New
- feat(dashboard): richer System History & Xray Metrics charts
- feat(dashboard): more System History metrics, persistence & localized labels
- feat(xray): merge basic routing into the routing rules section
- feat(xray): add connIdle and bufferSize policy controls
- feat(settings): sidebar submenu nav for settings and xray with icon tabs
- feat(settings): move the remark model control to the subscription tab
- feat(inbounds): per-proxy Pinned Peer Cert SHA-256 + labeled External Proxy form
- feat(tls): add ocspStapling to certificate config
- feat(links): richer share-link labels across QR, client info and sub views
- feat(hysteria2): emit UDP port hopping in subscriptions and share links (#4789)
- feat(clients): show filtered count in clients list (#4808)
- feat(clients,routing): label inbounds by remark with tag fallback
Update & improvement
- chore(deps): bump xray-core to v1.260327.1 and add pion/wireguard deps
- chore(frontend): bump deps to 0.2.7 and hide node row selection for single node
- i18n: translate connection-limit strings for all languages
- fix(sidebar): set fixed sider width to 220
- fix(ci): bump Go to 1.26.4 and exempt /panel/groups SPA route from api-docs test
- ci(issue-bot): ground the assistant in repo source with an investigation step
Bug fixed
- fix(api-token): hash tokens at rest and show plaintext only once
- fix(online): scope per-inbound online to inbounds that carried traffic (#4859)
- fix(nodes): Set Cert from Panel uses the node's own web cert for node inbounds (#4854)
- fix(panel): register /groups SPA route so hard refresh returns index.html (#4837)
- fix(clients): keep reverse tag clearable and preserve flow on attach (#4834)
- fix(settings): fall back to defaults for empty/NULL setting values (#4830)
- fix(links): use configured domain for panel copy/QR links on loopback (#4829)
- fix(docker): make x-ui CLI menu work inside containers (#4817)
- fix(hysteria2): emit pinSHA256 as hex in subscriptions, not base64 (#4818)
- fix(online): scope online status per node instead of a global union (#4809)
- fix(iplimit): populate client IP log without an IP limit (#4800)
- fix(sub): advertise routable inbound Listen in subscription links (#4798)
- fix(outbounds): preserve SNI/TLS settings on transport change (#4791)
- fix(clients): derive edit-form flow from per-inbound override (#4792)
- fix(tls): correct pinned cert SHA-256 hint to hex, not base64 (#4793)
- fix(node): fix "invalid input" on save and gate save on connectivity (#4794)
- fix(xray): default freedom finalRules to allow-all so reverse egress works
- fix(migrate): relax legacy freedom finalRules so reverse egress works on existing installs (#4782)
- fix(panel-proxy): route custom geo and http(s) Telegram through panelProxy
- fix(migrate-db): preserve false-valued columns in SQLite to Postgres copy
- fix(clients): use client_inbounds link to resolve inbound, not stale id
- fix(settings): allow pagination size of 0 to disable pagination
- fix(sub): escape Clash subscription profile filename header (#4799) @xiaoxiyao
Reports
Full Changelog: v3.2.6...v3.2.7