VLESS NFT
VLESS NFT 自成一个系列，每个图片都不同且只有一个，你可以选择自己喜欢的图片来收藏，先到先得
https://opensea.io/collection/vless 首发放出了二十个不同的 VLESS NFT 图片
本次还放出了两个稀缺的 Project X NFT，如果你有余力，请支持一下：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本升级了一些依赖，并使用 Go 1.25.3 拉满 inline 编译，已 tag v1.251015.0，感谢所有贡献者，详见下方 change log
What's Changed
- app/dispatcher/default.go: Add comment on run-time rejecting non-existent outbound tag by @RPRX in 5148c57
- app/dispatcher/default.go: Close link when routedDispatch() failed by @patterniha in #5131
- Config: Outbound proxy config no need to be nested by @KobeArthurScofield in #5124
- Outbound: One endpoint and at most one user only by @KobeArthurScofield in #5144
- Fix vless reverse panic in vision by @Fangliding in #5189
- External config: Add unix socket HTTP loader support by @kastov in #5200
- fix: darwin arm64 always has AESGCMHardwareSupport by @wwqgtxx in #5176
- Fix shadowsocks2022 memory leak by @Fangliding in #5166
- transport/internet/reality/reality.go: Safely get negotiated CurveID in VerifyPeerCertificate() by @RPRX in 40f0a54
- README.md: Add PasarGuard to Web Panels by @M03ED in #5224
- Router: Use built-in-dns only once for all rules (in "IPOnDemand"/"IPIfNonMatch" mode) by @patterniha in #5210
- XHTTP client: Change default maxConcurrency to 1 for speed testing by @RPRX in 9cc7907
- VLESS Reverse Proxy: Transfer real Source & Local (IP & port), enabled by default by @RPRX in 12f4a01
New Contributors
- @wwqgtxx made their first contribution in #5176
Full Changelog: v25.9.11...v25.10.15

VLESS protocol: Add Reverse Proxy (4) Command and extremely simple config #5101
reverse
Xray-core v25.9.10 极大程度上简化了反向代理 / 内网穿透、VLESS 出站的配置，极简配置示例与安全注意事项详见 #5101
> 这个 PR 的目的就是为了让 Xray 更适合做反向代理 / 内网穿透，独特的优势是你可以直接复用拿来翻墙的那台 VPS、复用 REALITY 的抗量子加密且防封，因为 REALITY 不仅可以稳定地穿透 GFW，也可以穿透公司网络那些奇奇怪怪的审计
> 内网端可以设 CDN 等多条冗余线路均为 "reverse": { "tag": "yyy" } 对应公网端多个相同的 "reverse": { "tag": "xxx" }，这也是 Xray-core / VLESS 做反向代理 / 内网穿透的优势之一
VLESS NFT
VLESS NFT 自成一个系列，每个图片都不同且只有一个，你可以选择自己喜欢的图片来收藏，先到先得
https://opensea.io/collection/vless 首发放出了二十个不同的 VLESS NFT 图片
本次还放出了两个稀缺的 Project X NFT，如果你有余力，请支持一下：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本升级了一些依赖，并使用 Go 1.25.1 拉满 inline 编译，已 tag v1.250910.0，感谢所有贡献者，详见下方 change log
What's Changed
- app/reverse/bridge.go: Fix DispatchLink() returns immediately by @RPRX in 6ec0291
- app/reverse/portal.go: Fix HandleConnection() returns immediately (from DispatchLink() with configured domain) by @RPRX in 4b0ee28
- app/reverse/portal.go: Fix goroutine leak & Add EndpointOverride by @patterniha in #5100
- Commands: Fix "with SNI" printing fixed port 443 for tls ping by @AndyChiang888 in #5099
- mKCP: Fix key derivation for obfuscation by @Fangliding in #5106
- VMess: Returns clearer error in AuthIDDecoderHolder by @Fangliding in #5090
- VLESS protocol: Add Reverse Proxy (4) Command and extremely simple config by @RPRX in #5101
- README.md: Add X-Panel to Web Panels by @xeefei in #5094
- Update github.com/xtls/reality to 20250904214705 by @RPRX in 4ae4971
- TPROXY: Prevent TCP loopback by @Fangliding in #5114
- MUX: Prevent goroutine leak by @patterniha in #5110
New Contributors
- @AndyChiang888 made their first contribution in #5099
- @xeefei made their first contribution in #5094
Full Changelog: v25.9.5...v25.9.10

VLESS protocol: Add lightweight, Post-Quantum ML-KEM-768-based PFS 1-RTT / anti-replay 0-RTT AEAD Encryption #5067
compare
Xray-core v25.9.5 未来已来，本次重点更新内容：
过̶于̶先̶进̶的̶ VLESS Post-Quantum Encryption：
- 抗量子的密钥交换与身份认证、前向安全、客户端配置安全、0-RTT
- 无需对时、完美的重放防护、无需多次尝试解密以确定用户、无需额外 AEAD length 故性能更优
- 建议开 XTLS 避免二次加解密（native/xorpub 可自动 ReadV/Splice），可再叠上 XHTTP、WS 等传输层，详见 #5067
适̶合̶机̶场̶的̶ VLESS Route：
- 允许在分享给客户端的 UUID 中自定义第 7、8 个字节
- 服务端路由设置 vleesRoute 以匹配它们、分流不同出口，详见 https://xtls.github.io/config/routing.html#ruleobject
利̶好̶ ̶i̶O̶S̶ ̶的̶ 客户端性能提升：
- Tunnel/Socks/HTTP 入站去掉了 pipe 及其内置缓存，Xray-core 运行效率更高、占用内存更少，详见 #5067 (comment)
Xray-core v25.9.5 相较于 v25.8.31：
- 修复了延迟问题 fd54b10 、用户流量统计问题 d20397c
- VLESS 入站也去掉了 pipe 及其内置缓存 #5076
- 新增了 ./xray vlessenc 指令 #5078
- 以及其它的一些修复与改进
VLESS NFT
VLESS NFT 自成一个系列，每个图片都不同且只有一个，你可以选择自己喜欢的图片来收藏，先到先得
https://opensea.io/collection/vless 首发放出了二十个不同的 VLESS NFT 图片
本次还放出了两个稀缺的 Project X NFT，如果你有余力，请支持一下：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本升级了一些依赖，并使用 Go 1.25.1 拉满 inline 编译，已 tag v1.250905.0，感谢所有贡献者，详见下方 change log
What's Changed
- API: Fix user online map remain 1 after connection dropped by @LjhAUMEM in #4982
- feat(api): update timestamp for existing IPs in AddIP instead of skipping by @LjhAUMEM in #4989
- Router: Add localIP and localPort; Add sourceIP as an alias of source by @patterniha in #4992
- Freedom: Add maxSplit fragment option; Add applyTo noises option by @patterniha in #4998
- Refine must2 and apply NewAesGcm() to all usage by @Fangliding in #5011
- Chore: Migrate to Go 1.25 by @Fangliding in #5024
- common/buf/multi_buffer.go: Fix Compact() by @Fangliding @patterniha in #5015
- XHTTP client: Fix edge-case issue for packet-up mode by @Fangliding in #5020
- Outbound: Add targetStrategy; Fix mux does not close link.Reader; Fix origin does not work on UDP; Add logs by @patterniha in #5006
- VLESS inbound: Add option to set default flow by @Jolymmiles in #5023
- Build: Use more aggressive inlining for higher efficiency by @KobeArthurScofield in #5026
- Direct/Freedom config: Add targetStrategy as an alias of domainStrategy; Routing config: Remove domainMatcher, "linear" and type by @patterniha in #5027
- DNS outbound: Set "reject" as the default value for nonIPQuery by @RPRX in de23e51
- VLESS practice: Use user-sent VLESS UUID's last byte as vlessRoute for routing rules by @RPRX in 105b306
- Wireguard inbound: Fix context sharing problem by @yuhan6665 in #4988
- XTLS Vision inbound: Use user-sent VLESS UUID for NewTrafficState() by @RPRX in 5464862
- VLESS practice: Use user-sent VLESS UUID's 7th<<8 | 8th bytes as vlessRoute instead by @RPRX in 7f300db
- Issues template: Refine requirements by @Fangliding in 573300b
- Chore: Optimize .gitignore by @Skh-web6982 in #5029
- Some refines related to direct/freedom and targetStrategy; More intelligent "useIP"/"ForceIP", enhance "origin" functionality by @patterniha in #5030
- Commands: Add -outpbfile for convert pb by @KobeArthurScofield in #5048
- common/signal/timer.go: Refator to use sync.Once by @Fangliding in #5052
- WireGuard outbound: Fix close closed by @Fangliding in #5054
- checkSystemNetwork(): Use c.root-servers.net by @xqzr in #5059
- Test_parseResponse(t *testing.T): Use dns.google for IPv6 by @xqzr in #5060
- VLESS protocol: Add lightweight, Post-Quantum ML-KEM-768-based PFS 1-RTT / anti-replay 0-RTT AEAD Encryption by @RPRX in #5067
- README.md: Update Donation & NFTs by @RPRX in 702d2c0
- Update github.com/xtls/reality to 20250828044527 by @RPRX in 12b077f
- Socks/HTTP inbound: Fix unexpected rawConn copy by @Fangliding in #5041
- First step of upcoming refactor for Xray-core: Add TimeoutWrapperReader; Use DispatchLink() in Tunnel/Socks/HTTP inbounds by @RPRX in 56a45ad
- VLESS Encryption: Re-add automatically ChaCha20-Poly1305 by @RPRX in 82ea7a3
- Trojan-UoT & UDP-nameserver: Fix forgotten release buffer; UDP dispatcher: Simplified and optimized by @patterniha in #5050
- Trojan UoT: Fix memory/gor

VLESS protocol: Add lightweight, Post-Quantum ML-KEM-768-based PFS 1-RTT / anti-replay 0-RTT AEAD Encryption #5067
compare
Xray-core v25.8.31 未来已来，本次重点更新内容：
过̶于̶先̶进̶的̶ VLESS Post-Quantum Encryption：
- 抗量子的密钥交换与身份认证、前向安全、客户端配置安全、0-RTT
- 无需对时、完备的重放防护、无需多次尝试解密以确定用户、无需加密 length 故性能更优
- 可选 XTLS 裸奔/ReadV/Splice 把性能拉满、再叠上 XHTTP/WS 等传输层，详见 #5067
适̶合̶机̶场̶的̶ VLESS Route：
- 允许在分享给客户端的 UUID 中自定义第 7、8 个字节
- 服务端路由设置 vleesRoute 以匹配它们、分流不同出口，详见 https://xtls.github.io/config/routing.html#ruleobject
利̶好̶ ̶i̶O̶S̶ ̶的̶ 客户端性能提升：
- Tunnel/Socks/HTTP 入站去掉了 pipe 和内置缓存，Xray-core 运行效率更高、占用内存更少，详见 #5067 (comment)
VLESS NFT
VLESS NFT 自成一个系列，每个图片都不同且只有一个，你可以选择自己喜欢的图片来收藏，先到先得
https://opensea.io/collection/vless 首发放出了二十个不同的 VLESS NFT 图片
本次还放出了两个稀缺的 Project X NFT，如果你有余力，请支持一下：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本升级了一些依赖，并使用 Go 1.25.0 拉满 inline 编译，已 tag v1.250831.0，感谢所有贡献者，详见下方 change log
What's Changed
- API: Fix user online map remain 1 after connection dropped by @LjhAUMEM in #4982
- feat(api): update timestamp for existing IPs in AddIP instead of skipping by @LjhAUMEM in #4989
- Router: Add localIP and localPort; Add sourceIP as an alias of source by @patterniha in #4992
- Freedom: Add maxSplit fragment option; Add applyTo noises option by @patterniha in #4998
- Refine must2 and apply NewAesGcm() to all usage by @Fangliding in #5011
- Chore: Migrate to Go 1.25 by @Fangliding in #5024
- common/buf/multi_buffer.go: Fix Compact() by @Fangliding @patterniha in #5015
- XHTTP client: Fix edge-case issue for packet-up mode by @Fangliding in #5020
- Outbound: Add targetStrategy; Fix mux does not close link.Reader; Fix origin does not work on UDP; Add logs by @patterniha in #5006
- VLESS inbound: Add option to set default flow by @Jolymmiles in #5023
- Build: Use more aggressive inlining for higher efficiency by @KobeArthurScofield in #5026
- Direct/Freedom config: Add targetStrategy as an alias of domainStrategy; Routing config: Remove domainMatcher, "linear" and type by @patterniha in #5027
- DNS outbound: Set "reject" as the default value for nonIPQuery by @RPRX in de23e51
- VLESS practice: Use user-sent VLESS UUID's last byte as vlessRoute for routing rules by @RPRX in 105b306
- Wireguard inbound: Fix context sharing problem by @yuhan6665 in #4988
- XTLS Vision inbound: Use user-sent VLESS UUID for NewTrafficState() by @RPRX in 5464862
- VLESS practice: Use user-sent VLESS UUID's 7th<<8 | 8th bytes as vlessRoute instead by @RPRX in 7f300db
- Issues template: Refine requirements by @Fangliding in 573300b
- Chore: Optimize .gitignore by @Skh-web6982 in #5029
- Some refines related to direct/freedom and targetStrategy; More intelligent "useIP"/"ForceIP", enhance "origin" functionality by @patterniha in #5030
- Commands: Add -outpbfile for convert pb by @KobeArthurScofield in #5048
- common/signal/timer.go: Refator to use sync.Once by @Fangliding in #5052
- WireGuard outbound: Fix close closed by @Fangliding in #5054
- checkSystemNetwork(): Use c.root-servers.net by @xqzr in #5059
- Test_parseResponse(t *testing.T): Use dns.google for IPv6 by @xqzr in #5060
- VLESS protocol: Add lightweight, Post-Quantum ML-KEM-768-based PFS 1-RTT / anti-replay 0-RTT AEAD Encryption by @RPRX in #5067
- README.md: Update Donation & NFTs by @RPRX in 702d2c0
- Update github.com/xtls/reality to 20250828044527 by @RPRX in 12b077f
- Socks/HTTP inbound: Fix unexpected rawConn copy by @Fangliding in #5041
- First step of upcoming refactor for Xray-core: Add TimeoutWrapperReader; Use DispatchLink() in Tunnel/Socks/HTTP inbounds by @RPRX in 56a45ad
- VLESS Encryption: Re-add automatically ChaCha20-Poly1305 by @RPRX in 82ea7a3
- Trojan-UoT & UDP-nameserver: Fix forgotten release buffer; UDP dispatcher: Simplified and optimized by @patterniha in #5050
- Trojan UoT: Fix memory/goroutine leak by @patterniha in #5064
- common/buf/buffer.go: Replace copy zero with clear() by @Fangliding @SkrideOne in #5071
- Commands/run: Try all suffixes for default c

Tunnel inbound: Add portMap config (local listening port -> remote specified address/port) 146b14a #4968 & TLS ECH client improvements #4973 #4949
*ray 一直支持”隧道“即”通过代理协议来端口转发“功能，此前主要由于命名原因（任意门）导致该功能被忽略，现在更名为了 tunnel、为原有的 address/port 参数设置了默认值、新增了优先级更高的 portMap 参数，简化配置后一个入站即可将本地多个端口通过代理协议转发到服务端对应的端口，或指定的地址/端口，详情见 #4968
这̶也̶提̶醒̶各̶位̶记̶得̶在̶服̶务̶端̶ ̶b̶l̶o̶c̶k̶ ̶"̶g̶e̶o̶i̶p̶:̶p̶r̶i̶v̶a̶t̶e̶"̶，̶防̶止̶用̶户̶通̶过̶代̶理̶直̶接̶穿̶透̶到̶服̶务̶端̶的̶内̶网̶
TLS ECH client：@Fangliding 新增了 echForceQuery 参数以支持三种需求 #4973 ，@patterniha 复制了 Xray-core 内置 DoH 已有的特性：Chrome 指纹、header & body padding、"h2c"、echSockopt #4949 ，文档见 TLSObject
Xray-core 根配置新增 version 参数，以限制该配置文件适用的最低、最高 Xray 版本：#4970
"version": {
"min": "25.8.3",
"max": ""
}
NFT
本次久违地放出了一些 REALITY NFT 和几个 Project X NFT
请支持一个 REALITY NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
如果你有余力，请支持一个 Project X NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本使用 Go 1.24.5 编译，已 tag v1.250803.0，感谢所有贡献者，详见下方 change log
What's Changed
- Update readme by @yuhan6665 in c569f47
- Dokodemo-door: Add simple tunnel config (alias and default values) by @RPRX in #4968
- TLS ECH client: Add echForceQuery config by @Fangliding in #4947
- Tunnel inbound: Add portMap config (local listening port -> remote specified address/port) by @RPRX in 146b14a
- TLS ECH client: Use chrome-fingerprint and add padding; Add "h2c" and echSockopt; Fix some issues by @patterniha in #4949
- Root config: Add version config (min and max) by @patterniha in #4970
- TLS ECH client: echForceQuery "full" / "half" / "none" (default) by @Fangliding in #4973
- app/proxyman/inbound/inbound.go: Fix ListHandlers() by @Fangliding in #4976
- UDS: Check address before listen by @Fangliding in #4945
Full Changelog: v25.7.26...v25.8.3

REALITY protocol: Add optional Post-Quantum ML-DSA-65 verification for cert's ExtraExtensions #4915 & TLS client & server: Support ECH #3813
REALITY 抗量子更新第二弹来袭！本次更新为 REALITY 协议加上了可选的、抗量子的 ML-DSA-65 签名验签机制，向后兼容，详情见 #4915 ，注意目标网站证书链总长度需 3500+，VLESS 分享链接标准 #716 已更新 REALITY pqv
该版本修复了 post-handshake records 的日志问题 #4845 、端口范围问题 #4843 ，将启动时探测改为并发并优化了缓存机制 XTLS/REALITY@e62c4ae 、改为用三种 ALPN 进行探测 XTLS/REALITY@05a351a ，已经 cover 绝大多数客户端指纹
时机成熟后，该版本终于合并了 TLS ECH 功能 #3813 ，文档见 XTLS/Xray-docs-next@b9a72a4 ，#716 已更新 TLS ech
该版本还新增了一些功能，比如 @Fangliding 给 DNS 出站的 nonIPQuery 加了 "reject" 以对非 IP 查询回复拒绝包 #4824 ，该版本还含有大量修复，据 @patterniha 称 Serverless-for-Iran-Anti-Sanctions 终于等齐了所有新功能和修复，即将更新
NFT
本次久违地放出了一些 REALITY NFT 和几个 Project X NFT
请支持一个 REALITY NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
如果你有余力，请支持一个 Project X NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本升级了一些依赖，并使用 Go 1.24.5 编译，已 tag v1.250726.0，感谢所有贡献者，详见下方 change log
What's Changed
- BurstObservatory: add option to set http method for burst check by @Jolymmiles @Fangliding in #4835
- API: Fix issue with inbounduser not finding emails with uppercase letters by @fL1pSt3r in #4818
- DNS: Add new nonIPQuery "reject" by @Fangliding in #4824
- common: fix task leak in timer by @isluckys in #4831
- API: add option to fetch only tags from ListInbounds by @Jolymmiles in #4870
- Bump quic-go to v0.53.0 & update codes by @xDragonZ in #4906
- REALITY server: Three types of ALPN for post-handshake records detection & imitation; Two fixes by @RPRX in 1785178
- README.md: Add AnyPortal to GUI Clients by @AnyPortal in #4902
- VLESS fallbacks: dest defaults to "127.0.0.1" -> "localhost" by @xqzr in #4840
- Commands: Display Post-Quantum key exchange in tls ping by @Fangliding in #4857
- Stats API: Return status "not found" instead of "unknown" by @M03ED in #4860
- Workflows: Cleaner Docker builds, support for manual exec and pre-release by @Meo597 in #4809
- DNS outbound: Prevent panic from rejecting invalid domain by @Fangliding in #4903
- REALITY protocol: Add optional Post-Quantum ML-DSA-65 verification for cert's ExtraExtensions by @RPRX in #4915
- Freedom: Cache UDP resolve result by @Fangliding in #4804
- Freedom: Fix UDP reply mismatch-address by @patterniha in #4816
- MUX: Refine and Fix some occasional problems by @patterniha in #4861
- Reverse: portal-worker should not be closed before making sure there is at least one other active worker by @patterniha in #4869
- UDP: Fix removeRay will close a connEntry that not belongs to it by @Fangliding in #4899
- DNS hosts: Support returning RCode by @j2rong4cn in #4681
- README.md: Add Happ to macOS x64 & tvOS Clients by @mangustyura @RPRX in #4921
- README.md: Add GoXRay to macOS & Linux Clients by @garstas @RPRX in #4260
- README.md: Add Project X NFT's image & link by @RPRX in a196a16
- Update github.com/xtls/reality to 20250723121014 by @RPRX in 4433641
- Chore: Three small fixes by @patterniha in #4922
- REALITY config: Allow mldsa65 fields to be empty by @Fangliding in #4924
- REALITY config: Convert mldsa65Seed to its private key later by @RPRX in 31b508d
- README.md: Update Donation & NFTs by @RPRX in 26de589
- REALITY client: Fix log when printing "is using X25519MLKEM768..." by @Fangliding in #4929
- Commands: Output certificate chain's total length in tls ping by @Fangliding @RPRX in #4933
- Inbounds & Outbounds: TCP KeepAlive better default value by @Fangliding in #4931
- Update github.com/xtls/reality to 20250725142056 by @RPRX in caee152
- UDP: Remove removeRay()'s error log by @Fangliding in #4936
- Workflows: Fix github.ref_name sometimes is empty when building Docker images by @Meo597 in #4937
- UDP listener: Allow listening on "localhost" by @Fangliding in #4940
- Freedom UDP: Fix some cone uses like STUN,... when address is domain by @patterniha in #4942
- REALITY config: mldsa65Seed and privateKey can not be the same value by @RPRX in 5f93ff6
- Commands: Add 

REALITY protocol: Add optional Post-Quantum ML-DSA-65 verification for cert's ExtraExtensions #4915
REALITY 抗量子更新第二弹来袭！本次更新为 REALITY 协议加上了可选的、抗量子的 ML-DSA-65 签名验签机制，向后兼容，详见 #4915 ，注意目标网站证书链总长度需 3500+，VLESS 分享链接标准 #716 已更新 REALITY pqv
该版本修复了 post-handshake records 的日志问题 #4845 、端口范围问题 #4843 ，将启动时探测改为并发并优化了缓存机制 XTLS/REALITY@e62c4ae 、改为用三种 ALPN 进行探测 XTLS/REALITY@05a351a ，已经 cover 绝大多数客户端指纹
该版本还新增了一些功能，比如 @Fangliding 给 DNS 出站的 nonIPQuery 加了 "reject" 以对非 IP 查询回复拒绝包 #4824 ，该版本还含有大量修复，据 @patterniha 称 Serverless-for-Iran-Anti-Sanctions 终于等齐了所有新功能和修复，即将更新
请支持一个 REALITY NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
如果你有余力，请支持一个 Project X NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本升级了一些依赖，并使用 Go 1.24.5 编译，已 tag v1.250725.0，感谢所有贡献者，详见下方 change log
What's Changed
- BurstObservatory: add option to set http method for burst check by @Jolymmiles @Fangliding in #4835
- API: Fix issue with inbounduser not finding emails with uppercase letters by @fL1pSt3r in #4818
- DNS: Add new nonIPQuery "reject" by @Fangliding in #4824
- common: fix task leak in timer by @isluckys in #4831
- API: add option to fetch only tags from ListInbounds by @Jolymmiles in #4870
- Bump quic-go to v0.53.0 & update codes by @xDragonZ in #4906
- REALITY server: Three types of ALPN for post-handshake records detection & imitation; Two fixes by @RPRX in 1785178
- README.md: Add AnyPortal to GUI Clients by @AnyPortal in #4902
- VLESS fallbacks: dest defaults to "127.0.0.1" -> "localhost" by @xqzr in #4840
- Commands: Display Post-Quantum key exchange in tls ping by @Fangliding in #4857
- Stats API: Return status "not found" instead of "unknown" by @M03ED in #4860
- Workflows: Cleaner Docker builds, support for manual exec and pre-release by @Meo597 in #4809
- DNS outbound: Prevent panic from rejecting invalid domain by @Fangliding in #4903
- REALITY protocol: Add optional Post-Quantum ML-DSA-65 verification for cert's ExtraExtensions by @RPRX in #4915
- Freedom: Cache UDP resolve result by @Fangliding in #4804
- Freedom: Fix UDP reply mismatch-address by @patterniha in #4816
- MUX: Refine and Fix some occasional problems by @patterniha in #4861
- Reverse: portal-worker should not be closed before making sure there is at least one other active worker by @patterniha in #4869
- UDP: Fix removeRay will close a connEntry that not belongs to it by @Fangliding in #4899
- DNS hosts: Support returning RCode by @j2rong4cn in #4681
- README.md: Add Happ to macOS x64 & tvOS Clients by @mangustyura @RPRX in #4921
- README.md: Add GoXRay to macOS & Linux Clients by @garstas @RPRX in #4260
- README.md: Add Project X NFT's image & link by @RPRX in a196a16
- Update github.com/xtls/reality to 20250723121014 by @RPRX in 4433641
- Chore: Three small fixes by @patterniha in #4922
- REALITY config: Allow mldsa65 fields to be empty by @Fangliding in #4924
- REALITY config: Convert mldsa65Seed to its private key later by @RPRX in 31b508d
- README.md: Update Donation & NFTs by @RPRX in 26de589
- REALITY client: Fix log when printing "is using X25519MLKEM768..." by @Fangliding in #4929
- Commands: Output certificate chain's total length in tls ping by @Fangliding @RPRX in #4933
- Inbounds & Outbounds: TCP KeepAlive better default value by @Fangliding in #4931
New Contributors
- @Jolymmiles made their first contribution in #4835
- @fL1pSt3r made their first contribution in #4818
- @xDragonZ made their first contribution in #4906
- @AnyPortal made their first contribution in #4902
- @M03ED made their first contribution in #4860
- @garstas made their first contribution in #4260
Full Changelog: v25.6.8...v25.7.25

REALITY practice: Detect & imitate target's post-handshake records
#4778 提到 @ban6cat6 发布了检测工具 Aparecium，通过检测“未模仿 OpenSSL 握手后发的两个 NewSessionTicket”来检测 REALITY、ShadowTLS 等可以“偷别人”的协议，对此，Xray 团队迅速响应，研究并着手修复该问题
该版本 REALITY 服务端启动后会用 Chrome 指纹自动探测 target 的 post-handshake records 长度，耗时半分钟左右（期间会阻塞代理请求），并在后续的 REALITY 连接中模仿发送这些 records，从而初步修复了上述问题，请大家尽快升级服务端
再次感谢 @ban6cat6 的发现，与此同时，Xray 团队对这类问题的响应与修复速度也非常值得骄傲
该版本还重点修复了上个版本中 REALITY 服务端未用上 AES-NI 硬件加速导致性能下降的问题 #4741 ，以及合并了 REALITY 回落限速、Happy Eyeballs、DNS New Features 等重要 PR，Serverless-for-Iran 预计会有更新
请支持一个 REALITY NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
如果你有余力，请支持一个 Project X NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本升级了一些依赖，并使用 Go 1.24.4 编译，已 tag v1.250608.0，感谢所有贡献者，详见下方 change log
What's Changed
- README.md: Rename FoXray to OneXray in GUI Clients by @yiguodev in #4754
- Update reality to 20250527 by @yuhan6665 in 84c8e24
- BurstObservatory: Fix nil panic when pingConfig is missing by @Fangliding in #4757
- Core: Export the running bool by @CodeWithTamim in #4775
- Workflows: Refactor docker by @Meo597 in #4738
- API: Add ListInbounds and ListOutbounds by @gsergey418 in #4723
- Outbound: Fix sendthrough srcip precheck by @ImAubrey @RPRX in #4750
- DNS New Features: disableCache, finalQuery, unexpectedIPs, "*", UseSystem-queryStrategy, useSystemHosts by @patterniha in #4666
- README.md: Add Amnezia VPN to Others by @yuhan6665 in #4718
- REALITY practice: Detect & imitate target's post-handshake records by @RPRX in ab0b9a6
- Sniffer-destOverride: Remove fakedns+others option by @patterniha in #4739
- README.md: Add VPainLess to One Click by @vpainless @RPRX in #4782
- README.md: Add SimpleXray to Android Clients by @lhear in #4761
- Update github.com/xtls/reality to 20250607105625 by @RPRX in bfbccc2
- New feature: Happy Eyeballs (RFC 8305) by @patterniha in #4667
- Tests: Fix TestCommanderListHandlers by @Meo597 in #4789
- Tests: Real fix for TestCommanderListHandlers by @Meo597 in #4792
- Docker: Fix geodata directory permissions issue by @Meo597 in #4790
- README.md: Add DeepWiki badge to Contributing by @TonyMa1 @RPRX in #4777
- RAW transport hub.go: Call REALITY's DetectPostHandshakeRecordsLens() in advance by @RPRX in e011b74
- REALITY: Add rate limiting to fallback handling via token bucket by @Meo597 in #4553
- README.md: Add xtls-sdk to Xray Wrapper by @kastov in #4793
- README.md: Add GorzRay to Linux Clients by @ketetefid in #4767
New Contributors
- @CodeWithTamim made their first contribution in #4775
- @gsergey418 made their first contribution in #4723
- @vpainless made their first contribution in #4782
- @lhear made their first contribution in #4761
- @TonyMa1 made their first contribution in #4777
- @kastov made their first contribution in #4793
- @ketetefid made their first contribution in #4767
Full Changelog: v25.5.16...v25.6.8

REALITY practice: Support X25519MLKEM768 for TLS' communication
REALITY 抗量子更新第一弹来袭！升级服务端、客户端至该版本，REALITY target 支持 X25519MLKEM768 时将自动启用
X25519MLKEM768 可有效预防被“现在记录、以后拿量子计算机解密 TLS 流量”，此外 #3813 (comment)
最近有越来越多的网站开始支持 X25519MLKEM768 了，所以服务端一定要及时升级，避免新版客户端连不上
感谢 @yuhan6665 对 REALITY 仓库的维护，以及 @mingyech @BRUHItsABunny 对 uTLS 仓库的维护
此外从上个版本开始，auto mode 的 XHTTP TLS 默认改为 packet-up，XHTTP REALITY 默认仍为 stream-one
请支持一个 REALITY NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
如果你有余力，请支持一个 Project X NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
该版本升级了一些依赖，并使用 Go 1.24.3 编译，感谢所有贡献者，详见下方 change log
What's Changed
- README.md: Add Remnawave to Web Panels by @iambabyninja in #4498
- API: Fix data race in online ipList by @Fangliding in #4513
- DNS: Ensure order for DNS server match by @Fangliding in #4510
- DNS: Add allowUnexpectedIPs for DnsServerObject by @patterniha in #4497
- DNS: Add tag for DnsServerObject by @Fangliding in #4515
- DNS: Retry with EDNS0 when response is truncated by @Fangliding in #4516
- DNS: Add timeoutMs for DnsServerObject by @patterniha in #4523
- Sockopt: Fix Windows UDP interface bind; Allow Linux customSockopt work for UDP by @Fangliding in #4504
- DNS DoH: Use EDNS0 with 100-300 padding by default (body padding) by @RPRX in 607c2a6
- Env: Add XRAY_LOCATION_CERT variable by @patterniha @RPRX in #4536
- DNS: Support returning upstream TTL to clients by @Meo597 in #4526
- DNS: Add expectedIPs as an alias of expectIPs by @patterniha in #4551
- HTTP inbound: Directly forward plain HTTP 1xx response header by @Fangliding in #4547
- Chore: Optimize .gitignore by @Pk-web6936 in #4564
- DNS: Use cache for NXDOMAIN (rcode 3 error) by @patterniha in #4560
- Sockopt: Fix Windows Multicast interface bind by @xqzr in #4568
- WireGuard: Improve config error handling; Prevent panic in case of errors during server initialization by @IlyaGulya in #4566
- Dialer: Do not use ListenSystemPacket() when dialing UDP by @RPRX in 8284a0e
- Sockopt: Fix Darwin (macOS, iOS...) UDP interface bind by @92613hjh in #4530
- Sockopt: Allow listen v6only work for Windows & Darwin by @xqzr @RPRX in #4571
- Config: Implement missing MarshalJSON for structs having custom UnmarshalJSON by @ragavpr in #4585
- Sockopt: Use Windows syscall by @xqzr in #4581
- Fix issues related to android client by @Cl-He-O in #4616
- Sockopt: Allow customSockopt work for Windows & Darwin by @Fangliding in #4576
- README.md: Add Loon to Others by @RPRX in 8212325
- README.md: Rename Clash.Meta to mihomo in Others by @RPRX in 2916b1b
- XHTTP client: Set packet-up as the default mode (auto) when using TLS by @RPRX in 0995fa4
- Sockopt: Fix Windows IP_MULTICAST_IF & IPV6_MULTICAST_IF by @xqzr in #4627
- DNS log: Optimize IP address display by @ddatsh in #4630
- uTLS: Add new fingerprints by @yuhan6665 in a608c5a
- QUIC sniffer: Full support for handling multiple initial packets by @j2rong4cn @RPRX @Vigilans @xiaokangwang @dyhkwong in #4642
- buffer.go: Ensure extended part by Extend() & Resize() are all-zero by @RPRX in 2eed70e
- QUIC sniffer: Optimize the code by @j2rong4cn in #4655
- Sockopt: Fix some domainStrategy & dialerProxy bugs by @patterniha in #4661
- DNS: Fix some bugs; Refactors; Optimizations by @patterniha in #4659
- Workflows: Build Android(7+) using NDK; Add Android(7+) amd64 build by @j2rong4cn in #4664
- Chore: Update gVisor to the latest version; Fmt .go files by @Pk-web6936 in #4663
- Improve random IP compatibility: support IPv4, add srcip option, and sync client source IP via sendthrough by @ImAubrey in #4671
- DNS: Extend hosts Abilities by @patterniha in #4673
- Workflows: Authenticating the GitHub API call with GitHub token by @yin1999 in #4703
- DNS-Hosts: appending matched-results again by @patterniha @Fangliding in #4702
- Workflows: Ensure Geodat exists by @Meo597 in #4680
- Removing code that was not being executed and should not be executed. by @patterniha in #4721
- REA

Xray-core 四月累积更新版本，主要包含大量修复，以及 XHTTP TLS 默认改为 packet-up，XHTTP REALITY 默认仍为 stream-one
> Xray-core v25.4.30 已转为 latest 以触发更大范围的测试，目前的发布策略是即使没有 release notes，每两个版本标一个 latest，有 release notes 时再标 v1.250306.0 这样的兼容性 tag
>
> 小火箭 TF 版已支持 XHTTP，大家可以测测，如果有问题请反馈过去
Full Changelog: v25.3.31...v25.4.30

XHTTP: Beyond REALITY #4113 & MITM-Domain-Fronting
距离上次写 release notes 已过了近三个月，在此期间 XHTTP 积累了大量的改进与修复，其中感知最明显的是逐步将 HTTP request header 的 path padding 迁移至了 Referer header 以避免产生过长的日志（由 @rPDmYQ 提出），以及逐步修复了 stream-up 通过 CF 时连接 100 秒后被掐断的问题，请查看 commit history 及第四版 XHTTP: Beyond REALITY。
XHTTP 服务端需要及时升级至该版本，以支持新版 XHTTP 客户端。
另一项重点开发的功能是 MITM-Domain-Fronting：
- 比如现在你可以用 Xray 对浏览器发出的 TLS MITM 并强制域前置，以实现无代理服务器直连一些被 GFW 封锁的网站。
- Xray 内置 DNS 也加了 h2c:// 以搭配 freedom 出站实现内置 DoH 域前置，它正好可以绕过近期 GFW 对 DoH 的封锁。并且 Xray 内置 DoH 现在均默认使用 Chrome 指纹、加了 header padding。
- @patterniha 分享出了适用于伊朗的完整 serverless 配置，包括 TCP/TLS fragment 和 UDP noises：Serverless-for-Iran。Please join the official Xray Iranian group https://t.me/projectXhttp for more information.
请支持一个 REALITY NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
如果你有余力，请支持一个 Project X NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
Xray 接下来的重心转向 Vision Seed & VLESS Encryption，Windows Tun & GUI Client，以及 ECH 和 REALITY 抗量子更新。
最低 Go 版本要求已升至 Go 1.24+，@KobeArthurScofield 正在维护 https://github.com/XTLS/go-win7 以继续支持 Win7。
虽然我们 tag 了 v1.250306.0，但目前仅打算在稳定版时更新这种 tag，所以如果你的项目需要追新，仍需指定 commit id。
What's Changed
- XHTTP XMUX: Fix OpenUsage never gets reduced by @RPRX in 1410b63
- XHTTP client: Make H3 httptrace work on v2rayNG by @RPRX in 53b04d5
- XHTTP client: Merge Open* into OpenStream(), and more by @RPRX in db934f0
- DNS: Always use a DNS Message ID of 0 for DoH and DoQ by @maoxikun @dyhkwong in #4193
- chore: use errors.New to replace fmt.Errorf with no parameters by @RiceChuan in #4204
- Core: Add mutex to injection resolution by @yuhan6665 in #4206
- Dokodemo TPROXY: Interrupt UDP download if upload timeouts by @RPRX in a8559a1
- XHTTP XMUX: Increase the default value for cMaxReuseTimes by @RPRX in ff4331a
- XHTTP XMUX: cMaxLifetimeMs -> hMaxReusableSecs, Refactor default values by @RPRX in 4ce65fc
- Sockopt config: Add penetrate for XHTTP U-D-S, Remove tcpNoDelay by @RPRX in 369d894
- Inbounds config: Add mixed as an alias of socks by @RPRX in 5af9068
- Build: Use patched newer Go version to build Windows 7 assets by @KobeArthurScofield in #4192
- Upgrade quic-go to patched v0.48.2 by @RPRX in 8a6a538
- Config: Correctly marshal Int32Range to JSON by @yiguous in #4234
- Freedom config: Fix noises delay by @GFW-knocker in #4233
- Workflows: Trigger all Build & Test on all branches & files by @RPRX in dd4ba82
- Freedom noises: Change legacy variable name by @Fangliding in #4238
- Freedom noises: Support "hex" as type & packet by @GFW-knocker @RPRX in #4239
- Freedom noises: Support RawURLEncoding for "base64" by @RPRX in 2f52aa7
- Upgrade gVisor to a newer version by @hossinasaadi in #3903
- Build: Update GeoIP/GeoSite Cache per hour by @KobeArthurScofield in #4247
- XHTTP XMUX: Abandon client if client.Do(req) failed by @RPRX in #4253
- Freedom: Don't use rawConn copy when using utls by @Fangliding in #4272
- chore: fix struct field name in comment by @dashangcun in #4284
- Commands: Fix dumping merged config for XHTTP by @vrnobody in #4290
- Mixed inbound: Handle immediately closing connection gracefully by @rPDmYQ @RPRX in #4297
- XHTTP client: Move x_padding into Referer header by @rPDmYQ in #4298
- DNS: Implement queryStrategy for "localhost" by @Fangliding in #4303
- XHTTP server: Add scStreamUpServerSecs, enabled by default by @RPRX in #4306
- DNS DoH: Add h2c Remote mode (with TLS serverNameToVerify) by @RPRX in 2522cfd
- RAW: Allow setting ALPN http/1.1 for non-REALITY uTLS by @RPRX in 740a6b0
- Log: Add microseconds for all kinds of logs by @RPRX in 5679d71
- UDS: Keep valid source addr by @Fangliding in #4325
- Upgrade quic-go to official v0.49.0 by @RPRX in a7a8362
- README.md: Add xray-checker to Xray Tools by @kutovoys in #4319
- XTLS Vision: Use separate uplink/downlink flag for direct copy by @yuhan6665 in #4329
- XHTTP client: Add back minimal path padding for compatibility by @RPRX in efdc70f
- Commands: Fix ambiguous pr