What's Changed
New
- add hysteria inbound @alireza0
- finalmask @alireza0
- Add ipsBlocked to Freedom
- tun: dual MTU, gateway, DNS, auto routing
- Sniffing: Add ipsExcluded, domainsExcluded (supports IP, CIDR, "geoip:", "ext:")
- XDNS finalmask: Support resolvers (client-outbound) and domains (server)
- mKCP transport: Add cwndMultiplier
- feat(tgbot): send connection links and qrs on client creation @abdalrahmanx9
- Add custom geosite/geoip URL sources @MrRefactoring
- Add new hourly reset traffic @sandrew-uj
- feat add clash yaml convert @haimu0427
- feat: Add NordVPN NordLynx (WireGuard) integration @PedroLiu1999
Update & improvement
- feat: mask password in telegram notification on 2FA failure @rydve
- Update fail2ban filter regex in x-ui.sh
- Set package ecosystem to GitHub Actions in dependabot.yml
- Add Go code analyzer workflow
- perf: replace /dev/urandom | tr with openssl rand to fix CPU spike @Kookiejarz
- reset button for auth password
- Add CodeQL Advanced GitHub Actions workflow
- Use vnext/users structure for VLESS outbound @alireza0
- Centralize session options and adjust cookies @alireza0
- revert: Disconnect client due to exceeded IP limit @HamidRezaSZ
- Enable CodeQL file coverage on PRs
- Add SSRF protection
- Update Xray-core to v26.4.17
- Bump Xray version cutoff to 26.4.17
- Bump Go version and update dependencies
- Bump Go and dependency versions
- Update x-ui.sh @kazan417
- Update translate.ru_RU.toml @sngvy
Bug fixed
- Fix SSL domain setup on reinstall: reuse existing certs and avoid false success/failure logs @Kookiejarz
- fix: enhance WebSocket stability, resolve XHTTP configurations and fix UI loading shifts @lolka1333
- fix(sub): use safe type assertion for xhttp mode field @nnemirovsky
- fix: Ban new IPs with fail2ban instead of disconnected the client @HamidRezaSZ
- fix: stop overwriting client_traffics.enable with JSON enable in GetClientTrafficByEmail @Alimpo
- Fix geosite:ru rule (Normalization to RU vs lowercase ru) @Troodi
- bug fix
Reports
Full Changelog: v2.8.11...v2.9.0