MHSanaei Release Notes

🚀 Live Shadowsocks Client Edits, Lighter Node Sync & Complete vmess Link Import

• 🔄 Shadowsocks hot apply — Client changes on multi-user Shadowsocks inbounds no longer drop every live connection on the port.
• 🗄️ Node sync load — The 5-second node traffic merge now writes only rows that actually changed, ending slow or timed-out client renews on large multi-node setups.
• 🔗 vmess link import — XHTTP, mKCP and finalmask settings in vmess links now survive import, so imported outbounds connect.
• 🛡️ MTProto handshake limit — A new per-IP cap on pending handshakes keeps one address from starving other clients.
• 💥 Core crash reports — Xray crash logs now contain the full panic and traceback instead of a 7-byte stub.
• 🪟 Windows build — The Windows executable is now 3x-ui.exe with version info and an icon, reducing antivirus false positives.
• 🕵️ Less panel fingerprinting — Sponsor data is fetched from a shared hostname that no longer identifies a server as running the panel.

⚠️ Before you upgrade

Action required

The Windows release zip now ships 3x-ui.exe instead of x-ui.exe — do this: update any service definition, scheduled task, shortcut or script that launches x-ui.exe, and remove the old executable after replacing the files.

Automatic — no action needed

Existing MTProto inbounds render a byte-identical config and are not restarted; the new handshake limit is written only when set above 0.

The panel sidebar no longer shows a sponsor card; sponsors appear only on the Sponsors page.

Requirements

Go 1.27.2 · Xray-core v26.10.10

🔐 Security

The panel's sponsor-data fetch no longer reveals in the TLS SNI that a server is running 3x-ui; it now uses a widely shared hostname with the path kept inside TLS (35b5e098)

🆕 New

• MTProto inbounds expose the sidecar's per-IP pending-handshake limit, closing new connections from an address that already holds that many unauthenticated handshakes (b177b98c)
• The Windows executable is renamed to 3x-ui.exe and carries version info, a manifest and the 3X icon, which lowers heuristic antivirus detections (db8b01b8)
• The Sponsors page lists only real sponsors in larger cards, and the sidebar sponsor slot is removed (6f1dd0d7)

⚡ Improved

• The bundled OpenSSL for Windows is updated to 4.0.3 (MSI installer) (c45ffcda)

🐞 Fixed

Xray & inbounds

• Adding, editing, renewing, resetting or auto-disabling a client on a multi-user Shadowsocks inbound (including 2022 ciphers) is applied in place instead of restarting the inbound and dropping live connections (a66b360c)
• Xray crash reports capture the whole panic and traceback, each report gets a unique file name, and ordinary log lines mentioning "panic" are no longer swallowed from the panel log (760f428c)

Nodes

• The node traffic merge skips unchanged client rows and stops flipping shared client fields between inbounds, so renewing a client on many inbounds no longer times out behind sync writes (f8b72de9)

Links & subscriptions

• vmess links now import their XHTTP settings (session/sequence placement, padding obfuscation, xmux and more), so XHTTP outbounds from subscriptions or external links connect (#6808) @jayhemnani9910
• vmess links now import the mKCP header, seed, MTU/TTI and finalmask, so mKCP outbounds from subscriptions, external links or the link import connect (#6809) @jayhemnani9910
• Clash subscriptions export Hysteria2 Gecko obfuscation with its packet-size range instead of plain salamander, so those clients can complete the handshake (cb4f2ec9)
• Client-specific subscription routing no longer leaks one client app's routing headers into another's response, while the shared JSON routing profile is still sent to both (#6810) @mvanhorn

Panel

• Long sponsor titles and descriptions wrap inside their card instead of spilling onto neighbouring cards (319e6932)

Reports

Full Changelog: v3.10.0...v3.10.2

Original source

🚀 MASQUE, XDRIVE, Xray-core v26.10.10 & Node Sync

🛰️ MASQUE — a new protocol and transport for inbounds and outbounds, and the WARP modal can now register WARP over MASQUE.

☁️ XDRIVE transport — tunnel traffic through files in Google Drive, a local folder or any templated HTTP storage API.

⚙️ Xray-core v26.10.10 — Lua DNS and routing scripts, new TUN and finalmask options, and stored configs migrate to the new shapes on their own.

🔗 Node sync — master pushes reach every node, a reset node can no longer wipe the hub's clients, and client edits on node inbounds no longer drop connections.

🧱 Configs that would stop Xray are refused — Shadowsocks-2022 keys and ciphers, mask passwords and storage settings Xray cannot run are rejected when you save.

📡 Port hopping restored — Hysteria and XHTTP clients hop ports again through the udphop mask.

🛡️ Sandboxed systemd service — the panel now runs with a reduced capability set and read-only system directories.

🔄 Safer updates — the database migration finishes before the service starts, and an update no longer touches your TLS setup.

🐘 PostgreSQL 18 — new local database installs get the current major version from the official PGDG repository.

⚠️ Before you upgrade

Action required

Several node fixes run on the node itself: in-place client updates (no dropped connections), applying master pushes on admin-token nodes, and hosting MASQUE inbounds. A node on an older release keeps the old behavior, and placing a MASQUE inbound on it is refused — do this: upgrade every node, not only the master.

Xray-core v26.10.10 checks outbound TLS against its bundled Mozilla roots instead of the OS certificate store — do this: on any outbound to a server signed by a privately installed CA, turn on Use system CA in that outbound's TLS settings.

JSON subscriptions now send port hopping as the udphop mask (needs Xray-core 26.9.9+) and xdns masks in the names/addrs shape (needs Xray-core 26.10.10+) — do this: ask users of port hopping or xdns to update their client apps to a build on Xray-core 26.10.10 or newer.

On systemd installs the service is now sandboxed: /usr, /boot, /etc, /home and /root are read-only except the panel's own DB, bin and log folders — do this: if the panel or Xray must write anywhere else under those trees, add the path with ReadWritePaths= in your own drop-in (/etc/systemd/system/x-ui.service.d/20-local.conf). After you change an XUI_*_FOLDER value in /etc/default/x-ui, re-run the update so the generated drop-in picks it up.

Automatic — no action needed

At first start, stored xdns finalmasks are rewritten to names/addrs. Legacy quicParams.udpHop on client-side configs (hosts, the subscription's global finalmask, cached outbound subscriptions, template outbounds) becomes a udphop mask. Inbounds keep udpHop as the advertised port range. Each rewrite runs once, and a failure stops the panel from starting.

Shadowsocks-2022 inbounds on 2022-blake3-chacha20-poly1305 move to 2022-blake3-aes-256-gcm, and their 32-byte keys stay valid. Server keys of the wrong size for their method are replaced. Neither kind of inbound could start before. A failure stops the panel from starting.

install.sh and update.sh install the hardened unit and regenerate x-ui.service.d/10-xui-sandbox.conf from your XUI_* folders on every run. The seccomp filter is added only on systemd 239 or newer, and on older systemd the scripts list the protections it lacks. A folder path containing whitespace is left out with a warning, and a failed refresh is only a warning.

A stored report or LDAP sync schedule that no longer parses falls back to the job's default, with a warning in the log.

PostgreSQL 18 applies only to new local databases. An existing cluster is never upgraded.

Requirements

Go 1.27.2 · Xray-core v26.10.10

🔐 Security

The shipped systemd units now sandbox the panel. Only its own folders are writable, its capabilities are reduced, namespaces and address families are restricted, UMask=0077 is set, and a @system-service seccomp filter is added on systemd 239 or newer (#6718) @ChesterFishmansWork

The repository's automated PR-review and issue-analysis workflows no longer hold write or OIDC tokens, so code checked out from a pull request cannot mint a write token (9130f6dd, 5939fda3, 53239285)

🆕 New

MASQUE inbounds and outbounds: CONNECT-IP over HTTP/3 or HTTP/2, always behind TLS. Clients sign in with their email and password, and the JSON subscription builds each client's MASQUE outbound. Share links and Clash skip MASQUE because it has no link format (b04039c2, 00aaef38, c4b9b3f9)

The WARP modal can register a WARP device over MASQUE and turn it into a ready warp-masque outbound. Your existing WireGuard registration is left untouched (04cccef3)

XDRIVE transport on inbounds and outbounds: tunnel a stream through files in Google Drive, a local folder or an HTTP storage API described by a template. XDRIVE outbounds can use TLS to front the storage API, and storage settings Xray cannot open are refused when you save (ca598359, c7d89cea, c5e1e54c)

Lua DNS and routing scripts: DNS gets a script field and a per-server ID, Basics gets a routing script field, and the Routing tab warns that rules are skipped while a script is set (b6c859f5, 73a028f5)

TUN inbounds can set the Windows adapter type, point systemd-resolved at the TUN gateway on Linux, and block DNS leaks through WFP on Windows (ef4bda4e)

The finalmask editor now covers more of the format: header-custom variables and transforms, a TCP errors group, UDP prefix/standalone mode, the sudoku UDP mask, and noise reset ranges such as 60-120. These keys used to be dropped on save (1c050f87)

Outbound TLS has a Use system CA switch for servers signed by a privately installed CA (73a028f5)

New local PostgreSQL installs get PostgreSQL 18 from the official PGDG repository. Where PGDG has no build, the distro package is used instead (c9207b6f)

⚡ Improved

Xray-core updated to v26.10.10 (73a028f5)

Go 1.27.2 and refreshed Go dependencies, including fasthttp 1.75.0 (82c77111, #6767)

Frontend and docs dependencies refreshed, and the npm audit findings cleared (d57dcf82, 2e8af647)

The public subscription page uses the panel's own theme in light, dark and ultra-dark (fd6c5925)

Traffic formatting does less work and allocates less memory when building status and report output (#6790) @javi0guerrero4-cloud

CI now tests node sync end to end with a real master panel and a real node panel, for both admin-token and node-sync-token enrollment (f843fe55, dae91276)

Fixed a data race in the service test suite, caused by a public-IP lookup that kept running after its test ended (#6742) @AyaseEli-Bing

SECURITY.md now names an email contact for reporters without a GitHub account, and the repository publishes a threat model (8fe7be94, eb498a3c)

🐞 Fixed

Nodes

Clients attached, disabled or edited on the master now reach nodes enrolled with an admin token. An inbound deleted on the node is re-created by reconcile, which used to keep trying to update it (2ffc694a)

A node that reports an empty client list (just reset, restarted or removed) no longer causes the hub to delete those clients. The hub pushes them back to the node (#6734) @yukh975

Renewing, resetting or auto-disabling a client on a node inbound now updates its users in place, so open connections on that port stay up. The inbound used to be rebuilt (44083338)

Masters enrolled with a node-sync token or mTLS can again set the subscription sort order, bulk-reset client traffic and read active inbounds on their nodes. These requests used to fail with 403 (5819a01c)

A client detached from a node inbound is no longer disabled on the master by the node's stale stats, and its old quota is no longer written back (dd956947)

Client traffic history and quota usage survive when a node inbound is replaced under a new tag (6be3c438)

Xray config & inbounds

Shadowsocks-2022 inbounds no longer offer 2022-blake3-chacha20-poly1305, which Xray cannot run with multiple users. Stored inbounds move to 2022-blake3-aes-256-gcm (f1ed1a9b, c20082d2)

A Shadowsocks-2022 server key of the wrong size for its method is refused when you save. It used to stop Xray (b9e1d3af)

A salamander or gecko finalmask password shorter than 4 bytes is refused when you save and flagged in the editor. It used to stop Xray when the listener opened (0466e8b0)

VLESS clients keep connecting after their inbound moves to a transport that cannot carry Vision. The Vision flow is now applied only where Xray runs it: TLS or REALITY on raw TCP, or VLESS encryption on any transport (c5e1e54c)

Balancer overrides set from the panel survive routing reloads and node tests. An override that points at an unknown or removed outbound is refused or cleared (#6779) @AliKarami

TLS ALPN defaults to http/1.1 for the WebSocket transport, so the WebSocket handshake no longer fails when h2 is negotiated (#6787) @HappyLeslieAlexander

Port hopping works again for Hysteria and XHTTP (HTTP/3) outbounds and for JSON-subscription clients. The hop is written as the client udphop mask, kept on every endpoint, and placed last, where Xray requires it (ec0a57fc, 27e45f30, 6321297f)

Subscriptions & links

JSON subscriptions emit "encryption": "none" for VLESS inbounds stored without that key. They used to emit an empty value, which Xray refuses to load (#6781) @jayhemnani9910

A host's ECH config, certificate pins and verify name now reach clients in the JSON subscription (66ef5bbc)

Hysteria share links now include the host's server description, as VLESS, Trojan and Shadowsocks links already did (#6740) @AyaseEli-Bing

QR codes are shown again for REALITY links and for VLESS-encryption links authenticated by an X25519 key. Only links that carry post-quantum keys too large to scan hide the QR code (d7da64f2)

TUIC, WireGuard & AmneziaWG

TUIC sniffing keeps the IP destination the client asked for (#6753) @libmur-dev

TUIC clients show their live speed again, and the certificate buttons are laid out correctly (#6723) @poise52

AmneziaWG UDP replies larger than the tunnel MTU are now fragmented to fit it (#6780) @mrdarkerr

A client on both a WireGuard and an AmneziaWG inbound now gets its own WireGuard public key and keepalive on the WireGuard peer (#6751) @mvanhorn

Panel & settings

On PostgreSQL, the panel no longer hangs until restart when node traffic sync runs at the same time as subscription fetches (b5a04ea9)

Report and LDAP sync schedules accept a standard five-field crontab. A schedule that cannot be parsed is refused when you save, so the job no longer silently never runs (b124af2a)

The attach and detach clients modals list the clients the first time they open (#6736) @drakeo338

The renewal preview shows readable dates with their UTC offset and labels its renewal count as an estimate, and the renewal form layout and mode help are clearer (#6662, #6672) @JacktheRanger

The panel-update confirmation closes as soon as you confirm, so it no longer dims the progress indicator (#6766) @libmur-dev

Toast messages follow the dark and ultra-dark themes (d1b60799)

Action buttons in the overview modals wrap to a new line instead of spilling out with longer translations (49fbcdc0)

Install & update

An update now runs the database migration before starting the service. An upgrade that adds schema no longer stops the service with "duplicate column" (#6729) @mrnickson-hue

Updating from the panel no longer opens the SSL menu. It used to stop x-ui to issue an IP certificate, could delete /root/cert/ip and the acme.sh state, or loop forever on an IP prompt. The URL printed afterwards shows the scheme the panel actually serves (257559c3)

Reports

New Contributors

@drakeo338 made their first contribution in #6736

@AyaseEli-Bing made their first contribution in #6740

@AliKarami made their first contribution in #6779

@mrdarkerr made their first contribution in #6780

@jayhemnani9910 made their first contribution in #6781

@HappyLeslieAlexander made their first contribution in #6787

@javi0guerrero4-cloud made their first contribution in #6790

Full Changelog: v3.9.0...v3.10.0

Original source

🚀 Native TUIC, Tunnels on Nodes, Xray-core v26.9.30 & Reliable Client Resets

🚀 Native TUIC v5 server — TUIC now runs inside the panel in Go, with no external binary to download, BBR congestion control and crash-safe traffic accounting.
🌐 AmneziaWG, TUIC & MTProto on nodes — these inbounds can now be created and cloned from the master straight onto a node.
⚙️ Xray-core v26.9.30 — stored XDNS masks and WireGuard outbound settings are migrated to the new core's shape automatically.
🔁 Client lifecycle you can trust — resets, renewals and quota cuts now reach every counter on every node, and saving an inbound or editing a client no longer reverts changes made in the meantime.
🤖 Telegram bot access levels — unknown accounts are locked out, customers link themselves with an invite link, and admins can broadcast to every client.
🗓️ Weekly calendar renewal — clients can renew on a fixed weekday, with a preview of the upcoming schedule.
📦 Subscription controls — hide an inbound from subscriptions without disabling it, carry traffic through export/import, and set the User-Agent used for external subscriptions.
🔐 Security hardening — API token rotation, database restore, certificate fetching and the bot's command surface are all tightened.

⚠️ Before you upgrade

Action required

/panel/api/inbounds/update and the inbound JSON editor no longer change which clients an inbound holds, their enable/expiry/quota/renewal fields, or the inbound's own enable flag — do this: move any script that edits clients through an inbound update to the client endpoints, and use /panel/api/inbounds/setEnable/:id to switch an inbound on or off.

The Telegram bot now answers only /start and /id for accounts that are not linked to a client or listed as an admin — do this: link customers who used /usage or /status by setting their Telegram ID on the client, or send them the new invite link from the client card.

XDNS finalmask changed its wire format in Xray-core v26.9.30 — do this: update clients that use an XDNS mask to a core of v26.9.30 or newer, or they will not connect.

Weekly renewal is ignored by older binaries, and an older panel's depleted-client cleanup can delete a weekly-only client — do this: upgrade every node before enabling weekly mode, and convert weekly clients to another mode before any downgrade.

Deploying an AmneziaWG, TUIC or MTProto inbound to a node is refused when the node is older than the release that introduced the protocol (MTProto v3.5.0, AmneziaWG v3.7.0, TUIC v3.8.0) — do this: upgrade the node first.

WireGuard and AmneziaWG allowedIPs that overlap another client's range are now rejected; existing overlapping clients keep working but cannot be saved until fixed — do this: narrow such ranges (for example 10.10.2.9/24 → 10.10.2.9/32) when editing them.

Self-built Docker images: the frontend stage now uses Node 26 — do this: rebuild from the updated Dockerfile; an older copy fails at npm ci.

Automatic — no action needed

One-time startup migrations rewrite stored XDNS finalmasks (inbounds, hosts, Xray template, JSON-subscription mask, cached outbound subscriptions) into the new object shape, and move a WireGuard outbound's domainStrategy to sockopt.domainStrategy / targetStrategy (remoteDNS: "local" becomes targetStrategy). They also add the excludeFromSub and weekly-renewal columns and the node_pending_resets and tuic_traffic_receipts tables. A migration failure stops the panel from starting.

The install and update scripts remove the old tuic-server binary, its bin/tuic configs and any leftover processes; TUIC inbounds come back up on the built-in server.

x-ui setting -getApiToken -tokenName <name> now keeps the regenerated token's scope and expiry instead of turning it into a non-expiring admin token; an already expired token is refused rather than rotated.

The panel fetches the sponsor list from sponsors.sanaei.dev at most once an hour and proxies sponsor logos itself, so admin browsers never contact a third party.

Requirements

Go 1.27.1 · Xray-core v26.9.30 · Node 26 (only for building the frontend from source)

🔐 Security

Regenerating a named API token from the CLI no longer silently turns a scoped or expiring token into a permanent full-admin one (#6700) @rokokol

Fetching a remote certificate for pinning now refuses private and loopback addresses unless the admin confirms, matching the REALITY target scan (ede275e4)

Restoring a SQL dump can no longer open or create any database file other than the panel's own (d31465e3)

The Telegram bot no longer lets unlinked accounts run client commands or press client buttons; invite-link claims are rate-limited and cannot be used to probe for valid subscription IDs (#6518) @pcxzs

Saving an inbound no longer restores a client that was deleted while the edit dialog was open, which brought revoked credentials back to life (823db059)

Subscriptions can tell supported client apps to require authentication on their local SOCKS/HTTP proxy, so other apps on the device can no longer use it to bypass per-app routing or learn the server address (#6628) @rudenko-ks

🆕 New

TUIC v5 is now served by a native in-process Go server with BBR/New Reno congestion control, native and QUIC UDP relay, full Xray routing and a durable traffic journal — no external binary (#6577) @poise52

AmneziaWG, TUIC and MTProto inbounds can be created and cloned onto nodes from the master (ed31ee43)

Calendar weekly renewal, plus a preview of upcoming renewal dates in the individual and bulk client forms (#6524) @JacktheRanger

Telegram bot invite links: the client card offers a link that binds the first account to open it (#6518) @pcxzs

Telegram bot /broadcast sends any admin message — text, media or a whole album — to every linked client, with progress and cancel (#6510) @DIMFLIX

Per-inbound "exclude from subscription" hides an inbound's links while it keeps serving and counting traffic (#6463) @mrchatam

Portable client export/import now carries traffic counters, without inflating group totals (#6469) @mrchatam

Visual routing-profile editor for client apps, with optional ad blocking and a LAN-bypass preset (#6545) @NgaiYeanCoi

App-management subscription headers for a second client app: per-app split tunnelling, fragmentation, UDP noise, DoH pre-resolution, banners and more (#6650) @DIMFLIX

Configurable User-Agent for fetching external subscriptions (#6613) @mrchatam

x-ui setting -getApiToken -tokenScope <scope> chooses the scope of the issued token (#6700) @rokokol

Finalmask noise items accept the new tag-expression type, and TUN exposes the new gateway-DNS and leak-block options (62423cac)

Sponsor slots on the overview, sidebar and login page plus a Sponsors page, with scheduled start dates; each slot can be hidden for 24 hours (fd7b3559, 09617f04, dcaadd48)

⚡ Improved

Xray-core updated to v26.9.30 (62423cac)

Go, frontend and docs dependencies refreshed; the frontend baseline is now Node 26 / npm 11 (86302d2f, 99bc68fa)

TUIC throughput through Xray rises from about 2.4 to 3.4 Gbit/s on loopback with BBR (#6577) @poise52

The client-app settings page is folded from seven tabs into four (8f47b538)

The test suite runs several times faster and isolates each package on PostgreSQL (12d51d71, #6594) @n0ctal

README screenshots refreshed for the current UI (17d7dd46)

🐞 Fixed

Clients & traffic

Saving an inbound no longer reverts client renewals, expiry, quotas, clients added meanwhile, the inbound's enable switch or traffic counted while the dialog was open (1110caaa, 823db059)

Adding, editing or deleting a client no longer undoes a renewal of another client that committed at the same moment (63ffc083)

A client traffic reset now reaches every node hosting the client and the MTProto quota, so a reset client is no longer switched off again on the next tick (4210a50c)

A client that ran out of quota or time is now dropped from every inbound it belongs to, not only the last one it was attached to (7c84ca96)

Resetting an inbound's traffic on a node now hits that inbound instead of an unrelated one (#6717) @ChesterFishmansWork

Subscriptions

JSON subscriptions for REALITY inbounds with a Host SNI no longer ship a config the client core refuses to start (#6691) @FZ1010

WireGuard, AmneziaWG and TUIC configs now advertise the inbound's Hosts on every surface, not the panel address (aee45ca3)

A client on several WireGuard/AmneziaWG inbounds now gets each inbound's own keys and address in its subscription (#6653) @mvanhorn

Protocols

Hysteria client changes are applied live instead of restarting the inbound and stalling every connected client (#6606) @iblchv

A WireGuard allowedIPs written as 10.10.2.9/24 can no longer claim other clients' traffic (c8a182b6)

All 45 fixes in this release

Clients & traffic

Saving an inbound no longer reverts client renewals, expiry, quotas, clients added meanwhile, the inbound's enable switch or traffic counted while the dialog was open (1110caaa, 823db059)

Adding, editing or deleting a client no longer undoes a renewal of another client that committed at the same moment (63ffc083)

A traffic reset no longer leaves a quota-disabled client looking enabled while it is dropped from the core (feb8451b)

A client traffic reset now reaches every node hosting the client and the MTProto quota, so a reset client is no longer switched off again on the next tick (4210a50c)

Resetting inbound traffic no longer hands every MTProto client a fresh quota, and a per-inbound client reset no longer touches other inbounds (fb7418f7)

A client that ran out of quota or time is now dropped from every inbound it belongs to, not only the last one it was attached to (7c84ca96)

Resetting an inbound's traffic on a node now hits that inbound instead of an unrelated one (#6717) @ChesterFishmansWork

Inbounds exported from v2.x panels import again (15d82a5e)

A WireGuard allowedIPs written as 10.10.2.9/24 can no longer claim other clients' traffic (c8a182b6)

Client search and group filter match names with non-ASCII capitals (#6685) @freeb5d

Changing a client's device limit can no longer be overwritten by a concurrent traffic cycle (#6591) @n0ctal

IP-limit bans reach fail2ban only after the scan is saved, so a failed save can no longer ban addresses the panel never recorded (#6590) @n0ctal

On PostgreSQL, concurrent IP-limit updates no longer drop node-reported IPs (#6612) @mrchatam

Subscriptions & links

JSON subscriptions for REALITY inbounds with a Host SNI no longer ship a config the client core refuses to start (#6691) @FZ1010

Spider settings in a REALITY spiderX query are kept in share links and JSON subscriptions (#6694) @FZ1010

VLESS REALITY share links carry the ML-KEM key-exchange hint (#6712) @libmur-dev

Fragment settings export in a form older client cores understand, and inbounds with UDP-only masks no longer break the QR, info and export views (#6702) @artemk1337

WireGuard, AmneziaWG and TUIC configs now advertise the inbound's Hosts on every surface, not the panel address (aee45ca3)

A client on several WireGuard/AmneziaWG inbounds now gets each inbound's own keys and address in its subscription (#6653) @mvanhorn

Clash subscriptions include the Hysteria2 certificate pin, so self-signed certificates are accepted (#6651) @libmur-dev

Clash subscriptions keep the encryption of external VLESS links (#6576) @SakikoTogawa0214

The server description in external link remarks is no longer mangled (#6580) @sdhfsl

Outbound subscription fetches send the same device ID as external links, so device-limited providers count the panel once (#6579) @sdhfsl

Behind a proxy that sends only X-Real-IP, links no longer advertise the subscriber's own IP as the server (#6608) @mrchatam

The JSON-subscription template no longer triggers a deprecation warning for its direct outbound (#6609) @mrchatam

Downloads on phones keep their file name, so peer.conf is no longer saved as peer.conf.txt (99047c0a)

Protocols & core

Hysteria client changes are applied live instead of restarting the inbound and stalling every connected client (#6606) @iblchv

An IPv4 inbound can share a port with an IPv6-only wildcard inbound (#6603) @lin-finegold

config.json is written after a hot apply, so config backups no longer upload stale rules (#6686) @freeb5d

AmneziaWG no longer redirects connections to a sniffed domain, and its IPv6 egress no longer breaks IPv4 traffic (#6654) @rudenko-ks

AmneziaWG padding and header ranges are validated the way the engine enforces them, accepting real configs that were refused and rejecting ones that would fail to start (#6642) @rudenko-ks

AmneziaWG tunnels without IPv6 stop resolving AAAA records, and the outbound form exposes I2–I5 (#6611) @mrchatam

AmneziaWG inbounds and outbounds work on Windows builds (044e2926, 75f3702d)

The node-token key file loads on Windows (3fc3992a)

Bots

The Telegram bot picks up Panel Outbound when Xray starts after it, instead of staying unreachable on filtered hosts (bb18734c)

The bot's individual-links and QR actions work when the subscription host does not resolve from the server (4df570b3)

The bot's add-client wizard offers WireGuard and AmneziaWG inbounds and no longer shows an empty picker (#6621) @romus204

Two admins in one group chat no longer share one add-client wizard (#6604) @sdhfsl

Panel & system

Panel navigation recovers after an update leaves the browser with stale page chunks (#6679) @mvanhorn

The Syslog view no longer hangs on a slow journal (#6689) @freeb5d

On EL7, firewalld pulled in by fail2ban no longer blocks the panel's ports (#6688) @freeb5d

The x-ui menu opens instantly on hosts with large journals (092cbd55)

A legacy inbound-tag cleanup no longer fails every startup migration when its target tag already exists (#6592) @n0ctal

The Docker image builds again (9b957b96)

The REALITY "Min Client Ver" hint states which cores accept every client when the field is empty (3308c816)

Reports

New Contributors

@pcxzs made their first contribution in #6518

@SakikoTogawa0214 made their first contribution in #6576

@lin-finegold made their first contribution in #6603

@iblchv made their first contribution in #6606

@romus204 made their first contribution in #6621

@rudenko-ks made their first contribution in #6628

@libmur-dev made their first contribution in #6651

@freeb5d made their first contribution in #6685

@artemk1337 made their first contribution in #6702

@ChesterFishmansWork made their first contribution in #6717

Full Changelog: v3.8.5...v3.9.0

Original source