## 🚀 Native TUIC, Tunnels on Nodes, Xray-core v26.9.30 & Reliable Client Resets - 🚀 **Native TUIC v5 server** — TUIC now runs inside the panel in Go, with no external binary to download, BBR congestion control and crash-safe traffic accounting. - 🌐 **AmneziaWG, TUIC & MTProto on nodes** — these inbounds can now be created and cloned from the master straight onto a node. - ⚙️ **Xray-core v26.9.30** — stored XDNS masks and WireGuard outbound settings are migrated to the new core's shape automatically. - 🔁 **Client lifecycle you can trust** — resets, renewals and quota cuts now reach every counter on every node, and saving an inbound or editing a client no longer reverts changes made in the meantime. - 🤖 **Telegram bot access levels** — unknown accounts are locked out, customers link themselves with an invite link, and admins can broadcast to every client. - 🗓️ **Weekly calendar renewal** — clients can renew on a fixed weekday, with a preview of the upcoming schedule. - 📦 **Subscription controls** — hide an inbound from subscriptions without disabling it, carry traffic through export/import, and set the User-Agent used for external subscriptions. - 🔐 **Security hardening** — API token rotation, database restore, certificate fetching and the bot's command surface are all tightened. --- ## ⚠️ Before you upgrade ### Action required - `/panel/api/inbounds/update` and the inbound JSON editor no longer change which clients an inbound holds, their enable/expiry/quota/renewal fields, or the inbound's own enable flag — **do this:** move any script that edits clients through an inbound update to the client endpoints, and use `/panel/api/inbounds/setEnable/:id` to switch an inbound on or off. - The Telegram bot now answers only `/start` and `/id` for accounts that are not linked to a client or listed as an admin — **do this:** link customers who used `/usage` or `/status` by setting their Telegram ID on the client, or send them the new invite link from the client card. - XDNS finalmask changed its wire format in Xray-core v26.9.30 — **do this:** update clients that use an XDNS mask to a core of v26.9.30 or newer, or they will not connect. - Weekly renewal is ignored by older binaries, and an older panel's depleted-client cleanup can delete a weekly-only client — **do this:** upgrade every node before enabling weekly mode, and convert weekly clients to another mode before any downgrade. - Deploying an AmneziaWG, TUIC or MTProto inbound to a node is refused when the node is older than the release that introduced the protocol (MTProto v3.5.0, AmneziaWG v3.7.0, TUIC v3.8.0) — **do this:** upgrade the node first. - WireGuard and AmneziaWG `allowedIPs` that overlap another client's range are now rejected; existing overlapping clients keep working but cannot be saved until fixed — **do this:** narrow such ranges (for example `10.10.2.9/24` → `10.10.2.9/32`) when editing them. - Self-built Docker images: the frontend stage now uses Node 26 — **do this:** rebuild from the updated `Dockerfile`; an older copy fails at `npm ci`. ### Automatic — no action needed - One-time startup migrations rewrite stored XDNS finalmasks (inbounds, hosts, Xray template, JSON-subscription mask, cached outbound subscriptions) into the new object shape, and move a WireGuard outbound's `domainStrategy` to `sockopt.domainStrategy` / `targetStrategy` (`remoteDNS: "local"` becomes `targetStrategy`). They also add the `excludeFromSub` and weekly-renewal columns and the `node_pending_resets` and `tuic_traffic_receipts` tables. A migration failure stops the panel from starting. - The install and update scripts remove the old `tuic-server` binary, its `bin/tuic` configs and any leftover processes; TUIC inbounds come back up on the built-in server. - `x-ui setting -getApiToken -tokenName <name>` now keeps the regenerated token's scope and expiry instead of turning it into a non-expiring admin token; an already expired token is refused rather than rotated. - The panel fetches the sponsor list from `sponsors.sanaei.dev` at most once an hour and proxies sponsor logos itself, so admin browsers never contact a third party. ### Requirements Go 1.27.1 · Xray-core v26.9.30 · Node 26 (only for building the frontend from source) --- ### 🔐 Security - Regenerating a named API token from the CLI no longer silently turns a scoped or expiring token into a permanent full-admin one ([#6700](https://github.com/MHSanaei/3x-ui/pull/6700)) @rokokol - Fetching a remote certificate for pinning now refuses private and loopback addresses unless the admin confirms, matching the REALITY target scan ([`ede275e4`](https://github.com/MHSanaei/3x-ui/commit/ede275e4)) - Restoring a SQL dump can no longer open or create any database file other than the panel's own ([`d31465e3`](https://github.com/MHSanaei/3x-ui/commit/d31465e3)) - The Telegram bot no longer lets unlinked accounts run client commands or press client buttons; invite-link claims are rate-limited and cannot be used to probe for valid subscription IDs ([#6518](https://github.com/MHSanaei/3x-ui/pull/6518)) @pcxzs - Saving an inbound no longer restores a client that was deleted while the edit dialog was open, which brought revoked credentials back to life ([`823db059`](https://github.com/MHSanaei/3x-ui/commit/823db059)) - Subscriptions can tell supported client apps to require authentication on their local SOCKS/HTTP proxy, so other apps on the device can no longer use it to bypass per-app routing or learn the server address ([#6628](https://github.com/MHSanaei/3x-ui/pull/6628)) @rudenko-ks ### 🆕 New - TUIC v5 is now served by a native in-process Go server with BBR/New Reno congestion control, native and QUIC UDP relay, full Xray routing and a durable traffic journal — no external binary ([#6577](https://github.com/MHSanaei/3x-ui/pull/6577)) @poise52 - AmneziaWG, TUIC and MTProto inbounds can be created and cloned onto nodes from the master ([`ed31ee43`](https://github.com/MHSanaei/3x-ui/commit/ed31ee43)) - Calendar weekly renewal, plus a preview of upcoming renewal dates in the individual and bulk client forms ([#6524](https://github.com/MHSanaei/3x-ui/pull/6524)) @JacktheRanger - Telegram bot invite links: the client card offers a link that binds the first account to open it ([#6518](https://github.com/MHSanaei/3x-ui/pull/6518)) @pcxzs - Telegram bot `/broadcast` sends any admin message — text, media or a whole album — to every linked client, with progress and cancel ([#6510](https://github.com/MHSanaei/3x-ui/pull/6510)) @DIMFLIX - Per-inbound "exclude from subscription" hides an inbound's links while it keeps serving and counting traffic ([#6463](https://github.com/MHSanaei/3x-ui/pull/6463)) @mrchatam - Portable client export/import now carries traffic counters, without inflating group totals ([#6469](https://github.com/MHSanaei/3x-ui/pull/6469)) @mrchatam - Visual routing-profile editor for client apps, with optional ad blocking and a LAN-bypass preset ([#6545](https://github.com/MHSanaei/3x-ui/pull/6545)) @NgaiYeanCoi - App-management subscription headers for a second client app: per-app split tunnelling, fragmentation, UDP noise, DoH pre-resolution, banners and more ([#6650](https://github.com/MHSanaei/3x-ui/pull/6650)) @DIMFLIX - Configurable User-Agent for fetching external subscriptions ([#6613](https://github.com/MHSanaei/3x-ui/pull/6613)) @mrchatam - `x-ui setting -getApiToken -tokenScope <scope>` chooses the scope of the issued token ([#6700](https://github.com/MHSanaei/3x-ui/pull/6700)) @rokokol - Finalmask noise items accept the new tag-expression type, and TUN exposes the new gateway-DNS and leak-block options ([`62423cac`](https://github.com/MHSanaei/3x-ui/commit/62423cac)) - Sponsor slots on the overview, sidebar and login page plus a Sponsors page, with scheduled start dates; each slot can be hidden for 24 hours ([`fd7b3559`](https://github.com/MHSanaei/3x-ui/commit/fd7b3559), [`09617f04`](https://github.com/MHSanaei/3x-ui/commit/09617f04), [`dcaadd48`](https://github.com/MHSanaei/3x-ui/commit/dcaadd48)) ### ⚡ Improved - Xray-core updated to v26.9.30 ([`62423cac`](https://github.com/MHSanaei/3x-ui/commit/62423cac)) - Go, frontend and docs dependencies refreshed; the frontend baseline is now Node 26 / npm 11 ([`86302d2f`](https://github.com/MHSanaei/3x-ui/commit/86302d2f), [`99bc68fa`](https://github.com/MHSanaei/3x-ui/commit/99bc68fa)) - TUIC throughput through Xray rises from about 2.4 to 3.4 Gbit/s on loopback with BBR ([#6577](https://github.com/MHSanaei/3x-ui/pull/6577)) @poise52 - The client-app settings page is folded from seven tabs into four ([`8f47b538`](https://github.com/MHSanaei/3x-ui/commit/8f47b538)) - The test suite runs several times faster and isolates each package on PostgreSQL ([`12d51d71`](https://github.com/MHSanaei/3x-ui/commit/12d51d71), [#6594](https://github.com/MHSanaei/3x-ui/pull/6594)) @n0ctal - README screenshots refreshed for the current UI ([`17d7dd46`](https://github.com/MHSanaei/3x-ui/commit/17d7dd46)) ### 🐞 Fixed **Clients & traffic** - Saving an inbound no longer reverts client renewals, expiry, quotas, clients added meanwhile, the inbound's enable switch or traffic counted while the dialog was open ([`1110caaa`](https://github.com/MHSanaei/3x-ui/commit/1110caaa), [`823db059`](https://github.com/MHSanaei/3x-ui/commit/823db059)) - Adding, editing or deleting a client no longer undoes a renewal of another client that committed at the same moment ([`63ffc083`](https://github.com/MHSanaei/3x-ui/commit/63ffc083)) - A client traffic reset now reaches every node hosting the client and the MTProto quota, so a reset client is no longer switched off again on the next tick ([`4210a50c`](https://github.com/MHSanaei/3x-ui/commit/4210a50c)) - A client that ran out of quota or time is now dropped from every inbound it belongs to, not only the last one it was attached to ([`7c84ca96`](https://github.com/MHSanaei/3x-ui/commit/7c84ca96)) - Resetting an inbound's traffic on a node now hits that inbound instead of an unrelated one ([#6717](https://github.com/MHSanaei/3x-ui/pull/6717)) @ChesterFishmansWork **Subscriptions** - JSON subscriptions for REALITY inbounds with a Host SNI no longer ship a config the client core refuses to start ([#6691](https://github.com/MHSanaei/3x-ui/pull/6691)) @FZ1010 - WireGuard, AmneziaWG and TUIC configs now advertise the inbound's Hosts on every surface, not the panel address ([`aee45ca3`](https://github.com/MHSanaei/3x-ui/commit/aee45ca3)) - A client on several WireGuard/AmneziaWG inbounds now gets each inbound's own keys and address in its subscription ([#6653](https://github.com/MHSanaei/3x-ui/pull/6653)) @mvanhorn **Protocols** - Hysteria client changes are applied live instead of restarting the inbound and stalling every connected client ([#6606](https://github.com/MHSanaei/3x-ui/pull/6606)) @iblchv - A WireGuard `allowedIPs` written as `10.10.2.9/24` can no longer claim other clients' traffic ([`c8a182b6`](https://github.com/MHSanaei/3x-ui/commit/c8a182b6)) <details><summary>All 45 fixes in this release</summary> **Clients & traffic** - Saving an inbound no longer reverts client renewals, expiry, quotas, clients added meanwhile, the inbound's enable switch or traffic counted while the dialog was open ([`1110caaa`](https://github.com/MHSanaei/3x-ui/commit/1110caaa), [`823db059`](https://github.com/MHSanaei/3x-ui/commit/823db059)) - Adding, editing or deleting a client no longer undoes a renewal of another client that committed at the same moment ([`63ffc083`](https://github.com/MHSanaei/3x-ui/commit/63ffc083)) - A traffic reset no longer leaves a quota-disabled client looking enabled while it is dropped from the core ([`feb8451b`](https://github.com/MHSanaei/3x-ui/commit/feb8451b)) - A client traffic reset now reaches every node hosting the client and the MTProto quota, so a reset client is no longer switched off again on the next tick ([`4210a50c`](https://github.com/MHSanaei/3x-ui/commit/4210a50c)) - Resetting inbound traffic no longer hands every MTProto client a fresh quota, and a per-inbound client reset no longer touches other inbounds ([`fb7418f7`](https://github.com/MHSanaei/3x-ui/commit/fb7418f7)) - A client that ran out of quota or time is now dropped from every inbound it belongs to, not only the last one it was attached to ([`7c84ca96`](https://github.com/MHSanaei/3x-ui/commit/7c84ca96)) - Resetting an inbound's traffic on a node now hits that inbound instead of an unrelated one ([#6717](https://github.com/MHSanaei/3x-ui/pull/6717)) @ChesterFishmansWork - Inbounds exported from v2.x panels import again ([`15d82a5e`](https://github.com/MHSanaei/3x-ui/commit/15d82a5e)) - A WireGuard `allowedIPs` written as `10.10.2.9/24` can no longer claim other clients' traffic ([`c8a182b6`](https://github.com/MHSanaei/3x-ui/commit/c8a182b6)) - Client search and group filter match names with non-ASCII capitals ([#6685](https://github.com/MHSanaei/3x-ui/pull/6685)) @freeb5d - Changing a client's device limit can no longer be overwritten by a concurrent traffic cycle ([#6591](https://github.com/MHSanaei/3x-ui/pull/6591)) @n0ctal - IP-limit bans reach fail2ban only after the scan is saved, so a failed save can no longer ban addresses the panel never recorded ([#6590](https://github.com/MHSanaei/3x-ui/pull/6590)) @n0ctal - On PostgreSQL, concurrent IP-limit updates no longer drop node-reported IPs ([#6612](https://github.com/MHSanaei/3x-ui/pull/6612)) @mrchatam **Subscriptions & links** - JSON subscriptions for REALITY inbounds with a Host SNI no longer ship a config the client core refuses to start ([#6691](https://github.com/MHSanaei/3x-ui/pull/6691)) @FZ1010 - Spider settings in a REALITY spiderX query are kept in share links and JSON subscriptions ([#6694](https://github.com/MHSanaei/3x-ui/pull/6694)) @FZ1010 - VLESS REALITY share links carry the ML-KEM key-exchange hint ([#6712](https://github.com/MHSanaei/3x-ui/pull/6712)) @libmur-dev - Fragment settings export in a form older client cores understand, and inbounds with UDP-only masks no longer break the QR, info and export views ([#6702](https://github.com/MHSanaei/3x-ui/pull/6702)) @artemk1337 - WireGuard, AmneziaWG and TUIC configs now advertise the inbound's Hosts on every surface, not the panel address ([`aee45ca3`](https://github.com/MHSanaei/3x-ui/commit/aee45ca3)) - A client on several WireGuard/AmneziaWG inbounds now gets each inbound's own keys and address in its subscription ([#6653](https://github.com/MHSanaei/3x-ui/pull/6653)) @mvanhorn - Clash subscriptions include the Hysteria2 certificate pin, so self-signed certificates are accepted ([#6651](https://github.com/MHSanaei/3x-ui/pull/6651)) @libmur-dev - Clash subscriptions keep the encryption of external VLESS links ([#6576](https://github.com/MHSanaei/3x-ui/pull/6576)) @SakikoTogawa0214 - The server description in external link remarks is no longer mangled ([#6580](https://github.com/MHSanaei/3x-ui/pull/6580)) @sdhfsl - Outbound subscription fetches send the same device ID as external links, so device-limited providers count the panel once ([#6579](https://github.com/MHSanaei/3x-ui/pull/6579)) @sdhfsl - Behind a proxy that sends only `X-Real-IP`, links no longer advertise the subscriber's own IP as the server ([#6608](https://github.com/MHSanaei/3x-ui/pull/6608)) @mrchatam - The JSON-subscription template no longer triggers a deprecation warning for its direct outbound ([#6609](https://github.com/MHSanaei/3x-ui/pull/6609)) @mrchatam - Downloads on phones keep their file name, so `peer.conf` is no longer saved as `peer.conf.txt` ([`99047c0a`](https://github.com/MHSanaei/3x-ui/commit/99047c0a)) **Protocols & core** - Hysteria client changes are applied live instead of restarting the inbound and stalling every connected client ([#6606](https://github.com/MHSanaei/3x-ui/pull/6606)) @iblchv - An IPv4 inbound can share a port with an IPv6-only wildcard inbound ([#6603](https://github.com/MHSanaei/3x-ui/pull/6603)) @lin-finegold - `config.json` is written after a hot apply, so config backups no longer upload stale rules ([#6686](https://github.com/MHSanaei/3x-ui/pull/6686)) @freeb5d - AmneziaWG no longer redirects connections to a sniffed domain, and its IPv6 egress no longer breaks IPv4 traffic ([#6654](https://github.com/MHSanaei/3x-ui/pull/6654)) @rudenko-ks - AmneziaWG padding and header ranges are validated the way the engine enforces them, accepting real configs that were refused and rejecting ones that would fail to start ([#6642](https://github.com/MHSanaei/3x-ui/pull/6642)) @rudenko-ks - AmneziaWG tunnels without IPv6 stop resolving AAAA records, and the outbound form exposes I2–I5 ([#6611](https://github.com/MHSanaei/3x-ui/pull/6611)) @mrchatam - AmneziaWG inbounds and outbounds work on Windows builds ([`044e2926`](https://github.com/MHSanaei/3x-ui/commit/044e2926), [`75f3702d`](https://github.com/MHSanaei/3x-ui/commit/75f3702d)) - The node-token key file loads on Windows ([`3fc3992a`](https://github.com/MHSanaei/3x-ui/commit/3fc3992a)) **Bots** - The Telegram bot picks up Panel Outbound when Xray starts after it, instead of staying unreachable on filtered hosts ([`bb18734c`](https://github.com/MHSanaei/3x-ui/commit/bb18734c)) - The bot's individual-links and QR actions work when the subscription host does not resolve from the server ([`4df570b3`](https://github.com/MHSanaei/3x-ui/commit/4df570b3)) - The bot's add-client wizard offers WireGuard and AmneziaWG inbounds and no longer shows an empty picker ([#6621](https://github.com/MHSanaei/3x-ui/pull/6621)) @romus204 - Two admins in one group chat no longer share one add-client wizard ([#6604](https://github.com/MHSanaei/3x-ui/pull/6604)) @sdhfsl **Panel & system** - Panel navigation recovers after an update leaves the browser with stale page chunks ([#6679](https://github.com/MHSanaei/3x-ui/pull/6679)) @mvanhorn - The Syslog view no longer hangs on a slow journal ([#6689](https://github.com/MHSanaei/3x-ui/pull/6689)) @freeb5d - On EL7, firewalld pulled in by fail2ban no longer blocks the panel's ports ([#6688](https://github.com/MHSanaei/3x-ui/pull/6688)) @freeb5d - The `x-ui` menu opens instantly on hosts with large journals ([`092cbd55`](https://github.com/MHSanaei/3x-ui/commit/092cbd55)) - A legacy inbound-tag cleanup no longer fails every startup migration when its target tag already exists ([#6592](https://github.com/MHSanaei/3x-ui/pull/6592)) @n0ctal - The Docker image builds again ([`9b957b96`](https://github.com/MHSanaei/3x-ui/commit/9b957b96)) - The REALITY "Min Client Ver" hint states which cores accept every client when the field is empty ([`3308c816`](https://github.com/MHSanaei/3x-ui/commit/3308c816)) </details> --- ### Reports  ### New Contributors * @pcxzs made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6518 * @SakikoTogawa0214 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6576 * @lin-finegold made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6603 * @iblchv made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6606 * @romus204 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6621 * @rudenko-ks made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6628 * @libmur-dev made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6651 * @freeb5d made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6685 * @artemk1337 made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6702 * @ChesterFishmansWork made their first contribution in https://github.com/MHSanaei/3x-ui/pull/6717 **Full Changelog**: https://github.com/MHSanaei/3x-ui/compare/v3.8.10...v3.9.0