🚀 MASQUE, XDRIVE, Xray-core v26.10.10 & Node Sync
- 🛰️ MASQUE — a new protocol and transport for inbounds and outbounds, and the WARP modal can now register WARP over MASQUE.
- ☁️ XDRIVE transport — tunnel traffic through files in Google Drive, a local folder or any templated HTTP storage API.
- ⚙️ Xray-core v26.10.10 — Lua DNS and routing scripts, new TUN and finalmask options, and stored configs migrate to the new shapes on their own.
- 🔗 Node sync — master pushes reach every node, a reset node can no longer wipe the hub's clients, and client edits on node inbounds no longer drop connections.
- 🧱 Configs that would stop Xray are refused — Shadowsocks-2022 keys and ciphers, mask passwords and storage settings Xray cannot run are rejected when you save.
- 📡 Port hopping restored — Hysteria and XHTTP clients hop ports again through the
udphopmask. - 🛡️ Sandboxed systemd service — the panel now runs with a reduced capability set and read-only system directories.
- 🔄 Safer updates — the database migration finishes before the service starts, and an update no longer touches your TLS setup.
- 🐘 PostgreSQL 18 — new local database installs get the current major version from the official PGDG repository.
⚠️ Before you upgrade
Action required
- Several node fixes run on the node itself: in-place client updates (no dropped connections), applying master pushes on admin-token nodes, and hosting MASQUE inbounds. A node on an older release keeps the old behavior, and placing a MASQUE inbound on it is refused — do this: upgrade every node, not only the master.
- Xray-core v26.10.10 checks outbound TLS against its bundled Mozilla roots instead of the OS certificate store — do this: on any outbound to a server signed by a privately installed CA, turn on Use system CA in that outbound's TLS settings.
- JSON subscriptions now send port hopping as the
udphopmask (needs Xray-core 26.9.9+) and xdns masks in thenames/addrsshape (needs Xray-core 26.10.10+) — do this: ask users of port hopping or xdns to update their client apps to a build on Xray-core 26.10.10 or newer. - On systemd installs the service is now sandboxed:
/usr,/boot,/etc,/homeand/rootare read-only except the panel's own DB, bin and log folders — do this: if the panel or Xray must write anywhere else under those trees, add the path withReadWritePaths=in your own drop-in (/etc/systemd/system/x-ui.service.d/20-local.conf). After you change anXUI_*_FOLDERvalue in/etc/default/x-ui, re-run the update so the generated drop-in picks it up.
Automatic — no action needed
- At first start, stored xdns finalmasks are rewritten to
names/addrs. LegacyquicParams.udpHopon client-side configs (hosts, the subscription's global finalmask, cached outbound subscriptions, template outbounds) becomes audphopmask. Inbounds keepudpHopas the advertised port range. Each rewrite runs once, and a failure stops the panel from starting. - Shadowsocks-2022 inbounds on
2022-blake3-chacha20-poly1305move to2022-blake3-aes-256-gcm, and their 32-byte keys stay valid. Server keys of the wrong size for their method are replaced. Neither kind of inbound could start before. A failure stops the panel from starting. install.shandupdate.shinstall the hardened unit and regeneratex-ui.service.d/10-xui-sandbox.conffrom yourXUI_*folders on every run. The seccomp filter is added only on systemd 239 or newer, and on older systemd the scripts list the protections it lacks. A folder path containing whitespace is left out with a warning, and a failed refresh is only a warning.- A stored report or LDAP sync schedule that no longer parses falls back to the job's default, with a warning in the log.
- PostgreSQL 18 applies only to new local databases. An existing cluster is never upgraded.
Requirements
Go 1.27.2 · Xray-core v26.10.10
🔐 Security
- The shipped systemd units now sandbox the panel. Only its own folders are writable, its capabilities are reduced, namespaces and address families are restricted,
UMask=0077is set, and a@system-serviceseccomp filter is added on systemd 239 or newer (#6718) @ChesterFishmansWork - The repository's automated PR-review and issue-analysis workflows no longer hold write or OIDC tokens, so code checked out from a pull request cannot mint a write token (
9130f6dd,5939fda3,53239285)
🆕 New
- MASQUE inbounds and outbounds: CONNECT-IP over HTTP/3 or HTTP/2, always behind TLS. Clients sign in with their email and password, and the JSON subscription builds each client's MASQUE outbound. Share links and Clash skip MASQUE because it has no link format (
b04039c2,00aaef38,c4b9b3f9) - The WARP modal can register a WARP device over MASQUE and turn it into a ready
warp-masqueoutbound. Your existing WireGuard registration is left untouched (04cccef3) - XDRIVE transport on inbounds and outbounds: tunnel a stream through files in Google Drive, a local folder or an HTTP storage API described by a template. XDRIVE outbounds can use TLS to front the storage API, and storage settings Xray cannot open are refused when you save (
ca598359,c7d89cea,c5e1e54c) - Lua DNS and routing scripts: DNS gets a script field and a per-server ID, Basics gets a routing script field, and the Routing tab warns that rules are skipped while a script is set (
b6c859f5,73a028f5) - TUN inbounds can set the Windows adapter type, point systemd-resolved at the TUN gateway on Linux, and block DNS leaks through WFP on Windows (
ef4bda4e) - The finalmask editor now covers more of the format: header-custom variables and transforms, a TCP
errorsgroup, UDP prefix/standalone mode, the sudoku UDP mask, and noise reset ranges such as60-120. These keys used to be dropped on save (1c050f87) - Outbound TLS has a Use system CA switch for servers signed by a privately installed CA (
73a028f5) - New local PostgreSQL installs get PostgreSQL 18 from the official PGDG repository. Where PGDG has no build, the distro package is used instead (
c9207b6f)
⚡ Improved
- Xray-core updated to v26.10.10 (
73a028f5) - Go 1.27.2 and refreshed Go dependencies, including fasthttp 1.75.0 (
82c77111, #6767) - Frontend and docs dependencies refreshed, and the npm audit findings cleared (
d57dcf82,2e8af647) - The public subscription page uses the panel's own theme in light, dark and ultra-dark (
fd6c5925) - Traffic formatting does less work and allocates less memory when building status and report output (#6790) @javi0guerrero4-cloud
- CI now tests node sync end to end with a real master panel and a real node panel, for both admin-token and node-sync-token enrollment (
f843fe55,dae91276) - Fixed a data race in the service test suite, caused by a public-IP lookup that kept running after its test ended (#6742) @AyaseEli-Bing
- SECURITY.md now names an email contact for reporters without a GitHub account, and the repository publishes a threat model (
8fe7be94,eb498a3c)
🐞 Fixed
Nodes
- Clients attached, disabled or edited on the master now reach nodes enrolled with an admin token. An inbound deleted on the node is re-created by reconcile, which used to keep trying to update it (
2ffc694a) - A node that reports an empty client list (just reset, restarted or removed) no longer causes the hub to delete those clients. The hub pushes them back to the node (#6734) @yukh975
- Renewing, resetting or auto-disabling a client on a node inbound now updates its users in place, so open connections on that port stay up. The inbound used to be rebuilt (
44083338) - Masters enrolled with a node-sync token or mTLS can again set the subscription sort order, bulk-reset client traffic and read active inbounds on their nodes. These requests used to fail with 403 (
5819a01c) - A client detached from a node inbound is no longer disabled on the master by the node's stale stats, and its old quota is no longer written back (
dd956947) - Client traffic history and quota usage survive when a node inbound is replaced under a new tag (
6be3c438)
Xray config & inbounds
- Shadowsocks-2022 inbounds no longer offer
2022-blake3-chacha20-poly1305, which Xray cannot run with multiple users. Stored inbounds move to2022-blake3-aes-256-gcm(f1ed1a9b,c20082d2) - A Shadowsocks-2022 server key of the wrong size for its method is refused when you save. It used to stop Xray (
b9e1d3af) - A salamander or gecko finalmask password shorter than 4 bytes is refused when you save and flagged in the editor. It used to stop Xray when the listener opened (
0466e8b0) - VLESS clients keep connecting after their inbound moves to a transport that cannot carry Vision. The Vision flow is now applied only where Xray runs it: TLS or REALITY on raw TCP, or VLESS encryption on any transport (
c5e1e54c) - Balancer overrides set from the panel survive routing reloads and node tests. An override that points at an unknown or removed outbound is refused or cleared (#6779) @AliKarami
- TLS ALPN defaults to
http/1.1for the WebSocket transport, so the WebSocket handshake no longer fails when h2 is negotiated (#6787) @HappyLeslieAlexander - Port hopping works again for Hysteria and XHTTP (HTTP/3) outbounds and for JSON-subscription clients. The hop is written as the client
udphopmask, kept on every endpoint, and placed last, where Xray requires it (ec0a57fc,27e45f30,6321297f)
Subscriptions & links
- JSON subscriptions emit
"encryption": "none"for VLESS inbounds stored without that key. They used to emit an empty value, which Xray refuses to load (#6781) @jayhemnani9910 - A host's ECH config, certificate pins and verify name now reach clients in the JSON subscription (
66ef5bbc) - Hysteria share links now include the host's server description, as VLESS, Trojan and Shadowsocks links already did (#6740) @AyaseEli-Bing
- QR codes are shown again for REALITY links and for VLESS-encryption links authenticated by an X25519 key. Only links that carry post-quantum keys too large to scan hide the QR code (
d7da64f2)
TUIC, WireGuard & AmneziaWG
- TUIC sniffing keeps the IP destination the client asked for (#6753) @libmur-dev
- TUIC clients show their live speed again, and the certificate buttons are laid out correctly (#6723) @poise52
- AmneziaWG UDP replies larger than the tunnel MTU are now fragmented to fit it (#6780) @mrdarkerr
- A client on both a WireGuard and an AmneziaWG inbound now gets its own WireGuard public key and keepalive on the WireGuard peer (#6751) @mvanhorn
Panel & settings
- On PostgreSQL, the panel no longer hangs until restart when node traffic sync runs at the same time as subscription fetches (
b5a04ea9) - Report and LDAP sync schedules accept a standard five-field crontab. A schedule that cannot be parsed is refused when you save, so the job no longer silently never runs (
b124af2a) - The attach and detach clients modals list the clients the first time they open (#6736) @drakeo338
- The renewal preview shows readable dates with their UTC offset and labels its renewal count as an estimate, and the renewal form layout and mode help are clearer (#6662, #6672) @JacktheRanger
- The panel-update confirmation closes as soon as you confirm, so it no longer dims the progress indicator (#6766) @libmur-dev
- Toast messages follow the dark and ultra-dark themes (
d1b60799) - Action buttons in the overview modals wrap to a new line instead of spilling out with longer translations (
49fbcdc0)
Install & update
- An update now runs the database migration before starting the service. An upgrade that adds schema no longer stops the service with "duplicate column" (#6729) @mrnickson-hue
- Updating from the panel no longer opens the SSL menu. It used to stop x-ui to issue an IP certificate, could delete
/root/cert/ipand the acme.sh state, or loop forever on an IP prompt. The URL printed afterwards shows the scheme the panel actually serves (257559c3)
Reports
New Contributors
- @drakeo338 made their first contribution in #6736
- @AyaseEli-Bing made their first contribution in #6740
- @AliKarami made their first contribution in #6779
- @mrdarkerr made their first contribution in #6780
- @jayhemnani9910 made their first contribution in #6781
- @HappyLeslieAlexander made their first contribution in #6787
- @javi0guerrero4-cloud made their first contribution in #6790
Full Changelog: v3.9.0...v3.10.0