New
- feat(outbounds): pick dialerProxy from other outbound tags for proxy chaining
- feat(nodes): add per-node TLS verification mode for self-signed certs (#4757)
- feat(inbounds): support Unix domain socket path in Listen field (#4429)
- feat(x-ui.sh): support Cloudflare API Token for DNS SSL (menu 20) (#4595)
- feat(x-ui.sh): add PostgreSQL management menu
Update & improvement
- perf(clients): batch bulk attach/detach to cut per-item DB work
- docs(readme): revamp README and sync all translations
- chore(generated): sync node types/zod with TLS verification fields (#4757)
- chore(ui): remove cards jump on hover (#4755) @fgsfds
- Replace static label with translation for downlink stats (#4762) @ckun52880
- Remove .svg extension from shields URLs in READMEs
Bug fixed
- fix(migrate): copy composite-key tables without FindInBatches (#4787)
- fix(node): suppress unavoidable InsecureSkipVerify alert for cert pinning
- fix(node): capture node cert via VerifyConnection for fingerprint fetch
- fix(clients): keep Add Client modal in viewport with internal scroll
- fix(xray): clear dirty state after saving unchanged config
- fix(job): skip fail2ban IP limit when disabled (#4581) @Mayurifag
- fix(fallbacks): allow free-form dest entries for external servers (#4748)
- fix(raw): complete the HTTP header section for inbound and outbound
- fix(x-ui.sh): preserve 2FA on credential reset (#4758)
- fix(inbounds): allow port 0 for UDS inbounds (#4783)
- fix(warp): persist client_id so WARP outbound gets reserved bytes (#4781)
- fix(nodes): sum client traffic across nodes instead of overwriting
- fix(hysteria): use pinSHA256 for pinned cert and emit ech in share links
- fix(sub): source Userinfo total/expiry from client config in multi-node (#4645)
- fix(db): make password-hash migration idempotent to prevent lock-out (#4612)
- fix(outbound): add None option to uTLS fingerprint in TLS form (#4760)
- fix(outbound): carry ALPN, fingerprint and UDP mask when importing a Hysteria2 link (#4760)
- fix(sockopt): rename interfaceName to interface so xray honors it
- fix(sub): ensure unique Clash proxy names (#4641)
- fix(settings): enforce trafficDiff max of 100 in UI (#4769)
- fix(outbound): fill encryption and pqv when importing VLESS link
- fix(docker): grant NET_ADMIN/NET_RAW so fail2ban IP-limit bans apply
- Fix IP limit enforcement and clarify related comments (#4699) @aloky
- fix(sub): Add Clash subscription profile filename header (#4743) @xiaoxiyao
Reports
Full Changelog: v3.2.5...v3.2.6