3x-ui Release Notes

What's Changed

New

• DNS outbound: Add rules
• wireguard: link
• kcp: noise, header-custom, sudoku
• TCP Masks
• Feature: Copy clients between inbounds @RsNest

Update & improvement

• sub: kcp finalmask
• Default to dark theme when unset
• Replace with-block with explicit settings
• Increase KCP maxSendingWindow to 2MiB
• kcp: mtu and tt
• SS: remove unsupported cipher method
• x-ui.sh: install nftables alongside fail2ban in install_iplimit @pwnnex
• hysteria: also accept "hysteria2" protocol string @pwnnex
• Bump Xray release to v26.4.25
• Minor changes

Bug fixed

• Fix IP Limit continuous ban loop from stale DB entries @pwnnex
• fix: handle Init error in GetXrayTraffic to prevent nil pointer panic

Reports

Full Changelog: v2.9.2...v2.9.3

What's Changed

Update & improvement

• CodeQL: ignore v* tag pushes
• Reduce observatory probe intervals and timeout
• Run cache cleanup daily and reduce cutoff to 1 day
• Add None option VLESS auth selection
• Extract bot command setup into trySetBotCommands
• Lower minimum Xray version

Bug fixed

• Fix: hysteria link gen crashes when echConfigList is a string @pwnnex
• Fix xhttp xPadding settings missing from generated links (panel + subs) @pwnnex
• Fix blank Xray Settings page from wrapped xrayTemplateConfig @pwnnex
• Fix Hysteria External Proxy + include Hysteria in Clash subscription @pwnnex
• sub json fix fragment noises effect @alireza0
• fix timelocation for windows @alireza0
• fix(panel): set ALPN to h3 when switching to Hysteria protocol @Imgodmaoyouknow
• balancerTags with a default empty entry

Reports

Full Changelog: v2.9.1...v2.9.2

What's Changed

New

• add hysteria inbound @alireza0
• finalmask @alireza0
• Add ipsBlocked to Freedom
• tun: dual MTU, gateway, DNS, auto routing
• Sniffing: Add ipsExcluded, domainsExcluded (supports IP, CIDR, "geoip:", "ext:")
• XDNS finalmask: Support resolvers (client-outbound) and domains (server)
• mKCP transport: Add cwndMultiplier
• feat(tgbot): send connection links and qrs on client creation @abdalrahmanx9
• Add custom geosite/geoip URL sources @MrRefactoring
• Add new hourly reset traffic @sandrew-uj
• feat add clash yaml convert @haimu0427
• feat: Add NordVPN NordLynx (WireGuard) integration @PedroLiu1999

Update & improvement

• kcp : default value maxSendingWindow
• Set CWND multiplier default and min to 1
• feat: mask password in telegram notification on 2FA failure @rydve
• Update fail2ban filter regex in x-ui.sh
• Set package ecosystem to GitHub Actions in dependabot.yml
• Add Go code analyzer workflow
• perf: replace /dev/urandom | tr with openssl rand to fix CPU spike @Kookiejarz
• reset button for auth password
• Add CodeQL Advanced GitHub Actions workflow
• Use vnext/users structure for VLESS outbound @alireza0
• Centralize session options and adjust cookies @alireza0
• revert: Disconnect client due to exceeded IP limit @HamidRezaSZ
• Enable CodeQL file coverage on PRs
• Add SSRF protection
• Update Xray-core to v26.4.17
• Bump Xray version cutoff to 26.4.17
• Bump Go version and update dependencies
• Bump Go and dependency versions
• Update x-ui.sh @kazan417
• Update translate.ru_RU.toml @sngvy

Bug fixed

• Fix SSL domain setup on reinstall: reuse existing certs and avoid false success/failure logs @Kookiejarz
• fix: enhance WebSocket stability, resolve XHTTP configurations and fix UI loading shifts @lolka1333
• fix(sub): use safe type assertion for xhttp mode field @nnemirovsky
• fix: Ban new IPs with fail2ban instead of disconnected the client @HamidRezaSZ
• fix: stop overwriting client_traffics.enable with JSON enable in GetClientTrafficByEmail @Alimpo
• Fix geosite:ru rule (Normalization to RU vs lowercase ru) @Troodi

bug fix

• salamander obfs and remove auth field
• fix: prevent AddUser panic on nil flow for VLESS XHTTP clients
• revert Fix geosite:ru rule (ram leak)

Reports

Full Changelog: v2.9.0...v2.9.1

What's Changed

New

• [feat] restart xray-core from cli @alireza0

Update & improvement

• Adjust KCP MTU when selecting xDNS mask
• Add cron to ubuntu packages @xqzts
• Add 'default' runlevel to x-ui service in Alpine @linkerlau
• Require HTTP 200 from curl before using IP
• Add timeouts and delays to backup sends
• Improve telego client robustness and retries
• Bump Go to 1.26
• update dependencies

Bug fixed

• fix windows build @alireza0
• bug fix
• translate bug fix
• fix: remove excluded paths from gzip middleware in router initialization @NabiKAZ
• Fix: escape HTML characters in tgbot start command @rydve
• Fix DeepLink for Happ, remove encoding URL @mangustyura

Reports

Full Changelog: v2.8.10...v2.8.11

What's Changed

New

• Finalmask: Add XICMP
• feat: implement 'last IP wins' policy for IP limitation @AungYeZawDev
• feat: add openssl to dockerfile @mojixcoder
• Add url speed test for outbound @surbiks

Update & improvement

• Remove allowInsecure
• refactor: set default ProfileUrl @nebulosa2007
• refactor: set header only if it not empty @nebulosa2007
• Refactor TLS peer cert verification settings
• Update geofiles according 304 http respond @nebulosa2007
• [Windows] Use MSYS2 to fix the runtime CGO problem @EbrahimTahernejad
• Add workflow to clean old GitHub Actions caches
• Xray Core v26.2.6 and dependency updates
• Update translate.es_ES.toml @emirjorge

Bug fixed

• Fix ipv6 hostname parsing for subscriptions @bakatrouble
• fix security issue
• fix : Uncontrolled data used in path expression
• fix: trim whitespace from comma-separated list values in routing rules @Alimpo

Reports

• Full Changelog: v2.8.9...v2.8.10

What's Changed

New

• XHTTP transport: New options for bypassing CDN's detection
• inbound : finalmask
• outbound: finalmask
• Add UDP hop interval min/max support for Hysteria
• Add pinnedPeerCertSha256 support to TLS settings
• feat: more subscription information fields @sh1shd
• Update & improvement
• Add UDP hop interval min/max support for Hysteria
• Add hysteria2 protocol in hint text @nebulosa2007
• Update reality_targets.js @lillinlin

Bug fixed

• fix: rename verifyPeerCertInNames to verifyPeerCertByName to be compatible with xray-core v26.1.31 @farhadh
• Fix default CA by enforcing it everywhere @sam-mosleh
• fix Telegram bot ignores reverse proxy setting @sviatoslav-gusev
• Fix modifying default CA @sam-mosleh
• fix Telegram bot ignores reverse proxy setting @mr-shura

Reports

• Full Changelog: v2.8.8...v2.8.9

What's Changed

New

• Add Hysteria2 outbound protocol support
• Add TUN protocol for inbound
• Add UDP mask support for Hysteria outbound
• Add x-ui.service.arch file @nebulosa2007
• Add port selection and checks for ACME HTTP-01 listener
• Added curl package to Dockerfile @VolgaIgor

Update & improvement

• Update minimum Xray version requirement
• feat: improve BBR management with sysctl.d and backup support @nebulosa2007
• Feature: Use of username and passwords consisting of several words @vorontsov-amd
• Enhance WebSocket client connection logic and improve event listener management @lolka1333
• refactor update geofiles fuctions @nebulosa2007
• Refactor ca-certificate dependency @nebulosa2007
• Default listen address to 0.0.0.0 in GenXrayInboundConfig
• Xray Core v26.1.18

Bug fixed

• Fixed incorrect filtering for IDN top-level domains @VolgaIgor
• Return nil if no error in GetXrayErr

Reports

• Full Changelog: v2.8.7...v2.8.8

New

• feat: Add WebSocket support for real-time updates and enhance VLESS settings @lolka1333
• Added WebSocket hub for real-time updates on inbounds and Xray service status
• Enhanced VLESS settings with X-Forwarded-For support and Vision Seed functionality
• Improved UI forms (TLS settings, VLESS configuration)
• feat: Add etckeeper compatibility @MeowyPouncer
• Self-signed SSL
• Add "Last Online" printing for Telegram bot @Psychosoc1al
• Add update-all-geofiles key to x-ui.sh @fgsfds
• Feature: add setting certs for subscription while generating for panel @dimasmir03
• feat: Add random Reality Target/SNI selection from 52 popular services @RFOTQ
• Update & improvement
• vless: use Inbound Listen address in Subscription service @gowa
• Added EnvironmentFile to systemd unit @cherts
• Better Random Reality @lillinlin
• Update for Red Hat base Linux @xujie86
• chore: use for date formatting @sh1shd
• Set variables for packaging purposes @nebulosa2007
• Remove wget dependency from everywhere @nebulosa2007
• Set log folder variable to /var/log/x-ui @nebulosa2007
• Improve English README @BOplaid
• Update x-ui.sh @EvgenyPopov72
• update dependencies
• minor changes
• Bug fixed
• feat: Add etckeeper compatibility @kr-ilya
• Fix telegram bot issue @vladon
• Fix QR codes colors inversion @Psychosoc1al
• fix: handle GitHub API error responses in GetXrayVersions @qzydustin
• fix: add missing is_domain helper function to x-ui.sh @Wyatt1026
• fix: display of outbound traffic @0zd0
• fix: handle CPU threshold error to prevent false notifications @kotopheiop
• Fix int64 for 32-bit arch @romka777
• Fix: Incorrect time in xray logs @fgsfds
• Fix: Invoke service.StopBot() in signal handlers @OleksandrParshyn
• fix: improve russian localization @rashid-yusubov
• Fix: Graceful Telegram bot shutdown to prevent 409 Conflict @OleksandrParshyn

Reports

• Full Changelog: v2.8.5...v2.8.6

New

• feat: add ldap component @konstpic
• feat: Add update script @cherts
• feat: add file logger support @slavafyi
• Add support for OpenSUSE Leap @xujiegb
• fragment : MaxSplit

DevTools

• Update & improvement
• Xray-core v25.10.15
• Add IPv4 for wget in install
• first try native CPU implementation
• [Security] Replace timestamp-based password generation with random generator @xujiegb
• login: autocomplete password
• tiny changes
• Update translate.ru_RU.toml @thefsfc
• update dependencies
• Bug fixed
• fix(import): prevent sqlite disk I/O error by validating temp DB then swapping
• fix: fix delete method @konstpic
• fix russian translate in tgbot @dimasmir03
• fix: login animation @TaraRostami
• fix

Reports

Full Changelog: v2.8.4...v2.8.5

New

• new: VACUUM database
• API: UUID for getClientTraffics

Update & improvement

• better design for dns presets
• docs: add comments for all functions
• improved sub: BuildURLs
• pageSize to 25
• TGbot: improved (5x faster)
• add EXPOSE port in Dockerfile @dimasmir03
• undo vnext for vmess
• update dependencies

Bug fixed

• Bug fixed
• fix: subpath panic
• fix: ineffectual assignment to needRestart
• Fix ineffassign “date”
• misspell

Security fix

• security fix: Uncontrolled data used in path expression
• security fix: Use of insufficient randomness as the key of a cryptographic algorithm
• security fix: Workflow with permissions CWE-275
• security fix: Command built from user-controlled sources CWE-78

Minor Fixes

• Minor Fixes @TaraRostami

Full Changelog

• Full Changelog: v2.8.2...v2.8.3

New

• new: subJsonEnable
• vscode: Debug for developer

Update & improvement

• enhancements
• chore: update sub page URL @harryngne
• minor change
• go package correction v2
• cpu history timeframe @Drahonn

Bug fixed

• misspell
• Fix ineffassign “date”
• fix: ineffectual assignment to needRestart
• fix PeriodicTrafficResetJob: log only when there are matching inbound
• fix: online
• Fix: Shadowrocket link using base64 encoding @harryngne
• css [fixes] @TaraRostami
• bug fix

Full Changelog: v2.8.1...v2.8.2