Incompatible changes:

For security reasons, all paths appearing in the configuration file will be limited to workdir (regardless of whether they are relative or absolute). If there is a specific need, please specify additional safe paths by setting the SAFE_PATHS environment variable while ensuring safety. The syntax of this environment variable is the same as the PATH environment variable parsing rules of this operating system (i.e., semicolon-separated under Windows and colon-separated under other systems)
In addition, support for specifying routing-mark and interface-name for proxy-groups has been removed. Please specify the relevant parameters in proxies directly.

What's Changed

5c40a63 feat: not inline rule-provider can also set payload as fallback rules when file/http parsing fails by @wwqgtxx
99aa1b0 feat: inbound support shadow-tls by @wwqgtxx
f328203 feat: not inline proxy-provider can also set payload as fallback proxies when file/http parsing fails by @wwqgtxx

2b4726b fix: build on go1.24.3 golang/go#73617 by @wwqgtxx
2fb9331 fix: some resources are not released in listener by @wwqgtxx
468cfc3 fix: set sni to servername if not specified for trojan outbound (#1991) by @WeidiDeng
48d8efb fix: do NOT reset the quic-go internal state when only port is different by @wwqgtxx
52ad793 fix: shadowtls v1 not work by @wwqgtxx
61d6a9a fix: fetcher does not start the pull loop when local file parsing errors occur and the first remote update fails by @wwqgtxx
7de4af2 fix: shadowtls test by @wwqgtxx
86c127d fix: missing read waiter for cancelers by @wwqgtxx
e6e7aa5 fix: alpn apply on shadowtls by @wwqgtxx
f774276 fix: ensure wait group completes by @Larvan2
febb602 fix: hysteria2 inbound not set UDPTimeout by @wwqgtxx

26e6d83 chore: make select display the specified testUrl for #2013 by @xishang0128
4ecb49b chore: dynamic fetch remoteAddr in hysteria2 service by @wwqgtxx
50d7834 chore: change the separator of the SAFE_PATHS environment variable to the default separator of the operating system platform (i.e., ; in Windows and : in other systems) by @wwqgtxx
791ea5e chore: allow setting addition safePaths by environment variable SAFE_PATHS package managers can allow for pre-defined safe paths without disabling the entire security check feature for #2004 by @wwqgtxx
793ce45 chore: update quic-go to 0.51.0 by @wwqgtxx
7e7016b chore: removed routing-mark and interface-name of the group, please set it directly on the proxy instead by @wwqgtxx
936df90 chore: update dependencies by @wwqgtxx
9e57b29 chore: update dependencies by @wwqgtxx
a013ac3 chore: give better error messages for some stupid config files by @wwqgtxx
aa51b9f chore: replace using internal batch package to x/sync/errgroup by @wwqgtxx
b4fe669 chore: better path checks by @wwqgtxx
c2301f6 chore: rebuild fingerprint and keypair handle by @wwqgtxx
cad26ac chore: fetcher will change duration to achieve fast retry when the update failed with a 2x factor step from 1s to interval by @wwqgtxx
d55b047 chore: ignore interfaces not with FlagUp in local interface finding by @wwqgtxx
ee5d77c chore: cleanup tls clientFingerprint code by @wwqgtxx

Full Changelog: v1.19.5...v1.19.6