New
- feat: Vue 3 migration — full frontend rewrite (#4198)
- Stack: Vue 2 + Ant Design Vue 1 + Go HTML templates → Vue 3 + Ant Design Vue 4 + Vite 8 (multi-page bundles embedded into the Go binary via
web/dist/) - Single-File Components with
<script setup>and composables replacing globalVue.component()registrations and Vue 2 mixins - WebSocket-driven live updates across the panel (dashboard, inbounds, nodes) replace the legacy polling loop
- Translation files migrated from TOML to JSON; vue-i18n 11 with per-locale code-split bundles for all 13 locales
- Pages ported end-to-end: login, dashboard (with live status / xray / cpu-history / logs / backup / panel-update / custom-geo modals), settings (General / Security + 2FA / Telegram / Subscription), inbounds (list, search/filter, add/edit/delete/clone/reset, client modal + bulk-add, info + QR, expand-row), xray (Basics / Routing / Outbounds / Balancers / DNS / WARP / NordVPN), nodes
- Inbound forms switched from raw JSON textareas to structured per-protocol/per-transport editors (an "Advanced" tab still exposes raw JSON for unsupported transports)
- Multi-node deployment landed alongside the migration: new
runtime/{local,manager,remote}layer,node_heartbeat_job+node_traffic_sync_job, central panel can deploy inbounds to remote node panels - Frontend bundle is split by route (login / xray / inbounds / settings / nodes) for faster initial load (LCP) on the dashboard
- Stack: Vue 2 + Ant Design Vue 1 + Go HTML templates → Vue 3 + Ant Design Vue 4 + Vite 8 (multi-page bundles embedded into the Go binary via
- feat(nodes): multi-node deployment with traffic-writer queue, full-mirror sync, and WebSocket event fixes
- feat(security): CSRF protection and security hardening across the application @farhadh
- feat(xray): add loopback outbound protocol
- feat(inbounds): mobile card layout for inbounds and clients
- feat(logs): mobile-friendly log modals with theme-aware colors
- feat(custom-geo): refresh index UI
- feat(xray/dns): expanded DNS settings with hosts editor, presets gallery, and Delete-All
Update & improvement
- refactor(websocket): split controller into service + thin controller
- refactor(fallbacks): share template, tighter UX, cleaner JSON
- refactor(xhttp): split fields by direction, expand outbound coverage
- refactor(vless): drop selectedAuth, expose two explicit auth buttons
- refactor(inbounds): reorder Inbound's Data tabs (client first, sub inline)
- perf(xray): bound Xray-version request and extend cache
- i18n: localize sidebar theme toggle, xray-status badge, and nodes menu
- avoid reset in QueryStatsRequest @samssh
- exclude virtual interfaces from network stats
- outbound: reverse Sniffing
- inbound: check transport in port conflict, allow tcp and udp on same port @pwnnex
- Reality: remove tesla.com because of blocking
- skip Xray 26.5.3 and bump version cutoff
- fix(scripts): harden server-IP detection with multi-provider + manual fallback
- Bump Go to 1.26.3
- Axios v1.16.0
- build frontend for CodeQL; remove release analyze job
Bug fixed
- fix(panel): make webBasePath work end-to-end in dev and prod
- fix(panel): silence update-check WARN spam when offline
- fix(panel-update): poll for restart, fix dark-mode version label
- fix(websocket): guard stale events and disconnect race in JS client
- fix(nodes): bind form-encoded posts and skip node inbounds in central xray
- fix(xray): align DNS outbound to spec and repair item-list rules UI
- fix(xray): clear outbound test state on delete to prevent result bleed @iAliF
- fix(xray): surface reverse tags in routing and balancer dropdowns
- fix(xray): silently ignored error when saving outbound test URL setting @hobostay
- fix(inbounds): remove stale reverse outbound tags after client deletion
- fix(tun): use single mtu number per Xray spec
- fix(vless): scope testseed to xtls-rprx-vision flow
- fix(warp): harden API client and frontend, bump to v0a4005
- fix(fail2ban): banning regression and Docker zero-jail issue
- fix(security): overly permissive file permissions (os.ModePerm) @hobostay
- fix(security): silently ignored errors in password migration seeder @hobostay
- fix(docker): include web/translation in frontend and final stages
- fix(x-ui.sh): pass silent flag to stop/start during IP SSL setup
- fix(arch): correct x-ui service path @odrawq
- fix(ui): mobile dashboard layout
- fix(ui): correct responsive breakpoints for inbound form and settings
- fix(ui): correct responsive breakpoints for add client form and bulk
- fix(ui): mobile filter view
- fix(outbound): mobile style
- fix: swap left/right classes for client table cells
- chore: fix shadowrocketUrl client @harryngne
- revert: Xray Core v26.5.3 (buggy — vless reverse broken)
Reports
Full Changelog: v2.9.4...v3.0.0