MHSanaei/3x-ui v3.3.1

on GitHub

🚀 Live Config Apply, Native Geodata, Smarter Nodes & a Big Internal Refactor

• ⚡ Live config apply — inbound / outbound / routing changes now apply over the Xray gRPC API without a full core restart, so existing connections survive edits.
• 🌍 Native geodata auto-update — the custom geo manager is gone; geo files now auto-update through Xray-core's built-in mechanism.
• 📡 Access-log-free online tracking — onlines and per-client IP limits now read from Xray's online-stats API instead of parsing access.log.
• 🕸️ Smarter multi-node sync — filter inbounds and clients by node, push global client usage to nodes for display + local enforcement, and a per-inbound share-address strategy that carries through to subscriptions.
• 🌉 Outbound-based egress bridge — the panel proxy URL is replaced by a proper outbound egress bridge; a balancer can now serve as the panel traffic outbound.
• 🔐 MTProto upgrades — domain-fronting and essential mtg options, plus Telegram egress routed through your Xray routing rules.
• 🧩 WireGuard refresh — latest Xray-core WireGuard features and per-peer comments to identify devices.
• 🛡️ Security fix — log.access / log.error paths are confined to the panel log folder (GHSA-jm48 arbitrary file write).
• 🛠️ Internal refactor — focused service files, leaf subpackages and a cleaner internal/ layout (no API surface change).

ℹ️ Heads-up: geo data now auto-updates via Xray-core and the old panel proxy URL is superseded by the outbound egress bridge. If you relied on either, review your settings after upgrading.

🆕 New

• feat: apply inbound/outbound/routing changes live via Xray gRPC API
• feat: replace panel proxy URL with outbound-based egress bridge
• feat(online): use xray online-stats API for onlines and access-log-free IP limit
• feat(node-sync): push global client usage to nodes for display and local enforcement
• feat: filter inbounds and clients by node (#4997)
• feat: add inbound share address strategy (#5162) @yuanzhidao
• feat: allow selecting inbounds synchronized from nodes (#5178) @animesha3
• feat(mtproto): add domain-fronting and essential mtg options
• feat(mtproto): route Telegram egress through Xray routing rules
• feat: support latest Wireguard features from Xray-core (#5131) @rqzbeh
• feat(wireguard): per-peer comments for identifying devices (#5168)
• feat: implement inbound XMUX form fields (#5211) @rqzbeh
• feat(inbound): support abstract unix sockets (@ prefix) in Address field
• feat(sub): per-inbound sort order for subscription links
• feat(sub): add Copy All Configs button to subscription page (#5163) @NikanZeyaei
• feat(outbound): batched connection tester with direct timed HTTP probes
• feat(settings): allow a balancer as the panel traffic outbound
• feat(settings): schedule picker, toggle placement, sub-theme docs link
• feat(groups): show upload/download breakdown in group traffic
• feat(api): include consumed traffic in the client-get response (#4973)
• feat(env): allow setting the initial URI path for the web panel (#5149) @Ponywka
• feat(routing): show tag (remark) in routing rules list (#5151) @aleskxyz
• feat(clients): restore traffic usage progress bars on Clients page (#5150) @nima1024m
• feat(clients): restore reset traffic button in edit client form
• feat(ui): add select all / clear all shortcuts for inbound multi-select (#5175) @NikanZeyaei
• feat(ui): use CodeMirror editor for Import Inbound and Inbound JSON
• feat(ui): improve client form modal UX
• feat(ui): allow custom fragment packets ranges, not just presets (#5075)

⚡ Update & improvement

• refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)
• refactor: replace custom geo manager with Xray-core native geodata auto-update
• refactor(settings): reorganize subscription settings into clearer tabs
• refactor(groups): restyle traffic summary into upload/download + usage cards
• style(inbounds): show total up/down with directional arrows
• style(ui): enlarge row action icons and rebalance clients table widths
• Update ExecReload command in x-ui.service.debian (#5219) @ssrlive
• i18n: point API token hint at the Authentication page in all locales
• docs: add Turkish language link to other README files (#5138) @tarihcituranx
• chore: pin generated files to LF to avoid phantom CRLF diffs on Windows
• chore: bump Go indirect deps; update frontend lock
• chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 (#5199)
• ci(bot): update issue-bot repo map and tighten reply style

🐞 Bug fixed

• fix(xray): confine log.access/error to the panel log folder
• fix(client): preserve UUID/password/auth on partial client update (#5111)
• fix(client): apply per-field client edits to every inbound of the email (#5039)
• fix(client): match clients by email for delete/update, not credentials
• fix(clients): invalidate Xray config cache after client mutations
• fix(node-sync): keep node baseline while a sibling inbound still reports the email (#5202)
• fix(node-sync): keep shared client traffic row when email still lives on other inbounds
• fix(nodes): "Invalid input" when saving a node with inbound sync mode "all"
• fix(sub): honor per-inbound share address strategy in subscription output (#5208)
• fix(sub): deduplicate settings.clients entries per inbound in subscription output (#5134)
• fix(sub): tag node-hosted entries with the node name in remarks (#5035)
• fix: derive JSON/Clash subscription URLs from configured subURI (#5203) @w3struk
• fix: enable XTLS vision flow for VLESS+XHTTP+vlessenc in UI and share links (#5157, #5185) @rqzbeh
• fix: expose streamSettings for Tunnel inbounds to support TProxy (#5171) @rqzbeh
• fix(inbound): preserve custom share strategy on edit (#5225) @yuanzhidao
• fix(inbound): offer node share-address strategy only when a node exists
• fix(inbound): avoid UNIQUE email constraint when importing inbounds that share clients
• fix(inbound): remove stale mkcp-legacy finalmask when switching away from mKCP
• fix(inbound): explain how to unlock fallbacks on the inbound form (#5014)
• fix(inbounds): show remark first, else inbound tag, in client labels
• fix(xhttp): stop injecting scMaxEachPostBytes/scMinPostsIntervalMs defaults (#5141)
• fix(hysteria): clamp udpIdleTimeout to xray-core's accepted 2-600s range (#5117)
• fix(warp): prefer IPv4 with v6 fallback and userspace TUN in generated WireGuard outbounds (#5205)
• fix(outbound): widen probe timeout and surface failure reason in outbound test (#5152)
• fix(outbound): include tested outbound in HTTP probe config (#5120)
• fix(settings): normalize tgCpu on load so a bad value can't block saving (#5091)
• fix: DNS server edit modal showing defaults instead of saved values (#5155)
• fix: apply only the x-ui sysctl config when toggling BBR (#5160)
• fix(update): restart panel after regenerating webBasePath to fix login desync
• fix(script): SSL management fixes (#4994, #5010, #5070)
• fix: properly configure fail2ban backend and dependencies on Ubuntu 22.04+ (#5159, #5184) @rqzbeh
• fix: accurately retrieve and generate API tokens via CLI with hashed storage (#5145, #5183) @rqzbeh
• fix: inbound edit validation failure and legacy copy to clipboard (#5132) @rqzbeh
• fix(ui): keep dropdown action menus inside the viewport (#5133)
• fix(ui): keep client IP log modal above edit modal (#5137) @JScarlet
• fix(ui): blink the online dot in mobile client cards like desktop
• fix(ui): classify ended clients as depleted, not disabled, on inbounds page
• fix(ui): correct inline style syntax between clients count and active clients count on inbounds page (#5114) @jimself218-ops

Reports

New Contributors

• @JScarlet made their first contribution in #5137
• @aleskxyz made their first contribution in #5151
• @NikanZeyaei made their first contribution in #5163
• @w3struk made their first contribution in #5203
• @yuanzhidao made their first contribution in #5162
• @animesha3 made their first contribution in #5178
• @ssrlive made their first contribution in #5219

Full Changelog: v3.3.0...v3.3.1