Incompatible changes:

• For security reasons, all paths appearing in the configuration file will be limited to workdir (regardless of whether they are relative or absolute). If there is a specific need, please specify additional safe paths by setting the SAFE_PATHS environment variable while ensuring safety. The syntax of this environment variable is the same as the PATH environment variable parsing rules of this operating system (i.e., semicolon-separated under Windows and colon-separated under other systems)
• In addition, support for specifying routing-mark and interface-name for proxy-groups has been removed. Please specify the relevant parameters in proxies directly.

What's Changed

• 5c40a63 feat: not inline rule-provider can also set payload as fallback rules when file/http parsing fails by @wwqgtxx
• 99aa1b0 feat: inbound support shadow-tls by @wwqgtxx
• f328203 feat: not inline proxy-provider can also set payload as fallback proxies when file/http parsing fails by @wwqgtxx

BUG & Fix

• 2b4726b fix: build on go1.24.3 golang/go#73617 by @wwqgtxx
• 2fb9331 fix: some resources are not released in listener by @wwqgtxx
• 468cfc3 fix: set sni to servername if not specified for trojan outbound (#1991) by @WeidiDeng
• 48d8efb fix: do NOT reset the quic-go internal state when only port is different by @wwqgtxx
• 52ad793 fix: shadowtls v1 not work by @wwqgtxx
• 61d6a9a fix: fetcher does not start the pull loop when local file parsing errors occur and the first remote update fails by @wwqgtxx
• 7de4af2 fix: shadowtls test by @wwqgtxx
• 86c127d fix: missing read waiter for cancelers by @wwqgtxx
• e6e7aa5 fix: alpn apply on shadowtls by @wwqgtxx
• f774276 fix: ensure wait group completes by @Larvan2
• febb602 fix: hysteria2 inbound not set UDPTimeout by @wwqgtxx

Maintenance

• 26e6d83 chore: make select display the specified testUrl for #2013 by @xishang0128
• 4ecb49b chore: dynamic fetch remoteAddr in hysteria2 service by @wwqgtxx
• 50d7834 chore: change the separator of the SAFE_PATHS environment variable to the default separator of the operating system platform (i.e., ; in Windows and : in other systems) by @wwqgtxx
• 791ea5e chore: allow setting addition safePaths by environment variable SAFE_PATHS package managers can allow for pre-defined safe paths without disabling the entire security check feature for #2004 by @wwqgtxx
• 793ce45 chore: update quic-go to 0.51.0 by @wwqgtxx
• 7e7016b chore: removed routing-mark and interface-name of the group, please set it directly on the proxy instead by @wwqgtxx
• 936df90 chore: update dependencies by @wwqgtxx
• 9e57b29 chore: update dependencies by @wwqgtxx
• a013ac3 chore: give better error messages for some stupid config files by @wwqgtxx
• aa51b9f chore: replace using internal batch package to x/sync/errgroup by @wwqgtxx
• b4fe669 chore: better path checks by @wwqgtxx
• c2301f6 chore: rebuild fingerprint and keypair handle by @wwqgtxx
• cad26ac chore: fetcher will change duration to achieve fast retry when the update failed with a 2x factor step from 1s to interval by @wwqgtxx
• d55b047 chore: ignore interfaces not with FlagUp in local interface finding by @wwqgtxx
• ee5d77c chore: cleanup tls clientFingerprint code by @wwqgtxx

Full Changelog: v1.19.5...v1.19.6

What's Changed

• 2a40eba feat: tun add exclude-src-port,exclude-src-port-range,exclude-dst-port and exclude-dst-port-range on linux by @wwqgtxx
• a22efd5 feat: add exclude port and exclude port range options (#1951) by @okhowang

BUG & Fix

• 09c7ee0 fix: grpc server panic by @wwqgtxx
• 190047c fix: grpc transport not apply dial timeout by @wwqgtxx
• 24a9ff6 fix: disallow dialFunc be called after grpc transport has be closed by @wwqgtxx
• 2acb0b7 fix: tun IncludeInterface/ExcludeInterface priority by @wwqgtxx
• 323973f fix: converter judgment conditions by @wwqgtxx
• 3d2cb99 fix: grpc outbound not apply ca fingerprint by @wwqgtxx
• 487d7fa fix: panic under some stupid input config by @wwqgtxx
• 55cbbf7 fix: singledo test by @wwqgtxx
• 577f64a fix: X25519MLKEM768 does not work properly with reality by @wwqgtxx
• 664b134 fix: websocket data losing by @wwqgtxx
• 76052b5 fix: grpc in trojan not apply client-fingerprint by @wwqgtxx
• 7a260f7 fix: udp dial support ip4p (#1377) by @HiMetre
• 7b37fcf fix: auto_redirect should only hijack DNS requests from local addresses by @wwqgtxx
• 7de24e2 fix: StreamGunWithConn not synchronously close the incoming net.Conn by @wwqgtxx
• 7f1225b fix: grpc transport can't be closed by @wwqgtxx
• 8752f80 fix: anytls stream read error (#1970) by @anytls
• 9e0889c fix: observable test by @wwqgtxx
• a75e570 fix: vision conn read short buffer error by @wwqgtxx
• b0bd4f4 fix: resources not released when hysteria2 verification failed by @wwqgtxx
• b21b8ee fix: panic in ssr packet by @wwqgtxx
• b5fcd1d fix: chacha8-ietf-poly1305 not work by @wwqgtxx
• bad61f9 fix: avoid panic in inbound test by @wwqgtxx
• daa592c fix: converter panic by @wwqgtxx
• dbb5b7d fix: SetupContextForConn should return context error to user by @wwqgtxx
• dcb20e2 fix: websocket server upgrade in golang1.20 by @wwqgtxx
• e81f3a9 fix: correctly implement references to proxies by @wwqgtxx
• e8af058 fix: websocketWithEarlyDataConn can't close underlay conn when is dialing or not dialed by @wwqgtxx
• eaaccff fix: race in Single.Do by @wwqgtxx
• efa2243 fix: shut it down more aggressively in grpc transport closing by @wwqgtxx

Maintenance

• 237e2ed chore: tun will add firewall rule for Profile ALL on windows system stack by @wwqgtxx
• 23ffe45 chore: using http/httptrace to get local/remoteAddr for grpc client by @wwqgtxx
• 30d90d4 chore: update option checks to use IsZeroOptions by @wwqgtxx
• 345d3d7 chore: add inbound test for anytls by @wwqgtxx
• 39d6a0d chore: update utls to 1.7.0 by @wwqgtxx
• 3d806b5 chore: add inbound test for shadowsocks/trojan by @wwqgtxx
• 4b15568 chore: cleanup metadata code by @wwqgtxx
• 619c9dc chore: apply the default interface/mark of the dialer in the final stage by @wwqgtxx
• 622d99d chore: rebuild outdated proxy auto close mechanism by @wwqgtxx
• 6236cb1 chore: cleanup trojan code by @wwqgtxx
• 63e66f4 chore: cleanup trojan code by @wwqgtxx
• 69ce4d0 chore: speed up inbound test by @wwqgtxx
• 7551c8a chore: remove unneed code by @wwqgtxx
• 7d7f5c8 chore: add inbound test for tuic by @wwqgtxx
• 8085c68 chore: decrease direct using *net.TCPConn by @wwqgtxx
• 84cd0ef chore: remove internal crypto/tls fork in shadowtls by @wwqgtxx
• 8fa4e81 chore: remove internal crypto/tls fork in reality server by @wwqgtxx
• 9e8f4ad chore: better addr parsing by @wwqgtxx
• a6c0c02 chore: ignore interfaces not in IfOperStatusUp when fetch system dns server on windows by @wwqgtxx
• b2d2890 chore: cleanup resolveUDPAddr code by @wwqgtxx
• b59f11f chore: add singMux inbound test for shadowsocks/trojan/vless/vmess by @wwqgtxx
• ba3c44a chore: code cleanup by @wwqgtxx
• bfd06eb chore: rebuild SetupContextForConn with context.AfterFunc by @wwqgtxx
• cac2bf7 chore: cleanup netip code by @wwqgtxx
• cedb36d chore: using SetupContextForConn to reduce the DialContext cannot be cancelled by @wwqgtxx
• d0d0c39 chore: add inbound test for vmess/vless by @wwqgtxx
• d5243ad chore: better global-client-fingerprint handle by @wwqgtxx
• e79465d chore: add inbound test for hysteria2 by @wwqgtxx
• fe01033 chore: quic sniffer should use the exact length of crypto stream when assembling by @wwqgtxx
• feee9b3 chore: remove unneeded tls timeout in anytls by @wwqgtxx

Full Changelog: v1.19.4...v1.19.5

What's Changed

• 0f32c05 feat: support UDP over TCP in mieru (#1926) by @enfein
• 801f3c3 feat: support sniff quic fragment data (#1899) by @5aaee9
• ff89bf0 feat: add gost-plugin in which only ws and mws are currently supported. (#1896) by @cesaryuan

BUG & Fix

• 025ff19 fix: wrong conditional judgment in removeExtraHTTPHostPort #1939 by @wwqgtxx
• 4f8b70c fix: buffer in tproxy not recycle (#1923) by @5aaee9
• 7c444a9 fix: correctly handle ipv6 zone by @wwqgtxx
• c0de3c0 fix: some default value in dialer not restore in tun when config reload by @wwqgtxx
• dee5898 fix: memory leak due to unclosed session (#1908) by @cesaryuan
• e3d4ec2 fix: race at interfaceName setting by @wwqgtxx

Maintenance

• 00e6466 chore: update checksum generation step by @Skyxim
• 070eb31 chore: speedup system stack in tun by @wwqgtxx
• 0ed159e chore: code cleanup by @wwqgtxx
• 14217e7 chore: update service capabilities to include CAP_SYS_TIME and CAP_DAC_OVERRIDE by @xishang0128
• 1e22f4d chore: reduce data copying in quic sniffer and better handle data fragmentation and overlap by @wwqgtxx
• 4bd3ae5 chore: dialer will consider the routing of the local interface when auto-detect-interface in tun is enabled for #1881 #1819 by @wwqgtxx
• 68abb13 chore: support longest-prefix matches in local interface finding by @wwqgtxx
• 7b38261 chore: update gvisor by @wwqgtxx
• 7ff046a chore: modify UDPSniff's function signature to prepare for its ability to handle multiple packets. by @wwqgtxx
• a7a796b chore: cleanup quic sniff's code by @wwqgtxx
• c94b442 chore: add checksum generation for production artifacts by @Skyxim
• dcef787 chore: update utls by @wwqgtxx
• f318b80 chore: better cache implement for group's getProxies by @wwqgtxx
• f615346 chore: anytls protocol version 2 (#1936) by @anytls

Full Changelog: v1.19.3...v1.19.4

What's Changed

• 136d114 feat: socks5/http/mixed inbound support setting tls in listeners by @wwqgtxx
• 1dc4155 feat: inbound's port can use ports format by @wwqgtxx
• 8d783c6 feat: inbound support grpc(lite) by @wwqgtxx
• 91324b7 feat: inbound support trojan by @wwqgtxx
• 9962a0d feat: implement anytls client and server (#1844) by @anytls

BUG & Fix

• 05e8f13 fix: integer overflow in ports iteration by @wwqgtxx
• 1213023 fix: reality not work with vmess+grpc outbound by @wwqgtxx
• 3b40bf7 fix: grpc server's ALPN order by @wwqgtxx
• 8bc6f77 fix DEB packaging (#1868) by @forestl
• 938ab7f fix: syscall packet read waiter for windows by @wwqgtxx
• a00f4f1 fix: vless inbound allow not use flow when request send empty flow by @wwqgtxx
• a7e56f1 fix: anytls client close (#1871) by @anytls
• d1d846f fix: s390x golang1.24 build by @wwqgtxx
• d81c19a fix: grpc server panic by @wwqgtxx
• dc1145a fix: anytls padding send (#1848) by @anytls

Maintenance

• 06b9e6c chore: update dependencies by @wwqgtxx
• 3cc67fd chore: update golang to 1.24 by @wwqgtxx
• 447c416 chore: update quic-go to 0.49.0 by @wwqgtxx
• 5830afc chore: add MinIdleSession option to AnyTLS configuration by @Larvan2
• 808fdcf chore: code cleanup by @wwqgtxx
• 9074b78 chore(dns): increase MaxConnsPerHost (#1834) by @5aaee9
• b151e7d chore: support fingerprint for anytls by @wwqgtxx
• e2140e6 chore: update anytls (#1863) by @anytls
• e23f40a chore: tradition shadowsocks server could handle smux by @wwqgtxx
• e2b75b3 chore: update anytls (#1851) by @anytls
• eaaccbc chore: update dependencies by @wwqgtxx
• ef29e45 chore: complete classical rule parse error log (#1839) by @forestl

Full Changelog: v1.19.2...v1.19.3

What's Changed

• ccc3f84 license: any downstream projects not affiliated with MetaCubeX shall not contain the word mihomo in their names
• 0ac6c3b feat: inbound support vless by @wwqgtxx
• fc23318 feat: add receive window config for hy2 #1796 by @wwqgtxx

BUG & Fix

• 49d54cc fix: remote conn statistic error (#1776) by @J.K.SAGE
• 56c1288 fix: empty proxy provider subscription info not omitted (#1759) by @mossia
• 9c73b5b fix: the trustcerts not add to globalCerts after ca.ResetCertificate (#1801) support PEM format for custom-certificates too by @wwqgtxx
• c7661d7 fix: initialize error message with cipher (#1760) by @lucidhz

Maintenance

• 0a5ea37 chore: update dependencies by @wwqgtxx
• 192d769 chore: ensure forced domains are always sniffed (#1793) by @tnextday
• 9bfb10d chore: extracting compressed files to correct location (#1823) by @forestl
• a440f64 chore: alignment capability for vmess inbound by @wwqgtxx
• b69e52d chore: deprecated routing-mark and interface-name of the group, please set it directly on the proxy instead by @wwqgtxx
• c99c71a chore: listening tcp together for dns server (#1792) by @wwqgtxx
• f4806b4 chore: update mieru version (#1762) by @enfein

Full Changelog: v1.19.1...v1.19.2

What's Changed

• 72a126e feat: support inline proxy provider by @wwqgtxx
• bb80324 feat: support inline rule provider (#1731) by @qianlongzt
• f3a43fe feat: support read config file from stdin via -f - by @wwqgtxx

BUG & Fix

• 3f6823b fix: handle invalid values in Decoder's decode method by @wwqgtxx
• 5d9d8f4 fix: check whether the dst port is within the specified range (#1706) by @laburaps
• a9ce5da fix: key missing for tun inbound #1672 by @wwqgtxx
• c7fc93d fix: the TLS Sniffer fails when the length of the ClientHello packet exceeds the TCP MSS (#1711) by @laburaps

Maintenance

• 1c5f4a3 chore: update dependencies by @wwqgtxx
• 20739f5 chore: code cleanup by @wwqgtxx
• 269c525 chore: update gopsutil to v4 by @wwqgtxx
• 301c78f chore: update sing-tun to v0.4.5 by @wwqgtxx
• 368b1e1 chore: rollback tfo-go version by @wwqgtxx
• 5a9ad0e chore: code cleanup by @wwqgtxx
• 89dfabe chore: align time fields in logs (#1704) by @valord577
• 9a95920 chore: support config multiplexing of mieru by @wwqgtxx
• c786b72 chore: update dependencies by @wwqgtxx
• cd23112 chore: remove gRPC dependency from mieru (#1705) by @enfein

Full Changelog: v1.19.0...v1.19.1

What's Changed

• 613becd feat: support mieru protocol (#1702) by @enfein
• fbead56 feat: add size-limit for provider #1645 by @wwqgtxx

BUG & Fix

• 5a24efd fix: DisableKeepAlive default value of android (#1690) by @forestl
• 792f162 fix: find process panic by @Larvan2
• 80e4eaa fix: process IPv6 Link-Local address (#1657) by @wwqgtxx
• 91d54bd fix: android tun start error by @wwqgtxx
• 9de9f1e fix: don't panic when listen on localhost #1655 by @wwqgtxx

Maintenance

• 1fff34d chore: update quic-go to 0.48.2 by @wwqgtxx
• 215bf09 chore: switch syscall.SyscallN back to syscall.Syscall6 Until the current version, SyscallN always escapes the variadic argument by @wwqgtxx
• 4623435 chore: update sing-tun to v0.4.1 by @wwqgtxx
• 69454b0 chore: allow disabled overrideAndroidVPN by environment variable DISABLE_OVERRIDE_ANDROID_VPN by @wwqgtxx
• a35f712 chore: update gvisor by @wwqgtxx
• a86c562 chore: Increase support for other format of ASN by @xishang0128
• ce52c34 chore: cleaned up some confusing code by @wwqgtxx
• d4478db chore: reduce the performance overhead of not enabling LoopBackDetector by @wwqgtxx
• d6b496d chore: allow upgrade ui in embed mode (#1692) by @hingbong
• de19f92 chore: restful api display smux and mptcp by @chenx Dust
• e6d1c8c chore: update sing-tun to v0.4.0-rc.5 by @wwqgtxx
• eb985b0 chore: restful api displays more information by @xishang0128
• f805a9f chore: cleaned up some weird code by @wwqgtxx
• fabd216 chore: update quic-go to 0.48.1 by @wwqgtxx

Full Changelog: v1.18.10...v1.19.0

What's Changed

• c63a851 feat: add direct-nameserver and direct-nameserver-follow-policy in dns section by @wwqgtxx

BUG & Fix

• 08dcef8 fix: mistaken using net.Dialer #1572 by @wwqgtxx
• 9937ae1 fix: defaultNS not working in system dns by @wwqgtxx
• ca3f1eb fix: sticky-sessions may not be effective by @xishang0128

Maintenance

• 3e966e8 chore: update quic-go to 0.48.0 by @wwqgtxx
• 4437c88 chore: better getUpdateTime() for iterating all Geofiles (#1570) by @forestl
• 4a16d22 chore: no longer used net.DefaultResolver when dns section is disabled, now is equally only "system://" by @wwqgtxx
• 5772507 chore: Adjust the error log for the search process by @xishang0128
• 8e6eb70 chore: temporary update general in ParseRawConfig and rollback before its retur by @wwqgtxx
• 8f5a864 chore: cleanup unneeded setting in parseGeneral, move to executor by @wwqgtxx
• 9286e21 chore: rebuild external ui updater by @wwqgtxx
• 95af5f7 chore: change subscription-userinfo retrieval by @xishang0128
• 990de84 chore: better atomic using by @wwqgtxx
• 9fd63fe chore: update dependencies by @wwqgtxx
• a330fa1 chore: disallow some restful api for CMFA by @wwqgtxx
• b9171ad chore: update sing-tun to v0.4.0-rc.4 by @wwqgtxx
• ecd8fac chore: add warning for unified delay test when second failed by @Skyxim

Full Changelog: v1.18.9...v1.18.10

What's Changed

• 3676d1b feat: add proxy name replacement functionality for override (#1481) by @chun
• 781b783 feat: add amnezia-wg-option to wireguard outbound by @wwqgtxx
• 88bfe7c feat: add external-controller-pipe for windows maybe useful for electron and tauri client, node.js and rust still not support AF_UNIX on windows by @wwqgtxx
• ddfa9e8 feat: add etag-support to let user can disable this feature manually by @wwqgtxx
• ecbbf9d feat: doh client support ecs and ecs-override by @wwqgtxx
• faaa90f feat: Allows passing in base64-encoded configuration strings by @xishang0128
• fc9d5cf feat: add external-controller-cors can config allow-origins and allow-private-network by @wwqgtxx

BUG & Fix

• 417d709 fix: RawSrcAddr and RawSrcAddr in metadata by @wwqgtxx
• 58c973e fix: NewRejectWithOption has wrong type (#1518) by @落心
• 6c03830 fix: AmneziaWG not working by @wwqgtxx
• 89b9438 fix: restful server restart by @wwqgtxx
• 910f236 fix: UpdateMonitor should start when AutoDetectInterface enabled by @wwqgtxx
• cd2d1c6 fix: skip-auth-prefixes not apply on listeners when users is unset by @wwqgtxx
• f305e44 fix: new tun with fd unneeded calculate interface name by @wwqgtxx
• f52fe6a fix: tun.device not shown in restful api by @wwqgtxx

Maintenance

• 0a2f606 chore: cleanup the patch code by @wwqgtxx
• 150c6cc chore: skip duplicates nameserver when parse by @wwqgtxx
• 1633885 chore: update dependencies by @wwqgtxx
• 223eae0 chore: force refresh provider in background by @wwqgtxx
• 2647135 chore: set 0o666 to unix socket file by @wwqgtxx
• 2afa279 chore: allow set security descriptor of namedpipe by environment variable LISTEN_NAMEDPIPE_SDDL by @wwqgtxx
• 33823f1 chore: sync internal interface by @wwqgtxx
• 3922b17 chore: deliver UDP packets from same connection in receiving order (#1540) by @HamsterReserved
• 4c3fe98 chore: modify the default download address of ASN by @xishang0128
• 4fa15c6 chore: ensures packets can be sent without blocking the tunnel by @wwqgtxx
• 5812a7b chore: simplify the code by @wwqgtxx
• 595a575 chore: add Count for ProxyProvider by @wwqgtxx
• 59a2b24 chore: save etag in bbolt by msgpack by @wwqgtxx
• 5d24251 chore: support ETag for providers by @wwqgtxx
• 794645b chore: direct using structure package decode proxy-name by @wwqgtxx
• 7c8f451 chore: cleanup geo internal code by @wwqgtxx
• 7dafe78 chore: disallow space at begin or end in DomainTrie by @wwqgtxx
• 8230bc8 chore: parse float in subscription info by @Larvan2
• 8940bdd chore: better pool_test by @wwqgtxx
• 966eeae chore: rewrite bbolt cachefile implements by @wwqgtxx
• a08aa10 chore: some internal types support encoding.TextUnmarshaler by @wwqgtxx
• a4e84f0 chore: better apply tcp keepalive to listeners by @wwqgtxx
• a67c379 chore: code cleanup by @wwqgtxx
• acfc9f8 chore: reset resolver's connection after default interface changed by @wwqgtxx
• ade4234 chore: mrs use best compression by @H1JK
• af5ad32 chore: Use DELETE to clear the proxy group fixed by @xishang0128
• b1301b1 chore: update quic-go to 0.47.0 by @wwqgtxx
• b7cb677 chore: support ETag for update geo by @wwqgtxx
• d80e8bb chore: remove some confusing restrictions on comma separation in NameServerPolicy configuration by @wwqgtxx
• dc29514 chore: typo by @wwqgtxx
• e33d4a4 chore: cleanup the patch code by @wwqgtxx
• ef244b8 chore: update geo in a batch by @wwqgtxx
• f020b20 chore: structure support encoding.TextUnmarshaler by @wwqgtxx
• f8557f5 chore: don't start UpdateMonitor when AutoRoute not enabled by @wwqgtxx
• fb4d3c4 chore: simplify VlessFlow Option by @Larvan2

Full Changelog: v1.18.8...v1.18.9

What's Changed

• 38fd371 feat: GEOIP,IP-ASN,IP-CIDR,IP-CIDR6 and IP-SUFFIX in rules support ,src option keep the same writing style as RULE-SET by @wwqgtxx
• 518e9bd feat: socks5, http and mixed listeners support independence users by @wwqgtxx
• 696b75e feat: fake-ip-filter support rule-set: and geosite: by @wwqgtxx
• 763a127 feat: RULE-SET in rules support ,src option should only be used with ipcidr behavior by @wwqgtxx
• 7fd0467 feat: sniffer's force-domain and skip-domain support rule-set: and geosite: by @wwqgtxx
• 8483178 feat: sniff add skip-src-address and skip-dst-address by @wwqgtxx
• f6164ac feat: add fake-ip-filter-mode in dns #1479 by @wwqgtxx

BUG & Fix

• 0306316 fix: parameter order in ChaCha20 constructor by @PharosVip
• 08ac9a3 fix: tfo ipv6 addr zone by @wwqgtxx
• 0a4570b fix: group filter touch provider by @Adlyq
• 16c95fc fix: tradition shadowsocks server not apply additions #1466 by @wwqgtxx
• 43f21c0 fix: fallback cannot be unfixed by @xishang0128
• 4c10d42 fix: normal rule not working in fake-ip-filter by @wwqgtxx
• 512d188 fix redundant WindowsDNS (#1456) by @ForestL18
• 5a73d99 fix: logic rules display error by @xishang0128
• 5bf2242 fix: wireguard not working in CMFA by @wwqgtxx
• 6e04e1e fix: hysteria2 close safety by @wwqgtxx
• 7d04904 fix: leak dns when domain in hosts list by @Skyxim
• 81756fc fix: wireguard outbound memory leaks when close by @wwqgtxx
• 9cf3eb3 fix: hysteria1 outbound should be closed when proxy removed by @wwqgtxx
• a1d0f22 fix: update flake.nix hash by @Rasphino
• a96f72a fix: geoip wrong matching logic in fallback-filter #1478 by @wwqgtxx
• d79423a fix: tun should not care "force" when Put configs from restful api by @wwqgtxx
• eea9a12 fix: 规则匹配默认策略组返回错误 by @Skyxim

Maintenance

• 0793998 chore: drop support of eBPF by @Larvan2
• 117cdd8 chore: remove suppress_prefixlength in tun linux auto-route for inet4/6-route-address #1368 by @wwqgtxx
• 12c5cf3 chore: update golang to 1.23 by @wwqgtxx
• 24c6e7d chore: update tcp keepAlive setting for go1.23 by @Larvan2
• 27bcb26 chore: better config internal structure by @wwqgtxx
• 3e2c9ce chore: cleanup patch code by @wwqgtxx
• 41efc5e chore: update dependencies by @wwqgtxx
• 4f33926 chore: update dependencies by @wwqgtxx
• 4fecf68 chore: add sourceGeoIP and sourceIPASN to metadata by @wwqgtxx
• 4fedfc4 chore: update geo unneeded reload whole config by @wwqgtxx
• 50d0cd3 chore: auto download external UI when 'external-ui' is set and not empty by @Larvan2
• 53425bb chore: add json struct tags for more fields in config.RawConfig (#1469) by @karin0
• 53b41ca Chore: Add action for deleting old workflow by @Larvan2
• 56fe7d5 chore: clean up update_ui code by @Larvan2
• 6306c6b chore: add route.ApplyConfig for CMFA by @wwqgtxx
• 6bf419c chore: better geo init logging by @wwqgtxx
• 8a75f78 chore: adjust Dockerfile by @MetaCubeX
• 92ec5f2 chore: cleanup dns policy match code by @wwqgtxx
• 951cae2 chore: corrected the incoming parameters of PowerUnregisterSuspendResumeNotification by @wwqgtxx
• 9e20f9c chore: update dependencies by @MetaCubeX
• a5acd3a refactor: clear linkname,reduce cycle dependencies,transport init geosite function by @Skyxim
• beefe37 chore: logic rules dynamic obtain parameters by @wwqgtxx
• c4660e1 chore: reopen tfo support on windows for golang1.23 maybe broken again when golang1.24 release by @wwqgtxx
• c838033 chore: improve include-all-proxies compatibility by @xishang0128
• e4646fc chore: update dependencies by @wwqgtxx
• e7e1400 chore: reduce image size by @Izumiko
• ea41813 chore: update quic-go to 0.46.0 by @wwqgtxx
• f20f371 chore: better keepalive handle by @wwqgtxx
• f5834dd chore: code cleanup by @wwqgtxx
• f968d0c chore: update github action by @Skimmle
• fd205bf chore: update quic-go to 0.45.2 by @wwqgtxx

Full Changelog: v1.18.7...v1.18.8