What's Changed
- New release alert and in-panel update #1298
- Hysteria2 realm (NAT traversal) and the hysteria-realm service; realm-aware subscriptions #1317
- Subscription setting to drop the client remark prefix from node names #1322
- Package updates: gin-contrib/gzip v1.2.9, gin-contrib/sessions v1.1.3, insomniacslk/dhcp (GO-2026-6237)
Frontend
- Update modal for new releases
- Hysteria2 realm options and hysteria-realm service #1317
- Switch for the client remark prefix on node names #1322
- Fix "Duplicate request cancelled" toast and overlapping status polls on Home #1321
- Package updates
Security
- Bind initUsers ids as query parameters #1301 @freedomdb
- Bump golang.org/x/net to v0.62.0 #1304 @freedomdb
- Panel security headers and release URL validation #1305 @freedomdb
- s-ui.sh: run installers from release tags, swap the menu script atomically #1306 @freedomdb
- Docker: take libcronet from the cronet-go module pinned in go.mod #1307 @freedomdb
- install.sh: fail closed on unusable SHA256SUMS #1308
- Admin password handling in the menu and install scripts #1309
Bug Fixes
- Replace bare type assertions in tag unmarshal and WARP API handling #1310 @freedomdb
- Strip control characters from the Profile-Title header #1311 @freedomdb
Reports