v1.34.0 (2026-10-25)
-
Android now needs Android 10 or later. Aether 2.4.0, the new MASQUE and
WARP core, does not run on Android 7 to 9, so those phones stay on 1.33.15. -
Aether 2.4.0 ships on Android and Windows. WARP registration goes through
the live tunnel first, keeps the gateway the editor just found, and tries
the last working gateway before scanning. Saved WARP keys are kept, and
MASQUE identities can be imported from a file. -
Nova Assist learns which TLS method works on each network (each Wi-Fi and
each SIM) for each subscription, and starts there next time. A remembered
method that is slow to come up gets one more check before Nova reports no
option, and a new method that passed the secure check but not the page
check is judged once more before it is dropped. -
A subscription that mixes Cloudflare servers with others now tries the
Cloudflare servers with Nova Assist first. If no method works on that
network, Nova connects through every server instead of showing no traffic,
and remembers the result for that network. -
On Irancell, Nova splits TLS records instead of TCP segments, on every
platform, even when the panel's carrier profile predates record splitting.
On Wi-Fi, the SIM carrier's settings are no longer applied. -
Android keeps watching the connection after Back or a relaunch, so a stalled
tunnel is still repaired while Nova is in the background. -
Missing WARP registrations are retried when returning to Nova. WireGuard
and MASQUE are checked independently, so obtaining one does not prevent the
other from being obtained. Existing keys are preserved. -
Windows x64 testers can explicitly check the bundled core's decoy SNI path
from the bypass editor when Nova runs as administrator. Passing the local
TLS test enables it for that app session. ECH remains preferred; this does
not establish that a carrier accepts the decoy or hide the real server name. -
Resolver presets use the generic Scanned resolvers label in both languages.
-
Saved WARP keys are retained on later connections and gateway failures.
Missing keys get a direct attempt at startup and can be obtained through a
Nova tunnel after it passes the connectivity check. Get new WARP keys
explicitly renews the selected transport; failure restores the previous key. -
Raw ECH links preserve their lookup when imported or re-shared, including
literal plus separators. AliDNS lookup failures fall back to Cloudflare UDP
without disabling ECH. Explicit user settings take precedence. -
DNS tunnel editors now offer The 71 scanned resolvers. MasterDNS can use
the full list, while Soar offers three groups within its 32-resolver limit.
Existing resolver settings change only when a preset is selected. -
Nova subscription and share-link imports preserve decoy SNI metadata for
desktop compatibility. Packet spoofing remains disabled on phones and on
desktops whose raw-packet support has not been verified. High-risk endpoint
headers show a subscription-specific warning without blocking connection. -
Base64 Nova JSON subscriptions now import even when their body contains no
share-link URL. -
macOS, Windows, and Linux now use the same bounded connectivity checks as
phones. Desktop recovery runs while Nova is hidden, checks after sleep, and
resets stalled core sessions after two failures without restarting the VPN
interface or asking for administrator approval again. -
Opening a subscription only shows its servers. It becomes active when a
server, Auto, or Connect is selected. Swipe horizontally between Free and
Subscriptions, and find Psiphon profiles using a personal config under
Subscriptions. Completed lightning tests leave Connect clear. -
Phone wake recovery checks the tunnel from the native VPN host after a long
screen lock, even while Nova remains in the background. Healthy tunnels are
kept; two failed checks reset stale core transports. Foreground health
checks now run fallback endpoints together under one six-second deadline. -
Soar now stays in a user's subscription beside their other servers. Nova
could parse the profile but dropped it during loading because its account
key is stored in the profile rather than a UUID or password field. The same
fix keeps it in saved lists and when a blocked refresh uses the saved copy.
The lightning test measures Soar through the phone's core and reports its
latency or no response like the other servers. It stays out of automatic
traffic pools because it carries TCP only.