MHSanaei/3x-ui v3.9.0

on GitHub

🚀 Native TUIC, Tunnels on Nodes, Xray-core v26.9.30 & Reliable Client Resets

• 🚀 Native TUIC v5 server — TUIC now runs inside the panel in Go, with no external binary to download, BBR congestion control and crash-safe traffic accounting.
• 🌐 AmneziaWG, TUIC & MTProto on nodes — these inbounds can now be created and cloned from the master straight onto a node.
• ⚙️ Xray-core v26.9.30 — stored XDNS masks and WireGuard outbound settings are migrated to the new core's shape automatically.
• 🔁 Client lifecycle you can trust — resets, renewals and quota cuts now reach every counter on every node, and saving an inbound or editing a client no longer reverts changes made in the meantime.
• 🤖 Telegram bot access levels — unknown accounts are locked out, customers link themselves with an invite link, and admins can broadcast to every client.
• 🗓️ Weekly calendar renewal — clients can renew on a fixed weekday, with a preview of the upcoming schedule.
• 📦 Subscription controls — hide an inbound from subscriptions without disabling it, carry traffic through export/import, and set the User-Agent used for external subscriptions.
• 🔐 Security hardening — API token rotation, database restore, certificate fetching and the bot's command surface are all tightened.

⚠️ Before you upgrade

Action required

• /panel/api/inbounds/update and the inbound JSON editor no longer change which clients an inbound holds, their enable/expiry/quota/renewal fields, or the inbound's own enable flag — do this: move any script that edits clients through an inbound update to the client endpoints, and use /panel/api/inbounds/setEnable/:id to switch an inbound on or off.
• The Telegram bot now answers only /start and /id for accounts that are not linked to a client or listed as an admin — do this: link customers who used /usage or /status by setting their Telegram ID on the client, or send them the new invite link from the client card.
• XDNS finalmask changed its wire format in Xray-core v26.9.30 — do this: update clients that use an XDNS mask to a core of v26.9.30 or newer, or they will not connect.
• Weekly renewal is ignored by older binaries, and an older panel's depleted-client cleanup can delete a weekly-only client — do this: upgrade every node before enabling weekly mode, and convert weekly clients to another mode before any downgrade.
• Deploying an AmneziaWG, TUIC or MTProto inbound to a node is refused when the node is older than the release that introduced the protocol (MTProto v3.5.0, AmneziaWG v3.7.0, TUIC v3.8.0) — do this: upgrade the node first.
• WireGuard and AmneziaWG allowedIPs that overlap another client's range are now rejected; existing overlapping clients keep working but cannot be saved until fixed — do this: narrow such ranges (for example 10.10.2.9/24 → 10.10.2.9/32) when editing them.
• Self-built Docker images: the frontend stage now uses Node 26 — do this: rebuild from the updated Dockerfile; an older copy fails at npm ci.

Automatic — no action needed

• One-time startup migrations rewrite stored XDNS finalmasks (inbounds, hosts, Xray template, JSON-subscription mask, cached outbound subscriptions) into the new object shape, and move a WireGuard outbound's domainStrategy to sockopt.domainStrategy / targetStrategy (remoteDNS: "local" becomes targetStrategy). They also add the excludeFromSub and weekly-renewal columns and the node_pending_resets and tuic_traffic_receipts tables. A migration failure stops the panel from starting.
• The install and update scripts remove the old tuic-server binary, its bin/tuic configs and any leftover processes; TUIC inbounds come back up on the built-in server.
• x-ui setting -getApiToken -tokenName <name> now keeps the regenerated token's scope and expiry instead of turning it into a non-expiring admin token; an already expired token is refused rather than rotated.
• The panel fetches the sponsor list from sponsors.sanaei.dev at most once an hour and proxies sponsor logos itself, so admin browsers never contact a third party.

Requirements

Go 1.27.1 · Xray-core v26.9.30 · Node 26 (only for building the frontend from source)

🔐 Security

• Regenerating a named API token from the CLI no longer silently turns a scoped or expiring token into a permanent full-admin one (#6700) @rokokol
• Fetching a remote certificate for pinning now refuses private and loopback addresses unless the admin confirms, matching the REALITY target scan (ede275e4)
• Restoring a SQL dump can no longer open or create any database file other than the panel's own (d31465e3)
• The Telegram bot no longer lets unlinked accounts run client commands or press client buttons; invite-link claims are rate-limited and cannot be used to probe for valid subscription IDs (#6518) @pcxzs
• Saving an inbound no longer restores a client that was deleted while the edit dialog was open, which brought revoked credentials back to life (823db059)
• Subscriptions can tell supported client apps to require authentication on their local SOCKS/HTTP proxy, so other apps on the device can no longer use it to bypass per-app routing or learn the server address (#6628) @rudenko-ks

🆕 New

• TUIC v5 is now served by a native in-process Go server with BBR/New Reno congestion control, native and QUIC UDP relay, full Xray routing and a durable traffic journal — no external binary (#6577) @poise52
• AmneziaWG, TUIC and MTProto inbounds can be created and cloned onto nodes from the master (ed31ee43)
• Calendar weekly renewal, plus a preview of upcoming renewal dates in the individual and bulk client forms (#6524) @JacktheRanger
• Telegram bot invite links: the client card offers a link that binds the first account to open it (#6518) @pcxzs
• Telegram bot /broadcast sends any admin message — text, media or a whole album — to every linked client, with progress and cancel (#6510) @DIMFLIX
• Per-inbound "exclude from subscription" hides an inbound's links while it keeps serving and counting traffic (#6463) @mrchatam
• Portable client export/import now carries traffic counters, without inflating group totals (#6469) @mrchatam
• Visual routing-profile editor for client apps, with optional ad blocking and a LAN-bypass preset (#6545) @NgaiYeanCoi
• App-management subscription headers for a second client app: per-app split tunnelling, fragmentation, UDP noise, DoH pre-resolution, banners and more (#6650) @DIMFLIX
• Configurable User-Agent for fetching external subscriptions (#6613) @mrchatam
• x-ui setting -getApiToken -tokenScope <scope> chooses the scope of the issued token (#6700) @rokokol
• Finalmask noise items accept the new tag-expression type, and TUN exposes the new gateway-DNS and leak-block options (62423cac)
• Sponsor slots on the overview, sidebar and login page plus a Sponsors page, with scheduled start dates; each slot can be hidden for 24 hours (fd7b3559, 09617f04, dcaadd48)

⚡ Improved

• Xray-core updated to v26.9.30 (62423cac)
• Go, frontend and docs dependencies refreshed; the frontend baseline is now Node 26 / npm 11 (86302d2f, 99bc68fa)
• TUIC throughput through Xray rises from about 2.4 to 3.4 Gbit/s on loopback with BBR (#6577) @poise52
• The client-app settings page is folded from seven tabs into four (8f47b538)
• The test suite runs several times faster and isolates each package on PostgreSQL (12d51d71, #6594) @n0ctal
• README screenshots refreshed for the current UI (17d7dd46)

🐞 Fixed

Clients & traffic

• Saving an inbound no longer reverts client renewals, expiry, quotas, clients added meanwhile, the inbound's enable switch or traffic counted while the dialog was open (1110caaa, 823db059)
• Adding, editing or deleting a client no longer undoes a renewal of another client that committed at the same moment (63ffc083)
• A client traffic reset now reaches every node hosting the client and the MTProto quota, so a reset client is no longer switched off again on the next tick (4210a50c)
• A client that ran out of quota or time is now dropped from every inbound it belongs to, not only the last one it was attached to (7c84ca96)
• Resetting an inbound's traffic on a node now hits that inbound instead of an unrelated one (#6717) @ChesterFishmansWork

Subscriptions

• JSON subscriptions for REALITY inbounds with a Host SNI no longer ship a config the client core refuses to start (#6691) @FZ1010
• WireGuard, AmneziaWG and TUIC configs now advertise the inbound's Hosts on every surface, not the panel address (aee45ca3)
• A client on several WireGuard/AmneziaWG inbounds now gets each inbound's own keys and address in its subscription (#6653) @mvanhorn

Protocols

• Hysteria client changes are applied live instead of restarting the inbound and stalling every connected client (#6606) @iblchv
• A WireGuard allowedIPs written as 10.10.2.9/24 can no longer claim other clients' traffic (c8a182b6)

Reports

New Contributors

• @pcxzs made their first contribution in #6518
• @SakikoTogawa0214 made their first contribution in #6576
• @lin-finegold made their first contribution in #6603
• @iblchv made their first contribution in #6606
• @romus204 made their first contribution in #6621
• @rudenko-ks made their first contribution in #6628
• @libmur-dev made their first contribution in #6651
• @freeb5d made their first contribution in #6685
• @artemk1337 made their first contribution in #6702
• @ChesterFishmansWork made their first contribution in #6717

Full Changelog: v3.8.5...v3.9.0