MHSanaei/3x-ui v3.8.0
一句话概括:本次大版本引入 TUIC v5 入站、AmneziaWG 出站与 Discord 通知机器人,升级内置 Xray-core 至 v26.9.9,并对订阅体系、多节点一致性和安装安全性做了系统性加固(含一次性自动迁移与数项行为变更)。
新增能力
- TUIC v5 入站:通过随包附带的
tuic-server sidecar 终结 TUIC 流量并中继进 Xray,从而获得按客户端统计与路由能力;支持 tuic:// 分享链接、Clash 输出以及独立的 QR 配置标签页。
- AmneziaWG 全面化:AmneziaWG 现在也可作为出站协议;Clash 订阅可生成 AmneziaWG proxy;新增多服务器 NordLynx 出站;内嵌隧道修复了中继、MTU、密钥协商、锁与吞吐等十余处问题。
- Discord 通知:新增 Discord bot 服务,带独立设置页,功能对齐原有 Telegram 告警。
- 订阅体系大改:客户端 App 集成请求头与精选路由预设;路由配置与 DNS 服务器可烘焙进 JSON 订阅;新增 legacy Clash 订阅端点、dummy info/status 节点、可选月末到期显示、只读 HWID 设备槽位状态端点、本地生成的 Crypt5 链接、订阅均衡器的 leastLoad 成员权重、JSON 订阅路由规则 Block 标签页。
- 面板 UX:全局 Ctrl+K 命令面板;入站列表显示关联 host 备注;Reality 扫描候选设置;geodata 标准源预设;路由规则新增仅面板可见的备注字段;WireGuard/AmneziaWG PresharedKey 一键生成按钮;隧道客户端可设 PersistentKeepalive;批量调整支持设置 HWID 上限与 MTProto ad-tag;管理员设备列表显示短 HWID 指纹。
- 节点与客户端:admin 可批量设置 HWID 限制;多隧道入站客户端保留每 peer 密钥;跨入站同步自动续期。
改进与性能
- Xray-core 连续两次升级(v26.9.8 → v26.9.9),跟随
udpHop → udphop 的位置迁移;面板对出站协议 id 的读取全部改为大小写不敏感。
- 并发化改造:多入站客户端创建、批量客户端变更、客户端编辑到各节点的推送均改为并发扇出,不再逐个串行;客户端批量记录查询改为批处理。
- AmneziaWG:回收入包路径上 gVisor 的池化 buffer;H1–H4 生成器与队列深度吞吐修复。
- TUIC:连接数超限时驱逐最旧的 relay flow,而不是拒绝新客户端接入。
- 文档:七份 README 全量刷新,补充 Discord bot、TUIC v5 说明;OpenAPI 与运行时契约对齐,集合响应标记为 nullable。
- 依赖:前端与 Go 依赖更新并修复 AntD Space API;
swagger-ui-react 的 js-yaml overrides 提到 4.3.2。
修复问题(重点)
- 协议/链接保真:导入时保留 mKCP 的 seed/headerType、Shadowsocks 的 TLS 参数与 tcp/http 混淆、VMess 证书检查与
vcn(映射到 verifyPeerCertByName);Hysteria 导出标准 gecko obfs 参数;Clash 输出丢弃无法表达的节点并输出裸主机名;Mihomo REALITY 订阅启用 ML-KEM。
- Xray/面板:日志路径在任意大小写键名下都被限制在允许目录;DNS outbound 迁移出 legacy
nonIPQuery/blockTypes;freedom 的 domainStrategy 放到核心实际读取的位置;VLESS vnext 端点探测修复;出站订阅标签保持稳定。
- 入站/客户端:缺少 TLS 证书时保存前即拒绝;支持负数
subSortIndex;切换启用状态时保留流量重置计划;EOM 23:59:59 过期对齐账单午夜;可移植导入保留 enable;节点采纳的入站编辑时保留自身协议;删除 tombstone 在 email 重建时撤回。
- 多节点正确性:节点快照不再“复活”批量删除的客户端,也不能劫持其它入站的客户端;新选择的入站会被导入而非被清扫;节点上报的 tag 优先于过期的采纳别名;心跳探测的 status body 加了解码上限。
- Bot 与安全:Telegram bot 增加客户端归属校验、HTML 转义、mutex 安全读取、callback 修复、漏掉 stale-inbound TOCTOU;Discord 回复按 embed 上限分页、心跳无响应时断开网关;
-getApiToken 可指明重新生成的是哪个 token;SMTP 失败显示真实原因;登录日志不再重复记录成功登录。
- 安装/运维:SQLite 存储改为 owner-only;下载的 geo 数据库对已发布摘要做校验;
x-ui.sh 与 unit 文件从已安装的 release tag 拉取;fail2ban 覆盖配置移到 jail.d 而非 jail.conf;ImportDB 后重启面板以匹配 subPath 路由。
破坏性变更与升级须知
- 升级后首次启动会执行一次性自动迁移:出站
proxySettings → sockopt.dialerProxy;freedom 的 domainStrategy → sockopt;dns-outbound 的 nonIPQuery/blockTypes → rules;SQLite 目录与文件权限收紧为 0700/0600(chmod 失败只记录日志,不中断);legacy MTProto 自定义分享地址转为 Host;subSortIndex 为 0 重编号为 1。
- 行为变更:错误的 API Bearer token 现在返回 401(原为 404);JSON 订阅的本地 SOCKS/HTTP 入站绑定 127.0.0.1 且 Vision 出站关闭 TCP mux;REALITY 的
minClientVer 为空表示无最低版本;扩大节点入站选择会重新触发采纳逻辑,使新增入站被导入。
- TUIC v5 依赖
tuic-server sidecar,发布压缩包、Docker 镜像与 install.sh 会把它放在面板二进制旁边(不再复制到 /usr/local/bin);install.sh/update.sh 校验发布包附带的 SHA-256,不匹配或拉取失败即中止(旧 tag 上的 404 仅告警)。
- 全新安装使用随机订阅路径,已有设置保持不变;构建需要 Go 1.27.1,内置核心为 Xray-core v26.9.9。
- 本次共有 17 位新贡献者首次提交代码。
▸ Release Notes 英文原文(24149 字符)
## 🚀 TUIC v5, AmneziaWG outbounds, Discord notifications, Xray-core v26.9.9 & hardened installs
- 🚀 **TUIC v5 inbounds** — a bundled `tuic-server` sidecar terminates TUIC and relays into Xray for per-client stats and routing, with `tuic://` share links, Clash output and a dedicated QR config tab.
- 🛰️ **AmneziaWG everywhere** — AmneziaWG is now an outbound protocol too, Clash subscriptions can emit AmneziaWG proxies, multi-server NordLynx outbounds arrive alongside, and the embedded tunnel picked up a dozen relay, MTU, keying, locking and throughput fixes.
- 💬 **Discord notifications** — a new Discord bot service mirrors the Telegram alerts with its own settings tab, while the Telegram bot gained ownership checks, HTML escaping, mutex-safe state and callback fixes.
- ⚙️ **Xray-core v26.9.9** — two core bumps with one-time template migrations for the keys the new core refuses or deprecates, the `udpHop` → `udphop` mask move, and outbound protocol ids read case-insensitively everywhere the panel looks at them.
- 📡 **Subscription overhaul** — client-app integration headers and curated routing presets, routing profiles and DNS servers baked into JSON subscriptions, a legacy Clash endpoint, a dummy info/status node, opt-in month-end expiry display, an HWID slot-status endpoint and locally generated Crypt5 links.
- 🔐 **Hardened installs** — release archives ship SHA-256 sums that `install.sh`/`update.sh` verify, geo databases are checked against published digests, the SQLite store is owner-only, fresh panels get random subscription paths, and the fail2ban override moved to `jail.d`.
- 🖧 **Multi-node correctness** — client edits fan out to every node concurrently, node snapshots can no longer resurrect deleted clients or hijack another inbound's client, and a newly selected inbound is imported instead of swept.
- 🧩 **Panel UX** — a global Ctrl+K command palette, linked host remarks in the inbound list, a Reality scan-candidate setting, geodata source presets, a routing-rule comment field and a Generate button for tunnel preshared keys.
- 🔗 **Share-link fidelity** — imports keep mKCP seed/headerType, Shadowsocks TLS params and obfuscation, VMess certificate checks and `vcn`; Clash output drops nodes it cannot express and emits bare hosts.
> ℹ️ **Heads-up:** The first start after upgrading runs several **one-time automatic migrations**: stored Xray templates are rewritten for keys the new core refuses or deprecates (outbound `proxySettings` → `sockopt.dialerProxy`, freedom `domainStrategy` → `sockopt`, dns-outbound `nonIPQuery`/`blockTypes` → `rules`), the SQLite directory and files are tightened to **0700/0600** (a failed chmod is logged, not fatal), a legacy MTProto custom share address becomes a **Host**, and a `subSortIndex` of 0 is renumbered to 1. **Behavior changes:** a wrong API Bearer token now returns **401** instead of 404; JSON subscriptions bind their local SOCKS/HTTP inbounds to **127.0.0.1** and disable TCP mux on Vision outbounds; an empty REALITY `minClientVer` now means **no minimum**; growing a node's inbound selection re-arms adoption so the added inbound is imported rather than swept. **TUIC v5** needs the `tuic-server` sidecar, which the release archives, Docker image and `install.sh` now place next to the panel binary (it is no longer copied to `/usr/local/bin`), and `install.sh`/`update.sh` verify the archive's published **SHA-256** sidecar, aborting on mismatch or fetch failure (a 404 on older tags only warns). Fresh installs get **random subscription paths** while existing settings are preserved; building needs **Go 1.27.1** and the bundled core is **Xray-core v26.9.9**.
<h3>🆕 New</h3>
- [feat(tuic): add TUIC v5 inbounds via the tuic-server sidecar](https://github.com/MHSanaei/3x-ui/commit/6d96accd) (#6337) @momachka2
- [feat(amneziawg): add AmneziaWG as an outbound protocol](https://github.com/MHSanaei/3x-ui/commit/d5ab84e8) (#6320) @rqzbeh
- [feat(nord): support multi-server NordLynx outbounds](https://github.com/MHSanaei/3x-ui/commit/f9cfd87c) (#6311) @Masterain98
- [feat(outbounds): support custom subscription user agents](https://github.com/MHSanaei/3x-ui/commit/9f07951b) (#6398) @T3RR7
- [feat(discord): add Discord notification bot service](https://github.com/MHSanaei/3x-ui/commit/bf7ce2da) (#6486) @poise52
- [feat(sub): add client-app integration headers, routing presets, and app management](https://github.com/MHSanaei/3x-ui/commit/14566580) (#6434) @Pejman-Yousefi-Official
- [feat(sub): refine routing presets, serverDescription escaping, and auto-detect placement](https://github.com/MHSanaei/3x-ui/commit/cba8f067) (#6488) @Pejman-Yousefi-Official
- [feat(sub): bake client routing profiles into the JSON subscription](https://github.com/MHSanaei/3x-ui/commit/2dd903ea) (#6402) @DIMFLIX
- [feat(sub): let the panel set the JSON subscription DNS servers](https://github.com/MHSanaei/3x-ui/commit/2730e4d0) (#6485) @DIMFLIX
- [feat(sub): leastLoad member weights for subscription balancers](https://github.com/MHSanaei/3x-ui/commit/7100fbcd) (#6304) @DIMFLIX
- [feat(settings): add Block tab for JSON subscription routing rules](https://github.com/MHSanaei/3x-ui/commit/b332d884) (#6466) @mrchatam
- [feat(sub): generate Crypt5 subscription links locally](https://github.com/MHSanaei/3x-ui/commit/6a5b4fab) (#6494) @NgaiYeanCoi
- [feat(sub): add legacy Clash subscription endpoint](https://github.com/MHSanaei/3x-ui/commit/64b6e43e) (#6338) @duqigit
- [feat(sub): add AmneziaWG proxy generation for Clash subscriptions](https://github.com/MHSanaei/3x-ui/commit/876497db) (#6326) @VibeProgramm
- [feat(sub): add dummy info node and status configs for subscriptions](https://github.com/MHSanaei/3x-ui/commit/9f76a66d) (#6412) @rqzbeh
- [feat(sub): add read-only HWID device-slot status endpoint](https://github.com/MHSanaei/3x-ui/commit/89ee1242) (#6380) @Namso9
- [feat(sub): add opt-in month-end expiry presentation](https://github.com/MHSanaei/3x-ui/commit/c90996ed) (#6517) @JacktheRanger
- [feat(clients): let admins set PersistentKeepalive on tunnel clients](https://github.com/MHSanaei/3x-ui/commit/8f162994) (#6377) @YoungReckless4
- [feat(clients): add Generate button for WireGuard/AmneziaWG PresharedKey](https://github.com/MHSanaei/3x-ui/commit/22763fe8) (#6455) @mrchatam
- [feat(clients): support setting HWID limit and MTProto ad-tag in bulk adjust](https://github.com/MHSanaei/3x-ui/commit/ed5465d0) (#6399) @rqzbeh
- [feat(clients): show short HWID fingerprint in admin device list](https://github.com/MHSanaei/3x-ui/commit/8082ab4d) (#6464) @mrchatam
- [feat(inbounds): show linked host remarks in inbound list](https://github.com/MHSanaei/3x-ui/commit/939c4706) (#6468) @mrchatam
- [feat(settings): add setting for Reality scan candidates](https://github.com/MHSanaei/3x-ui/commit/768bbd2a) (#6471) @mrchatam
- [feat(reality): warn when target cert chain is too small for ML-DSA-65](https://github.com/MHSanaei/3x-ui/commit/b467d4c6) (#6470) @mrchatam
- [feat(geodata): add standard source presets](https://github.com/MHSanaei/3x-ui/commit/d600de2c) (#6504) @rokokol
- [feat(routing): add panel-only comment field to routing rules](https://github.com/MHSanaei/3x-ui/commit/1bf078c5) (#6361) @Ssentiago
- [feat(ui): add global command palette (Ctrl+K) for fast navigation and search](https://github.com/MHSanaei/3x-ui/commit/fc08b533) (#6352) @TheMRVX
- [feat(release): publish SHA-256 sums and verify them in install.sh/update.sh](https://github.com/MHSanaei/3x-ui/commit/f294e180) (#6393) @rokokol
<h3>⚡ Update & improvement</h3>
- [feat(xray): update xray-core to v26.9.9 and follow the udpHop move](https://github.com/MHSanaei/3x-ui/commit/d0edbcec)
- [feat(xray): update xray-core to v26.9.8 and adapt panel](https://github.com/MHSanaei/3x-ui/commit/2ec6c736)
- [perf(clients): batch the client record lookup in bulk operations](https://github.com/MHSanaei/3x-ui/commit/8b9cf260)
- [perf(clients): apply a multi-inbound client create concurrently](https://github.com/MHSanaei/3x-ui/commit/63b46cd6)
- [perf(clients): push a bulk client change to every node at once](https://github.com/MHSanaei/3x-ui/commit/e9e2e302)
- [perf(node): push a client edit to every node at once, not one after another](https://github.com/MHSanaei/3x-ui/commit/d34ec97f)
- [perf(node): bound the per-client node push and fan out the traffic reset](https://github.com/MHSanaei/3x-ui/commit/a5e68f41)
- [perf(amneziawg): return gVisor's pooled buffers on the embedded data path](https://github.com/MHSanaei/3x-ui/commit/24cb6bfe)
- [refactor(tgbot): make the add-client expiry presets say what they do](https://github.com/MHSanaei/3x-ui/commit/2fcd28c1) (#6503) @BlindMaster24
- [docs(readme): refresh all seven READMEs for the current feature set](https://github.com/MHSanaei/3x-ui/commit/3ef06b70)
- [docs: add Discord bot to READMEs, architecture, operations guides, and locales](https://github.com/MHSanaei/3x-ui/commit/a09e1360) (#6513) @poise52
- [docs: add TUIC v5 to READMEs, guides, and protocol references](https://github.com/MHSanaei/3x-ui/commit/2d7c8c77) (#6511) @poise52
- [docs(api): align OpenAPI with runtime contracts](https://github.com/MHSanaei/3x-ui/commit/ed6bc1d8) (#6409) @LineGM
- [docs(api): mark collection responses nullable](https://github.com/MHSanaei/3x-ui/commit/b8597314) (#6430) @LineGM
- [docs(readme): add 3X-UI Manager to Community Tools](https://github.com/MHSanaei/3x-ui/commit/3a932357) (#6266) @yukh975
- [chore(deps): update frontend and Go deps and fix the AntD Space API](https://github.com/MHSanaei/3x-ui/commit/dd46a067)
- [chore(deps): bump Go dependency versions](https://github.com/MHSanaei/3x-ui/commit/38dd9bcc)
- [chore(deps): raise the swagger-ui-react js-yaml override to 4.3.2](https://github.com/MHSanaei/3x-ui/commit/33e6c2ec)
<h3>🐞 Bug fixed</h3>
- [fix(xray): read an outbound protocol id the way the core does](https://github.com/MHSanaei/3x-ui/commit/4d6db1c9) (#6521) @BlindMaster24
- [fix(panel): read outbound protocol ids case-insensitively everywhere](https://github.com/MHSanaei/3x-ui/commit/c0c2dd27) (#6523) @BlindMaster24
- [fix(panel): read an outbound protocol id the way the core does](https://github.com/MHSanaei/3x-ui/commit/a5a4c9cd) (#6522) @BlindMaster24
- [fix(panel): read the outbound protocol id in the Outbounds row like the core](https://github.com/MHSanaei/3x-ui/commit/c0271e23) (#6528) @BlindMaster24
- [fix(outbound): read the probe protocol id and transport name like the core](https://github.com/MHSanaei/3x-ui/commit/f69d1e86) (#6526) @BlindMaster24
- [fix(outbound): read the probe testability gate's ids like the core](https://github.com/MHSanaei/3x-ui/commit/efcf1529) (#6527) @BlindMaster24
- [fix(panel): probe UDP outbounds and hide the block outbound from the mtproto egress picker](https://github.com/MHSanaei/3x-ui/commit/84c5aef4) (#6525) @BlindMaster24
- [fix(xray): migrate the dns outbound off its legacy nonIPQuery and blockTypes](https://github.com/MHSanaei/3x-ui/commit/39ce7cbc) (#6519) @BlindMaster24
- [fix(xray): place the freedom domain strategy where the core reads it](https://github.com/MHSanaei/3x-ui/commit/826e29e2) (#6515) @BlindMaster24
- [fix(xray): confine log paths written under any key case](https://github.com/MHSanaei/3x-ui/commit/f9de0226)
- [fix(outbound): test VLESS vnext endpoints](https://github.com/MHSanaei/3x-ui/commit/c62ee0bb) (#6358) @sanmaxdev
- [fix(outbounds): preserve stable subscription tags](https://github.com/MHSanaei/3x-ui/commit/8abe87b6) (#6345) @dawNotPoi
- [fix(dns): stop offering a port field that DoH entries discard](https://github.com/MHSanaei/3x-ui/commit/c392f367)
- [fix(inbounds): reject missing TLS certificates before saving](https://github.com/MHSanaei/3x-ui/commit/47d23033) (#6429) @duqigit
- [fix(inbounds): serve fresh client UUIDs for list and allLinks](https://github.com/MHSanaei/3x-ui/commit/67addab3) (#6458) @mrchatam
- [fix(inbounds): allow negative subSortIndex for subscription order](https://github.com/MHSanaei/3x-ui/commit/51e0afdd) (#6465) @mrchatam
- [fix(inbounds): let a node-adopted inbound keep its own protocol on edit](https://github.com/MHSanaei/3x-ui/commit/2004340d)
- [fix(frontend): fold sockopt v6only into V6Only on inbound load](https://github.com/MHSanaei/3x-ui/commit/958d7f13) (#6453) @mrchatam
- [fix(hosts): keep TLS override fields visible when Security is same](https://github.com/MHSanaei/3x-ui/commit/72df05a4) (#6452) @mrchatam
- [fix(clients): preserve traffic reset schedule when toggling enable](https://github.com/MHSanaei/3x-ui/commit/d0ad773e) (#6502) @alireza4682
- [fix(clients): snap EOM 23:59:59 expiry to billing midnight without renew](https://github.com/MHSanaei/3x-ui/commit/5cce2464) (#6457) @mrchatam
- [fix(clients): sync auto-renewal across inbounds](https://github.com/MHSanaei/3x-ui/commit/b8121613) (#6339) @dawNotPoi
- [fix(clients): preserve enable on portable import](https://github.com/MHSanaei/3x-ui/commit/5fbd2b49) (#6481) @mrchatam
- [fix(clients): use EffectiveFlow in BulkAttach](https://github.com/MHSanaei/3x-ui/commit/0a838563) (#6454) @mrchatam
- [fix(clients): keep per-peer keys when a client spans several tunnel inbounds](https://github.com/MHSanaei/3x-ui/commit/65c5580e)
- [fix(clients): withdraw the delete tombstone when the email is re-created](https://github.com/MHSanaei/3x-ui/commit/bc57548a)
- [fix(clients): flag the restart a partly-applied edit or delete still needs](https://github.com/MHSanaei/3x-ui/commit/f072d044)
- [fix(clients): render all tunnel configs for multi-inbound client](https://github.com/MHSanaei/3x-ui/commit/47964afb) (#6349) @TheMRVX
- [fix(wireguard): preserve per-inbound WireGuard peer addresses](https://github.com/MHSanaei/3x-ui/commit/f6445304) (#6344) @mvanhorn
- [fix(node): import a newly selected node inbound instead of sweeping it](https://github.com/MHSanaei/3x-ui/commit/22346eef)
- [fix(node): flag every hosting node before a client edit applies](https://github.com/MHSanaei/3x-ui/commit/f2cf5899)
- [fix(node): let a node-reported tag outrank a stale adopted alias](https://github.com/MHSanaei/3x-ui/commit/5fc4b9f4)
- [fix(node): keep an adopted inbound alias across a remote id cache refresh](https://github.com/MHSanaei/3x-ui/commit/0775fcaa)
- [fix(node): sweep a selected inbound the node reports without its prefix](https://github.com/MHSanaei/3x-ui/commit/6f40a51d)
- [fix(node): cap the status body the heartbeat probe decodes](https://github.com/MHSanaei/3x-ui/commit/ab422953)
- [fix(node): refuse a node's claim on another inbound's client](https://github.com/MHSanaei/3x-ui/commit/a31fa9ab)
- [fix(node): prevent node snapshots from resurrecting bulk-deleted clients](https://github.com/MHSanaei/3x-ui/commit/71607e38) (#6382) @mvanhorn
- [fix(sub): drop external Clash shadowsocks nodes the panel cannot express](https://github.com/MHSanaei/3x-ui/commit/ff1a6c3c) (#6508) @BlindMaster24
- [fix(link): rebuild shadowsocks tcp/http obfuscation on import](https://github.com/MHSanaei/3x-ui/commit/8fc4fc0b) (#6505) @BlindMaster24
- [fix(link): read the vmess certificate checks on import](https://github.com/MHSanaei/3x-ui/commit/f3dba07e) (#6507) @BlindMaster24
- [fix(link): restore mKCP seed and headerType on share-link import](https://github.com/MHSanaei/3x-ui/commit/5ad9df69) (#6480) @mrchatam
- [fix(link): preserve Shadowsocks TLS query params on import](https://github.com/MHSanaei/3x-ui/commit/503b5df4) (#6467) @mrchatam
- [fix(link): map vcn to verifyPeerCertByName in applySecurity](https://github.com/MHSanaei/3x-ui/commit/f51b0040) (#6479) @mrchatam
- [fix(hysteria): export standard gecko obfs share-link params and persist uTLS None](https://github.com/MHSanaei/3x-ui/commit/540caa4e) (#6325) @rqzbeh
- [fix(mtproto): use hosts for public share links](https://github.com/MHSanaei/3x-ui/commit/5a63d5d4) (#6369) @samssh
- [fix(sub): enable ML-KEM for Mihomo REALITY subscriptions](https://github.com/MHSanaei/3x-ui/commit/0a2cd789) (#6451) @King19950905
- [fix(sub): skip AmneziaWG JSON entries](https://github.com/MHSanaei/3x-ui/commit/4e355edc) (#6420) @atirna
- [fix(sub): bind JSON local inbounds to 127.0.0.1 and keep mux.cool off Vision outbounds](https://github.com/MHSanaei/3x-ui/commit/0f6e1ae8) (#6418) @FZ1010
- [fix(sub): randomize fresh panel subscription paths](https://github.com/MHSanaei/3x-ui/commit/f9898e0b) (#6375) @rokokol
- [fix(sub): apply the device limit to ?view=raw](https://github.com/MHSanaei/3x-ui/commit/f17e4684)
- [fix(sub): drop Reality parameters when a host forces plain TLS](https://github.com/MHSanaei/3x-ui/commit/4e423fa4)
- [fix(sub): emit a bare host in Clash proxies](https://github.com/MHSanaei/3x-ui/commit/246d9207)
- [fix(sub): restore compatible SOCKS subscription inbound](https://github.com/MHSanaei/3x-ui/commit/0c72dd83) (#6395) @dawNotPoi
- [fix(sub): honor and show client expiry on external subscription links](https://github.com/MHSanaei/3x-ui/commit/2ddcf530) (#6333) @duqigit
- [fix(frontend): isolate subscription language preference](https://github.com/MHSanaei/3x-ui/commit/ded2aa15) (#6394) @dawNotPoi
- [fix(frontend): improve dense QR readability](https://github.com/MHSanaei/3x-ui/commit/04e84580) (#6396) @dawNotPoi
- [fix(amneziawg): bound the SOCKS5 UDP associate exchange](https://github.com/MHSanaei/3x-ui/commit/cfd4f64a)
- [fix(amneziawg): honor inbound listen when binding UDP socket](https://github.com/MHSanaei/3x-ui/commit/7a41c594) (#6461) @mrchatam
- [fix(amneziawgnet): wait for the client netstack goroutines before closing its device](https://github.com/MHSanaei/3x-ui/commit/6ee74f20)
- [fix(amneziawg): let a cleared header protection key reach a running device](https://github.com/MHSanaei/3x-ui/commit/cfd596a4)
- [fix(amneziawg): stop losing an inbound and its server keys on the API path](https://github.com/MHSanaei/3x-ui/commit/705b291d)
- [fix(amneziawg): reject obfuscation values amneziawg-go's own UAPI rejects](https://github.com/MHSanaei/3x-ui/commit/3b5273b1)
- [fix(amneziawg): three defects in the embedded relay's connection handling](https://github.com/MHSanaei/3x-ui/commit/be5ee3e0)
- [fix(amneziawg): account for S4 junk in the default tunnel MTU](https://github.com/MHSanaei/3x-ui/commit/3cd3836d) (#6376) @YoungReckless4
- [fix(amneziawg): H1-H4 generator + queue-depth throughput fixes](https://github.com/MHSanaei/3x-ui/commit/bd1c27b0) (#6330) @kuzzrus
- [fix(amneziawg): avoid manager lock inversion](https://github.com/MHSanaei/3x-ui/commit/e95fe80f) (#6397) @dawNotPoi
- [fix(tuic): evict the oldest relay flow instead of refusing new clients](https://github.com/MHSanaei/3x-ui/commit/5815254f)
- [fix(install): stop copying tuic-server over /usr/local/bin](https://github.com/MHSanaei/3x-ui/commit/19a692e0)
- [fix(tgbot): close stale-inbound TOCTOU and contain handler panics](https://github.com/MHSanaei/3x-ui/commit/87420e3b) (#6442) @BlindMaster24
- [fix(tgbot): suppress 'message not modified' warnings in Telegram edit calls](https://github.com/MHSanaei/3x-ui/commit/8e13f8b1) (#6340) @BlindMaster24
- [fix(tgbot): require client ownership for non-admin link callbacks](https://github.com/MHSanaei/3x-ui/commit/7ac5277c) (#6489) @BlindMaster24
- [fix(tgbot): read the admin list and running flag under their mutex](https://github.com/MHSanaei/3x-ui/commit/615876b2) (#6491) @BlindMaster24
- [fix(tgbot): render the add-client draft as HTML and escape its values](https://github.com/MHSanaei/3x-ui/commit/02c6c3a9) (#6492) @BlindMaster24
- [fix(tgbot): answer the callbacks the bot cannot route](https://github.com/MHSanaei/3x-ui/commit/aaa5e61c) (#6493) @BlindMaster24
- [fix(tgbot): answer only the link callbacks that match nothing](https://github.com/MHSanaei/3x-ui/commit/b98f947e)
- [fix(tgbot): send the admin traffic reports as one message](https://github.com/MHSanaei/3x-ui/commit/c7518c40) (#6490) @BlindMaster24
- [fix(tgbot): keep the add-client draft with the chat that owns it](https://github.com/MHSanaei/3x-ui/commit/1691c9ca) (#6499) @BlindMaster24
- [fix(tgbot): render a disabled start-after-first-use client as days](https://github.com/MHSanaei/3x-ui/commit/e98be4f7) (#6500) @BlindMaster24
- [fix(discord): page the inbounds reply within Discord's embed caps](https://github.com/MHSanaei/3x-ui/commit/d45a09d6) (#6496) @BlindMaster24
- [fix(discord): drop the gateway connection when heartbeats go unanswered](https://github.com/MHSanaei/3x-ui/commit/5c34baa8) (#6497) @BlindMaster24
- [fix(discord): report a start-after-first-use client as days, not unlimited](https://github.com/MHSanaei/3x-ui/commit/cc60cefe) (#6498) @BlindMaster24
- [fix(api): return 401 for invalid Bearer token instead of 404](https://github.com/MHSanaei/3x-ui/commit/bdd351bd) (#6459) @mrchatam
- [fix(web): restart panel after ImportDB so subPath routes match](https://github.com/MHSanaei/3x-ui/commit/435ed976) (#6456) @mrchatam
- [fix(settings): show the SMTP failure reason instead of a raw i18n key](https://github.com/MHSanaei/3x-ui/commit/efc603f5)
- [fix(ui): keep the empty-group placeholder legible in dark mode](https://github.com/MHSanaei/3x-ui/commit/0fbdf0f9)
- [fix(logs): standardize login and logout logs](https://github.com/MHSanaei/3x-ui/commit/4760ccab) (#6484) @Mapioe
- [fix(logs): stop logging a successful login twice](https://github.com/MHSanaei/3x-ui/commit/de18c5a0) (#6374) @Mapioe
- [fix(cli): let -getApiToken name the token it regenerates](https://github.com/MHSanaei/3x-ui/commit/d2ac3b4d) (#6405) @rokokol
- [fix(api-docs): generate request bodies for all encodings](https://github.com/MHSanaei/3x-ui/commit/0ff3c239) (#6296) @rokokol
- [fix(database): keep the SQLite store owner-only](https://github.com/MHSanaei/3x-ui/commit/23511108) (#6390) @rokokol
- [fix(geofile): verify downloaded geo databases against published digests](https://github.com/MHSanaei/3x-ui/commit/fc05249e) (#6404) @rokokol
- [fix(install): fetch x-ui.sh and unit files from the installed release tag](https://github.com/MHSanaei/3x-ui/commit/195988bd) (#6391) @rokokol
- [fix(x-ui.sh): put the fail2ban backend override in jail.d, not jail.conf](https://github.com/MHSanaei/3x-ui/commit/4019f47d) (#6392) @rokokol
<h3> Reports </h3>

## New Contributors
* @VibeProgramm made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6326
* @duqigit made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6333
* @momachka2 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6337
* @BlindMaster24 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6340
* @TheMRVX made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6349
* @Mapioe made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6374
* @YoungReckless4 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6376
* @Namso9 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6380
* @T3RR7 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6398
* @LineGM made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6409
* @atirna made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6420
* @Pejman-Yousefi-Official made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6434
* @King19950905 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6451
* @poise52 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6486
* @NgaiYeanCoi made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6494
* @alireza4682 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6502
* @JacktheRanger made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6517
**Full Changelog**: https://github.com/MHSanaei/3x-ui/compare/v3.7.0...v3.8.0