🚀 Xray-knife v11.4.0 (JOIN THE TELEGRAM CHANNEL)

https://t.me/lilendian0x00

xray-core moves to 26.10.10, and plaintext links to public servers keep getting tested. 🛠️

⚠️ After upgrading

• 🧰 Go 1.27 is needed to build from source or to import the packages.
• ⛓️ proxySettings is gone from xray-core. An xray JSON outbound that still sets it fails to load; chain with streamSettings.sockopt.dialerProxy instead.
• 🔐 REALITY servers on Xray 26.9.8+ only let in a Client Hello that offers X25519MLKEM768. Links with fp=ios, android, edge, 360 or qq (and some random / randomized runs) now fail against them. That is the server turning them away: chrome, firefox and safari get through.

🔓 Plaintext links to public servers still get tested

xray-core 26.9.9 refuses VLESS without TLS, REALITY or VLESS encryption, and Trojan without TLS, when the server is a public address:

vless without TLS or other encryption is prohibited unless the server address is a private IP or domain

With -z auto those links now run on sing-box whenever it has the transport (tcp without HTTP obfuscation, ws, grpc, httpupgrade). kcp and xhttp stay on xray and report its error. Private addresses keep running on xray.

🆙 xray-core 26.10.10

• 🌐 TLS links are verified against xray-core's built-in root bundle instead of the system store.
• 🛡️ WireGuard links resolve domains inside the tunnel (Cloudflare DNS by default).
• 🩹 Upstream fixes for XHTTP, mux and gRPC client races, including an XHTTP client crash.

📦 Install

Grab a prebuilt binary from the assets below (verify with sha256sum -c --ignore-missing SHA256SUMS), or install with Go. The tags match the release binaries:

go install -tags "with_gvisor,with_quic,with_wireguard,with_utls,with_clash_api,with_grpc" \
  github.com/lilendian0x00/xray-knife/v11@latest

Full Changelog: v11.3.0...v11.4.0