github.com/sagernet/sing-box@v1.9.0-rc.20/docs/changelog.md (about)

     1  ---
     2  icon: material/alert-decagram
     3  ---
     4  
     5  #### 1.9.0-rc.20
     6  
     7  * Prioritize `*_route_address` in linux auto-route
     8  * Fix `*_route_address` in darwin auto-route
     9  
    10  #### 1.8.14
    11  
    12  * Fix hysteria2 panic
    13  * Fixes and improvements
    14  
    15  #### 1.9.0-rc.18
    16  
    17  * Add custom prefix support in EDNS0 client subnet options
    18  * Fix hysteria2 crash
    19  * Fix `store_rdrc` corrupted
    20  * Update quic-go to v0.43.1
    21  * Fixes and improvements
    22  
    23  #### 1.9.0-rc.16
    24  
    25  * Mitigating TunnelVision attacks **1**
    26  * Fixes and improvements
    27  
    28  **1**:
    29  
    30  See [TunnelVision](/manual/misc/tunnelvision).
    31  
    32  #### 1.9.0-rc.15
    33  
    34  * Fixes and improvements
    35  
    36  #### 1.8.13
    37  
    38  * Fix fake-ip mapping
    39  * Fixes and improvements
    40  
    41  #### 1.9.0-rc.14
    42  
    43  * Fixes and improvements
    44  
    45  #### 1.9.0-rc.13
    46  
    47  * Update Hysteria protocol
    48  * Update quic-go to v0.43.0
    49  * Update gVisor to 20240422.0
    50  * Fixes and improvements
    51  
    52  #### 1.8.12
    53  
    54  * Now we have official APT and DNF repositories **1**
    55  * Fix packet MTU for QUIC protocols
    56  * Fixes and improvements
    57  
    58  **1**:
    59  
    60  Including stable and beta versions, see https://sing-box.sagernet.org/installation/package-manager/
    61  
    62  #### 1.9.0-rc.11
    63  
    64  * Fixes and improvements
    65  
    66  #### 1.8.11
    67  
    68  * Fixes and improvements
    69  
    70  #### 1.8.10
    71  
    72  * Fixes and improvements
    73  
    74  #### 1.9.0-beta.17
    75  
    76  * Update `quic-go` to v0.42.0
    77  * Fixes and improvements
    78  
    79  #### 1.9.0-beta.16
    80  
    81  * Fixes and improvements
    82  
    83  _Our Testflight distribution has been temporarily blocked by Apple (possibly due to too many beta versions)
    84  and you cannot join the test, install or update the sing-box beta app right now.
    85  Please wait patiently for processing._
    86  
    87  #### 1.9.0-beta.14
    88  
    89  * Update gVisor to 20240212.0-65-g71212d503
    90  * Fixes and improvements
    91  
    92  #### 1.8.9
    93  
    94  * Fixes and improvements
    95  
    96  #### 1.8.8
    97  
    98  * Fixes and improvements
    99  
   100  #### 1.9.0-beta.7
   101  
   102  * Fixes and improvements
   103  
   104  #### 1.9.0-beta.6
   105  
   106  * Fix address filter DNS rule items **1**
   107  * Fix DNS outbound responding with wrong data
   108  * Fixes and improvements
   109  
   110  **1**:
   111  
   112  Fixed an issue where address filter DNS rule was incorrectly rejected under certain circumstances.
   113  If you have enabled `store_rdrc` to save results, consider clearing the cache file.
   114  
   115  #### 1.8.7
   116  
   117  * Fixes and improvements
   118  
   119  #### 1.9.0-alpha.15
   120  
   121  * Fixes and improvements
   122  
   123  #### 1.9.0-alpha.14
   124  
   125  * Improve DNS truncate behavior
   126  * Fixes and improvements
   127  
   128  #### 1.9.0-alpha.13
   129  
   130  * Fixes and improvements
   131  
   132  #### 1.8.6
   133  
   134  * Fixes and improvements
   135  
   136  #### 1.9.0-alpha.12
   137  
   138  * Handle Windows power events
   139  * Always disable cache for fake-ip DNS transport if `dns.independent_cache` disabled
   140  * Fixes and improvements
   141  
   142  #### 1.9.0-alpha.11
   143  
   144  * Fix missing `rule_set_ipcidr_match_source` item in DNS rules **1**
   145  * Fixes and improvements
   146  
   147  **1**:
   148  
   149  See [DNS Rule](/configuration/dns/rule/).
   150  
   151  #### 1.9.0-alpha.10
   152  
   153  * Add `bypass_domain` and `search_domain` platform HTTP proxy options **1**
   154  * Fixes and improvements
   155  
   156  **1**:
   157  
   158  See [TUN](/configuration/inbound/tun) inbound.
   159  
   160  #### 1.9.0-alpha.8
   161  
   162  * Add rejected DNS response cache support **1**
   163  * Fixes and improvements
   164  
   165  **1**:
   166  
   167  The new feature allows you to cache the check results of
   168  [Address filter DNS rule items](/configuration/dns/rule/#address-filter-fields) until expiration.
   169  
   170  #### 1.9.0-alpha.7
   171  
   172  * Update gVisor to 20240206.0
   173  * Fixes and improvements
   174  
   175  #### 1.9.0-alpha.6
   176  
   177  * Fixes and improvements
   178  
   179  #### 1.9.0-alpha.3
   180  
   181  * Update `quic-go` to v0.41.0
   182  * Fixes and improvements
   183  
   184  #### 1.9.0-alpha.2
   185  
   186  * Add support for `client-subnet` DNS options **1**
   187  * Fixes and improvements
   188  
   189  **1**:
   190  
   191  See [DNS](/configuration/dns), [DNS Server](/configuration/dns/server) and [DNS Rules](/configuration/dns/rule).
   192  
   193  Since this feature makes the scenario mentioned in `alpha.1` no longer leak DNS requests,
   194  the [Client example](/manual/proxy/client#traffic-bypass-usage-for-chinese-users) has been updated.
   195  
   196  #### 1.9.0-alpha.1
   197  
   198  * `domain_suffix` behavior update **1**
   199  * `process_path` format update on Windows **2**
   200  * Add address filter DNS rule items **3**
   201  
   202  **1**:
   203  
   204  See [Migration](/migration/#domain_suffix-behavior-update).
   205  
   206  **2**:
   207  
   208  See [Migration](/migration/#process_path-format-update-on-windows).
   209  
   210  **3**:
   211  
   212  The new DNS feature allows you to more precisely bypass Chinese websites via **DNS leaks**. Do not use plain local DNS
   213  if using this method.
   214  
   215  See [Address Filter Fields](/configuration/dns/rule#address-filter-fields).
   216  
   217  [Client example](/manual/proxy/client#traffic-bypass-usage-for-chinese-users) updated.
   218  
   219  #### 1.8.5
   220  
   221  * Fixes and improvements
   222  
   223  #### 1.8.4
   224  
   225  * Fixes and improvements
   226  
   227  #### 1.8.2
   228  
   229  * Fixes and improvements
   230  
   231  #### 1.8.1
   232  
   233  * Fixes and improvements
   234  
   235  #### 1.8.0
   236  
   237  * Fixes and improvements
   238  
   239  Important changes since 1.7:
   240  
   241  * Migrate cache file from Clash API to independent options **1**
   242  * Introducing [Rule Set](/configuration/rule-set/) **2**
   243  * Add `sing-box geoip`, `sing-box geosite` and `sing-box rule-set` commands **3**
   244  * Allow nested logical rules **4**
   245  * Independent `source_ip_is_private` and `ip_is_private` rules **5**
   246  * Add context to JSON decode error message **6**
   247  * Reject internal fake-ip queries **7**
   248  * Add GSO support for TUN and WireGuard system interface **8**
   249  * Add `idle_timeout` for URLTest outbound **9**
   250  * Add simple loopback detect
   251  * Optimize memory usage of idle connections
   252  * Update uTLS to 1.5.4 **10**
   253  * Update dependencies **11**
   254  
   255  **1**:
   256  
   257  See [Cache File](/configuration/experimental/cache-file/) and
   258  [Migration](/migration/#migrate-cache-file-from-clash-api-to-independent-options).
   259  
   260  **2**:
   261  
   262  Rule set is independent collections of rules that can be compiled into binaries to improve performance.
   263  Compared to legacy GeoIP and Geosite resources,
   264  it can include more types of rules, load faster,
   265  use less memory, and update automatically.
   266  
   267  See [Route#rule_set](/configuration/route/#rule_set),
   268  [Route Rule](/configuration/route/rule/),
   269  [DNS Rule](/configuration/dns/rule/),
   270  [Rule Set](/configuration/rule-set/),
   271  [Source Format](/configuration/rule-set/source-format/) and
   272  [Headless Rule](/configuration/rule-set/headless-rule/).
   273  
   274  For GEO resources migration, see [Migrate GeoIP to rule sets](/migration/#migrate-geoip-to-rule-sets) and
   275  [Migrate Geosite to rule sets](/migration/#migrate-geosite-to-rule-sets).
   276  
   277  **3**:
   278  
   279  New commands manage GeoIP, Geosite and rule set resources, and help you migrate GEO resources to rule sets.
   280  
   281  **4**:
   282  
   283  Logical rules in route rules, DNS rules, and the new headless rule now allow nesting of logical rules.
   284  
   285  **5**:
   286  
   287  The `private` GeoIP country never existed and was actually implemented inside V2Ray.
   288  Since GeoIP was deprecated, we made this rule independent, see [Migration](/migration/#migrate-geoip-to-rule-sets).
   289  
   290  **6**:
   291  
   292  JSON parse errors will now include the current key path.
   293  Only takes effect when compiled with Go 1.21+.
   294  
   295  **7**:
   296  
   297  All internal DNS queries now skip DNS rules with `server` type `fakeip`,
   298  and the default DNS server can no longer be `fakeip`.
   299  
   300  This change is intended to break incorrect usage and essentially requires no action.
   301  
   302  **8**:
   303  
   304  See [TUN](/configuration/inbound/tun/) inbound and [WireGuard](/configuration/outbound/wireguard/) outbound.
   305  
   306  **9**:
   307  
   308  When URLTest is idle for a certain period of time, the scheduled delay test will be paused.
   309  
   310  **10**:
   311  
   312  Added some new [fingerprints](/configuration/shared/tls#utls).
   313  Also, starting with this release, uTLS requires at least Go 1.20.
   314  
   315  **11**:
   316  
   317  Updated `cloudflare-tls`, `gomobile`, `smux`, `tfo-go` and `wireguard-go` to latest, `quic-go` to `0.40.1` and  `gvisor`
   318  to `20231204.0`
   319  
   320  #### 1.8.0-rc.11
   321  
   322  * Fixes and improvements
   323  
   324  #### 1.7.8
   325  
   326  * Fixes and improvements
   327  
   328  #### 1.8.0-rc.10
   329  
   330  * Fixes and improvements
   331  
   332  #### 1.7.7
   333  
   334  * Fix V2Ray transport `path` validation behavior **1**
   335  * Fixes and improvements
   336  
   337  **1**:
   338  
   339  See [V2Ray transport](/configuration/shared/v2ray-transport/).
   340  
   341  #### 1.8.0-rc.7
   342  
   343  * Fixes and improvements
   344  
   345  #### 1.8.0-rc.3
   346  
   347  * Fix V2Ray transport `path` validation behavior **1**
   348  * Fixes and improvements
   349  
   350  **1**:
   351  
   352  See [V2Ray transport](/configuration/shared/v2ray-transport/).
   353  
   354  #### 1.7.6
   355  
   356  * Fixes and improvements
   357  
   358  #### 1.8.0-rc.1
   359  
   360  * Fixes and improvements
   361  
   362  #### 1.8.0-beta.9
   363  
   364  * Add simple loopback detect
   365  * Fixes and improvements
   366  
   367  #### 1.7.5
   368  
   369  * Fixes and improvements
   370  
   371  #### 1.8.0-alpha.17
   372  
   373  * Add GSO support for TUN and WireGuard system interface **1**
   374  * Update uTLS to 1.5.4 **2**
   375  * Update dependencies **3**
   376  * Fixes and improvements
   377  
   378  **1**:
   379  
   380  See [TUN](/configuration/inbound/tun/) inbound and [WireGuard](/configuration/outbound/wireguard/) outbound.
   381  
   382  **2**:
   383  
   384  Added some new [fingerprints](/configuration/shared/tls#utls).
   385  Also, starting with this release, uTLS requires at least Go 1.20.
   386  
   387  **3**:
   388  
   389  Updated `cloudflare-tls`, `gomobile`, `smux`, `tfo-go` and `wireguard-go` to latest, and `gvisor` to `20231204.0`
   390  
   391  This may break something, good luck!
   392  
   393  #### 1.7.4
   394  
   395  * Fixes and improvements
   396  
   397  _Due to the long waiting time, this version is no longer waiting for approval
   398  by the Apple App Store, so updates to Apple Platforms will be delayed._
   399  
   400  #### 1.8.0-alpha.16
   401  
   402  * Fixes and improvements
   403  
   404  #### 1.8.0-alpha.15
   405  
   406  * Some chaotic changes **1**
   407  * Fixes and improvements
   408  
   409  **1**:
   410  
   411  Designed to optimize memory usage of idle connections, may take effect on the following protocols:
   412  
   413  | Protocol                                             | TCP              | UDP              |
   414  |------------------------------------------------------|------------------|------------------|
   415  | HTTP proxy server                                    | :material-check: | /                |
   416  | SOCKS5                                               | :material-close: | :material-check: |
   417  | Shadowsocks none/AEAD/AEAD2022                       | :material-check: | :material-check: |
   418  | Trojan                                               | /                | :material-check: |
   419  | TUIC/Hysteria/Hysteria2                              | :material-close: | :material-check: |
   420  | Multiplex                                            | :material-close: | :material-check: |
   421  | Plain TLS (Trojan/VLESS without extra sub-protocols) | :material-check: | /                |
   422  | Other protocols                                      | :material-close: | :material-close: |
   423  
   424  At the same time, everything existing may be broken, please actively report problems with this version.
   425  
   426  #### 1.8.0-alpha.13
   427  
   428  * Fixes and improvements
   429  
   430  #### 1.8.0-alpha.10
   431  
   432  * Add `idle_timeout` for URLTest outbound **1**
   433  * Fixes and improvements
   434  
   435  **1**:
   436  
   437  When URLTest is idle for a certain period of time, the scheduled delay test will be paused.
   438  
   439  #### 1.7.2
   440  
   441  * Fixes and improvements
   442  
   443  #### 1.8.0-alpha.8
   444  
   445  * Add context to JSON decode error message **1**
   446  * Reject internal fake-ip queries **2**
   447  * Fixes and improvements
   448  
   449  **1**:
   450  
   451  JSON parse errors will now include the current key path.
   452  Only takes effect when compiled with Go 1.21+.
   453  
   454  **2**:
   455  
   456  All internal DNS queries now skip DNS rules with `server` type `fakeip`,
   457  and the default DNS server can no longer be `fakeip`.
   458  
   459  This change is intended to break incorrect usage and essentially requires no action.
   460  
   461  #### 1.8.0-alpha.7
   462  
   463  * Fixes and improvements
   464  
   465  #### 1.7.1
   466  
   467  * Fixes and improvements
   468  
   469  #### 1.8.0-alpha.6
   470  
   471  * Fix rule-set matching logic **1**
   472  * Fixes and improvements
   473  
   474  **1**:
   475  
   476  Now the rules in the `rule_set` rule item can be logically considered to be merged into the rule using rule sets,
   477  rather than completely following the AND logic.
   478  
   479  #### 1.8.0-alpha.5
   480  
   481  * Parallel rule-set initialization
   482  * Independent `source_ip_is_private` and `ip_is_private` rules **1**
   483  
   484  **1**:
   485  
   486  The `private` GeoIP country never existed and was actually implemented inside V2Ray.
   487  Since GeoIP was deprecated, we made this rule independent, see [Migration](/migration/#migrate-geoip-to-rule-sets).
   488  
   489  #### 1.8.0-alpha.1
   490  
   491  * Migrate cache file from Clash API to independent options **1**
   492  * Introducing [Rule Set](/configuration/rule-set/) **2**
   493  * Add `sing-box geoip`, `sing-box geosite` and `sing-box rule-set` commands **3**
   494  * Allow nested logical rules **4**
   495  
   496  **1**:
   497  
   498  See [Cache File](/configuration/experimental/cache-file/) and
   499  [Migration](/migration/#migrate-cache-file-from-clash-api-to-independent-options).
   500  
   501  **2**:
   502  
   503  Rule set is independent collections of rules that can be compiled into binaries to improve performance.
   504  Compared to legacy GeoIP and Geosite resources,
   505  it can include more types of rules, load faster,
   506  use less memory, and update automatically.
   507  
   508  See [Route#rule_set](/configuration/route/#rule_set),
   509  [Route Rule](/configuration/route/rule/),
   510  [DNS Rule](/configuration/dns/rule/),
   511  [Rule Set](/configuration/rule-set/),
   512  [Source Format](/configuration/rule-set/source-format/) and
   513  [Headless Rule](/configuration/rule-set/headless-rule/).
   514  
   515  For GEO resources migration, see [Migrate GeoIP to rule sets](/migration/#migrate-geoip-to-rule-sets) and
   516  [Migrate Geosite to rule sets](/migration/#migrate-geosite-to-rule-sets).
   517  
   518  **3**:
   519  
   520  New commands manage GeoIP, Geosite and rule set resources, and help you migrate GEO resources to rule sets.
   521  
   522  **4**:
   523  
   524  Logical rules in route rules, DNS rules, and the new headless rule now allow nesting of logical rules.
   525  
   526  #### 1.7.0
   527  
   528  * Fixes and improvements
   529  
   530  Important changes since 1.6:
   531  
   532  * Add [exclude route support](/configuration/inbound/tun/) for TUN inbound
   533  * Add `udp_disable_domain_unmapping` [inbound listen option](/configuration/shared/listen/) **1**
   534  * Add [HTTPUpgrade V2Ray transport](/configuration/shared/v2ray-transport#HTTPUpgrade) support **2**
   535  * Migrate multiplex and UoT server to inbound **3**
   536  * Add TCP Brutal support for multiplex **4**
   537  * Add `wifi_ssid` and `wifi_bssid` route and DNS rules **5**
   538  * Update quic-go to v0.40.0
   539  * Update gVisor to 20231113.0
   540  
   541  **1**:
   542  
   543  If enabled, for UDP proxy requests addressed to a domain,
   544  the original packet address will be sent in the response instead of the mapped domain.
   545  
   546  This option is used for compatibility with clients that
   547  do not support receiving UDP packets with domain addresses, such as Surge.
   548  
   549  **2**:
   550  
   551  Introduced in V2Ray 5.10.0.
   552  
   553  The new HTTPUpgrade transport has better performance than WebSocket and is better suited for CDN abuse.
   554  
   555  **3**:
   556  
   557  Starting in 1.7.0, multiplexing support is no longer enabled by default
   558  and needs to be turned on explicitly in inbound
   559  options.
   560  
   561  **4**
   562  
   563  Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server,
   564  see [TCP Brutal](/configuration/shared/tcp-brutal/) for details.
   565  
   566  **5**:
   567  
   568  Only supported in graphical clients on Android and Apple platforms.
   569  
   570  #### 1.7.0-rc.3
   571  
   572  * Fixes and improvements
   573  
   574  #### 1.6.7
   575  
   576  * macOS: Add button for uninstall SystemExtension in the standalone graphical client
   577  * Fix missing UDP user context on TUIC/Hysteria2 inbounds
   578  * Fixes and improvements
   579  
   580  #### 1.7.0-rc.2
   581  
   582  * Fix missing UDP user context on TUIC/Hysteria2 inbounds
   583  * macOS: Add button for uninstall SystemExtension in the standalone graphical client
   584  
   585  #### 1.6.6
   586  
   587  * Fixes and improvements
   588  
   589  #### 1.7.0-rc.1
   590  
   591  * Fixes and improvements
   592  
   593  #### 1.7.0-beta.5
   594  
   595  * Update gVisor to 20231113.0
   596  * Fixes and improvements
   597  
   598  #### 1.7.0-beta.4
   599  
   600  * Add `wifi_ssid` and `wifi_bssid` route and DNS rules **1**
   601  * Fixes and improvements
   602  
   603  **1**:
   604  
   605  Only supported in graphical clients on Android and Apple platforms.
   606  
   607  #### 1.7.0-beta.3
   608  
   609  * Fix zero TTL was incorrectly reset
   610  * Fixes and improvements
   611  
   612  #### 1.6.5
   613  
   614  * Fix crash if TUIC inbound authentication failed
   615  * Fixes and improvements
   616  
   617  #### 1.7.0-beta.2
   618  
   619  * Fix crash if TUIC inbound authentication failed
   620  * Update quic-go to v0.40.0
   621  * Fixes and improvements
   622  
   623  #### 1.6.4
   624  
   625  * Fixes and improvements
   626  
   627  #### 1.7.0-beta.1
   628  
   629  * Fixes and improvements
   630  
   631  #### 1.6.3
   632  
   633  * iOS/Android: Fix profile auto update
   634  * Fixes and improvements
   635  
   636  #### 1.7.0-alpha.11
   637  
   638  * iOS/Android: Fix profile auto update
   639  * Fixes and improvements
   640  
   641  #### 1.7.0-alpha.10
   642  
   643  * Fix tcp-brutal not working with TLS
   644  * Fix Android client not closing in some cases
   645  * Fixes and improvements
   646  
   647  #### 1.6.2
   648  
   649  * Fixes and improvements
   650  
   651  #### 1.6.1
   652  
   653  * Our [Android client](/installation/clients/sfa/) is now available in the Google Play Store ▶️
   654  * Fixes and improvements
   655  
   656  #### 1.7.0-alpha.6
   657  
   658  * Fixes and improvements
   659  
   660  #### 1.7.0-alpha.4
   661  
   662  * Migrate multiplex and UoT server to inbound **1**
   663  * Add TCP Brutal support for multiplex **2**
   664  
   665  **1**:
   666  
   667  Starting in 1.7.0, multiplexing support is no longer enabled by default and needs to be turned on explicitly in inbound
   668  options.
   669  
   670  **2**
   671  
   672  Hysteria Brutal Congestion Control Algorithm in TCP. A kernel module needs to be installed on the Linux server,
   673  see [TCP Brutal](/configuration/shared/tcp-brutal/) for details.
   674  
   675  #### 1.7.0-alpha.3
   676  
   677  * Add [HTTPUpgrade V2Ray transport](/configuration/shared/v2ray-transport#HTTPUpgrade) support **1**
   678  * Fixes and improvements
   679  
   680  **1**:
   681  
   682  Introduced in V2Ray 5.10.0.
   683  
   684  The new HTTPUpgrade transport has better performance than WebSocket and is better suited for CDN abuse.
   685  
   686  #### 1.6.0
   687  
   688  * Fixes and improvements
   689  
   690  Important changes since 1.5:
   691  
   692  * Our [Apple tvOS client](/installation/clients/sft/) is now available in the App Store 🍎
   693  * Update BBR congestion control for TUIC and Hysteria2 **1**
   694  * Update brutal congestion control for Hysteria2
   695  * Add `brutal_debug` option for Hysteria2
   696  * Update legacy Hysteria protocol **2**
   697  * Add TLS self sign key pair generate command
   698  * Remove [Deprecated Features](/deprecated/) by agreement
   699  
   700  **1**:
   701  
   702  None of the existing Golang BBR congestion control implementations have been reviewed or unit tested.
   703  This update is intended to address the multi-send defects of the old implementation and may introduce new issues.
   704  
   705  **2**
   706  
   707  Based on discussions with the original author, the brutal CC and QUIC protocol parameters of
   708  the old protocol (Hysteria 1) have been updated to be consistent with Hysteria 2
   709  
   710  #### 1.7.0-alpha.2
   711  
   712  * Fix bugs introduced in 1.7.0-alpha.1
   713  
   714  #### 1.7.0-alpha.1
   715  
   716  * Add [exclude route support](/configuration/inbound/tun/) for TUN inbound
   717  * Add `udp_disable_domain_unmapping` [inbound listen option](/configuration/shared/listen/) **1**
   718  * Fixes and improvements
   719  
   720  **1**:
   721  
   722  If enabled, for UDP proxy requests addressed to a domain,
   723  the original packet address will be sent in the response instead of the mapped domain.
   724  
   725  This option is used for compatibility with clients that
   726  do not support receiving UDP packets with domain addresses, such as Surge.
   727  
   728  #### 1.5.5
   729  
   730  * Fix IPv6 `auto_route` for Linux **1**
   731  * Add legacy builds for old Windows and macOS systems **2**
   732  * Fixes and improvements
   733  
   734  **1**:
   735  
   736  When `auto_route` is enabled and `strict_route` is disabled, the device can now be reached from external IPv6 addresses.
   737  
   738  **2**:
   739  
   740  Built using Go 1.20, the last version that will run on
   741  Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
   742  Sierra, 10.14 Mojave.
   743  
   744  #### 1.6.0-rc.4
   745  
   746  * Fixes and improvements
   747  
   748  #### 1.6.0-rc.1
   749  
   750  * Add legacy builds for old Windows and macOS systems **1**
   751  * Fixes and improvements
   752  
   753  **1**:
   754  
   755  Built using Go 1.20, the last version that will run on
   756  Windows 7, 8, Server 2008, Server 2012 and macOS 10.13 High
   757  Sierra, 10.14 Mojave.
   758  
   759  #### 1.6.0-beta.4
   760  
   761  * Fix IPv6 `auto_route` for Linux **1**
   762  * Fixes and improvements
   763  
   764  **1**:
   765  
   766  When `auto_route` is enabled and `strict_route` is disabled, the device can now be reached from external IPv6 addresses.
   767  
   768  #### 1.5.4
   769  
   770  * Fix Clash cache crash on arm32 devices
   771  * Fixes and improvements
   772  
   773  #### 1.6.0-beta.3
   774  
   775  * Update the legacy Hysteria protocol **1**
   776  * Fixes and improvements
   777  
   778  **1**
   779  
   780  Based on discussions with the original author, the brutal CC and QUIC protocol parameters of
   781  the old protocol (Hysteria 1) have been updated to be consistent with Hysteria 2
   782  
   783  #### 1.6.0-beta.2
   784  
   785  * Add TLS self sign key pair generate command
   786  * Update brutal congestion control for Hysteria2
   787  * Fix Clash cache crash on arm32 devices
   788  * Update golang.org/x/net to v0.17.0
   789  * Fixes and improvements
   790  
   791  #### 1.6.0-beta.3
   792  
   793  * Update the legacy Hysteria protocol **1**
   794  * Fixes and improvements
   795  
   796  **1**
   797  
   798  Based on discussions with the original author, the brutal CC and QUIC protocol parameters of
   799  the old protocol (Hysteria 1) have been updated to be consistent with Hysteria 2
   800  
   801  #### 1.6.0-beta.2
   802  
   803  * Add TLS self sign key pair generate command
   804  * Update brutal congestion control for Hysteria2
   805  * Fix Clash cache crash on arm32 devices
   806  * Update golang.org/x/net to v0.17.0
   807  * Fixes and improvements
   808  
   809  #### 1.5.3
   810  
   811  * Fix compatibility with Android 14
   812  * Fixes and improvements
   813  
   814  #### 1.6.0-beta.1
   815  
   816  * Fixes and improvements
   817  
   818  #### 1.6.0-alpha.5
   819  
   820  * Fix compatibility with Android 14
   821  * Update BBR congestion control for TUIC and Hysteria2 **1**
   822  * Fixes and improvements
   823  
   824  **1**:
   825  
   826  None of the existing Golang BBR congestion control implementations have been reviewed or unit tested.
   827  This update is intended to fix a memory leak flaw in the new implementation introduced in 1.6.0-alpha.1 and may
   828  introduce new issues.
   829  
   830  #### 1.6.0-alpha.4
   831  
   832  * Add `brutal_debug` option for Hysteria2
   833  * Fixes and improvements
   834  
   835  #### 1.5.2
   836  
   837  * Our [Apple tvOS client](/installation/clients/sft/) is now available in the App Store 🍎
   838  * Fixes and improvements
   839  
   840  #### 1.6.0-alpha.3
   841  
   842  * Fixes and improvements
   843  
   844  #### 1.6.0-alpha.2
   845  
   846  * Fixes and improvements
   847  
   848  #### 1.5.1
   849  
   850  * Fixes and improvements
   851  
   852  #### 1.6.0-alpha.1
   853  
   854  * Update BBR congestion control for TUIC and Hysteria2 **1**
   855  * Update quic-go to v0.39.0
   856  * Update gVisor to 20230814.0
   857  * Remove [Deprecated Features](/deprecated/) by agreement
   858  * Fixes and improvements
   859  
   860  **1**:
   861  
   862  None of the existing Golang BBR congestion control implementations have been reviewed or unit tested.
   863  This update is intended to address the multi-send defects of the old implementation and may introduce new issues.
   864  
   865  #### 1.5.0
   866  
   867  * Fixes and improvements
   868  
   869  Important changes since 1.4:
   870  
   871  * Add TLS [ECH server](/configuration/shared/tls/) support
   872  * Improve TLS TCH client configuration
   873  * Add TLS ECH key pair generator **1**
   874  * Add TLS ECH support for QUIC based protocols **2**
   875  * Add KDE support for the `set_system_proxy` option in HTTP inbound
   876  * Add Hysteria2 protocol support **3**
   877  * Add `interrupt_exist_connections` option for `Selector` and `URLTest` outbounds **4**
   878  * Add DNS01 challenge support for ACME TLS certificate issuer **5**
   879  * Add `merge` command **6**
   880  * Mark [Deprecated Features](/deprecated/)
   881  
   882  **1**:
   883  
   884  Command: `sing-box generate ech-keypair <plain_server_name> [--pq-signature-schemes-enabled]`
   885  
   886  **2**:
   887  
   888  All inbounds and outbounds are supported, including `Naiveproxy`, `Hysteria[/2]`, `TUIC` and `V2ray QUIC transport`.
   889  
   890  **3**:
   891  
   892  See [Hysteria2 inbound](/configuration/inbound/hysteria2/) and [Hysteria2 outbound](/configuration/outbound/hysteria2/)
   893  
   894  For protocol description, please refer to [https://v2.hysteria.network](https://v2.hysteria.network)
   895  
   896  **4**:
   897  
   898  Interrupt existing connections when the selected outbound has changed.
   899  
   900  Only inbound connections are affected by this setting, internal connections will always be interrupted.
   901  
   902  **5**:
   903  
   904  Only `Alibaba Cloud DNS` and `Cloudflare` are supported, see [ACME Fields](/configuration/shared/tls#acme-fields)
   905  and [DNS01 Challenge Fields](/configuration/shared/dns01_challenge/).
   906  
   907  **6**:
   908  
   909  This command also parses path resources that appear in the configuration file and replaces them with embedded
   910  configuration, such as TLS certificates or SSH private keys.
   911  
   912  #### 1.5.0-rc.6
   913  
   914  * Fixes and improvements
   915  
   916  #### 1.4.6
   917  
   918  * Fixes and improvements
   919  
   920  #### 1.5.0-rc.5
   921  
   922  * Fixed an improper authentication vulnerability in the SOCKS5 inbound
   923  * Fixes and improvements
   924  
   925  **Security Advisory**
   926  
   927  This update fixes an improper authentication vulnerability in the sing-box SOCKS inbound. This vulnerability allows an
   928  attacker to craft special requests to bypass user authentication. All users exposing SOCKS servers with user
   929  authentication in an insecure environment are advised to update immediately.
   930  
   931  此更新修复了 sing-box SOCKS 入站中的一个不正确身份验证漏洞。 该漏洞允许攻击者制作特殊请求来绕过用户身份验证。建议所有将使用用户认证的
   932  SOCKS 服务器暴露在不安全环境下的用户立更新。
   933  
   934  #### 1.4.5
   935  
   936  * Fixed an improper authentication vulnerability in the SOCKS5 inbound
   937  * Fixes and improvements
   938  
   939  **Security Advisory**
   940  
   941  This update fixes an improper authentication vulnerability in the sing-box SOCKS inbound. This vulnerability allows an
   942  attacker to craft special requests to bypass user authentication. All users exposing SOCKS servers with user
   943  authentication in an insecure environment are advised to update immediately.
   944  
   945  此更新修复了 sing-box SOCKS 入站中的一个不正确身份验证漏洞。 该漏洞允许攻击者制作特殊请求来绕过用户身份验证。建议所有将使用用户认证的
   946  SOCKS 服务器暴露在不安全环境下的用户立更新。
   947  
   948  #### 1.5.0-rc.3
   949  
   950  * Fixes and improvements
   951  
   952  #### 1.5.0-beta.12
   953  
   954  * Add `merge` command **1**
   955  * Fixes and improvements
   956  
   957  **1**:
   958  
   959  This command also parses path resources that appear in the configuration file and replaces them with embedded
   960  configuration, such as TLS certificates or SSH private keys.
   961  
   962  ```
   963  Merge configurations
   964  
   965  Usage:
   966    sing-box merge [output] [flags]
   967  
   968  Flags:
   969    -h, --help   help for merge
   970  
   971  Global Flags:
   972    -c, --config stringArray             set configuration file path
   973    -C, --config-directory stringArray   set configuration directory path
   974    -D, --directory string               set working directory
   975        --disable-color                  disable color output
   976  ```
   977  
   978  #### 1.5.0-beta.11
   979  
   980  * Add DNS01 challenge support for ACME TLS certificate issuer **1**
   981  * Fixes and improvements
   982  
   983  **1**:
   984  
   985  Only `Alibaba Cloud DNS` and `Cloudflare` are supported,
   986  see [ACME Fields](/configuration/shared/tls#acme-fields)
   987  and [DNS01 Challenge Fields](/configuration/shared/dns01_challenge/).
   988  
   989  #### 1.5.0-beta.10
   990  
   991  * Add `interrupt_exist_connections` option for `Selector` and `URLTest` outbounds **1**
   992  * Fixes and improvements
   993  
   994  **1**:
   995  
   996  Interrupt existing connections when the selected outbound has changed.
   997  
   998  Only inbound connections are affected by this setting, internal connections will always be interrupted.
   999  
  1000  #### 1.4.3
  1001  
  1002  * Fixes and improvements
  1003  
  1004  #### 1.5.0-beta.8
  1005  
  1006  * Fixes and improvements
  1007  
  1008  #### 1.4.2
  1009  
  1010  * Fixes and improvements
  1011  
  1012  #### 1.5.0-beta.6
  1013  
  1014  * Fix compatibility issues with official Hysteria2 server and client
  1015  * Fixes and improvements
  1016  * Mark [deprecated features](/deprecated/)
  1017  
  1018  #### 1.5.0-beta.3
  1019  
  1020  * Fixes and improvements
  1021  * Updated Hysteria2 documentation **1**
  1022  
  1023  **1**:
  1024  
  1025  Added notes indicating compatibility issues with the official
  1026  Hysteria2 server and client when using `fastOpen=false` or UDP MTU >= 1200.
  1027  
  1028  #### 1.5.0-beta.2
  1029  
  1030  * Add hysteria2 protocol support **1**
  1031  * Fixes and improvements
  1032  
  1033  **1**:
  1034  
  1035  See [Hysteria2 inbound](/configuration/inbound/hysteria2/) and [Hysteria2 outbound](/configuration/outbound/hysteria2/)
  1036  
  1037  For protocol description, please refer to [https://v2.hysteria.network](https://v2.hysteria.network)
  1038  
  1039  #### 1.5.0-beta.1
  1040  
  1041  * Add TLS [ECH server](/configuration/shared/tls/) support
  1042  * Improve TLS TCH client configuration
  1043  * Add TLS ECH key pair generator **1**
  1044  * Add TLS ECH support for QUIC based protocols **2**
  1045  * Add KDE support for the `set_system_proxy` option in HTTP inbound
  1046  
  1047  **1**:
  1048  
  1049  Command: `sing-box generate ech-keypair <plain_server_name> [--pq-signature-schemes-enabled]`
  1050  
  1051  **2**:
  1052  
  1053  All inbounds and outbounds are supported, including `Naiveproxy`, `Hysteria`, `TUIC` and `V2ray QUIC transport`.
  1054  
  1055  #### 1.4.1
  1056  
  1057  * Fixes and improvements
  1058  
  1059  #### 1.4.0
  1060  
  1061  * Fix bugs and update dependencies
  1062  
  1063  Important changes since 1.3:
  1064  
  1065  * Add TUIC support **1**
  1066  * Add `udp_over_stream` option for TUIC client **2**
  1067  * Add MultiPath TCP support **3**
  1068  * Add `include_interface` and `exclude_interface` options for tun inbound
  1069  * Pause recurring tasks when no network or device idle
  1070  * Improve Android and Apple platform clients
  1071  
  1072  *1*:
  1073  
  1074  See [TUIC inbound](/configuration/inbound/tuic/)
  1075  and [TUIC outbound](/configuration/outbound/tuic/)
  1076  
  1077  **2**:
  1078  
  1079  This is the TUIC port of the [UDP over TCP protocol](/configuration/shared/udp-over-tcp/), designed to provide a QUIC
  1080  stream based UDP relay mode that TUIC does not provide. Since it is an add-on protocol, you will need to use sing-box or
  1081  another program compatible with the protocol as a server.
  1082  
  1083  This mode has no positive effect in a proper UDP proxy scenario and should only be applied to relay streaming UDP
  1084  traffic (basically QUIC streams).
  1085  
  1086  *3*:
  1087  
  1088  Requires sing-box to be compiled with Go 1.21.
  1089  
  1090  #### 1.4.0-rc.3
  1091  
  1092  * Fixes and improvements
  1093  
  1094  #### 1.4.0-rc.2
  1095  
  1096  * Fixes and improvements
  1097  
  1098  #### 1.4.0-rc.1
  1099  
  1100  * Fix TUIC UDP
  1101  
  1102  #### 1.4.0-beta.6
  1103  
  1104  * Add `udp_over_stream` option for TUIC client **1**
  1105  * Add `include_interface` and `exclude_interface` options for tun inbound
  1106  * Fixes and improvements
  1107  
  1108  **1**:
  1109  
  1110  This is the TUIC port of the [UDP over TCP protocol](/configuration/shared/udp-over-tcp/), designed to provide a QUIC
  1111  stream based UDP relay mode that TUIC does not provide. Since it is an add-on protocol, you will need to use sing-box or
  1112  another program compatible with the protocol as a server.
  1113  
  1114  This mode has no positive effect in a proper UDP proxy scenario and should only be applied to relay streaming UDP
  1115  traffic (basically QUIC streams).
  1116  
  1117  #### 1.4.0-beta.5
  1118  
  1119  * Fixes and improvements
  1120  
  1121  #### 1.4.0-beta.4
  1122  
  1123  * Graphical clients: Persistence group expansion state
  1124  * Fixes and improvements
  1125  
  1126  #### 1.4.0-beta.3
  1127  
  1128  * Fixes and improvements
  1129  
  1130  #### 1.4.0-beta.2
  1131  
  1132  * Add MultiPath TCP support **1**
  1133  * Drop QUIC support for Go 1.18 and 1.19 due to upstream changes
  1134  * Fixes and improvements
  1135  
  1136  *1*:
  1137  
  1138  Requires sing-box to be compiled with Go 1.21.
  1139  
  1140  #### 1.4.0-beta.1
  1141  
  1142  * Add TUIC support **1**
  1143  * Pause recurring tasks when no network or device idle
  1144  * Fixes and improvements
  1145  
  1146  *1*:
  1147  
  1148  See [TUIC inbound](/configuration/inbound/tuic/)
  1149  and [TUIC outbound](/configuration/outbound/tuic/)
  1150  
  1151  #### 1.3.6
  1152  
  1153  * Fixes and improvements
  1154  
  1155  #### 1.3.5
  1156  
  1157  * Fixes and improvements
  1158  * Introducing our [Apple tvOS](/installation/clients/sft/) client applications **1**
  1159  * Add per app proxy and app installed/updated trigger support for Android client
  1160  * Add profile sharing support for Android/iOS/macOS clients
  1161  
  1162  **1**:
  1163  
  1164  Due to the requirement of tvOS 17, the app cannot be submitted to the App Store for the time being, and can only be
  1165  downloaded through TestFlight.
  1166  
  1167  #### 1.3.4
  1168  
  1169  * Fixes and improvements
  1170  * We're now on the [App Store](https://apps.apple.com/us/app/sing-box/id6451272673), always free! It should be noted
  1171    that due to stricter and slower review, the release of Store versions will be delayed.
  1172  * We've made a standalone version of the macOS client (the original Application Extension relies on App Store
  1173    distribution), which you can download as SFM-version-universal.zip in the release artifacts.
  1174  
  1175  #### 1.3.3
  1176  
  1177  * Fixes and improvements
  1178  
  1179  #### 1.3.1-rc.1
  1180  
  1181  * Fix bugs and update dependencies
  1182  
  1183  #### 1.3.1-beta.3
  1184  
  1185  * Introducing our [new iOS](/installation/clients/sfi/) and [macOS](/installation/clients/sfm/) client applications **1
  1186    **
  1187  * Fixes and improvements
  1188  
  1189  **1**:
  1190  
  1191  The old testflight link and app are no longer valid.
  1192  
  1193  #### 1.3.1-beta.2
  1194  
  1195  * Fix bugs and update dependencies
  1196  
  1197  #### 1.3.1-beta.1
  1198  
  1199  * Fixes and improvements
  1200  
  1201  #### 1.3.0
  1202  
  1203  * Fix bugs and update dependencies
  1204  
  1205  Important changes since 1.2:
  1206  
  1207  * Add [FakeIP](/configuration/dns/fakeip/) support **1**
  1208  * Improve multiplex **2**
  1209  * Add [DNS reverse mapping](/configuration/dns#reverse_mapping) support
  1210  * Add `rewrite_ttl` DNS rule action
  1211  * Add `store_fakeip` Clash API option
  1212  * Add multi-peer support for [WireGuard](/configuration/outbound/wireguard#peers) outbound
  1213  * Add loopback detect
  1214  * Add Clash.Meta API compatibility for Clash API
  1215  * Download Yacd-meta by default if the specified Clash `external_ui` directory is empty
  1216  * Add path and headers option for HTTP outbound
  1217  * Perform URLTest recheck after network changes
  1218  * Fix `system` tun stack for ios
  1219  * Fix network monitor for android/ios
  1220  * Update VLESS and XUDP protocol
  1221  * Make splice work with traffic statistics systems like Clash API
  1222  * Significantly reduces memory usage of idle connections
  1223  * Improve DNS caching
  1224  * Add `independent_cache` [option](/configuration/dns#independent_cache) for DNS
  1225  * Reimplemented shadowsocks client
  1226  * Add multiplex support for VLESS outbound
  1227  * Automatically add Windows firewall rules in order for the system tun stack to work
  1228  * Fix TLS 1.2 support for shadow-tls client
  1229  * Add `cache_id` [option](/configuration/experimental#cache_id) for Clash cache file
  1230  * Fix `local` DNS transport for Android
  1231  
  1232  *1*:
  1233  
  1234  See [FAQ](/faq/fakeip/) for more information.
  1235  
  1236  *2*:
  1237  
  1238  Added new `h2mux` multiplex protocol and `padding` multiplex option, see [Multiplex](/configuration/shared/multiplex/).
  1239  
  1240  #### 1.3-rc2
  1241  
  1242  * Fix `local` DNS transport for Android
  1243  * Fix bugs and update dependencies
  1244  
  1245  #### 1.3-rc1
  1246  
  1247  * Fix bugs and update dependencies
  1248  
  1249  #### 1.3-beta14
  1250  
  1251  * Fixes and improvements
  1252  
  1253  #### 1.3-beta13
  1254  
  1255  * Fix resolving fakeip domains  **1**
  1256  * Deprecate L3 routing
  1257  * Fix bugs and update dependencies
  1258  
  1259  **1**:
  1260  
  1261  If the destination address of the connection is obtained from fakeip, dns rules with server type fakeip will be skipped.
  1262  
  1263  #### 1.3-beta12
  1264  
  1265  * Automatically add Windows firewall rules in order for the system tun stack to work
  1266  * Fix TLS 1.2 support for shadow-tls client
  1267  * Add `cache_id` [option](/configuration/experimental#cache_id) for Clash cache file
  1268  * Fixes and improvements
  1269  
  1270  #### 1.3-beta11
  1271  
  1272  * Fix bugs and update dependencies
  1273  
  1274  #### 1.3-beta10
  1275  
  1276  * Improve direct copy **1**
  1277  * Improve DNS caching
  1278  * Add `independent_cache` [option](/configuration/dns#independent_cache) for DNS
  1279  * Reimplemented shadowsocks client **2**
  1280  * Add multiplex support for VLESS outbound
  1281  * Set TCP keepalive for WireGuard gVisor TCP connections
  1282  * Fixes and improvements
  1283  
  1284  **1**:
  1285  
  1286  * Make splice work with traffic statistics systems like Clash API
  1287  * Significantly reduces memory usage of idle connections
  1288  
  1289  **2**:
  1290  
  1291  Improved performance and reduced memory usage.
  1292  
  1293  #### 1.3-beta9
  1294  
  1295  * Improve multiplex **1**
  1296  * Fixes and improvements
  1297  
  1298  *1*:
  1299  
  1300  Added new `h2mux` multiplex protocol and `padding` multiplex option, see [Multiplex](/configuration/shared/multiplex/).
  1301  
  1302  #### 1.2.6
  1303  
  1304  * Fix bugs and update dependencies
  1305  
  1306  #### 1.3-beta8
  1307  
  1308  * Fix `system` tun stack for ios
  1309  * Fix network monitor for android/ios
  1310  * Update VLESS and XUDP protocol **1**
  1311  * Fixes and improvements
  1312  
  1313  *1:
  1314  
  1315  This is an incompatible update for XUDP in VLESS if vision flow is enabled.
  1316  
  1317  #### 1.3-beta7
  1318  
  1319  * Add `path` and `headers` options for HTTP outbound
  1320  * Add multi-user support for Shadowsocks legacy AEAD inbound
  1321  * Fixes and improvements
  1322  
  1323  #### 1.2.4
  1324  
  1325  * Fixes and improvements
  1326  
  1327  #### 1.3-beta6
  1328  
  1329  * Fix WireGuard reconnect
  1330  * Perform URLTest recheck after network changes
  1331  * Fix bugs and update dependencies
  1332  
  1333  #### 1.3-beta5
  1334  
  1335  * Add Clash.Meta API compatibility for Clash API
  1336  * Download Yacd-meta by default if the specified Clash `external_ui` directory is empty
  1337  * Add path and headers option for HTTP outbound
  1338  * Fixes and improvements
  1339  
  1340  #### 1.3-beta4
  1341  
  1342  * Fix bugs
  1343  
  1344  #### 1.3-beta2
  1345  
  1346  * Download clash-dashboard if the specified Clash `external_ui` directory is empty
  1347  * Fix bugs and update dependencies
  1348  
  1349  #### 1.3-beta1
  1350  
  1351  * Add [DNS reverse mapping](/configuration/dns#reverse_mapping) support
  1352  * Add [L3 routing](/configuration/route/ip-rule/) support **1**
  1353  * Add `rewrite_ttl` DNS rule action
  1354  * Add [FakeIP](/configuration/dns/fakeip/) support **2**
  1355  * Add `store_fakeip` Clash API option
  1356  * Add multi-peer support for [WireGuard](/configuration/outbound/wireguard#peers) outbound
  1357  * Add loopback detect
  1358  
  1359  *1*:
  1360  
  1361  It can currently be used to [route connections directly to WireGuard](/examples/wireguard-direct/) or block connections
  1362  at the IP layer.
  1363  
  1364  *2*:
  1365  
  1366  See [FAQ](/faq/fakeip/) for more information.
  1367  
  1368  #### 1.2.3
  1369  
  1370  * Introducing our [new Android client application](/installation/clients/sfa/)
  1371  * Improve UDP domain destination NAT
  1372  * Update reality protocol
  1373  * Fix TTL calculation for DNS response
  1374  * Fix v2ray HTTP transport compatibility
  1375  * Fix bugs and update dependencies
  1376  
  1377  #### 1.2.2
  1378  
  1379  * Accept `any` outbound in dns rule **1**
  1380  * Fix bugs and update dependencies
  1381  
  1382  *1*:
  1383  
  1384  Now you can use the `any` outbound rule to match server address queries instead of filling in all server domains
  1385  to `domain` rule.
  1386  
  1387  #### 1.2.1
  1388  
  1389  * Fix missing default host in v2ray http transport`s request
  1390  * Flush DNS cache for macOS when tun start/close
  1391  * Fix tun's DNS hijacking compatibility with systemd-resolved
  1392  
  1393  #### 1.2.0
  1394  
  1395  * Fix bugs and update dependencies
  1396  
  1397  Important changes since 1.1:
  1398  
  1399  * Introducing our [new iOS client application](/installation/clients/sfi/)
  1400  * Introducing [UDP over TCP protocol version 2](/configuration/shared/udp-over-tcp/)
  1401  * Add [platform options](/configuration/inbound/tun#platform) for tun inbound
  1402  * Add [ShadowTLS protocol v3](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-v3-en.md)
  1403  * Add [VLESS server](/configuration/inbound/vless/) and [vision](/configuration/outbound/vless#flow) support
  1404  * Add [reality TLS](/configuration/shared/tls/) support
  1405  * Add [NTP service](/configuration/ntp/)
  1406  * Add [DHCP DNS server](/configuration/dns/server/) support
  1407  * Add SSH [host key validation](/configuration/outbound/ssh/) support
  1408  * Add [query_type](/configuration/dns/rule/) DNS rule item
  1409  * Add fallback support for v2ray transport
  1410  * Add custom TLS server support for http based v2ray transports
  1411  * Add health check support for http-based v2ray transports
  1412  * Add multiple configuration support
  1413  
  1414  #### 1.2-rc1
  1415  
  1416  * Fix bugs and update dependencies
  1417  
  1418  #### 1.2-beta10
  1419  
  1420  * Add multiple configuration support **1**
  1421  * Fix bugs and update dependencies
  1422  
  1423  *1*:
  1424  
  1425  Now you can pass the parameter `--config` or `-c` multiple times, or use the new parameter `--config-directory` or `-C`
  1426  to load all configuration files in a directory.
  1427  
  1428  Loaded configuration files are sorted by name. If you want to control the merge order, add a numeric prefix to the file
  1429  name.
  1430  
  1431  #### 1.1.7
  1432  
  1433  * Improve the stability of the VMESS server
  1434  * Fix `auto_detect_interface` incorrectly identifying the default interface on Windows
  1435  * Fix bugs and update dependencies
  1436  
  1437  #### 1.2-beta9
  1438  
  1439  * Introducing the [UDP over TCP protocol version 2](/configuration/shared/udp-over-tcp/)
  1440  * Add health check support for http-based v2ray transports
  1441  * Remove length limit on short_id for reality TLS config
  1442  * Fix bugs and update dependencies
  1443  
  1444  #### 1.2-beta8
  1445  
  1446  * Update reality and uTLS libraries
  1447  * Fix `auto_detect_interface` incorrectly identifying the default interface on Windows
  1448  
  1449  #### 1.2-beta7
  1450  
  1451  * Fix the compatibility issue between VLESS's vision sub-protocol and the Xray-core client
  1452  * Improve the stability of the VMESS server
  1453  
  1454  #### 1.2-beta6
  1455  
  1456  * Introducing our [new iOS client application](/installation/clients/sfi/)
  1457  * Add [platform options](/configuration/inbound/tun#platform) for tun inbound
  1458  * Add custom TLS server support for http based v2ray transports
  1459  * Add generate commands
  1460  * Enable XUDP by default in VLESS
  1461  * Update reality server
  1462  * Update vision protocol
  1463  * Fixed [user flow in vless server](/configuration/inbound/vless#usersflow)
  1464  * Bug fixes
  1465  * Update dependencies
  1466  
  1467  #### 1.2-beta5
  1468  
  1469  * Add [VLESS server](/configuration/inbound/vless/) and [vision](/configuration/outbound/vless#flow) support
  1470  * Add [reality TLS](/configuration/shared/tls/) support
  1471  * Fix match private address
  1472  
  1473  #### 1.1.6
  1474  
  1475  * Improve vmess request
  1476  * Fix ipv6 redirect on Linux
  1477  * Fix match geoip private
  1478  * Fix parse hysteria UDP message
  1479  * Fix socks connect response
  1480  * Disable vmess header protection if transport enabled
  1481  * Update QUIC v2 version number and initial salt
  1482  
  1483  #### 1.2-beta4
  1484  
  1485  * Add [NTP service](/configuration/ntp/)
  1486  * Add Add multiple server names and multi-user support for shadowtls
  1487  * Add strict mode support for shadowtls v3
  1488  * Add uTLS support for shadowtls v3
  1489  
  1490  #### 1.2-beta3
  1491  
  1492  * Update QUIC v2 version number and initial salt
  1493  * Fix shadowtls v3 implementation
  1494  
  1495  #### 1.2-beta2
  1496  
  1497  * Add [ShadowTLS protocol v3](https://github.com/ihciah/shadow-tls/blob/master/docs/protocol-v3-en.md)
  1498  * Add fallback support for v2ray transport
  1499  * Fix parse hysteria UDP message
  1500  * Fix socks connect response
  1501  * Disable vmess header protection if transport enabled
  1502  
  1503  #### 1.2-beta1
  1504  
  1505  * Add [DHCP DNS server](/configuration/dns/server/) support
  1506  * Add SSH [host key validation](/configuration/outbound/ssh/) support
  1507  * Add [query_type](/configuration/dns/rule/) DNS rule item
  1508  * Add v2ray [user stats](/configuration/experimental#statsusers) api
  1509  * Add new clash DNS query api
  1510  * Improve vmess request
  1511  * Fix ipv6 redirect on Linux
  1512  * Fix match geoip private
  1513  
  1514  #### 1.1.5
  1515  
  1516  * Add Go 1.20 support
  1517  * Fix inbound default DF value
  1518  * Fix auth_user route for naive inbound
  1519  * Fix gRPC lite header
  1520  * Ignore domain case in route rules
  1521  
  1522  #### 1.1.4
  1523  
  1524  * Fix DNS log
  1525  * Fix write to h2 conn after closed
  1526  * Fix create UDP DNS transport from plain IPv6 address
  1527  
  1528  #### 1.1.2
  1529  
  1530  * Fix http proxy auth
  1531  * Fix user from stream packet conn
  1532  * Fix DNS response TTL
  1533  * Fix override packet conn
  1534  * Skip override system proxy bypass list
  1535  * Improve DNS log
  1536  
  1537  #### 1.1.1
  1538  
  1539  * Fix acme config
  1540  * Fix vmess packet conn
  1541  * Suppress quic-go set DF error
  1542  
  1543  #### 1.1
  1544  
  1545  * Fix close clash cache
  1546  
  1547  Important changes since 1.0:
  1548  
  1549  * Add support for use with android VPNService
  1550  * Add tun support for WireGuard outbound
  1551  * Add system tun stack
  1552  * Add comment filter for config
  1553  * Add option for allow optional proxy protocol header
  1554  * Add Clash mode and persistence support
  1555  * Add TLS ECH and uTLS support for outbound TLS options
  1556  * Add internal simple-obfs and v2ray-plugin
  1557  * Add ShadowsocksR outbound
  1558  * Add VLESS outbound and XUDP
  1559  * Skip wait for hysteria tcp handshake response
  1560  * Add v2ray mux support for all inbound
  1561  * Add XUDP support for VMess
  1562  * Improve websocket writer
  1563  * Refine tproxy write back
  1564  * Fix DNS leak caused by
  1565    Windows' ordinary multihomed DNS resolution behavior
  1566  * Add sniff_timeout listen option
  1567  * Add custom route support for tun
  1568  * Add option for custom wireguard reserved bytes
  1569  * Split bind_address into ipv4 and ipv6
  1570  * Add ShadowTLS v1 and v2 support
  1571  
  1572  #### 1.1-rc1
  1573  
  1574  * Fix TLS config for h2 server
  1575  * Fix crash when input bad method in shadowsocks multi-user inbound
  1576  * Fix listen UDP
  1577  * Fix check invalid packet on macOS
  1578  
  1579  #### 1.1-beta18
  1580  
  1581  * Enhance defense against active probe for shadowtls server **1**
  1582  
  1583  **1**:
  1584  
  1585  The `fallback_after` option has been removed.
  1586  
  1587  #### 1.1-beta17
  1588  
  1589  * Fix shadowtls server **1**
  1590  
  1591  *1*:
  1592  
  1593  Added [fallback_after](/configuration/inbound/shadowtls#fallback_after) option.
  1594  
  1595  #### 1.0.7
  1596  
  1597  * Add support for new x/h2 deadline
  1598  * Fix copy pipe
  1599  * Fix decrypt xplus packet
  1600  * Fix macOS Ventura process name match
  1601  * Fix smux keepalive
  1602  * Fix vmess request buffer
  1603  * Fix h2c transport
  1604  * Fix tor geoip
  1605  * Fix udp connect for mux client
  1606  * Fix default dns transport strategy
  1607  
  1608  #### 1.1-beta16
  1609  
  1610  * Improve shadowtls server
  1611  * Fix default dns transport strategy
  1612  * Update uTLS to v1.2.0
  1613  
  1614  #### 1.1-beta15
  1615  
  1616  * Add support for new x/h2 deadline
  1617  * Fix udp connect for mux client
  1618  * Fix dns buffer
  1619  * Fix quic dns retry
  1620  * Fix create TLS config
  1621  * Fix websocket alpn
  1622  * Fix tor geoip
  1623  
  1624  #### 1.1-beta14
  1625  
  1626  * Add multi-user support for hysteria inbound **1**
  1627  * Add custom tls client support for std grpc
  1628  * Fix smux keep alive
  1629  * Fix vmess request buffer
  1630  * Fix default local DNS server behavior
  1631  * Fix h2c transport
  1632  
  1633  *1*:
  1634  
  1635  The `auth` and `auth_str` fields have been replaced by the `users` field.
  1636  
  1637  #### 1.1-beta13
  1638  
  1639  * Add custom worker count option for WireGuard outbound
  1640  * Split bind_address into ipv4 and ipv6
  1641  * Move WFP manipulation to strict route
  1642  * Fix WireGuard outbound panic when close
  1643  * Fix macOS Ventura process name match
  1644  * Fix QUIC connection migration by @HyNetwork
  1645  * Fix handling QUIC client SNI by @HyNetwork
  1646  
  1647  #### 1.1-beta12
  1648  
  1649  * Fix uTLS config
  1650  * Update quic-go to v0.30.0
  1651  * Update cloudflare-tls to go1.18.7
  1652  
  1653  #### 1.1-beta11
  1654  
  1655  * Add option for custom wireguard reserved bytes
  1656  * Fix shadowtls v2
  1657  * Fix h3 dns transport
  1658  * Fix copy pipe
  1659  * Fix decrypt xplus packet
  1660  * Fix v2ray api
  1661  * Suppress no network error
  1662  * Improve local dns transport
  1663  
  1664  #### 1.1-beta10
  1665  
  1666  * Add [sniff_timeout](/configuration/shared/listen#sniff_timeout) listen option
  1667  * Add [custom route](/configuration/inbound/tun#inet4_route_address) support for tun **1**
  1668  * Fix interface monitor
  1669  * Fix websocket headroom
  1670  * Fix uTLS handshake
  1671  * Fix ssh outbound
  1672  * Fix sniff fragmented quic client hello
  1673  * Fix DF for hysteria
  1674  * Fix naive overflow
  1675  * Check destination before udp connect
  1676  * Update uTLS to v1.1.5
  1677  * Update tfo-go to v2.0.2
  1678  * Update fsnotify to v1.6.0
  1679  * Update grpc to v1.50.1
  1680  
  1681  *1*:
  1682  
  1683  The `strict_route` on windows is removed.
  1684  
  1685  #### 1.0.6
  1686  
  1687  * Fix ssh outbound
  1688  * Fix sniff fragmented quic client hello
  1689  * Fix naive overflow
  1690  * Check destination before udp connect
  1691  
  1692  #### 1.1-beta9
  1693  
  1694  * Fix windows route **1**
  1695  * Add [v2ray statistics api](/configuration/experimental#v2ray-api-fields)
  1696  * Add ShadowTLS v2 support **2**
  1697  * Fixes and improvements
  1698  
  1699  **1**:
  1700  
  1701  * Fix DNS leak caused by
  1702    Windows' [ordinary multihomed DNS resolution behavior](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552%28v%3Dws.10%29)
  1703  * Flush Windows DNS cache when start/close
  1704  
  1705  **2**:
  1706  
  1707  See [ShadowTLS inbound](/configuration/inbound/shadowtls#version)
  1708  and [ShadowTLS outbound](/configuration/outbound/shadowtls#version)
  1709  
  1710  #### 1.1-beta8
  1711  
  1712  * Fix leaks on close
  1713  * Improve websocket writer
  1714  * Refine tproxy write back
  1715  * Refine 4in6 processing
  1716  * Fix shadowsocks plugins
  1717  * Fix missing source address from transport connection
  1718  * Fix fqdn socks5 outbound connection
  1719  * Fix read source address from grpc-go
  1720  
  1721  #### 1.0.5
  1722  
  1723  * Fix missing source address from transport connection
  1724  * Fix fqdn socks5 outbound connection
  1725  * Fix read source address from grpc-go
  1726  
  1727  #### 1.1-beta7
  1728  
  1729  * Add v2ray mux and XUDP support for VMess inbound
  1730  * Add XUDP support for VMess outbound
  1731  * Disable DF on direct outbound by default
  1732  * Fix bugs in 1.1-beta6
  1733  
  1734  #### 1.1-beta6
  1735  
  1736  * Add [URLTest outbound](/configuration/outbound/urltest/)
  1737  * Fix bugs in 1.1-beta5
  1738  
  1739  #### 1.1-beta5
  1740  
  1741  * Print tags in version command
  1742  * Redirect clash hello to external ui
  1743  * Move shadowsocksr implementation to clash
  1744  * Make gVisor optional **1**
  1745  * Refactor to miekg/dns
  1746  * Refactor bind control
  1747  * Fix build on go1.18
  1748  * Fix clash store-selected
  1749  * Fix close grpc conn
  1750  * Fix port rule match logic
  1751  * Fix clash api proxy type
  1752  
  1753  *1*:
  1754  
  1755  The build tag `no_gvisor` is replaced by `with_gvisor`.
  1756  
  1757  The default tun stack is changed to system.
  1758  
  1759  #### 1.0.4
  1760  
  1761  * Fix close grpc conn
  1762  * Fix port rule match logic
  1763  * Fix clash api proxy type
  1764  
  1765  #### 1.1-beta4
  1766  
  1767  * Add internal simple-obfs and v2ray-plugin [Shadowsocks plugins](/configuration/outbound/shadowsocks#plugin)
  1768  * Add [ShadowsocksR outbound](/configuration/outbound/shadowsocksr/)
  1769  * Add [VLESS outbound and XUDP](/configuration/outbound/vless/)
  1770  * Skip wait for hysteria tcp handshake response
  1771  * Fix socks4 client
  1772  * Fix hysteria inbound
  1773  * Fix concurrent write
  1774  
  1775  #### 1.0.3
  1776  
  1777  * Fix socks4 client
  1778  * Fix hysteria inbound
  1779  * Fix concurrent write
  1780  
  1781  #### 1.1-beta3
  1782  
  1783  * Fix using custom TLS client in http2 client
  1784  * Fix bugs in 1.1-beta2
  1785  
  1786  #### 1.1-beta2
  1787  
  1788  * Add Clash mode and persistence support **1**
  1789  * Add TLS ECH and uTLS support for outbound TLS options **2**
  1790  * Fix socks4 request
  1791  * Fix processing empty dns result
  1792  
  1793  *1*:
  1794  
  1795  Switching modes using the Clash API, and `store-selected` are now supported,
  1796  see [Experimental](/configuration/experimental/).
  1797  
  1798  *2*:
  1799  
  1800  ECH (Encrypted Client Hello) is a TLS extension that allows a client to encrypt the first part of its ClientHello
  1801  message, see [TLS#ECH](/configuration/shared/tls#ech).
  1802  
  1803  uTLS is a fork of "crypto/tls", which provides ClientHello fingerprinting resistance,
  1804  see [TLS#uTLS](/configuration/shared/tls#utls).
  1805  
  1806  #### 1.0.2
  1807  
  1808  * Fix socks4 request
  1809  * Fix processing empty dns result
  1810  
  1811  #### 1.1-beta1
  1812  
  1813  * Add support for use with android VPNService **1**
  1814  * Add tun support for WireGuard outbound **2**
  1815  * Add system tun stack **3**
  1816  * Add comment filter for config **4**
  1817  * Add option for allow optional proxy protocol header
  1818  * Add half close for smux
  1819  * Set UDP DF by default **5**
  1820  * Set default tun mtu to 9000
  1821  * Update gVisor to 20220905.0
  1822  
  1823  *1*:
  1824  
  1825  In previous versions, Android VPN would not work with tun enabled.
  1826  
  1827  The usage of tun over VPN and VPN over tun is now supported, see [Tun Inbound](/configuration/inbound/tun#auto_route).
  1828  
  1829  *2*:
  1830  
  1831  In previous releases, WireGuard outbound support was backed by the lower performance gVisor virtual interface.
  1832  
  1833  It achieves the same performance as wireguard-go by providing automatic system interface support.
  1834  
  1835  *3*:
  1836  
  1837  It does not depend on gVisor and has better performance in some cases.
  1838  
  1839  It is less compatible and may not be available in some environments.
  1840  
  1841  *4*:
  1842  
  1843  Annotated json configuration files are now supported.
  1844  
  1845  *5*:
  1846  
  1847  UDP fragmentation is now blocked by default.
  1848  
  1849  Including shadowsocks-libev, shadowsocks-rust and quic-go all disable segmentation by default.
  1850  
  1851  See [Dial Fields](/configuration/shared/dial#udp_fragment)
  1852  and [Listen Fields](/configuration/shared/listen#udp_fragment).
  1853  
  1854  #### 1.0.1
  1855  
  1856  * Fix match 4in6 address in ip_cidr
  1857  * Fix clash api log level format error
  1858  * Fix clash api unknown proxy type
  1859  
  1860  #### 1.0
  1861  
  1862  * Fix wireguard reconnect
  1863  * Fix naive inbound
  1864  * Fix json format error message
  1865  * Fix processing vmess termination signal
  1866  * Fix hysteria stream error
  1867  * Fix listener close when proxyproto failed
  1868  
  1869  #### 1.0-rc1
  1870  
  1871  * Fix write log timestamp
  1872  * Fix write zero
  1873  * Fix dial parallel in direct outbound
  1874  * Fix write trojan udp
  1875  * Fix DNS routing
  1876  * Add attribute support for geosite
  1877  * Update documentation for [Dial Fields](/configuration/shared/dial/)
  1878  
  1879  #### 1.0-beta3
  1880  
  1881  * Add [chained inbound](/configuration/shared/listen#detour) support
  1882  * Add process_path rule item
  1883  * Add macOS redirect support
  1884  * Add ShadowTLS [Inbound](/configuration/inbound/shadowtls/), [Outbound](/configuration/outbound/shadowtls/)
  1885    and [Examples](/examples/shadowtls/)
  1886  * Fix search android package in non-owner users
  1887  * Fix socksaddr type condition
  1888  * Fix smux session status
  1889  * Refactor inbound and outbound documentation
  1890  * Minor fixes
  1891  
  1892  #### 1.0-beta2
  1893  
  1894  * Add strict_route option for [Tun inbound](/configuration/inbound/tun#strict_route)
  1895  * Add packetaddr support for [VMess outbound](/configuration/outbound/vmess#packet_addr)
  1896  * Add better performing alternative gRPC implementation
  1897  * Add [docker image](https://github.com/SagerNet/sing-box/pkgs/container/sing-box)
  1898  * Fix sniff override destination
  1899  
  1900  #### 1.0-beta1
  1901  
  1902  * Initial release
  1903  
  1904  ##### 2022/08/26
  1905  
  1906  * Fix ipv6 route on linux
  1907  * Fix read DNS message
  1908  
  1909  ##### 2022/08/25
  1910  
  1911  * Let vmess use zero instead of auto if TLS enabled
  1912  * Add trojan fallback for ALPN
  1913  * Improve ip_cidr rule
  1914  * Fix format bind_address
  1915  * Fix http proxy with compressed response
  1916  * Fix route connections
  1917  
  1918  ##### 2022/08/24
  1919  
  1920  * Fix naive padding
  1921  * Fix unix search path
  1922  * Fix close non-duplex connections
  1923  * Add ACME EAB support
  1924  * Fix early close on windows and catch any
  1925  * Initial zh-CN document translation
  1926  
  1927  ##### 2022/08/23
  1928  
  1929  * Add [V2Ray Transport](/configuration/shared/v2ray-transport/) support for VMess and Trojan
  1930  * Allow plain http request in Naive inbound (It can now be used with nginx)
  1931  * Add proxy protocol support
  1932  * Free memory after start
  1933  * Parse X-Forward-For in HTTP requests
  1934  * Handle SIGHUP signal
  1935  
  1936  ##### 2022/08/22
  1937  
  1938  * Add strategy setting for each [DNS server](/configuration/dns/server/)
  1939  * Add bind address to outbound options
  1940  
  1941  ##### 2022/08/21
  1942  
  1943  * Add [Tor outbound](/configuration/outbound/tor/)
  1944  * Add [SSH outbound](/configuration/outbound/ssh/)
  1945  
  1946  ##### 2022/08/20
  1947  
  1948  * Attempt to unwrap ip-in-fqdn socksaddr
  1949  * Fix read packages in android 12
  1950  * Fix route on some android devices
  1951  * Improve linux process searcher
  1952  * Fix write socks5 username password auth request
  1953  * Skip bind connection with private destination to interface
  1954  * Add [Trojan connection fallback](/configuration/inbound/trojan#fallback)
  1955  
  1956  ##### 2022/08/19
  1957  
  1958  * Add Hysteria [Inbound](/configuration/inbound/hysteria/) and [Outbund](/configuration/outbound/hysteria/)
  1959  * Add [ACME TLS certificate issuer](/configuration/shared/tls/)
  1960  * Allow read config from stdin (-c stdin)
  1961  * Update gVisor to 20220815.0
  1962  
  1963  ##### 2022/08/18
  1964  
  1965  * Fix find process with lwip stack
  1966  * Fix crash on shadowsocks server
  1967  * Fix crash on darwin tun
  1968  * Fix write log to file
  1969  
  1970  ##### 2022/08/17
  1971  
  1972  * Improve async dns transports
  1973  
  1974  ##### 2022/08/16
  1975  
  1976  * Add ip_version (route/dns) rule item
  1977  * Add [WireGuard](/configuration/outbound/wireguard/) outbound
  1978  
  1979  ##### 2022/08/15
  1980  
  1981  * Add uid, android user and package rules support in [Tun](/configuration/inbound/tun/) routing.
  1982  
  1983  ##### 2022/08/13
  1984  
  1985  * Fix dns concurrent write
  1986  
  1987  ##### 2022/08/12
  1988  
  1989  * Performance improvements
  1990  * Add UoT option for [SOCKS](/configuration/outbound/socks/) outbound
  1991  
  1992  ##### 2022/08/11
  1993  
  1994  * Add UoT option for [Shadowsocks](/configuration/outbound/shadowsocks/) outbound, UoT support for all inbounds
  1995  
  1996  ##### 2022/08/10
  1997  
  1998  * Add full-featured [Naive](/configuration/inbound/naive/) inbound
  1999  * Fix default dns server option [#9] by iKirby
  2000  
  2001  ##### 2022/08/09
  2002  
  2003  No changelog before.
  2004  
  2005  [#9]: https://github.com/SagerNet/sing-box/pull/9