hysteria-plugin-2.6.5

• Please be aware that although github.com/apernet/hysteria/app/v2 claims that it is licensed under the MIT License, some GPL libraries are imported:

  • github.com/apernet/sing-tun (GPL v3 or later), which is a fork of github.com/sagernet/sing-tun (GPL v3 or later)
  • github.com/sagernet/sing (GPL v3 or later)
    A common statement is that they got a "license exception" from the author of sing and sing-tun.

  We will remove published Hysteria 2 plugin APKs if we do not actually have the license to redistribute Hysteria 2 binaries.

mieru-plugin-3.21.0

Re-uploaded on Novemver 9, 2025 because the previous release used the incorrect version of mieru.

0.16.9

• Merge the changes of v2ray-core 5.41.0.
• Update Go to 1.25.3 to fix TLS verification failure for certificates with SANs with a trailing dot (golang/go#75828). This violates RFC but has been widely abused.
• Workaround the parsing failure for URLs containing IPv4-mapped IPv6 addresses in square brackets until Go fixes it (golang/go#75815, likely next month).
• Update uTLS to 1.8.1 to fix incorrect Chrome fingerprint (refraction-networking/utls#375).
• Rework the workaround for SIP003 plugin binary execution crash on Android 11 or lower until Go fixes it (golang/go#70508, no ETA).
• Refactor certificate prober. It now prints certificate fingerprint hash and display certificate verification error to inform users the result is untrustworthy. You can also manually input the certificate content to calculate certificate fingerprint hash.
• Fix URL scheme parsing being incorrectly case sensitive.

0.16.7-1

⚠️ This is a hotfix release for two bugs introduced in Go 1.25.2. This release used a patched Go 1.25.2 toolchain, and the patches are backported from Go master branch. Do not use this version unless you encounter these bugs. This version will not be published on F-Droid.

• Go 1.25.2 fixed CVE-2025-58187, but introduced a bug that causes TLS validation fails for SAN with trailing dot. This has been fixed in Go master branch.
• Go 1.25.2 fixed CVE-2025-47912, but introduced a bug that causes URL parsing fails for IPv4-mapped IPv6 address in square brackets. This has been fixed in Go master branch.

0.16.7

• Merge the changes of v2ray-core 5.40.0, which partially fixed the memory leak caused by the global variable abuse in "grpc" transport.
  Also apply similar fix for global variable abuse on instance close, and to "http" transport, "quic" transport, "hy2" transport, "xhttp" transport, HTTP/2 proxy and HTTP/3 proxy.
• Try to fix potential memory leak in DNS outbound.
• Fix mTLS (mutual TLS) of uTLS not working and add UI for mTLS. If a plugin does not support this, the software will fallback to use core implementation. It is added for compatibility reason only.
• Add certificate fingerprint SHA-256 pinning and certificate public key fingerprint SHA-256 pinning in addition to the existing private "certificate chain SHA-256 pinning" of V2Ray. "Skip certificate verification" is not silently enabled like some other software so they need to use with "skip certificate verification" if the certificate itself is untrusted or invalid. If a plugin does not support this, the software will fallback to use core implementation. They are added for compatibility reason only.

tuic-plugin-1.5.2

Update TUIC v5 plugin to 1.5.2

tuic-plugin-1.5.1

Update TUIC v5 plugin to 1.5.1

mieru-plugin-3.20.1

Update mieru plugin to 3.20.1

hysteria-plugin-2.6.4

⚠️This release contains a security fix for pinSHA256, which is also a behavior change. Everyone is strongly encouraged to upgrade.

Security fix & behavior change: tls.pinSHA256 now matches only the fingerprint of the leaf certificate, instead of any certificate in the chain. This change mitigates MITM risks in cases where insecure=true by preventing 1) user accidentally pinning a CA certificate, which would allow any certificate issued by that CA to be accepted, and 2) attacker constructing a forged certificate chain by combining their own leaf certificate with the user server's certificate.

See https://github.com/apernet/hysteria/releases/tag/app%2Fv2.6.4 for details.

• Please be aware that although github.com/apernet/hysteria/app/v2 claims that it is licensed under the MIT License, some GPL libraries are imported:

  • github.com/apernet/sing-tun (GPL v3 or later), which is a fork of github.com/sagernet/sing-tun (GPL v3 or later)
  • github.com/sagernet/sing (GPL v3 or later)
    A common statement is that they got a "license exception" from the author of sing and sing-tun.

  We will remove published Hysteria 2 plugin APKs if we do not actually have the license to redistribute Hysteria 2 binaries.

tuic-plugin-1.5.0

Update TUIC v5 plugin to 1.5.0