xray-core 26.11.9 (bb335c6) raises any mux concurrency from 0 to 128 to
128, where 0 used to mean 8 and every other value was used as written. The
panel's default of 8 and anything a user types up to 128 therefore no
longer changes the result on a current core, while an older client core
still honours it.
The concurrency field of the outbound mux form, the host mux override and
the JSON subscription mux settings now carries that as a hint in all 14
locales. The emitted value is unchanged.
xray-core 26.11.9 (#7340, #7352) gives the Google Drive backend its own
defaults for the knobs a config leaves empty: flushIntervalMs 10,
maxPollIntervalMs 200 and concurrency 64. The other services keep 20, 500
and 8.
The tuning placeholders stand for "what the core uses when this is empty",
so they now follow the selected service, and the transports page in all
four doc languages names the Google Drive values.
Majors: i18next 26 -> 27.1.1 with react-i18next 17 -> 18.0.1, and jsdom
30 -> 31. The vitest group moves together to 5.1.0 (vitest, coverage-v8,
browser-playwright and the addon-vitest override). Also antd 6.7.0,
storybook 10.6.7, vite 8.3.8, @vitejs/plugin-react 6.3.0, react-query
5.107.1, react-hook-form 7.92.0, msw 3.0.5, playwright 1.65.0, otpauth
9.6.0 and oxfmt 0.78.0.
i18next 27 dropped interpolation.nestingPrefixEscaped, the option that kept
"$t(...)" nesting from ever matching, and an empty nestingPrefix falls back
to "$t(". The prefix is now a NUL character, which no translation or
node-reported text contains; node-list-untrusted-i18n.test.tsx goes red
without it.
Held back: oxlint stays at 1.90.0, because 1.91 and later flag six
fetch-in-effect loaders with react(set-state-in-effect) and those need a
data-loading rewrite of their own. @hookform/resolvers 7.0.6 and
oxlint-tsgolint 7.0.2007 are less than a day old, so 7.0.5 and 7.0.2006
are locked; the lockfile was resolved with a one-day cutoff.
Move the modules that are not pinned by xray-core: quic-go v0.65.0,
fasthttp v1.78.0, go-sqlite3 v1.14.53, klauspost/compress v1.20.4,
gin-contrib gzip v1.2.10 / sessions v1.1.4 / sse v1.2.1, x/crypto v0.59.0
(back on a tagged release), x/sync v0.25.0, x/sys v0.50.0, x/text v0.44.0,
x/arch v0.33.0, mongo-driver v2.10.0, purego, goupnp, go-ssdp,
pion/transport, go-internal and genproto.
Held back: pgx v5.13.0, x/exp and x509roots/fallback are less than a day
old; apernet/quic-go, gvisor and xtls/reality move only with xray-core.
xray-core 26.11.9 (#7329) spells the key log.logLevel and still accepts
loglevel. A template written with the new spelling showed "warning" in the
panel, and changing the level added a second loglevel key beside it, leaving
the core to pick between two values.
The select now reads either spelling and saves a single logLevel key.
xray-core 26.11.9 (#7315) added "all", "allexceptlan", "tcp", "udp" and
"icmp", bare ports, port ranges and a CIDR prefix in front of any value.
The save-time check already runs the core's own parser, so the typed forms
are accepted as they are; the form now lists the new named values and the
tooltip explains them in all 14 locales.
xray-core 26.11.9 (#7329) renamed a final rule's blockDelay to delay, added
logLevel, and now refuses either on a rule whose action is not block. A
stored template with a blockDelay on an allow rule therefore stops the core
at startup after the upgrade.
A one-time seeder strips delay, blockDelay and logLevel from non-block rules
of the template's freedom outbounds and moves blockDelay to delay on block
rules. The outbound form reads both spellings (blockDelay wins, as in the
core), writes delay, gains a log level control on block rules and emits
neither key on an allow rule.
Bump xtls/xray-core to 676eaf66f8f0 (v26.11.9) and the three binary pins
(DockerInit.sh, release.yml Linux + Windows) in lockstep, so the vendored
config loader and the child binary validate the same config.
The same go.mod also moves the go directive to 1.27.4 and
golang.org/x/crypto to v0.58.1-0.20261009181718-2f1f834330b2; the core pulls
in refraction-networking/utls 20261108164504, xtls/reality 20261108101329 and
klauspost/cpuid v2.4.2.
XDRIVE now caps concurrency at 256 instead of 64 (#7340), so the schema
comment quoting the cap follows.
tzdata 2026f cancelled Cuba's November 2026 DST fallback, so on hosts
with current tzdata (macOS) 2026-11-01 has no repeated midnight:
TestNextWeeklyRenewal_RepeatedMidnight failed and the subscription
calendar cases passed without exercising the repeated midnight.
Move both to 2020-11-01, a Sunday fallback on the 1st that every tzdata
version agrees on. The weekly case still catches a 168-hour advance.
submitTrafficWrite falls back to running fn inline when the serial
writer is not running (before StartTrafficWriter, during the shutdown
drain, in CLI paths and tests). That path took no lock, so an inline
write could run beside the draining writer or another inline write,
breaking the single-writer invariant that guards the Postgres deadlock.
One visible effect: ResetTrafficByEmail fans out one reset per inbound.
Run side by side, the second reset read the record still disabled but
the traffic already zeroed, judged the client operator-disabled and
saved enable=false over the first reset's restore
(TestResetTrafficByEmail_ReenablesEveryInboundOfTheClient failed ~25%).
safeApply now holds a package mutex, so every write path is serialized.
Use valid translation keys on six panel screens, add the missing copy-failure and empty-value strings across all locales, and reject unresolved literal translation keys in the regression test.
Expose selectable options and selected values, associate validation guidance with controls, and contain keyboard focus in inbound dialogs. Preserve create and edit serialization and add Chromium keyboard and accessibility checks.
Restore usable clients when renewed, avoid duplicate reset updates, and prioritize operator writes in the serialized traffic writer. Preserve manual disables and keep every inbound consistent after traffic resets.
Keep omitted client fields and per-inbound flows unchanged while honoring explicit clears. Support the query aliases used to recover legacy dot-name clients and regenerate the API reference. Add an HTTP regression covering partial updates through those aliases.
Reject reserved dot-segment client names and recover legacy records through query aliases. Preserve token scopes and path identity precedence, and update the generated API reference.
The v3.11.0 bot rebuild left the admin's client card without the subscription link, individual links and QR code, so an admin could not hand a config to a client who cannot reach Telegram yet. The card now carries Links and QR code buttons that open the existing screens. Closes#6984.
Xray refuses a VLESS inbound with server decryption whenever fallbacks is non-nil, even an empty list, so an API or imported inbound with decryption and fallbacks: [] took every inbound down. Empty fallback arrays are now normalized away on add, update, config build and node push; non-empty ones are refused with decryption, enabling decryption over stored fallback rules is refused, and a legacy conflicting row holds back the running core instead of stopping it. The form, API docs and locales follow. Closes#7001.
A kernel-mode AmneziaWG inbound routes and masquerades only its interface subnet, so peers whose AllowedIPs lay outside it (a restored backup, a changed subnet) handshook but got no internet. Enabling kernel mode, saving an active kernel inbound, and adding, enabling or re-addressing a client now refuse out-of-subnet peers with the offending client named. Legacy stray peers still start and can still be edited or disabled.
Typed commands edited the remembered menu message, which a user who cleared the chat can no longer see, and then deleted the command, so /start left the chat empty again. Typed commands (/start, /status, /usage, /clearall) now send a new screen and then remove the old menu, or retire its buttons when it is past Telegram's delete window; button taps still edit in place. Closes#6997.
The panel-port prompt accepted only y/Y, so yes picked a random port; a custom port was never validated (empty, non-numeric, out-of-range, busy, or leading-zero octal), is_port_in_use never detected a listener, and the installer printed success even when applying the settings failed. Answers are now case-insensitive, custom ports are normalized and checked, the port check is fixed, and the install aborts unless the CLI reports every setting applied. A bash suite runs in shell-lint.
parseWireguard joined u.Hostname(), which strips IPv6 brackets, with the port, so wireguard://key@[2001:db8::1]:51820 became 2001:db8::1:51820 and Xray's ParseDestination rejected it. The endpoint is now built with net.JoinHostPort, matching the frontend parser; IPv4 and hostname endpoints are unchanged.
An inbound switched off by its own traffic cap came back on the periodic reset, but the admin per-inbound reset and Reset All Traffic only zeroed the counters. After that nothing could tell it from a hand-disabled inbound, so it stayed off with every client on it. Both admin resets now re-enable the inbounds their cap switched off, using the predicate the periodic job used, now in the service next to disableInvalidInbounds; expired and hand-disabled inbounds stay off.
While a lazily loaded dialog's code downloaded, LazyMount's default Spin fallback was laid out beside the page content, narrowing it and poking past the right edge, so scrollbars flashed. The default fallback is now a fullscreen Spin outside the layout; a story pins the content width while the dialog loads.
The host Remark hint said the label is shown as the config name when the inbound has no remark, but a host remark only ever fills the {{HOST}} token of the remark template; it never substitutes the inbound's remark. The hint in all 14 locales now tells operators to put {{HOST}} in the Remark Template. Fixes#7027.
install.sh and update.sh stripped the leading slash and regenerated webBasePath whenever the rest was shorter than four characters, so valid short paths such as /a/ or /ab/ were replaced by a random one on every update or reinstall. Only an empty or root path is initialized now, and both scripts read one settings snapshot and leave the settings alone when that read fails or is malformed. Fixes#6961.
Restarting the panel left it unreachable for up to a minute. CheckCpuJob sampled cpu.Percent over its whole one-minute period, so cron.Stop nearly always waited on it; it now diffs cpu.Times against its previous run (iowait counted as idle, as before). With Telegram unreachable, bus.Stop waited on an in-flight send and tgbot.Start ran getMe/setMyCommands inline; each bot call now returns once StopBot closes the bot's stop channel, the bot stops before the bus, and the artwork/commands warm-up runs in the background.
The subscription settings cache strips each inbound's clients array, but the TUIC link generator still reads credentials from it, so raw subscriptions (v2rayN, Shadowrocket) lost every TUIC link while the browser page kept it. TUIC now reads its full settings, as WireGuard and AmneziaWG already do.
A client on inbounds of several nodes has one traffic row homed on one inbound, but the lifecycle merge looked it up in a node-scoped map. A node that was not the home therefore looked like it had no master state, so its stale enable or disable overwrote the shared record and adopted settings, flipping the client every tick, and a renewal on that node was missed. The merge now uses the global per-email traffic lookup, including clients reported only in settings.
pg:next, pg:prev and pg:none were missing from isClientSelfCallback, so the callback gate dropped every page tap from a non-admin and a client with several accounts was stuck on page one. Paging only re-renders the screen stored for the caller's own chat, so the gate now lets it through. An account's links screen also shows that account's usage to its owner instead of the admin-only client card button. Fixes#7032.
EnsureURLScheme matched the mailto: and tel: prefixes case-sensitively, so a support link typed as Mailto: or TEL: (phone keyboards capitalize the first letter) got https:// prepended and opened a broken web page. URL schemes are case-insensitive, and the check now is too.
UpdateXray stopped the core before downloading, which also stopped the Panel Traffic Outbound bridge the download needed on servers that reach GitHub only through it, leaving every client offline. The new core is now downloaded, staged and checked with run -test against the current config while the old one serves; only the rename and restart swap it (Windows still stops first). update.sh gets the bridge as XUI_UPDATE_PROXY, installs x-ui.sh from the release archive, and fetches Alpine's x-ui.rc before stopping x-ui.
When Telegram rejected a cached decorative photo, /start returned without a screen and edits failed the same way. A Bot API 400 on cached artwork now retries once with the generated PNG, keeping caption, keyboard and target, and the stale cached id is dropped only after the fallback succeeds. Refs #6943.
importPostgresDB forwarded keepHostSettings only for native PostgreSQL dumps; both SQLite branches dropped it, so importing a .db or SQL dump copied the source's ports, paths, certificates and node identity over the destination's. Both formats now capture the host-bound settings first and restore them after a successful migration. CI runs the new integration test against PostgreSQL. Fixes#6993.
url.Parse already unescapes the fragment, and decodeHash unescaped it again, so a + in a vless, trojan, hysteria2 or wireguard remark became a space and an escaped % was decoded twice. These parsers now pass the escaped fragment, decoding it once like the shadowsocks parser and the frontend.
The bot rewrite sent only the rotated previous ban log, so today's bans stayed hidden until the daily rotation, and an empty file was uploaded and rejected. The bot now sends the previous and then the current log, skips missing or empty files, and replies No results only when neither can be sent. Closes#6990.
The auto-delete retention guard refused a partial directory result for one tick, but still stored it as the next baseline, so the following tick detached clients that were still in LDAP. A refused fetch now leaves the baseline unchanged. Closes#6935.
An external hy2:// link turned into a bare Clash Hysteria2 node: obfs, obfs-password, the port-hopping range and the certificate pin were dropped, so Mihomo could not reach servers that require them. External and panel Hysteria2 nodes now share one converter.
RuleCardList labelled balancer rules with t('pages.xray.balancer'), which is an object in every locale, so phones showed i18next's 'returned an object instead of string' error. It now uses the pages.xray.rules.balancer leaf the Balancers tab already uses, and the dead-keys test fails on any literal key that names a group.
parseVmess tried standard base64, then unpadded URL-safe base64, so a URL-safe body that kept its = padding failed both and the server silently dropped out of an imported outbound subscription. It now uses base64DecodeFlexible, the helper the shadowsocks parser already uses.
Ant Design's Spin wraps its content in aria-live="polite", so every
WebSocket tick on the dashboard, inbounds, clients and nodes pages was
announced, and only the changed number was read, with no label.
Pass aria-live="off" on every Spin that wraps content; aria-busy still
signals loading. Each vital tile is now a group named by its metric,
so "47.2 %" is read as CPU.
rc-select renders each tag's remove "x" as an aria-hidden span with no
tabIndex, so screen-reader users could only Backspace the last value
away, never remove one SNI or inbound from the middle.
selectTagRender swaps in a real button named "Remove <value>" and
moves focus to the next tag after removal. It is applied to every
tags/multiple Select. maxTagCount="responsive" is dropped because it
hid selected inbounds behind "+N", where no screen reader could reach
them.
Two oxlint rules (antd-a11y/spin-content-not-live and
antd-a11y/select-tag-remove) keep new code from regressing either fix.
Bump docs deps (fumadocs-core/ui 16.17.9, fumadocs-openapi 12.5.7, lucide-react 1.66, oxfmt 0.75, oxlint 1.90, postcss, @types/node) and pnpm to 12.16.1. Drop the now-unneeded minimumReleaseAge excludes for the old fumadocs versions.
Frontend: override minimatch to ^11.0.3 for swagger-ui-react and glob to ^14.0.3 for the docgen vite plugin, which updates the lockfile.
Also fix the AmneziaWG kernel Alert to use the Ant Design 6 `title` prop instead of the deprecated `message`.
The race job failed TestEnsureRebuildsWhenS4ChangesTheDerivedMTU with
"bind 127.0.0.1:58720: address already in use". The package hardcoded
WireGuard and port-forward ports 58712-58922, all inside Linux's ephemeral
range (32768-60999), so any concurrent :0 socket could already hold one;
several were also reused across tests (58713 x3, 58715, 58717, 58720).
Tests that never dial the server now use ListenPort 0; tests that need the
number take an OS-assigned one via freeUDPPort / freeTCPUDPPort (the latter
for port forwards, which bind TCP and UDP on the same port).
TestScreenArtReprobeWindow failed under -race -shuffle in CI: the probe
slot is process-wide, and a probe an earlier test started against its
own (now closing) server still held it when the next test asked for a
re-probe, so that request was dropped and the stale avatar never
re-probed. The leftover probe could also write its result over the
state the next test had just reset.
Probes now run in a WaitGroup that resetScreenArt waits on, so a reset
between mock servers always starts from an idle probe slot.
xray-core 26.10.31 (#7231) added an "s3" XDRIVE service that carries the
stream through S3-compatible storage: secrets are AccessKeyID,
SecretAccessKey and an optional SessionToken, an "s3" object names the
endpoint, region, bucket and pathStyle, and remoteFolder becomes the
object prefix.
The schema and the shared XDRIVE form offer the service with a field for
every S3 key, so an outbound or inbound keeps its storage on save. The
save path refused "s3" as an unknown service; it now runs the vendored
loader, whose ValidateS3Config would otherwise only fire when the
listener starts and stop every inbound. A node refuses a pushed S3
storage like a pushed template one, since its endpoint is any URL the
node would dial, including its own panel. Labels in all 14 locales;
docs updated in en/fa/ru/zh.
xray-core 26.10.31 (#7288) widened a TUN inbound's
autoSystemWfpBlockLeak: "dns" now also blocks DNS over TLS/QUIC (port
853), "windnsclient" covers only Windows' DNS Client service, and any
"tcp/<port>" or "udp/<port>" keeps that port inside the TUN. Anything
else, such as "tcp/0" or "icmp/1", stops the core at startup.
The form offers windnsclient and takes typed port values, the hint
explains them in all 14 locales, and the inbound and template save
paths run the core's own ExpandWfpBlockLeak so a value it refuses is
refused at save instead of taking every inbound down.
xray-core 26.10.31 (#7295) added xhttpSettings.h2Params, a Go net/http
HTTP2Config the XHTTP server applies to its HTTP/2 listener. The
inbound form parsed xhttpSettings through a Zod object that strips
unknown keys, so a value set through the JSON editor vanished on the
next save; it is now kept as an optional record.
h2Params tunes the server only. Share links already carry an allowlist
of XHTTP keys, but the JSON subscription copies the inbound's
xhttpSettings minus a denylist, which now drops h2Params too.
xray-core 26.10.29 (#7267) checks a scheduled geodata section when the
core starts: at most 100 assets, every file a .dat, a cron it can parse
and an @every interval of at least a minute. A refusal there stops the
core and every inbound with it, and the panel's own file-name pattern
still let any extension through.
The geodata editor now requires a .dat file name, and the template save
path applies the same checks the core does. The invalid-file hint names
the .dat requirement in all 14 locales.
xray-core 26.10.29 (#7249) narrowed the "private" addresses an
unencrypted vless/trojan outbound may reach to RFC 1918, loopback and
link-local, so 100.64.0.0/10 (CGNAT, Tailscale), 198.18.0.0/15 and the
other ranges of the old geoip:private list are now refused. The
embedded validator follows the new core, which made the template save
and outbound subscriptions refuse such an outbound even when the panel
still runs an older core that accepts it.
The legacy skip now also lets through, on a core from 26.7.11 up to
26.10.28, an outbound whose server address (flat, vnext or servers) is
an IP in that core's wider private set. Unknown versions stay strict.
Sanaei
Cheng Ho Ming, Eric
Hamed
Mahdi Fallahnejhad
Aleksey Fedorov
Benjamin Mitchell
dependabot[bot]
25f2002654
Aleksey
Jay Hemnani
VAIO73
Guidance
PluS98
Denis Gritsenko
Seyed Mahdi
Бат-Орших
kevin
Cheng Ho Ming, Eric
Alireza Ahmadi