MHSanaei/3x-ui v3.6.0

on GitHub

🚀 Trend-First Overview, xray-core v26.7.28, Subscription Correctness & Panel Hardening

• 🧭 Overview rebuilt as a command deck — the ten small cards are gone: four vitals tiles with 72-sample sparklines, a two-series throughput chart, a TCP/UDP connections chart, a grouped system strip, and a sidebar that became an auto-collapsed icon rail expanding on hover.
• 🛡 xray-core v26.7.28 — the XMC finalmask breaking change is absorbed end to end: incomplete masks are rejected at save time with the missing field named, and only the offending mask is dropped at config-generation time so one bad row can no longer take every inbound offline.
• 🔗 Subscription output correctness — a long run of link and format fixes (forwarded-URL trust, coalesced external refreshes, Clash scalars a YAML parser would misread, VLESS flow gating, external link names, WireGuard Allowed IPs) plus opt-in identity tokens on every link, raw download actions, live online status with a new ?format=info endpoint, and User-Agent format auto-detection.
• 🔐 Panel surface tightened — openapi.json moved behind session auth (it was serving the whole admin API surface unauthenticated), node API tokens became write-only, production sourcemaps no longer ship inside the binary, and the default freedom rules block private-range egress.
• 🧹 Two large verified audit sweeps — 54 fixes from a repo-wide self-correcting audit and 16 more from a bug-label issue sweep, spanning email, node sync, subscriptions, xray config and the database.
• 🗃 Data integrity — SQLite backup snapshots are taken online, legacy string tgId values in inbound settings are repaired on upgrade, and client_traffics rows are no longer deleted for detached-but-alive clients or left stale when an email is reused.
• 🎛 Settings UX — settings sitting at their shipped default are tagged as such, clearing a port field keeps the stored port instead of writing zero, date-pickers commit on selection rather than on confirm, and the REALITY client version range is validated at save time.
• 🧰 Frontend platform — the component Storybook became a validated, fully covered workbench and is published on the docs site, every axe accessibility violation in the library is resolved, react-router 8 and Node 24 LTS landed, and 210 dead translation keys were deleted with a test that fails the build on new ones.

ℹ️ Heads-up: The bundled core moved to xray-core v26.7.28, where the XMC finalmask usernames list was replaced by a required profiles array (username + UUID + both Mojang texture fields, no "default to Dream" fallback) — a mask saved by an older panel is now rejected at save time, and stripped from the generated config with a warning rather than failing the whole core, so anyone using that obfuscation must refill their profiles. A database migration repairs legacy string tgId values in inbound settings that previously broke every client operation on the affected inbound. Two surfaces changed behavior for existing setups: GET /panel/api/openapi.json now requires an authenticated session (it was reachable without one), and node API tokens are write-only — the API no longer returns them, so tooling that read a token back must store it at creation time. The default freedom finalRules also gain a geoip:private block rule, applied in place to installs still carrying the stock rules.

🆕 New

• feat(ui): redesign the overview page as a trend-first command deck
• feat(ui): tag settings that sit at their shipped default value (#6128) @PathGao
• feat(ui): validate the REALITY client version range at save time (#6126) @PathGao
• feat(inbounds): allow custom monthly traffic reset days (#6071) @Ki-Seki
• feat(sub): auto-detect subscription format by User-Agent (#5826) @Tomilla
• feat(sub): allow identity tokens on every subscription link (#5935) @H-TTTTT
• feat(sub): expose live online status and add ?format=info endpoint
• feat(sub): add raw subscription download actions (#6017) @w3struk
• feat(sub): add XHTTP session field compatibility in share links and subscriptions (#5929) @beehunt9r
• feat(api): add GET endpoint to look up clients by Telegram ID (#5945) @kimfom01
• feat(notifications): add a consecutive-failure threshold for outbound.down alerts (#5968) @yukh975
• feat(frontend): show client comments on mobile cards (#5942) @sanmaxdev

⚡️ Update & improvement

• feat(xray): update xray-core to v26.7.28 and adapt panel
• perf(clients): make the clients page scale to large panels
• perf(clients): take one email snapshot per client fan-out, not one per inbound (#6091)
• feat(frontend): make Storybook a validated, fully covered component workbench
• feat(docs): publish the component Storybook on the docs site
• refactor(frontend): migrate off deprecated Ant Design 6 props
• refactor(ui): share one onNumber handler for numeric setting inputs (#6127) @PathGao
• chore(lint): forbid the Number-or-clamp idiom in direct-write settings pages (#6129) @PathGao
• chore(build): stop shipping production sourcemaps inside the binary (#6131) @PathGao
• chore(i18n): delete 230 dead translation keys and guard against new ones (#6132) @PathGao
• style(i18n): normalize Chinese-English spacing (#6076) @Yosyoo
• chore(deps): migrate to react-router 8 and refresh frontend dependencies
• chore: standardize the toolchain on Node 24 LTS
• chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms
• fix(docs): force transitive sharp up to patched 0.35.3
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#5994)
• chore(deps): bump github.com/go-ldap/ldap/v3 from 3.4.13 to 3.4.14 (#5993)
• chore(deps): bump react-i18next from 17.0.9 to 17.0.10 (#5996)
• chore(deps-dev): bump vite from 8.1.4 to 8.1.5 (#5997)
• chore(deps): bump actions/setup-go from 6 to 7 (#5995)
• chore(deps): bump actions/setup-node from 6 to 7 (#5992)
• refactor(ci): make the bot read-only except for PR conflict resolution
• fix(ci): survive transient GitHub 5xx outages in the release workflow
• fix(ci): resolve the mtg-multi tag from the release-page redirect
• fix(ci): publish dev-latest edit-first instead of probing for existence

🐞 Bug fixed

• Repo-wide self-correcting audit: 54 verified bug fixes (#5970)
• Bug-label issue sweep: 16 fixes (#6083)
• fix(api): authenticate GET /panel/api/openapi.json + pin the route registry to the router (#6133) @PathGao
• fix(nodes): make node API tokens write-only (#5613) @n0ctal
• fix(xray): reject configs xray-core refuses, and check the fixtures against it
• fix(xray): stop the runtime user API from crashing xray-core
• fix(xray): emit an empty client array instead of null in the generated config (#6117)
• fix(xray): validate generated egress targets (#5989) @Alishahrokhiii
• fix(xray): gate embedded unencrypted-outbound rejection on the running core version (#6028) @mvanhorn
• fix(xray): synchronize lifecycle state (#6138) @PathGao
• fix(balancer): pin loopback routing rules ahead of general rules (#6054) @H-TTTTT
• fix(mtproto): synchronize child-process lifecycle (#6141) @PathGao
• fix(sub): honor trustedProxyCIDRs before forwarded URLs (#6135) @PathGao
• fix(sub): coalesce external subscription refreshes (#6139) @PathGao
• fix(sub): quote Clash scalars a YAML parser would read as numbers (#6104)
• fix(sub): gate the VLESS flow in JSON subscriptions like raw and Clash links
• fix(sub): omit hyphen for empty remark variables (#6101) @Tosd0
• fix(sub): drop duplicated fingerprint in external-proxy tlsSettings (#6096) @n0liu
• fix(sub): omit non-standard fm param from Hysteria2 URI (#6048) @H-TTTTT
• fix(sub): preserve external link names in Clash/JSON (#6049) @H-TTTTT
• fix(sub): send the routing-enable header only when the toggle is on (#6008) @a-poluyan
• fix(wireguard): widen the client address pool past a full /24 (#6089)
• fix(wireguard): preserve all Allowed IPs in share link, .conf, and subscription (#6051) @H-TTTTT
• fix(warp): preserve outbound customization when rotating IP (#6052) @H-TTTTT
• fix(clients): keep a client editable when its subId is already shared (#6065)
• fix(clients): allow case-only email updates without duplicates (#6050) @H-TTTTT
• fix(clients): persist all editable fields for clients with no inbound (#6053) @H-TTTTT
• fix(clients): keep VLESS xtls-rprx-vision flow when inbound options reload (#5971) @sleepingF0x
• fix(clients): stop deleting client_traffics for detached-but-alive clients (#6110) @mrnickson-hue
• fix(clients): refresh stale client_traffics row when an inbound-deleted client's email is reused (#6003) @mrnickson-hue
• fix(nodes): keep the credential-presence flag on the node heartbeat push
• fix(node): stop a departed master's frozen traffic from disabling clients (#6113)
• fix(database): create SQLite backup snapshots online (#6137) @PathGao
• fix(database): repair legacy string tgId in inbound settings on upgrade
• fix(hosts): assign group ids to imported hosts and repair empty ones
• fix(dns): stop forcing port 53 on DoH/DoQ DNS server entries (#5950) @mvanhorn
• fix(frontend): keep DNS hosts synchronized (#6158) @PathGao
• fix(settings): keep the stored port when a port field is cleared (#6121) @PathGao
• fix(ui): commit date-picker selections immediately instead of on confirm (#6122) @PathGao
• fix(ui): explain the REALITY client version gate and drop the impossible placeholder (#6125) @PathGao
• fix(frontend): preserve cancellation and reject invalid query data (#6143) @PathGao
• fix(frontend): preserve edited server drafts (#6156) @PathGao
• fix(frontend): preserve theme body classes (#6157) @PathGao
• fix(frontend): stabilize speed tags on inbound and client pages (#5930) @H-TTTTT
• fix(frontend): resolve every axe accessibility violation in the component library
• fix(job): bound the traffic-notify POST so a stalled receiver can't wedge it (#6115)
• fix(email): build an RFC 5322 message with a proper From address and name (#5941) @yukh975
• fix(install.sh): use realpath instead of script name (#6075) @Intervence
• fix(script): remove release download time limit (#5952) @sanmaxdev
• fix(script): remove old mtg binary (#5955) @cherts

Reports

New Contributors

• @H-TTTTT made their first contribution in #5930
• @kimfom01 made their first contribution in #5945
• @mvanhorn made their first contribution in #5950
• @sleepingF0x made their first contribution in #5971
• @Alishahrokhiii made their first contribution in #5989
• @mrnickson-hue made their first contribution in #6003
• @a-poluyan made their first contribution in #6008
• @Ki-Seki made their first contribution in #6071
• @Intervence made their first contribution in #6075
• @Yosyoo made their first contribution in #6076
• @n0liu made their first contribution in #6096
• @Tosd0 made their first contribution in #6101
• @PathGao made their first contribution in #6121

Full Changelog: v3.5.0...v3.6.0