Every bot notice carries a Hide button, which deletes the message it sits on.
On a backup that message is the file itself: one tap, with no confirmation,
could remove the admin's only copy of the database. Backup files (the .db and
config.json, from the backup button, the scheduled job and the panel's
backup-to-Telegram endpoint) are now sent without a keyboard; other notices,
including the ban log file, keep Hide.
The backup button also left the menu above the files it sent, out of view at
the bottom of the chat. It now sends the Maintenance menu again below them and
removes the old one. A scheduled backup leaves the menu where it is.
A Host Description is appended to every raw-subscription node name as a base64
`?serverDescription=` tail. Only Happ and INCY read it; v2rayN, v2rayNG,
OpenClash and the rest show it as part of the node name, and the only way out
was clearing the Description (#7105).
The raw subscription body now carries the tail only when the requesting
User-Agent is Happ or INCY, for the endpoint links and the Hysteria2 loop
alike. Copied links, QR codes and the panel's link export keep it, since the
server cannot tell which client they end up in.
Closes#7105
gotp decodes the stored secret with strict base32 and panics when that fails,
so a 2FA secret saved through the settings API in lower case, grouped by
spaces, or not base32 at all turned every login and every attempt to turn 2FA
off into an HTTP 500. An empty secret had the opposite problem: the login
check accepted the code of an empty HMAC key, which anyone can compute.
VerifyWithSkew now normalizes the secret and verifies nothing for an empty or
non-base32 one, so secrets already stored in a display form work again.
Turning 2FA on through the settings update stores the normalized secret and
refuses one no authenticator could match.
Removing the last SNI tag in Hosts → Edit Host and saving did nothing: the
submit fell back to the hidden legacy `sni` field, so the old name was sent
again and the backend rebuilt the pool from it. It came back on the next edit
and stayed in every share link built from that host.
The tag list is the only SNI input, so the primary SNI is now the first tag or
empty. The dynamic ECH helper read the same stale field and follows the list
too. Hosts saved with only the legacy field still load, because the form seeds
the tag list from it.
The automatic soft limit read only /sys/fs/cgroup/memory.max, the root of
the cgroup namespace. A systemd MemoryMax on x-ui.service lives below that
root, so it was never seen: on a bare host the root has no memory.max and
no soft limit was set at all, and inside an LXC/Incus container the limit
came from the container (2 GiB -> "1843 MiB") while systemd killed the
panel at 650M. Either way GC never tightened before the OOM kill.
Walk from the process's own cgroup (/proc/self/cgroup) up to the visible
root and take the tightest memory.max (cgroup v2) or
memory.limit_in_bytes (v1). Docker with a private cgroup namespace sees
the same root limit as before.
xray-core 26.11.9 (bb335c6) raises any mux concurrency from 0 to 128 to
128, where 0 used to mean 8 and every other value was used as written. The
panel's default of 8 and anything a user types up to 128 therefore no
longer changes the result on a current core, while an older client core
still honours it.
The concurrency field of the outbound mux form, the host mux override and
the JSON subscription mux settings now carries that as a hint in all 14
locales. The emitted value is unchanged.
xray-core 26.11.9 (#7340, #7352) gives the Google Drive backend its own
defaults for the knobs a config leaves empty: flushIntervalMs 10,
maxPollIntervalMs 200 and concurrency 64. The other services keep 20, 500
and 8.
The tuning placeholders stand for "what the core uses when this is empty",
so they now follow the selected service, and the transports page in all
four doc languages names the Google Drive values.
Majors: i18next 26 -> 27.1.1 with react-i18next 17 -> 18.0.1, and jsdom
30 -> 31. The vitest group moves together to 5.1.0 (vitest, coverage-v8,
browser-playwright and the addon-vitest override). Also antd 6.7.0,
storybook 10.6.7, vite 8.3.8, @vitejs/plugin-react 6.3.0, react-query
5.107.1, react-hook-form 7.92.0, msw 3.0.5, playwright 1.65.0, otpauth
9.6.0 and oxfmt 0.78.0.
i18next 27 dropped interpolation.nestingPrefixEscaped, the option that kept
"$t(...)" nesting from ever matching, and an empty nestingPrefix falls back
to "$t(". The prefix is now a NUL character, which no translation or
node-reported text contains; node-list-untrusted-i18n.test.tsx goes red
without it.
Held back: oxlint stays at 1.90.0, because 1.91 and later flag six
fetch-in-effect loaders with react(set-state-in-effect) and those need a
data-loading rewrite of their own. @hookform/resolvers 7.0.6 and
oxlint-tsgolint 7.0.2007 are less than a day old, so 7.0.5 and 7.0.2006
are locked; the lockfile was resolved with a one-day cutoff.
Move the modules that are not pinned by xray-core: quic-go v0.65.0,
fasthttp v1.78.0, go-sqlite3 v1.14.53, klauspost/compress v1.20.4,
gin-contrib gzip v1.2.10 / sessions v1.1.4 / sse v1.2.1, x/crypto v0.59.0
(back on a tagged release), x/sync v0.25.0, x/sys v0.50.0, x/text v0.44.0,
x/arch v0.33.0, mongo-driver v2.10.0, purego, goupnp, go-ssdp,
pion/transport, go-internal and genproto.
Held back: pgx v5.13.0, x/exp and x509roots/fallback are less than a day
old; apernet/quic-go, gvisor and xtls/reality move only with xray-core.
xray-core 26.11.9 (#7329) spells the key log.logLevel and still accepts
loglevel. A template written with the new spelling showed "warning" in the
panel, and changing the level added a second loglevel key beside it, leaving
the core to pick between two values.
The select now reads either spelling and saves a single logLevel key.
xray-core 26.11.9 (#7315) added "all", "allexceptlan", "tcp", "udp" and
"icmp", bare ports, port ranges and a CIDR prefix in front of any value.
The save-time check already runs the core's own parser, so the typed forms
are accepted as they are; the form now lists the new named values and the
tooltip explains them in all 14 locales.
xray-core 26.11.9 (#7329) renamed a final rule's blockDelay to delay, added
logLevel, and now refuses either on a rule whose action is not block. A
stored template with a blockDelay on an allow rule therefore stops the core
at startup after the upgrade.
A one-time seeder strips delay, blockDelay and logLevel from non-block rules
of the template's freedom outbounds and moves blockDelay to delay on block
rules. The outbound form reads both spellings (blockDelay wins, as in the
core), writes delay, gains a log level control on block rules and emits
neither key on an allow rule.
Bump xtls/xray-core to 676eaf66f8f0 (v26.11.9) and the three binary pins
(DockerInit.sh, release.yml Linux + Windows) in lockstep, so the vendored
config loader and the child binary validate the same config.
The same go.mod also moves the go directive to 1.27.4 and
golang.org/x/crypto to v0.58.1-0.20261009181718-2f1f834330b2; the core pulls
in refraction-networking/utls 20261108164504, xtls/reality 20261108101329 and
klauspost/cpuid v2.4.2.
XDRIVE now caps concurrency at 256 instead of 64 (#7340), so the schema
comment quoting the cap follows.
tzdata 2026f cancelled Cuba's November 2026 DST fallback, so on hosts
with current tzdata (macOS) 2026-11-01 has no repeated midnight:
TestNextWeeklyRenewal_RepeatedMidnight failed and the subscription
calendar cases passed without exercising the repeated midnight.
Move both to 2020-11-01, a Sunday fallback on the 1st that every tzdata
version agrees on. The weekly case still catches a 168-hour advance.
submitTrafficWrite falls back to running fn inline when the serial
writer is not running (before StartTrafficWriter, during the shutdown
drain, in CLI paths and tests). That path took no lock, so an inline
write could run beside the draining writer or another inline write,
breaking the single-writer invariant that guards the Postgres deadlock.
One visible effect: ResetTrafficByEmail fans out one reset per inbound.
Run side by side, the second reset read the record still disabled but
the traffic already zeroed, judged the client operator-disabled and
saved enable=false over the first reset's restore
(TestResetTrafficByEmail_ReenablesEveryInboundOfTheClient failed ~25%).
safeApply now holds a package mutex, so every write path is serialized.
Use valid translation keys on six panel screens, add the missing copy-failure and empty-value strings across all locales, and reject unresolved literal translation keys in the regression test.
Expose selectable options and selected values, associate validation guidance with controls, and contain keyboard focus in inbound dialogs. Preserve create and edit serialization and add Chromium keyboard and accessibility checks.
Restore usable clients when renewed, avoid duplicate reset updates, and prioritize operator writes in the serialized traffic writer. Preserve manual disables and keep every inbound consistent after traffic resets.
Keep omitted client fields and per-inbound flows unchanged while honoring explicit clears. Support the query aliases used to recover legacy dot-name clients and regenerate the API reference. Add an HTTP regression covering partial updates through those aliases.
Reject reserved dot-segment client names and recover legacy records through query aliases. Preserve token scopes and path identity precedence, and update the generated API reference.
The v3.11.0 bot rebuild left the admin's client card without the subscription link, individual links and QR code, so an admin could not hand a config to a client who cannot reach Telegram yet. The card now carries Links and QR code buttons that open the existing screens. Closes#6984.
Xray refuses a VLESS inbound with server decryption whenever fallbacks is non-nil, even an empty list, so an API or imported inbound with decryption and fallbacks: [] took every inbound down. Empty fallback arrays are now normalized away on add, update, config build and node push; non-empty ones are refused with decryption, enabling decryption over stored fallback rules is refused, and a legacy conflicting row holds back the running core instead of stopping it. The form, API docs and locales follow. Closes#7001.
A kernel-mode AmneziaWG inbound routes and masquerades only its interface subnet, so peers whose AllowedIPs lay outside it (a restored backup, a changed subnet) handshook but got no internet. Enabling kernel mode, saving an active kernel inbound, and adding, enabling or re-addressing a client now refuse out-of-subnet peers with the offending client named. Legacy stray peers still start and can still be edited or disabled.
Typed commands edited the remembered menu message, which a user who cleared the chat can no longer see, and then deleted the command, so /start left the chat empty again. Typed commands (/start, /status, /usage, /clearall) now send a new screen and then remove the old menu, or retire its buttons when it is past Telegram's delete window; button taps still edit in place. Closes#6997.
The panel-port prompt accepted only y/Y, so yes picked a random port; a custom port was never validated (empty, non-numeric, out-of-range, busy, or leading-zero octal), is_port_in_use never detected a listener, and the installer printed success even when applying the settings failed. Answers are now case-insensitive, custom ports are normalized and checked, the port check is fixed, and the install aborts unless the CLI reports every setting applied. A bash suite runs in shell-lint.
parseWireguard joined u.Hostname(), which strips IPv6 brackets, with the port, so wireguard://key@[2001:db8::1]:51820 became 2001:db8::1:51820 and Xray's ParseDestination rejected it. The endpoint is now built with net.JoinHostPort, matching the frontend parser; IPv4 and hostname endpoints are unchanged.
An inbound switched off by its own traffic cap came back on the periodic reset, but the admin per-inbound reset and Reset All Traffic only zeroed the counters. After that nothing could tell it from a hand-disabled inbound, so it stayed off with every client on it. Both admin resets now re-enable the inbounds their cap switched off, using the predicate the periodic job used, now in the service next to disableInvalidInbounds; expired and hand-disabled inbounds stay off.
While a lazily loaded dialog's code downloaded, LazyMount's default Spin fallback was laid out beside the page content, narrowing it and poking past the right edge, so scrollbars flashed. The default fallback is now a fullscreen Spin outside the layout; a story pins the content width while the dialog loads.
The host Remark hint said the label is shown as the config name when the inbound has no remark, but a host remark only ever fills the {{HOST}} token of the remark template; it never substitutes the inbound's remark. The hint in all 14 locales now tells operators to put {{HOST}} in the Remark Template. Fixes#7027.
install.sh and update.sh stripped the leading slash and regenerated webBasePath whenever the rest was shorter than four characters, so valid short paths such as /a/ or /ab/ were replaced by a random one on every update or reinstall. Only an empty or root path is initialized now, and both scripts read one settings snapshot and leave the settings alone when that read fails or is malformed. Fixes#6961.
Restarting the panel left it unreachable for up to a minute. CheckCpuJob sampled cpu.Percent over its whole one-minute period, so cron.Stop nearly always waited on it; it now diffs cpu.Times against its previous run (iowait counted as idle, as before). With Telegram unreachable, bus.Stop waited on an in-flight send and tgbot.Start ran getMe/setMyCommands inline; each bot call now returns once StopBot closes the bot's stop channel, the bot stops before the bus, and the artwork/commands warm-up runs in the background.
The subscription settings cache strips each inbound's clients array, but the TUIC link generator still reads credentials from it, so raw subscriptions (v2rayN, Shadowrocket) lost every TUIC link while the browser page kept it. TUIC now reads its full settings, as WireGuard and AmneziaWG already do.
A client on inbounds of several nodes has one traffic row homed on one inbound, but the lifecycle merge looked it up in a node-scoped map. A node that was not the home therefore looked like it had no master state, so its stale enable or disable overwrote the shared record and adopted settings, flipping the client every tick, and a renewal on that node was missed. The merge now uses the global per-email traffic lookup, including clients reported only in settings.
pg:next, pg:prev and pg:none were missing from isClientSelfCallback, so the callback gate dropped every page tap from a non-admin and a client with several accounts was stuck on page one. Paging only re-renders the screen stored for the caller's own chat, so the gate now lets it through. An account's links screen also shows that account's usage to its owner instead of the admin-only client card button. Fixes#7032.
EnsureURLScheme matched the mailto: and tel: prefixes case-sensitively, so a support link typed as Mailto: or TEL: (phone keyboards capitalize the first letter) got https:// prepended and opened a broken web page. URL schemes are case-insensitive, and the check now is too.
UpdateXray stopped the core before downloading, which also stopped the Panel Traffic Outbound bridge the download needed on servers that reach GitHub only through it, leaving every client offline. The new core is now downloaded, staged and checked with run -test against the current config while the old one serves; only the rename and restart swap it (Windows still stops first). update.sh gets the bridge as XUI_UPDATE_PROXY, installs x-ui.sh from the release archive, and fetches Alpine's x-ui.rc before stopping x-ui.
When Telegram rejected a cached decorative photo, /start returned without a screen and edits failed the same way. A Bot API 400 on cached artwork now retries once with the generated PNG, keeping caption, keyboard and target, and the stale cached id is dropped only after the fallback succeeds. Refs #6943.
importPostgresDB forwarded keepHostSettings only for native PostgreSQL dumps; both SQLite branches dropped it, so importing a .db or SQL dump copied the source's ports, paths, certificates and node identity over the destination's. Both formats now capture the host-bound settings first and restore them after a successful migration. CI runs the new integration test against PostgreSQL. Fixes#6993.
url.Parse already unescapes the fragment, and decodeHash unescaped it again, so a + in a vless, trojan, hysteria2 or wireguard remark became a space and an escaped % was decoded twice. These parsers now pass the escaped fragment, decoding it once like the shadowsocks parser and the frontend.
The bot rewrite sent only the rotated previous ban log, so today's bans stayed hidden until the daily rotation, and an empty file was uploaded and rejected. The bot now sends the previous and then the current log, skips missing or empty files, and replies No results only when neither can be sent. Closes#6990.
The auto-delete retention guard refused a partial directory result for one tick, but still stored it as the next baseline, so the following tick detached clients that were still in LDAP. A refused fetch now leaves the baseline unchanged. Closes#6935.
An external hy2:// link turned into a bare Clash Hysteria2 node: obfs, obfs-password, the port-hopping range and the certificate pin were dropped, so Mihomo could not reach servers that require them. External and panel Hysteria2 nodes now share one converter.
RuleCardList labelled balancer rules with t('pages.xray.balancer'), which is an object in every locale, so phones showed i18next's 'returned an object instead of string' error. It now uses the pages.xray.rules.balancer leaf the Balancers tab already uses, and the dead-keys test fails on any literal key that names a group.
parseVmess tried standard base64, then unpadded URL-safe base64, so a URL-safe body that kept its = padding failed both and the server silently dropped out of an imported outbound subscription. It now uses base64DecodeFlexible, the helper the shadowsocks parser already uses.
Ant Design's Spin wraps its content in aria-live="polite", so every
WebSocket tick on the dashboard, inbounds, clients and nodes pages was
announced, and only the changed number was read, with no label.
Pass aria-live="off" on every Spin that wraps content; aria-busy still
signals loading. Each vital tile is now a group named by its metric,
so "47.2 %" is read as CPU.
rc-select renders each tag's remove "x" as an aria-hidden span with no
tabIndex, so screen-reader users could only Backspace the last value
away, never remove one SNI or inbound from the middle.
selectTagRender swaps in a real button named "Remove <value>" and
moves focus to the next tag after removal. It is applied to every
tags/multiple Select. maxTagCount="responsive" is dropped because it
hid selected inbounds behind "+N", where no screen reader could reach
them.
Two oxlint rules (antd-a11y/spin-content-not-live and
antd-a11y/select-tag-remove) keep new code from regressing either fix.
Bump docs deps (fumadocs-core/ui 16.17.9, fumadocs-openapi 12.5.7, lucide-react 1.66, oxfmt 0.75, oxlint 1.90, postcss, @types/node) and pnpm to 12.16.1. Drop the now-unneeded minimumReleaseAge excludes for the old fumadocs versions.
Frontend: override minimatch to ^11.0.3 for swagger-ui-react and glob to ^14.0.3 for the docgen vite plugin, which updates the lockfile.
Also fix the AmneziaWG kernel Alert to use the Ant Design 6 `title` prop instead of the deprecated `message`.
The race job failed TestEnsureRebuildsWhenS4ChangesTheDerivedMTU with
"bind 127.0.0.1:58720: address already in use". The package hardcoded
WireGuard and port-forward ports 58712-58922, all inside Linux's ephemeral
range (32768-60999), so any concurrent :0 socket could already hold one;
several were also reused across tests (58713 x3, 58715, 58717, 58720).
Tests that never dial the server now use ListenPort 0; tests that need the
number take an OS-assigned one via freeUDPPort / freeTCPUDPPort (the latter
for port forwards, which bind TCP and UDP on the same port).
PluS98
Jay Hemnani
Aleksey Fedorov
Benjamin Mitchell
Sanaei
Cheng Ho Ming, Eric
Hamed
Mahdi Fallahnejhad
Benjamin Mitchell
dependabot[bot]
25f2002654
Aleksey
VAIO73
Guidance
Denis Gritsenko
Seyed Mahdi
Бат-Орших
kevin
Cheng Ho Ming, Eric
Alireza Ahmadi