3x-ui Updates & Release Notes

🚀 MTProto Multi-Client, SQLite→PostgreSQL Migration, 500k-Scale Performance & Node Sync Hardening

📬 MTProto goes multi-client — MTProto inbounds now run on the mtg-multi engine with one FakeTLS secret per client, per-client ad-tags, and per-client quota & expiry enforced in the sidecar; client edits hot-apply through a management API so live connections survive.

🐘 SQLite → PostgreSQL, end to end — the PostgreSQL panel restore now accepts SQLite .db files and migration dumps directly (uploads are sniffed automatically), cross-db migration became lossless, transactional and pre-checked, and a new x-ui pgclient command installs or upgrades the PostgreSQL client tools.

🚄 Built for 500k clients — batched ip-limit lookups, depleted-client disables by id, delta WebSocket stats above a snapshot threshold, and subscriptions resolved from normalized tables — pinned by a scale test suite at 500,000 clients.

🧠 Frontend platform overhaul — full React Hook Form migration, axios replaced with the native Fetch API, charts moved to uPlot, and Husky / lint-staged / MSW / Storybook dev tooling.

🛰️ Node sync hardening — host overrides adopted into the master, no more premature inbound sweeps or Postgres deadlocks in sync, client edits no longer tear down node inbounds, and node auto-renewals open a fresh quota window.

🌍 Outbound insight — egress metadata (IP + country) per outbound, a real-delay connection test measured on a warm connection, and a targetStrategy field in the outbound editor.

⚖️ Routing & balancers — balancer-to-balancer fallback, a default outbound in basic routing, encrypted DNS presets, and private-IP dns.servers allowed past the geoip:private block rule.

🔎 Panel QoL — text search on the inbound list and node selects, column sorting, per-client realtime speed, bulk-adding hosts to multiple inbounds, and WireGuard export split into config and links tabs.

ℹ️ Heads-up: MTProto inbounds are now natively multi-client — legacy single-secret inbounds migrate automatically to the clients model, and tg:// deep links no longer carry the remark fragment. The bundled core was bumped to xray-core v26.7.11, and the Final Mask + REALITY combination is now rejected (it crashes Xray-core). A database migration also repairs overflowed traffic counters and drops the legacy UNIQUE constraint on inbound ports.

🆕 New

feat(mtproto): adopt mtg-multi and make MTProto inbounds multi-client
feat(mtproto): per-client ad-tags, management-API auth, and secret sync
feat(mtproto): enforce per-client quota & expiry via mtg-multi limits
feat(db): import SQLite migration dumps through the PostgreSQL panel restore
feat(server): sniff SQLite panel restore uploads and keep the fallback on failure
feat(db): add pgclient command to install or upgrade PostgreSQL client tools
feat(outbound): add outbound egress metadata (IP + country) (#5886) @isultanov99
feat(outbound): add real-delay connection test mode
feat(balancer): add balancer-to-balancer fallback support (#5586) @Ssentiago
feat(xray): default outbound in basic routing (#5815) @rqzbeh
feat(dns): add encrypted DNS presets (#5837) @rqzbeh
feat(hosts): bulk-add multiple hosts to multiple inbounds (#5677) @AmirRnz
feat(ui): per-client realtime speed (#5687) @NikanZeyaei
feat(frontend): add text search to the inbound list
feat(inbounds): add column sorting to the inbounds table (#5661) @isultanov99
feat(frontend): add text search to node select components
feat(frontend): treat WireGuard inbounds as multi-user in client actions
feat(frontend): split WireGuard inbound export into config and links tabs
feat(wireguard): make client allowedIPs editable with validation
feat(reality): derive a stable per-client spiderX for shared links
feat(web): broadcast delta client stats above a snapshot threshold
feat(sub): show the announcement on the subscription info page
feat(sub): serve the HTML info page for browser requests on JSON and Clash URLs
feat(settings): let users clear stored secrets from the UI
feat(clients): hide disabled inbounds in the client form selector
feat(frontend): show client group in the client info modal
feat(frontend): add targetStrategy field to the outbound editor
feat(clients): clarify which protocols use the password field (#5809) @ecgang
feat(tgbot): register usage, inbound, restart and clearall in the bot command menu
feat(tgbot): show inbound remark alongside email in the online clients list
feat(tgbot): include hostname in backup and ban-log messages

⚡ Update & improvement

feat(xray): update xray-core to v26.7.11 and adapt panel
chore(mtproto): bump the mtg-multi binary pin to v1.14.0
refactor(mtproto): manage ad-tags per client only
Frontend dev tooling (Husky, lint-staged, MSW, Storybook) + full React Hook Form migration (#5859)
refactor(frontend): replace axios with the native Fetch API
refactor(frontend): replace recharts with uPlot for charts
test(scale): cover traffic poll, ws payloads, ip-limit job, sub and xray config at 500k
refactor: modernize Go with strings.SplitSeq and maps.Copy
refactor: use the built-in max/min to simplify the code (#5751) @alaningtrump
chore: add golangci-lint tasks and force LF on Go files
docs: vendor the documentation site into the monorepo
docs: move architecture map into docs/ and refresh it against the live tree
docs(settings): clarify Sub Port/Sub Domain double as subscription-link fallback (#5721) @volov-de
docs: update the env vars example file (#5678) @nebulosa2007
ci(claude-bot): auto-fix trusted PRs and easy issue bugs
ci(claude-bot): gate write capability to trusted actors
chore(frontend): bump version and deps
chore(deps): bump google.golang.org/grpc to 1.82.0 (#5729)
chore(deps): bump golang.org/x/text to 0.40.0 (#5872)

🐞 Bug fixed

fix(node): stop client edits from tearing down node inbounds and harden reconcile fingerprints
fix(node): stop Postgres deadlocks and deleted-client resurrection in node sync
fix(node): never sweep a node's inbounds before their first adoption
fix(node): adopt a node inbound's host overrides into the master
fix(node): stop one rejected inbound from starving a node's traffic sync
fix(node): fully delete clients on nodes instead of only detaching them
fix(node): start a fresh quota window when a node auto-renews a client
fix(node): stop force-restarting a node's Xray when its clients auto-disable
fix(node): show the activated first-use deadline on the Clients page
fix(inbound): scope port-conflict check to the stored node on update (#5833) @yukh975
fix(panel): use the hosting node address for WireGuard client configs (#5679) @STRENCH0
fix(inbound): reject finalmask + REALITY combo (crashes Xray-core) (#5861) @mrnickson-hue
fix(inbounds): apply runtime changes after the DB commit (#5768) @n0ctal
fix(xray): reconcile client auto-disable through the API instead of a forced restart
fix(xray): force full restart for inbounds with a VLESS reverse client
fix(inbounds): apply the legacy xhttp session-key migration when editing
fix(xhttp): stop XMUX maxConcurrency from reverting on save
fix(ui): make the Happy Eyeballs toggle produce a config xray actually enables
fix(ui): keep an explicit zero happy-eyeballs delay across the round trip
fix(web): sync the VLESS generate-key dropdown with the encryption field
fix(routing): allow dns.servers on private IPs past the geoip:private block rule (#5774) @volov-de
fix(balancers): keep mixed strategies on one observer (#5674) @nima1024m
fix(logs): limit Xray log growth (#5840) @rqzbeh
fix(client): stop duplicate client entries accumulating in inbound settings
fix(clients): reuse stored credentials when re-adding an existing identity
fix(clients): rename client record atomically with inbound settings
fix(clients): finish deleting from every inbound when one fails
fix(client): clean node_client_traffics rows when deleting a client
fix(clients): parse only settings.clients across protocols (#5855) @n0ctal
fix(clients): surface bulk-reset auto-enable failures (#5763) @n0ctal
fix(clients): include Telegram ID in client list search (#5888) @mrnickson-hue
fix(frontend): show zero client count for mtproto and wireguard inbounds
fix(groups): keep group traffic totals stable across client resets and deletes
fix(mtproto): stop dropping connections on client/inbound edits; add live updates + ad-tag (#5838)
fix(mtproto): stop persisting a vestigial inbound-level secret
fix(mtproto): drop the remark fragment from tg proxy deep links
fix(sub): include native WireGuard clients in Clash and JSON subscriptions (#5676) @STRENCH0
fix(wireguard): build peers in GenXrayInboundConfig so node reconcile keeps clients (#5684) @STRENCH0
fix(sub): carry a host's Final Mask into raw share links
fix(sub): use configured spiderX instead of always randomizing
fix(sub): default https:// for scheme-less support and profile URLs
fix(sub): resolve subscription clients and stats from normalized tables
fix(sub): apply host Allow Insecure to Hysteria2 subscription links (#5866)
fix(link): strip query and trailing slash when parsing ss:// port (#5895) @Djjanks
fix(link): sanitize numeric quicParams taken from a share link's fm= param
fix(link): reject non-finite and clamp out-of-range quicParams from fm=
fix(database): make cross-db migration lossless, transactional, and pre-checked
fix(db): clamp traffic counters below int64 max and repair overflowed rows
fix(database): drop the legacy UNIQUE constraint on inbounds.port
fix(db): probe dump readability before PostgreSQL import
fix(database): stop noisy per-startup errors in the Postgres server log
fix(job): batch ip-limit per-email lookups and persistence
fix(job): gate ip-limit scan on clients.limit_ip instead of parsing all settings
fix(iplimit): ban a dead connection once instead of every scan
fix(traffic): disable depleted clients by id instead of a second full scan
fix(traffic): persist delayed-start expiry only for converted clients
fix(ldap): convert default total GB to bytes when auto-creating clients (#5854) @mrnickson-hue
fix(ldap): attach auto-created clients to every configured inbound tag
fix(tgbot): find clients by tgId regardless of settings JSON formatting
fix(outbound): measure HTTP test delay on a warm connection
fix(settings): repair legacy path settings that block every settings save
fix(ui): align the subUpdates limit with the backend and show the range
fix(frontend): stop group modals clearing selection on background refetch
fix(web): opt panel pages out of Cloudflare Rocket Loader
fix(api): preserve 64-bit integer schema formats (#5908) @sanmaxdev
fix: make all self-managed file downloads/installs atomic, with real completion status (#5711) @nima1024m
fix(docker): start crond and persist acme.sh state so cert renewal works
fix(script): confirm auto-detected public IPv4 before issuing IP certificate
fix(scripts): pass --force to acme.sh --installcert so it survives sudo
fix(script): stop logging an error when Enter accepts the default ACME port
fix(script): rename the Xray binary to xray-linux-arm32 on 32-bit ARM
fix(script): make local PostgreSQL and fail2ban setup work on RHEL-family distros
fix(script): stop running full system upgrades via pacman -Syu on Arch
fix(update): avoid full dnf system upgrade (#5717) @v-2841
fix(scripts): avoid rpm package upgrades before installs (#5750) @v-2841
fix(script): correct hardcoded menu option numbers in x-ui.sh (#5787) @lxk955

Reports

New Contributors

@isultanov99 made their first contribution in #5661
@AmirRnz made their first contribution in #5677
@STRENCH0 made their first contribution in #5679
@v-2841 made their first contribution in #5717
@alaningtrump made their first contribution in #5751
@lxk955 made their first contribution in #5787
@ecgang made their first contribution in #5809
@yukh975 made their first contribution in #5833
@mrnickson-hue made their first contribution in #5854
@Djjanks made their first contribution in #5895
@sanmaxdev made their first contribution in #5908

Full Changelog: v3.4.2...v3.5.0