🚀 Features
- Auto-reload local file rule/proxy-providers on change (#1465) by @Copilot
- (tun) Add FreeBSD tun support via FIB multi-table routing (#1475) by @lakako
🐛 Bug Fixes
- (config) Ignore unknown fields for forward-compatible parsing (#1471) by @Copilot
- (hysteria2) Refresh the UDP poller after port hops (#1482) by @cedar-otter-47
- (ws) Percent-encode spaces in WebSocket paths (#1480) by @cedar-otter-47
- (urltest) Honor tolerance and skip unavailable proxies (#1481) by @cedar-otter-47
🚜 Refactor
- (dispatcher,transport) Dedup tracked streams + TransportLayer enum (#1477) by @ibigbug
🛠️ Builds
- (deps) Bump the npm-dependencies group in /clash-dashboard with 17 updates (#1462) by @dependabot[bot]
- (deps) Bump the actions-dependencies group with 6 updates (#1461) by @dependabot[bot]
- (deps) Bump the rust-dependencies group with 32 updates (#1463) by @dependabot[bot]
- (deps) Bump cmov from 0.5.3 to 0.5.4 (#1469) by @dependabot[bot]
- (deps) Bump body-parser from 2.2.2 to 2.3.0 in /clash-dashboard (#1479) by @dependabot[bot]
- (deps) Bump brace-expansion from 5.0.6 to 5.0.7 in /clash-dashboard (#1478) by @dependabot[bot]
- (deps) Bump serde_with from 3.20.0 to 3.21.0 (#1474) by @dependabot[bot]
⚙️ Miscellaneous Tasks
- Bump shadowquic version (#1476) by @spongebob888
- Bump version to v0.10.8 by @github-actions[bot]
Other
- Add Hysteria2 inbound listener (#1466)
- Initial plan
- Add Hysteria2 inbound listener (issue #1460)
- Fix UdpPacket src_addr/inbound_user in Hysteria2InboundDatagram
- Refactor user watch-channel creation to use match with OR patterns
- fix(hysteria2 inbound): keep connection alive after auth; harden UDP/TCP paths
Address review findings on the Hysteria2 inbound listener.
- Keep the h3 server connection alive for the QUIC connection's lifetime.
authenticate() previously dropped it on return, and h3's Drop closes the
underlying QUIC connection — so every proxy stream/datagram failed
immediately after a successful auth, making the inbound non-functional.
- Bounds-check the UDP packet decoder before split_to(addr_len); a malformed
datagram with an oversized address length previously panicked the datagram
task (a remote DoS under panic = "abort").
- Send the correct address in UDP reply datagrams: use the upstream source
(src_addr), not the client's own address (dst_addr), so clients can
correlate replies (e.g. DNS-over-Hysteria2).
- Evict per-session Defraggers: move fragment state into the session map so
it is dropped when the session ends, instead of a separate map that grew
unbounded per distinct session id.
- Use try_send on the per-session datagram channel so one stalled UDP
destination cannot head-of-line-block every other session on the connection.
- Preserve payload bytes pipelined into the request frame via into_parts()
instead of discarding the read buffer with into_inner().
- Reject empty auth passwords so a blank password cannot become an open relay.
- Guard Fragments against underflow/divide-by-zero when the advertised max
datagram size is smaller than the frame header.
- Treat a request frame split across QUIC reads as "need more bytes" instead of
a fatal decode error.
- Canonicalize the client address before the allow_lan check (dual-stack
IPv4-mapped IPv6), matching the other inbounds.
- Remove a duplicate address parser; add regression tests for the UDP decode
bounds check and partial-frame handling.
- style: fix typos spellcheck (avoid 'mis' fragment in comment)
- refactor(hysteria2): split inbound/outbound and share stream/codec/TLS helpers
Reorganize the hysteria2 module to match the shadowsocks layout and remove
duplication between the client and server sides:
- Move the outbound client implementation from mod.rs into outbound/mod.rs;
mod.rs is now a thin module root that declares submodules and re-exports the
outbound surface (Handler, HystOption, Obfs, SalamanderObfs).
- Add a shared stream.rs unifying the outbound HystStream and inbound
HystServerStream into one HystStream (with an optional read prefix for the
server's pipelined-bytes case).
- Merge the duplicate Hy2TcpRespMsg into Hy2TcpResp (Hy2TcpResp::ok()).
- Extract resolve_server_cert_and_key into common/tls.rs and use it from
both the anytls and hysteria2 inbounds instead of copy-pasted load-or-generate
cert logic.
- fix(hysteria2): correct test_utils path after outbound module move
- fix(hysteria2 inbound): bound request lengths, validate auth request
Address review feedback:
- Cap the client-supplied address and padding lengths in Hy2TcpReqCodec
(MAX_ADDR_LEN / MAX_PADDING_LEN) so a bogus varint length can't force
unbounded buffering (memory DoS).
- Validate the auth handshake is POST /auth and 404 anything else, so an
unrelated first request isn't treated as authentication.
- Add codec unit tests: full-frame decode, oversized-length rejection, and
response encode/decode round-trip.
- style: nightly rustfmt for test imports
Co-authored-by: copilot-swe-agent[bot] 198982749+Copilot@users.noreply.github.com
Co-authored-by: Yuwei B contact@yba.dev by @Copilot
New Contributors ❤️
