MHSanaei/3x-ui v3.8.0

on GitHub

🚀 TUIC v5, AmneziaWG outbounds, Discord notifications, Xray-core v26.9.9 & hardened installs

• 🚀 TUIC v5 inbounds — a bundled tuic-server sidecar terminates TUIC and relays into Xray for per-client stats and routing, with tuic:// share links, Clash output and a dedicated QR config tab.
• 🛰️ AmneziaWG everywhere — AmneziaWG is now an outbound protocol too, Clash subscriptions can emit AmneziaWG proxies, multi-server NordLynx outbounds arrive alongside, and the embedded tunnel picked up a dozen relay, MTU, keying, locking and throughput fixes.
• 💬 Discord notifications — a new Discord bot service mirrors the Telegram alerts with its own settings tab, while the Telegram bot gained ownership checks, HTML escaping, mutex-safe state and callback fixes.
• ⚙️ Xray-core v26.9.9 — two core bumps with one-time template migrations for the keys the new core refuses or deprecates, the udpHop → udphop mask move, and outbound protocol ids read case-insensitively everywhere the panel looks at them.
• 📡 Subscription overhaul — client-app integration headers and curated routing presets, routing profiles and DNS servers baked into JSON subscriptions, a legacy Clash endpoint, a dummy info/status node, opt-in month-end expiry display, an HWID slot-status endpoint and locally generated Crypt5 links.
• 🔐 Hardened installs — release archives ship SHA-256 sums that install.sh/update.sh verify, geo databases are checked against published digests, the SQLite store is owner-only, fresh panels get random subscription paths, and the fail2ban override moved to jail.d.
• 🖧 Multi-node correctness — client edits fan out to every node concurrently, node snapshots can no longer resurrect deleted clients or hijack another inbound's client, and a newly selected inbound is imported instead of swept.
• 🧩 Panel UX — a global Ctrl+K command palette, linked host remarks in the inbound list, a Reality scan-candidate setting, geodata source presets, a routing-rule comment field and a Generate button for tunnel preshared keys.
• 🔗 Share-link fidelity — imports keep mKCP seed/headerType, Shadowsocks TLS params and obfuscation, VMess certificate checks and vcn; Clash output drops nodes it cannot express and emits bare hosts.

ℹ️ Heads-up: The first start after upgrading runs several one-time automatic migrations: stored Xray templates are rewritten for keys the new core refuses or deprecates (outbound proxySettings → sockopt.dialerProxy, freedom domainStrategy → sockopt, dns-outbound nonIPQuery/blockTypes → rules), the SQLite directory and files are tightened to 0700/0600 (a failed chmod is logged, not fatal), a legacy MTProto custom share address becomes a Host, and a subSortIndex of 0 is renumbered to 1. Behavior changes: a wrong API Bearer token now returns 401 instead of 404; JSON subscriptions bind their local SOCKS/HTTP inbounds to 127.0.0.1 and disable TCP mux on Vision outbounds; an empty REALITY minClientVer now means no minimum; growing a node's inbound selection re-arms adoption so the added inbound is imported rather than swept. TUIC v5 needs the tuic-server sidecar, which the release archives, Docker image and install.sh now place next to the panel binary (it is no longer copied to /usr/local/bin), and install.sh/update.sh verify the archive's published SHA-256 sidecar, aborting on mismatch or fetch failure (a 404 on older tags only warns). Fresh installs get random subscription paths while existing settings are preserved; building needs Go 1.27.1 and the bundled core is Xray-core v26.9.9.

🆕 New

• feat(tuic): add TUIC v5 inbounds via the tuic-server sidecar (#6337) @momachka2
• feat(amneziawg): add AmneziaWG as an outbound protocol (#6320) @rqzbeh
• feat(nord): support multi-server NordLynx outbounds (#6311) @Masterain98
• feat(outbounds): support custom subscription user agents (#6398) @T3RR7
• feat(discord): add Discord notification bot service (#6486) @poise52
• feat(sub): add client-app integration headers, routing presets, and app management (#6434) @Pejman-Yousefi-Official
• feat(sub): refine routing presets, serverDescription escaping, and auto-detect placement (#6488) @Pejman-Yousefi-Official
• feat(sub): bake client routing profiles into the JSON subscription (#6402) @DIMFLIX
• feat(sub): let the panel set the JSON subscription DNS servers (#6485) @DIMFLIX
• feat(sub): leastLoad member weights for subscription balancers (#6304) @DIMFLIX
• feat(settings): add Block tab for JSON subscription routing rules (#6466) @mrchatam
• feat(sub): generate Crypt5 subscription links locally (#6494) @NgaiYeanCoi
• feat(sub): add legacy Clash subscription endpoint (#6338) @duqigit
• feat(sub): add AmneziaWG proxy generation for Clash subscriptions (#6326) @VibeProgramm
• feat(sub): add dummy info node and status configs for subscriptions (#6412) @rqzbeh
• feat(sub): add read-only HWID device-slot status endpoint (#6380) @Namso9
• feat(sub): add opt-in month-end expiry presentation (#6517) @JacktheRanger
• feat(clients): let admins set PersistentKeepalive on tunnel clients (#6377) @YoungReckless4
• feat(clients): add Generate button for WireGuard/AmneziaWG PresharedKey (#6455) @mrchatam
• feat(clients): support setting HWID limit and MTProto ad-tag in bulk adjust (#6399) @rqzbeh
• feat(clients): show short HWID fingerprint in admin device list (#6464) @mrchatam
• feat(inbounds): show linked host remarks in inbound list (#6468) @mrchatam
• feat(settings): add setting for Reality scan candidates (#6471) @mrchatam
• feat(reality): warn when target cert chain is too small for ML-DSA-65 (#6470) @mrchatam
• feat(geodata): add standard source presets (#6504) @rokokol
• feat(routing): add panel-only comment field to routing rules (#6361) @Ssentiago
• feat(ui): add global command palette (Ctrl+K) for fast navigation and search (#6352) @TheMRVX
• feat(release): publish SHA-256 sums and verify them in install.sh/update.sh (#6393) @rokokol

⚡ Update & improvement

• feat(xray): update xray-core to v26.9.9 and follow the udpHop move
• feat(xray): update xray-core to v26.9.8 and adapt panel
• perf(clients): batch the client record lookup in bulk operations
• perf(clients): apply a multi-inbound client create concurrently
• perf(clients): push a bulk client change to every node at once
• perf(node): push a client edit to every node at once, not one after another
• perf(node): bound the per-client node push and fan out the traffic reset
• perf(amneziawg): return gVisor's pooled buffers on the embedded data path
• refactor(tgbot): make the add-client expiry presets say what they do (#6503) @BlindMaster24
• docs(readme): refresh all seven READMEs for the current feature set
• docs: add Discord bot to READMEs, architecture, operations guides, and locales (#6513) @poise52
• docs: add TUIC v5 to READMEs, guides, and protocol references (#6511) @poise52
• docs(api): align OpenAPI with runtime contracts (#6409) @LineGM
• docs(api): mark collection responses nullable (#6430) @LineGM
• docs(readme): add 3X-UI Manager to Community Tools (#6266) @yukh975
• chore(deps): update frontend and Go deps and fix the AntD Space API
• chore(deps): bump Go dependency versions
• chore(deps): raise the swagger-ui-react js-yaml override to 4.3.2

🐞 Bug fixed

• fix(xray): read an outbound protocol id the way the core does (#6521) @BlindMaster24
• fix(panel): read outbound protocol ids case-insensitively everywhere (#6523) @BlindMaster24
• fix(panel): read an outbound protocol id the way the core does (#6522) @BlindMaster24
• fix(panel): read the outbound protocol id in the Outbounds row like the core (#6528) @BlindMaster24
• fix(outbound): read the probe protocol id and transport name like the core (#6526) @BlindMaster24
• fix(outbound): read the probe testability gate's ids like the core (#6527) @BlindMaster24
• fix(panel): probe UDP outbounds and hide the block outbound from the mtproto egress picker (#6525) @BlindMaster24
• fix(xray): migrate the dns outbound off its legacy nonIPQuery and blockTypes (#6519) @BlindMaster24
• fix(xray): place the freedom domain strategy where the core reads it (#6515) @BlindMaster24
• fix(xray): confine log paths written under any key case
• fix(outbound): test VLESS vnext endpoints (#6358) @sanmaxdev
• fix(outbounds): preserve stable subscription tags (#6345) @dawNotPoi
• fix(dns): stop offering a port field that DoH entries discard
• fix(inbounds): reject missing TLS certificates before saving (#6429) @duqigit
• fix(inbounds): serve fresh client UUIDs for list and allLinks (#6458) @mrchatam
• fix(inbounds): allow negative subSortIndex for subscription order (#6465) @mrchatam
• fix(inbounds): let a node-adopted inbound keep its own protocol on edit
• fix(frontend): fold sockopt v6only into V6Only on inbound load (#6453) @mrchatam
• fix(hosts): keep TLS override fields visible when Security is same (#6452) @mrchatam
• fix(clients): preserve traffic reset schedule when toggling enable (#6502) @alireza4682
• fix(clients): snap EOM 23:59:59 expiry to billing midnight without renew (#6457) @mrchatam
• fix(clients): sync auto-renewal across inbounds (#6339) @dawNotPoi
• fix(clients): preserve enable on portable import (#6481) @mrchatam
• fix(clients): use EffectiveFlow in BulkAttach (#6454) @mrchatam
• fix(clients): keep per-peer keys when a client spans several tunnel inbounds
• fix(clients): withdraw the delete tombstone when the email is re-created
• fix(clients): flag the restart a partly-applied edit or delete still needs
• fix(clients): render all tunnel configs for multi-inbound client (#6349) @TheMRVX
• fix(wireguard): preserve per-inbound WireGuard peer addresses (#6344) @mvanhorn
• fix(node): import a newly selected node inbound instead of sweeping it
• fix(node): flag every hosting node before a client edit applies
• fix(node): let a node-reported tag outrank a stale adopted alias
• fix(node): keep an adopted inbound alias across a remote id cache refresh
• fix(node): sweep a selected inbound the node reports without its prefix
• fix(node): cap the status body the heartbeat probe decodes
• fix(node): refuse a node's claim on another inbound's client
• fix(node): prevent node snapshots from resurrecting bulk-deleted clients (#6382) @mvanhorn
• fix(sub): drop external Clash shadowsocks nodes the panel cannot express (#6508) @BlindMaster24
• fix(link): rebuild shadowsocks tcp/http obfuscation on import (#6505) @BlindMaster24
• fix(link): read the vmess certificate checks on import (#6507) @BlindMaster24
• fix(link): restore mKCP seed and headerType on share-link import (#6480) @mrchatam
• fix(link): preserve Shadowsocks TLS query params on import (#6467) @mrchatam
• fix(link): map vcn to verifyPeerCertByName in applySecurity (#6479) @mrchatam
• fix(hysteria): export standard gecko obfs share-link params and persist uTLS None (#6325) @rqzbeh
• fix(mtproto): use hosts for public share links (#6369) @samssh
• fix(sub): enable ML-KEM for Mihomo REALITY subscriptions (#6451) @King19950905
• fix(sub): skip AmneziaWG JSON entries (#6420) @atirna
• fix(sub): bind JSON local inbounds to 127.0.0.1 and keep mux.cool off Vision outbounds (#6418) @FZ1010
• fix(sub): randomize fresh panel subscription paths (#6375) @rokokol
• fix(sub): apply the device limit to ?view=raw
• fix(sub): drop Reality parameters when a host forces plain TLS
• fix(sub): emit a bare host in Clash proxies
• fix(sub): restore compatible SOCKS subscription inbound (#6395) @dawNotPoi
• fix(sub): honor and show client expiry on external subscription links (#6333) @duqigit
• fix(frontend): isolate subscription language preference (#6394) @dawNotPoi
• fix(frontend): improve dense QR readability (#6396) @dawNotPoi
• fix(amneziawg): bound the SOCKS5 UDP associate exchange
• fix(amneziawg): honor inbound listen when binding UDP socket (#6461) @mrchatam
• fix(amneziawgnet): wait for the client netstack goroutines before closing its device
• fix(amneziawg): let a cleared header protection key reach a running device
• fix(amneziawg): stop losing an inbound and its server keys on the API path
• fix(amneziawg): reject obfuscation values amneziawg-go's own UAPI rejects
• fix(amneziawg): three defects in the embedded relay's connection handling
• fix(amneziawg): account for S4 junk in the default tunnel MTU (#6376) @YoungReckless4
• fix(amneziawg): H1-H4 generator + queue-depth throughput fixes (#6330) @kuzzrus
• fix(amneziawg): avoid manager lock inversion (#6397) @dawNotPoi
• fix(tuic): evict the oldest relay flow instead of refusing new clients
• fix(install): stop copying tuic-server over /usr/local/bin
• fix(tgbot): close stale-inbound TOCTOU and contain handler panics (#6442) @BlindMaster24
• fix(tgbot): suppress 'message not modified' warnings in Telegram edit calls (#6340) @BlindMaster24
• fix(tgbot): require client ownership for non-admin link callbacks (#6489) @BlindMaster24
• fix(tgbot): read the admin list and running flag under their mutex (#6491) @BlindMaster24
• fix(tgbot): render the add-client draft as HTML and escape its values (#6492) @BlindMaster24
• fix(tgbot): answer the callbacks the bot cannot route (#6493) @BlindMaster24
• fix(tgbot): answer only the link callbacks that match nothing
• fix(tgbot): send the admin traffic reports as one message (#6490) @BlindMaster24
• fix(tgbot): keep the add-client draft with the chat that owns it (#6499) @BlindMaster24
• fix(tgbot): render a disabled start-after-first-use client as days (#6500) @BlindMaster24
• fix(discord): page the inbounds reply within Discord's embed caps (#6496) @BlindMaster24
• fix(discord): drop the gateway connection when heartbeats go unanswered (#6497) @BlindMaster24
• fix(discord): report a start-after-first-use client as days, not unlimited (#6498) @BlindMaster24
• fix(api): return 401 for invalid Bearer token instead of 404 (#6459) @mrchatam
• fix(web): restart panel after ImportDB so subPath routes match (#6456) @mrchatam
• fix(settings): show the SMTP failure reason instead of a raw i18n key
• fix(ui): keep the empty-group placeholder legible in dark mode
• fix(logs): standardize login and logout logs (#6484) @Mapioe
• fix(logs): stop logging a successful login twice (#6374) @Mapioe
• fix(cli): let -getApiToken name the token it regenerates (#6405) @rokokol
• fix(api-docs): generate request bodies for all encodings (#6296) @rokokol
• fix(database): keep the SQLite store owner-only (#6390) @rokokol
• fix(geofile): verify downloaded geo databases against published digests (#6404) @rokokol
• fix(install): fetch x-ui.sh and unit files from the installed release tag (#6391) @rokokol
• fix(x-ui.sh): put the fail2ban backend override in jail.d, not jail.conf (#6392) @rokokol

Reports

New Contributors

• @VibeProgramm made their first contribution in #6326
• @duqigit made their first contribution in #6333
• @momachka2 made their first contribution in #6337
• @BlindMaster24 made their first contribution in #6340
• @TheMRVX made their first contribution in #6349
• @Mapioe made their first contribution in #6374
• @YoungReckless4 made their first contribution in #6376
• @Namso9 made their first contribution in #6380
• @T3RR7 made their first contribution in #6398
• @LineGM made their first contribution in #6409
• @atirna made their first contribution in #6420
• @Pejman-Yousefi-Official made their first contribution in #6434
• @King19950905 made their first contribution in #6451
• @poise52 made their first contribution in #6486
• @NgaiYeanCoi made their first contribution in #6494
• @alireza4682 made their first contribution in #6502
• @JacktheRanger made their first contribution in #6517

Full Changelog: v3.7.0...v3.8.0