Jolymmiles/Xray-core v26.8.23 on GitHub

Highlights

BitTorrent detection no longer misfires on real-world DNS queries. The v26.8.22 exclusion modeled textbook queries only; a deployment still classified a query to 8.8.8.8:53 as bittorrent and auto-banned the user. The shape space is now verified live against the world's most popular resolvers. Upgrade is strongly recommended for every deployment routing on protocol: ["bittorrent"] with automatic enforcement (webhooks, panels).

DNS false positives closed over the deployed query space (production-verified). The v26.8.22 DNS exclusion required exactly one question, opcode QUERY, zero answer/authority records, at most one additional record and no trailing bytes. Live verification against Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex, AliDNS and DNSPod confirmed 24 real query shapes (plain, EDNS0, EDNS cookie, padded, mixed-case, HTTPS/SVCB, PTR, SRV, long names, and more); five of them slipped past the strict model — EDNS with two additional records, two-question queries, trailing bytes with zero additional records, dynamic-update opcodes from Windows domain machines, and answer-carrying queries — accounting for 25 of 120 colliding replays. isDNSQuery now accepts request-bit-clear queries with a deployed opcode (query, iquery, status, notify, update), one or two questions and a structurally valid first question; record counts and trailing bytes are unconstrained. A real uTP packet passing this needs its connection id to clear the response bit and opcode nibble and its timestamp to read as a question count of one or two (on the order of 1e-7).
The verified shapes are pinned as a permanent regression test (TestSniffUTPIgnoresDNSQueries) with their resolver provenance; the uTP, DHT and UDP tracker corpora and the process e2e gate remain green, so torrent detection coverage is unchanged.

Routing behavior change: DNS queries matching any deployed real-world shape are never classified as bittorrent. Deployments that ban users on the bittorrent rule should upgrade from v26.8.22, which intermittently auto-bans users over unlucky DNS transaction ids (roughly one query in 13000 with non-textbook shapes).
Torrent detection coverage is unchanged from v26.8.21+: plaintext TCP handshakes, uTP, DHT (KRPC) and UDP trackers are detected; MSE/protocol-encrypted peer handshakes and HTTPS tracker traffic remain undetectable by content.

Live-verified corpus: 24 query shapes x 8 popular resolvers, all answered; 5 previously failing shapes x 5 colliding transaction ids now produce 0 of 120 misclassifications.
Unit corpus, -race, go vet, dispatcher tests and the integration process e2e gate (torrent probes blocked, DNS/UDP/TCP controls pass) all green.
Linux/amd64 build gate: CGO_ENABLED=0 GOAMD64=v1 -trimpath with release linker flags; static stripped ELF; sha256 70d1faabcf658e20a83aeeabd8e31700d844b24b8ea0aa20b6a0fdb5f5d56e4a.