Upgrade Notes
No migration is needed. Two behaviour changes:
- Failed logins are rate limited per source address: 10 failures, 10 minutes lockout
- Only loopback and private peers are trusted as reverse proxies, so
X-Forwarded-*from anywhere else is ignored
What's Changed
- Maintenance mode: stop the core and keep it stopped #1247
- TLS spoofing
- Generate OpenVPN static keys
- Own TLS options for OpenVPN and OpenConnect endpoints #1253
- Login rate limiting
- Protected settings are no longer writable through the settings endpoint
- Trusted proxy list, so the login log cannot be forged
- Non-ASCII subscription filenames (RFC 5987)
- Cron jobs recover from panics and no longer overlap
- Backups cover every table
- Documentation moved to the Wiki #1257
- Unified pipelines
- Remove the
with_usbipbuild tag - Update packages
Frontend
- Maintenance mode
- TLS spoofing
- Generate OpenVPN static keys
- Own TLS settings for OpenVPN and OpenConnect endpoints
- Session, log viewer and bulk client edit fixes
Bug Fixes
- Fix any user rewriting another user's credentials
- Reject an empty new password
- API tokens are deletable only by their owner
- Fix an expired API token hiding a valid one
- Fix the HTTP to HTTPS redirect on the TLS port
- Fix a silent peer holding a goroutine and a file descriptor forever
- Fix TLS mode starting with only one of certificate and key set
- Fix session age being ignored after login
- Fix ECH keys losing their first and last line in Clash subscriptions
- Fix a vmess link with no
psbreaking the whole subscription - Fix subscriptions failing on configs from an older schema
- Fix a socket leak in the certificate check
- Fix inbound tag names in JSON and Clash subscriptions #1249
- Remove stale QUIC options from naive
out_json#1243 @BingEdward - Fix a malformed config starting a core that reported itself healthy
- Fix a failed start publishing a half-built core
- Fix two backups in the same period overwriting each other
- Fix re-enabled clients staying disconnected after a traffic reset
- Log why a global traffic reset is skipped
- Fix a settings save on a fresh install writing nothing
Reports