* feat(protocol): add Sudoku proxy protocol support and optimize data-path forwarding to reduce memory allocations and buffer copying * feat(dns): support dedicated DNS routing for direct domains, DNS over TCP, DNSCrypt upstreams, and multiple servers in CNAME/Host rules * feat(tailscale): migrate login to TS2021, support subnet routing and exit nodes, and introduce low-power tunnel suspension on demand * feat(protocol): support Clash SSH/packetaddr subscription imports * feat(macos): add menu bar routing controls and quick server configurations for macOS * feat(group): add an independent ping-based auto-sort option for policy groups * perf(transport): handle KCP backpressure, harden WireGuard/Hysteria packet security, and restore full upload throughput on QUIC transports * fix(vpn): prevent tunnel startup hangs, preserve local device connectivity, and prevent stale speedtests from resetting VPN states * fix(dns): route host resolutions and QUIC endpoints through tunnel resolver, and reuse H2 addresses for H3 upgrades * fix(tailscale): advertise disco keys for direct paths, respect custom DERP TLS verification, and fix battery drain when VPN is disconnected * fix(rule): fix remote rule set refreshes, preserve quoted rewrite tokens during parsing/export, and guard compiled policy group updates * fix(system): support WebKit scoped globals and fetch polyfills in scripts, and apply tombstone-based iCloud manifest to prevent configuration rollbacks * fix(system): prevent WKWebView/JavaScriptCore teardown crashes and limit proxy stream memory growth to prevent OOM Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(tailscale): add global Tailscale tunnel, local MagicDNS resolution, and UI support for peer device, RTT, and config management * perf(tailscale): optimize Tailscale power efficiency and stability, scheduling WireGuard ticks on demand and improving UDP socket recreation * feat(masque): add MASQUE outbound proxy (H3 & H2 transport) with custom SNI/URI support, keepalive configuration, and logger gating * feat(tls): add TLS ClientHello fingerprinting support and profile selection UI * perf(network): optimize connection management for Mux, XHTTP, and Chain Sockets, supporting HTTP/2 graceful stream shutdown and resolving SOCKS5 UDP relay failures in chained proxy setups * fix(dns): restore Bonjour and DNS-SD service discovery over VPN, centralize query retry scheduling, and optimize IPv6 PTR local resolution * fix(ssh): avoid blocking multiplexed queues during handshake and correct UDPGW length calculations * fix(protocol): enhance Mieru user hints and Clash parsing, correct Hysteria 2 stream closure, fix AmneziaWG magic header processing, and guard OpenConnect config updates * perf(system): rewrite IPC message channel and encrypt status replies, fix WebKit runtime battery drain on iOS, unify HUD toasts, and add macOS/Catalyst certificate instructions * chore(i18n): clean up and merge localized strings in Localizable.strings Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(tls): add TLS ClientHello fingerprinting support and profile selection UI * feat(server): sort by server weight as a fallback in ping-based comparisons * feat(tailscale): add a global Tailscale tunnel module * fix(dns): allow DNS-SD queries to reach mDNS to resolve local Bonjour service discovery issues * fix(proxy): wait for previous listener sockets to teardown completely before rebinding proxy ports * fix(wireguard): trigger WireGuard rehandshake after keepalive keys expire * fix(relay): notify delegate properly after asynchronous UDP relay handshake * fix(udp): guard delegate callbacks during UDP relay connection Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(mieru): add support for Mieru traffic pattern obfuscation and fragmented timing * perf(tester): optimize concurrent url-test scheduling and interim updates for large groups * perf(tunnel): centralize DNS retry scheduling and add backoff retry for proxy binding * perf(udp): correct UDP rule rematch priority after DNS and centralize relay socket cleanup * perf(ssh): tune channel window adjustment * fix(udp): correct UDP rule rematch after DNS resolution * fix(rule): skip IP matching when IP is empty * fix(tuic): retry authenticate when QUIC cannot write immediately * fix(UI): fix table footer view layouts in macOS and QR scanner preview transitions Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(vless): enable compact stream buffers on iOS/tvOS to reduce concurrent memory usage * perf(tester): optimize group tester switch logic to compare current round results * perf(hysteria): stabilize upload pacing and congestion control for HYBBR * fix(dns): handle transient socket backpressure gracefully in DNS over QUIC/HTTP3 * fix(http3): fix egress write stalls and prevent assertions on HTTP/3 connections * fix(fallback): prevent application crash when falling back to string policy group placeholders * fix(xhttp): allow NSNumber values in options parsing to preserve numeric parameters Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(http): use dynamic browser User-Agent for HTTP2, HTTP3, and XHTTP requests * feat(clash): support parsing the port-range field in Clash proxy configurations * feat(config): support parsing xhttp transport options and nest them into obfsParam * refactor(rule): optimize QUIC traffic matching in logical rules by decoupling port constraints * perf(mieru): refine Mieru configuration parsing and URL import/export format * fix(tunnel): close local streams after terminal proxy responses and add handshake timeout * fix(ip): correct minimum length validation thresholds for IPv4 and IPv6 addresses * fix(mux): centralize stream removal on remote disconnect to fix HTTP/2 leaks Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* feat(mieru): add support for Mieru protocol and its reliable UDP transport mode * refactor(ech): refine ECH mode detection and validate configurations * perf(widget): simplify Control Center widget status checking and toggle logic * fix(backend): fix parameter truncation error when parsing WebSocket Early Data paths Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

This update is one of the most significant version upgrades recently, adding support for various mainstream protocols and deeply optimizing the core transmission engine: 1. New Protocol Support * Mieru Protocol: Officially supports the Mieru transmission protocol, providing you with more stealthy connection options. * OpenConnect: Added support for the OpenConnect protocol, compatible with more office and enterprise network environments. * TrustTunnel: Supports the brand-new TrustTunnel protocol, further enhancing penetration capabilities in complex networks. 2. Core Protocol Optimization * VLESS Vision Enhancement: Improved support for VLESS XTLS Vision, significantly increasing camouflage and stability during high-performance transmission and reducing detection risks. * All-new DNS Engine: Reconstructed the DNS cache system, significantly shortening the initial webpage loading time. * HTTP/3 Optimization: Deeply optimized the transmission efficiency of HTTP/3 based on QUIC, making video playback smoother in high packet loss environments. 3. Transmission and Decryption Upgrade * More Stable HTTPS Decryption: Greatly improved the compatibility of MITM (Man-in-the-Middle decryption), providing script enthusiasts with more reliable Body modification and flow control capabilities. * Asymmetrical Download Support: Supports asynchronous download settings for XHTTP, allowing download and upload paths to be separated and optimizing transmission performance in specific networks. 4. UI and User Experience * QR Code Scanning Fix: Resolved the display abnormality of the QR code scanner during screen rotation. * List Management: Fixed the issue where moving positions in the server list during edit mode might fail. 5. Stability and Power Consumption * System-level Hardening: Fixed multiple issues that could lead to App crashes or deadlocks in the background, further reducing system resource usage. * Shortcuts: Optimized iOS Shortcuts integration, making VPN status retrieval faster and more accurate. Please note: Shadowrocket is a standalone networking utility and does not include any proxy services or server resources. Users are responsible for providing their own configurations.

* chore(task): add execution delay for background tasks * fix(config): optimize rule building to prevent crashes * fix(dns): resolve mDNS and DNS-SD query issues * fix(icon): resolve white artifact issue during app switcher animation * fix(mux): resolve AnyTLS pool mode and idle session management issues * fix(UI): resolve "More" button reset issue

* chore(server): display VLESS encryption in plain text * feat(http3): implement HTTP/3 support and optimize data reading * feat(naive): add UDP over TCP (UoT) support * fix(dns): resolve local FQDN query issue * fix(group): prevent crash from accessing deallocated weak references * fix(http2): resolve NaiveProxy padding length parsing issue * fix(log): resolve domain rejection with pre-matching issue * fix(mux): improve idle session cleanup logic * fix(mux): resolve session asynchronous handshake issue * fix(naive): resolve compatibility issues with older NaiveProxy HTTPS proxies * fix(scene): resolve default item issue in Scene * fix(server): resolve Hysteria URL parsing issue * fix(UI): resolve server obfuscation settings saving issue * fix(vless): resolve VLESS encryption issue when using Mux * fix(websocket): resolve implicit truncation issue in WebSocket * fix(widget): resolve server widget display issue * fix(wireguard): resolve WireGuard obfuscation editing issue

* chore(grpc): Resolve issues with custom gRPC headers. * chore(macos): Adjust status bar speed text layout. * chore(quic): Adjust QUIC max-idle and keep-alive timeouts. * chore(server): Include proxy pass failures in the server lookup log. * chore(server): Add show/hide function for subscription servers. * chore(shadowsocks): Optimize read packet handling for Shadowsocks UDP over TCP. * feat(AmneziaWG): Implement Junk Manager and refactor obfuscator. * feat(anytls): Implement session pool with idle cleanup. * feat(grpc): Support chunked gRPC data transmission to prevent stream pauses. * feat(intents): Enable VPN toggle/start/stop intents to run quietly. * feat(kcp): Add AES-128-GCM support for kcptun. * feat(script): Add WebView script engine support. * feat(server): Add duplicate handling strategies when adding servers. * feat(server): Support specifying HTTPS DNS for resolving subscription link domains. * feat(shortcuts): Add shortcuts for toggling TUN mode. * feat(vless): Add support for VLESS Post-Quantum encryption. * fix(anytls): Fix protocol handling bugs in AnyTLS sessions. * fix(backend): Remove recursive lock calls in TLS settings caching. * fix(backend): Resolve Naïve HTTPS handshake issues. * fix(config): Resolve configuration rule file synchronization issues. * fix(config): Fix crash during file synchronization and optimize checksum calculation. * fix(geoip): Resolve task interval issues. * fix(group): Resolve proxy group policy case-sensitivity issues. * fix(http2): Fix connection teardown when HTTP/2 sessions are idle. * fix(intents): Resolve issues with App Intents extension execution. * fix(intents): Resolve subscription updates over DoH. * fix(kcp): Fix null pointer dereference in the write loop. * fix(macos): Resolve file picking and QR code scanning issues. * fix(macos): Fix GeoIP storage path issues. * fix(macos): Fix table cell hover issues. * fix(module): Resolve module installation issues. * fix(rule): Fix potential crashes caused by dangling pointers in rule results. * fix(script): Fix crash when script code is empty. * fix(script): Resolve script engine saving issues. * fix(script): Fix use-after-free (wild pointer) crash in script request tasks. * fix(script): Resolve potential wild pointer crash in script timer tasks. * fix(server): Resolve Easy Mode server update issues. * fix(server): Fix server chain lookup issues. * fix(server): Resolve ECH parsing issues in server URLs. * fix(server): Fix ShadowsocksR URL parsing issues. * fix(server): Resolve subscription server import issues. * fix(server): Fix saving issues for VMess xHTTP mode. * fix(server): Resolve YAML and configuration import issues. * fix(server): Fix expiration date issues for subscription servers. * fix(task): Fix background task completion and scheduling issues. * fix(task): Resolve background task execution timing issues. * fix(tcp): Prevent `os_unfair_lock` corruption crashes during deallocation. * fix(test): Resolve test result score calculation issues. * fix(TUIC): Fix TUIC crash due to retransmission of released stack data. * fix(UDP): Resolve heap buffer overflow in UDP socket packet generation. * fix(UI): Prevent crash in Code View when the title is nil. * fix(UI): Resolve permissions request logic issues. * fix(vless): Resolve issues with XTLS and Mux. * fix(vmess): Fix heap corruption in VMess backend decryption. * fix(websocket): Resolve VLESS WebSocket response parsing issues. * fix(widget): Resolve widget intent user activity handling issues. * fix(xhttp): Improve stability and connection reuse for HTTP/2. * fix(xhttp): Resolve HTTP/3 stream-up issues. * fix(xhttp): Fix HTTP/2 default mode issues in xHTTP. * fix(xudp): Resolve XUDP over XTLS-Vision issues. * perf(backend): Cache backend TLS settings using associated objects. * perf(kcp): Optimize update logic and timer management to reduce CPU overhead. * perf(mux): Optimize Mux socket performance and flow control. * perf(test): Adjust test result score calculator.

* fix(config): resolve invalid hyphen hostname parse issue * fix(intents): resolve intents extension execute issue * fix(macos): resolve statusItem button title color issue * fix(server): resolve server add by url scheme issue * fix(test): resolve server test task cancel issue * fix(mux): resolve VLESS/VMess mux frame parse issue * fix(websocket): resolve VLESS websocket response parse issue

* Feature(macOS): Added a speed display (upload/download rate) to the macOS status bar for real-time monitoring. * Feature(Config): Implemented automatic background updating for modules, ensuring components stay current without manual intervention. * Feature(UI): Added an App Intents Extension (e.g., for Siri/Shortcuts integration) to enable new voice and automation commands. * Fix(Backend): Resolved a critical issue concerning the handling of VLESS/VMess early data, improving connection reliability. * Fix(DNS): Corrected a bug where DNS over HTTPS (DoH) fallback mechanisms failed to execute properly. * Fix(GeoIP): Resolved an issue with the incorrect metadata database type in the GeoIP component. * Fix(macOS): Restored or added full support for macOS 10.15 (Catalina) compatibility. * Fix(macOS): Resolved the issue where the Dock icon was incorrectly visible for status bar applications. * Fix(macOS): Fixed a bug preventing items from being deleted via the context menu (right-click). * Fix(Rule): Resolved an IP-CIDR match crash issue that occurred under specific routing conditions. * Fix(Rule): Corrected the MITM exclude hostname order, ensuring priority rules are applied correctly. * Fix(Rule): Fixed an issue where the rule resource URL update result was not correctly processed or displayed. * Fix(Server): Fixed a bug where the TLS 'Allow Insecure' setting was not correctly applied to server configurations. * Fix(Server): Resolved an issue with URL query parameter values not being encoded correctly during server operations. * Fix(tvOS): Resolved a "file not found"" message specific to the tvOS platform when accessing cloud server configurations.

What's New: Stability & Permissions This update significantly improves the reliability of the rule engine and introduces user controls for system permissions. * Core Stability Fix: Fixed a critical bug where the rule matching context could be prematurely freed during complex, nested asynchronous operations (involving rules, DNS lookups, and threading), preventing crashes and ensuring accurate routing. * Performance: Optimized the logical rule matching condition for faster execution. * User Control: Added new configuration switches to manage application permissions for Location, Pasteboard, and Notifications, giving you more control over your privacy.

What's New: Major Stability & Crash Fixes This is a critical stability update. We have resolved numerous race conditions and crashes to ensure a more robust and reliable experience across all platforms. * Critical Stability: Fixed multiple concurrency issues causing crashes in proxy groups, server management, MUX sessions, and ping timers. * Prevented Crashes: Resolved crashes caused by stack overflow (by limiting recursion depth), memory corruption (in proxy groups), and SIGABRT (in HTTP parser). * Networking Fixes: Resolved the Shadowsocks UDP relay issue and fixed a WireGuard session release bug. * macOS & UI: Fixed the macOS status bar issue in standalone mode and various UI crashes/display bugs. * Performance: Optimized rule matching and policy group interval parsing for faster performance.

What's New: Stability, macOS, and Reliability This update delivers a large number of bug fixes and optimizations, focusing on cross-platform stability and core features. - macOS Experience Enhanced: * Fixed critical UI bugs on Mac, including the broken multiple selection in server tables and issues with the menu bar and Dock icon. * Resolved system symbol display issues for earlier macOS versions. - Core Protocol Stability: * Fixed the Hysteria datagram session closure. * Improved XHTTP reliability by resolving conflicts with TLS fragmentation and fixing a packet issue. - Rules & Configuration: * Fixed various issues with Rule parsing, including backslashes in rewrite rules and handling of SSID/DNS case matching. * Resolved all known issues with GeoIP database importing and reloading. * Optimized module file read/write for better performance and corrected an async save bug. - UI & Other: * Added an alternate classic icon option.

What's New: Stability & Performance - Fixed Critical VPN Bugs: Resolved a major issue causing the VPN connection to stop unexpectedly. - Networking Reliability: Fixed issues with TLS parsing and Clash TLS fingerprint handling for stronger connections. - Rule & Automation Fixes: Restored Wi-Fi Scene Rules by fixing the SSID fetch issue. Corrected QUIC protocol rule matching. - Performance: Made server speed testing significantly faster. - Compatibility: Fixed Shortcuts failing to run and addressed UI issues on iOS 26.

* fix(server): resolve shadowsocks udp relay issue