3x-ui Updates & Release Notes

🚀 Native AmneziaWG, Calendar-Day Renewals, Scoped API Tokens & Node-Sync Hardening

🛡️ Native AmneziaWG 3.1 — AmneziaWG inbounds run in-process on an embedded userspace device with a reconcile manager, so DPI-resistant peers need no kernel module, no Docker and no second panel.

🌐 More outbound and routing reach — PIA WireGuard outbounds added by login, remote routing URLs, a client picker inside user rules, and geosite/geoip categories browsable straight from a routing rule.

📅 Client lifecycle you can actually bill against — renewals that step whole calendar months, a per-client traffic reset cycle, a cap on auto-renewals, single-device HWID removal, per-client subscription HWID limits and per-client external-link controls.

🔑 Credentials that can be scoped and revoked — API tokens now carry scopes and an optional expiry, node API tokens can be encrypted at rest, replacing the TOTP secret requires a 2FA code, and the CLI stopped quietly accumulating admin-equivalent tokens.

🔗 Subscription output — client-side balancers in the JSON format, template variables in subscription metadata, an exposed last-fetch time, and a neutral copy-only page when a subscription URL is opened in a browser.

🕸️ Multi-node hardening — the sync adopts a matching deployed inbound instead of recreating it, keeps disabled inbounds a snapshot cannot report, stops undoing client extensions, validates every certificate in the mTLS trust bundle, and applies a rotated master certificate without a panel restart.

🧱 Transactional correctness — bulk client pushes, traffic maintenance side effects and group moves now fire only after the commit lands, and a half-applied startup migration can no longer commit silently.

🧰 Toolchain and supply chain — Go 1.27, TypeScript 7 on the oxc toolchain, provenance plus SBOM attestations on published images, and release binaries stamped with their source revision.

🖥️ Panel polish — a pinnable sidebar, network-only PWA installability, virtualized tables, real loading spinners, and localized log levels, access events and calendar labels.

ℹ️ Heads-up: First start runs automatic schema migrations (client reset-cycle and last-fetch columns, node sync orphan columns, a lowercase client-email index, API token scope/expiry, external-link normalization) — take a database backup before upgrading. Two defaults changed for existing setups: importing a database now keeps this machine's own listen addresses, ports, base path, certificate paths and node identity (clear the new checkbox to restore the old whole-file clone), and opening a subscription URL in a browser returns a copy-only page unless you append html=1 or view=html. x-ui setting -getApiToken now rotates a single cli-fallback token instead of minting a new one, so previously printed CLI fallback tokens stop working; calendar renewal is opt-in per client, so clients left on day 0 keep the old rolling interval. Building from source now requires the Go 1.27 toolchain.

🆕 New

• feat(amneziawg): add native AmneziaWG protocol support (#6105) @Kuzz007
• feat(pia): add PIA login-and-add WireGuard outbounds (#6272) @Masterain98
• feat(inbound): DisableFlow — opt an inbound out of auto XTLS Vision (#5698) @FZ1010
• feat(routing): add client picker to user rules (#6271) @ZaneL1u
• feat(xray): browse geosite/geoip categories from routing rules (#6165) @STRENCH0
• feat(routing): add remote routing URL support (#6168) @yelloduxx
• feat(clients): renew on a calendar day instead of a rolling interval (#6239) @n0ctal
• feat(clients): give each client its own traffic reset cycle (#6240) @n0ctal
• feat(clients): cap how many times a client may auto-renew (#6238) @n0ctal
• feat(clients): allow removing a single HWID device (#6265) @Kuzz007
• feat(sub): add per-client subscription HWID limits (#5802) @rqzbeh
• feat(clients): add per-client external link controls (#5650) @fastnas2023
• feat(limitip): let operators exempt trusted addresses from the IP limit (#6230) @n0ctal
• feat(sub): client-side balancers for the JSON subscription (#6243) @DIMFLIX
• feat(sub): add template variables to subscription metadata (#6163) @isultanov99
• feat(sub): expose last subscription fetch time (#6217) @hunmar
• feat(sub): warn when salamander settings cannot reach the client (#6177) @n0ctal
• feat(inbounds): add a narrow endpoint for subscription sort order (#6179) @n0ctal
• feat(api): scoped, optionally expiring API tokens (#6201) @n0ctal
• feat(nodes): opt-in encryption at rest for the outbound node API token (#6186) @n0ctal
• feat(frontend): multi-node cloning initial implementation (#6216) @rlex
• feat(inbounds): improve multi-node online attribution (#6164) @isultanov99
• feat(server): keep this machine's own settings when importing a database (#6227) @n0ctal
• feat(ui): let users pin the sidebar (#6161) @PathGao
• feat(web): add network-only PWA installability (#6190) @korsun009
• feat(i18n): translate the log levels, access events and calendar labels (#6226) @n0ctal

⚡ Update & improvement

• chore(build): bump Go toolchain to 1.27.0
• Move to TypeScript 7 and the oxc toolchain (oxlint + oxfmt) (#6262)
• chore(lint): adapt to staticcheck v0.8.0 under golangci-lint v2.13.1
• chore: bump dependencies and clear deprecated frontend APIs
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 (#6162)
• chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#6212)
• chore(deps): bump dompurify (#6193)
• chore(deps-dev): bump postcss (#6173)
• chore(frontend): resolve the high-severity brace-expansion advisory (#6180) @n0ctal
• perf(clients): write client_inbounds deltas and check identity from the clients table
• perf(frontend): replace blank Suspense fallbacks with Spin, switch to matchMedia hook, add virtual table scrolling (#6187) @PathGao
• refactor(tgbot): share numeric keypad transitions (#6211) @n0ctal
• test(tgbot): detect open-coded keypad transitions (#6214) @n0ctal
• ci: attach provenance and SBOM attestations to the published images (#6130) @kobihikri
• ci(release): stamp released binaries with their source revision (#6223) @n0ctal
• ci: actually run the PostgreSQL schema and migration tests (#6224) @n0ctal
• refactor(ci): replace the in-house review lanes with the official code-review skill
• docs(api): document WireGuard and mtproto secret generation on clients/add (#6282) @rokokol
• chore(i18n): update tr-TR translations (#6288) @tarihcituranx
• fix(i18n): localize Chinese Xray labels (#6202) @nrps9909

🐞 Bug fixed

• fix(node): stop the node sync from deleting clients it never meant to
• fix(node): stop stale expiry sync from undoing client extensions (#6231) @mrchatam
• fix(node): adopt a matching deployed inbound instead of recreating it (#6197) @n0ctal
• fix(node): keep disabled inbounds the node snapshot cannot report (#6221) @n0ctal
• fix(node): don't stamp InboundsAdoptedAt when the sync adopted nothing (#6284) @yzxcj797
• fix(nodes): log the inbound the node snapshot removes centrally (#6219) @n0ctal
• fix(nodes): validate every certificate in the node mTLS trust bundle (#6188) @n0ctal
• fix(nodes): apply a rotated master mTLS certificate without restarting the panel (#6194) @n0ctal
• fix(nodes): persist the master mTLS credential atomically and stop silent reissue (#6195) @n0ctal
• fix(nodes): report probe heartbeat persistence failures (#6207) @n0ctal
• fix(clients): push bulk client changes to nodes only after the commit lands (#6181) @n0ctal
• fix(clients): stop a stale IP row from blocking a client edit
• fix(clients): stop recomputing the summary badges from the client_stats snapshot (#6169) @mrnickson-hue
• fix(traffic): clear cross-panel rows only for clients actually renewed (#6263) @n0ctal
• fix(traffic): apply maintenance side effects only after the commit lands (#6200) @n0ctal
• fix(job): expire stored client IPs of offline clients
• fix(job): force-disconnect over-limit Hysteria2 clients
• fix(database): keep IP limits when the fail2ban probe is inconclusive (#6176) @n0ctal
• fix(ldap): stop auto-delete from wiping every client on an empty directory
• fix(inbounds): close the port check-and-claim race on the serial writer (#6225) @n0ctal
• fix(inbounds): reject Hysteria inbound updates with empty client auth (#6268) @mvanhorn
• fix(inbounds): surface form validation errors (#6084) @narcotics0507
• fix(reality): make the REALITY target check usable on a private network (#6242) @shustovTE
• fix(groups): report changed bulk moves without restarting xray (#6199) @n0ctal
• fix(panel): stop one poisoned DNS answer from blocking outbound tests
• fix(outbounds): propagate allocation query failures (#6208) @n0ctal
• fix(outbound): import Hysteria2 salamander properly from standard obfs params (#6166) @xMasterX
• fix(warp): preserve WARP Plus license key when changing IP (#6218) @rqzbeh
• fix(warp): surface update-clock persistence failures (#6209) @n0ctal
• fix(netsafe): classify IPv6 transition and CGNAT ranges as internal
• fix(sub): keep Hysteria2 mport on external-proxy links
• fix(sub): forward tlsSettings.cipherSuites into the JSON subscription
• fix(sub): serve a copy-only page when a subscription URL is opened in a browser (#6183) @n0ctal
• fix(sub): restore the subscription info page for browser visits
• fix(sub): keep copy page within mobile viewport
• fix(sub): render the full remark once per subscription, not once per credential (#6198) @n0ctal
• fix(sub): use a fullwidth percent in USAGE_PERCENTAGE (#6174) @n0ctal
• fix(migration): stop a half-applied startup migration from committing silently (#6182) @n0ctal
• fix(db): harden unrestricted freedom outbounds (#6184) @n0ctal
• fix(security): require a 2FA code to replace the stored TOTP secret
• fix(cli): stop -getApiToken accumulating admin tokens (#6175) @n0ctal
• fix(web): fallback to default secret when database setting is empty (#6189) @CaMeDoZa
• fix(web): report unexpected HTTP serve failures (#6210) @n0ctal
• fix(frontend): make the jalali expiry clear button actually clear
• fix(frontend): refresh subscription settings after save (#6287) @dawNotPoi
• fix(frontend): restore responsive table height
• fix(frontend): disable table virtualization
• fix(frontend): isolate swagger deps from main vendor chunk
• fix(frontend): restore the two rolldown bindings npm dropped from the lockfile
• fix(frontend): keep the MSW worker in step with the lockfile (#6222) @n0ctal
• fix(install): preserve custom bin/ files (e.g. hand-added geoip) across updates (#6152) @Kuzz007
• fix(panel): forward the panel's proxy to update.sh's own downloads (#6259) @Kuzz007
• fix(tgbot): split long messages at line boundaries (#6293) @sanmaxdev
• fix: dead code, typo, and minor bugs in main.go, process.go and index.go (#6167) @isuru709
• fix: follow-ups from the post-merge reviews of #6221, #6227, #6230 and #6239 (#6250) @n0ctal

Reports

New Contributors

• @fastnas2023 made their first contribution in #5650
• @FZ1010 made their first contribution in #5698
• @narcotics0507 made their first contribution in #6084
• @kobihikri made their first contribution in #6130
• @Kuzz007 made their first contribution in #6152
• @xMasterX made their first contribution in #6166
• @isuru709 made their first contribution in #6167
• @yelloduxx made their first contribution in #6168
• @CaMeDoZa made their first contribution in #6189
• @korsun009 made their first contribution in #6190
• @nrps9909 made their first contribution in #6202
• @rlex made their first contribution in #6216
• @hunmar made their first contribution in #6217
• @mrchatam made their first contribution in #6231
• @shustovTE made their first contribution in #6242
• @DIMFLIX made their first contribution in #6243
• @ZaneL1u made their first contribution in #6271
• @Masterain98 made their first contribution in #6272
• @rokokol made their first contribution in #6282
• @yzxcj797 made their first contribution in #6284
• @dawNotPoi made their first contribution in #6287

Full Changelog: v3.6.0...v3.7.0

🚀 Trend-First Overview, xray-core v26.7.28, Subscription Correctness & Panel Hardening

🧭 Overview rebuilt as a command deck — the ten small cards are gone: four vitals tiles with 72-sample sparklines, a two-series throughput chart, a TCP/UDP connections chart, a grouped system strip, and a sidebar that became an auto-collapsed icon rail expanding on hover.

🛡 xray-core v26.7.28 — the XMC finalmask breaking change is absorbed end to end: incomplete masks are rejected at save time with the missing field named, and only the offending mask is dropped at config-generation time so one bad row can no longer take every inbound offline.

🔗 Subscription output correctness — a long run of link and format fixes (forwarded-URL trust, coalesced external refreshes, Clash scalars a YAML parser would misread, VLESS flow gating, external link names, WireGuard Allowed IPs) plus opt-in identity tokens on every link, raw download actions, live online status with a new ?format=info endpoint, and User-Agent format auto-detection.

🔐 Panel surface tightened — openapi.json moved behind session auth (it was serving the whole admin API surface unauthenticated), node API tokens became write-only, production sourcemaps no longer ship inside the binary, and the default freedom rules block private-range egress.

🧹 Two large verified audit sweeps — 54 fixes from a repo-wide self-correcting audit and 16 more from a bug-label issue sweep, spanning email, node sync, subscriptions, xray config and the database.

🗃 Data integrity — SQLite backup snapshots are taken online, legacy string tgId values in inbound settings are repaired on upgrade, and client_traffics rows are no longer deleted for detached-but-alive clients or left stale when an email is reused.

🎛 Settings UX — settings sitting at their shipped default are tagged as such, clearing a port field keeps the stored port instead of writing zero, date-pickers commit on selection rather than on confirm, and the REALITY client version range is validated at save time.

🧰 Frontend platform — the component Storybook became a validated, fully covered workbench and is published on the docs site, every axe accessibility violation in the library is resolved, react-router 8 and Node 24 LTS landed, and 210 dead translation keys were deleted with a test that fails the build on new ones.

ℹ️ Heads-up: The bundled core moved to xray-core v26.7.28, where the XMC finalmask usernames list was replaced by a required profiles array (username + UUID + both Mojang texture fields, no "default to Dream" fallback) — a mask saved by an older panel is now rejected at save time, and stripped from the generated config with a warning rather than failing the whole core, so anyone using that obfuscation must refill their profiles. A database migration repairs legacy string tgId values in inbound settings that previously broke every client operation on the affected inbound. Two surfaces changed behavior for existing setups: GET /panel/api/openapi.json now requires an authenticated session (it was reachable without one), and node API tokens are write-only — the API no longer returns them, so tooling that read a token back must store it at creation time. The default freedom finalRules also gain a geoip:private block rule, applied in place to installs still carrying the stock rules.

🆕 New

• feat(ui): redesign the overview page as a trend-first command deck
• feat(ui): tag settings that sit at their shipped default value (#6128) @PathGao
• feat(ui): validate the REALITY client version range at save time (#6126) @PathGao
• feat(inbounds): allow custom monthly traffic reset days (#6071) @Ki-Seki
• feat(sub): auto-detect subscription format by User-Agent (#5826) @Tomilla
• feat(sub): allow identity tokens on every subscription link (#5935) @H-TTTTT
• feat(sub): expose live online status and add ?format=info endpoint
• feat(sub): add raw subscription download actions (#6017) @w3struk
• feat(sub): add XHTTP session field compatibility in share links and subscriptions (#5929) @beehunt9r
• feat(api): add GET endpoint to look up clients by Telegram ID (#5945) @kimfom01
• feat(notifications): add a consecutive-failure threshold for outbound.down alerts (#5968) @yukh975
• feat(frontend): show client comments on mobile cards (#5942) @sanmaxdev

⚡️ Update & improvement

• feat(xray): update xray-core to v26.7.28 and adapt panel
• perf(clients): make the clients page scale to large panels
• perf(clients): take one email snapshot per client fan-out, not one per inbound (#6091)
• feat(frontend): make Storybook a validated, fully covered component workbench
• feat(docs): publish the component Storybook on the docs site
• refactor(frontend): migrate off deprecated Ant Design 6 props
• refactor(ui): share one onNumber handler for numeric setting inputs (#6127) @PathGao
• chore(lint): forbid the Number-or-clamp idiom in direct-write settings pages (#6129) @PathGao
• chore(build): stop shipping production sourcemaps inside the binary (#6131) @PathGao
• chore(i18n): delete 230 dead translation keys and guard against new ones (#6132) @PathGao
• style(i18n): normalize Chinese-English spacing (#6076) @Yosyoo
• chore(deps): migrate to react-router 8 and refresh frontend dependencies
• chore: standardize the toolchain on Node 24 LTS
• chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms
• fix(docs): force transitive sharp up to patched 0.35.3
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#5994)
• chore(deps): bump github.com/go-ldap/ldap/v3 from 3.4.13 to 3.4.14 (#5993)
• chore(deps): bump react-i18next from 17.0.9 to 17.0.10 (#5996)
• chore(deps-dev): bump vite from 8.1.4 to 8.1.5 (#5997)
• chore(deps): bump actions/setup-go from 6 to 7 (#5995)
• chore(deps): bump actions/setup-node from 6 to 7 (#5992)
• refactor(ci): make the bot read-only except for PR conflict resolution
• fix(ci): survive transient GitHub 5xx outages in the release workflow
• fix(ci): resolve the mtg-multi tag from the release-page redirect
• fix(ci): publish dev-latest edit-first instead of probing for existence

🐞 Bug fixed

• Repo-wide self-correcting audit: 54 verified bug fixes (#5970)
• Bug-label issue sweep: 16 fixes (#6083)
• fix(api): authenticate GET /panel/api/openapi.json + pin the route registry to the router (#6133) @PathGao
• fix(nodes): make node API tokens write-only (#5613) @n0ctal
• fix(xray): reject configs xray-core refuses, and check the fixtures against it
• fix(xray): stop the runtime user API from crashing xray-core
• fix(xray): emit an empty client array instead of null in the generated config (#6117)
• fix(xray): validate generated egress targets (#5989) @Alishahrokhiii
• fix(xray): gate embedded unencrypted-outbound rejection on the running core version (#6028) @mvanhorn
• fix(xray): synchronize lifecycle state (#6138) @PathGao
• fix(balancer): pin loopback routing rules ahead of general rules (#6054) @H-TTTTT
• fix(mtproto): synchronize child-process lifecycle (#6141) @PathGao
• fix(sub): honor trustedProxyCIDRs before forwarded URLs (#6135) @PathGao
• fix(sub): coalesce external subscription refreshes (#6139) @PathGao
• fix(sub): quote Clash scalars a YAML parser would read as numbers (#6104)
• fix(sub): gate the VLESS flow in JSON subscriptions like raw and Clash links
• fix(sub): omit hyphen for empty remark variables (#6101) @Tosd0
• fix(sub): drop duplicated fingerprint in external-proxy tlsSettings (#6096) @n0liu
• fix(sub): omit non-standard fm param from Hysteria2 URI (#6048) @H-TTTTT
• fix(sub): preserve external link names in Clash/JSON (#6049) @H-TTTTT
• fix(sub): send the routing-enable header only when the toggle is on (#6008) @a-poluyan
• fix(wireguard): widen the client address pool past a full /24 (#6089)
• fix(wireguard): preserve all Allowed IPs in share link, .conf, and subscription (#6051) @H-TTTTT
• fix(warp): preserve outbound customization when rotating IP (#6052) @H-TTTTT
• fix(clients): keep a client editable when its subId is already shared (#6065)
• fix(clients): allow case-only email updates without duplicates (#6050) @H-TTTTT
• fix(clients): persist all editable fields for clients with no inbound (#6053) @H-TTTTT
• fix(clients): keep VLESS xtls-rprx-vision flow when inbound options reload (#5971) @sleepingF0x
• fix(clients): stop deleting client_traffics for detached-but-alive clients (#6110) @mrnickson-hue
• fix(clients): refresh stale client_traffics row when an inbound-deleted client's email is reused (#6003) @mrnickson-hue
• fix(nodes): keep the credential-presence flag on the node heartbeat push
• fix(node): stop a departed master's frozen traffic from disabling clients (#6113)
• fix(database): create SQLite backup snapshots online (#6137) @PathGao
• fix(database): repair legacy string tgId in inbound settings on upgrade
• fix(hosts): assign group ids to imported hosts and repair empty ones
• fix(dns): stop forcing port 53 on DoH/DoQ DNS server entries (#5950) @mvanhorn
• fix(frontend): keep DNS hosts synchronized (#6158) @PathGao
• fix(settings): keep the stored port when a port field is cleared (#6121) @PathGao
• fix(ui): commit date-picker selections immediately instead of on confirm (#6122) @PathGao
• fix(ui): explain the REALITY client version gate and drop the impossible placeholder (#6125) @PathGao
• fix(frontend): preserve cancellation and reject invalid query data (#6143) @PathGao
• fix(frontend): preserve edited server drafts (#6156) @PathGao
• fix(frontend): preserve theme body classes (#6157) @PathGao
• fix(frontend): stabilize speed tags on inbound and client pages (#5930) @H-TTTTT
• fix(frontend): resolve every axe accessibility violation in the component library
• fix(job): bound the traffic-notify POST so a stalled receiver can't wedge it (#6115)
• fix(email): build an RFC 5322 message with a proper From address and name (#5941) @yukh975
• fix(install.sh): use realpath instead of script name (#6075) @Intervence
• fix(script): remove release download time limit (#5952) @sanmaxdev
• fix(script): remove old mtg binary (#5955) @cherts

Reports

New Contributors

• @H-TTTTT made their first contribution in #5930
• @kimfom01 made their first contribution in #5945
• @mvanhorn made their first contribution in #5950
• @sleepingF0x made their first contribution in #5971
• @Alishahrokhiii made their first contribution in #5989
• @mrnickson-hue made their first contribution in #6003
• @a-poluyan made their first contribution in #6008
• @Ki-Seki made their first contribution in #6071
• @Intervence made their first contribution in #6075
• @Yosyoo made their first contribution in #6076
• @n0liu made their first contribution in #6096
• @Tosd0 made their first contribution in #6101
• @PathGao made their first contribution in #6121

Full Changelog: v3.5.0...v3.6.0