0.17.41

• Fix TUIC and Juicity don't work with server-speaks-first protocols.
• Workaround mieru stuck on close (again).
• Fix the lifecycle of ECH config for TUIC and Juicity.
• Fix proxying DNS.
• Add SSH keepalive.
• Add global and per-profile "OmitMaxDatagramFrameSize" option for Hysteria 2. ¹
• Behavior change: DNS HTTPS query for ECH config now respects "resolve destination (server address)".

The custom v2ray-core fork used by Exclave will soon have a new name. It has long been diverted from the original project and it is a de facto separate project. Future updates will no longer rebase on top of v2ray-core.

1. Do not add max_datagram_frame_size parameter to QUIC Client Hello. Hysteria 2 mimics itself as HTTP/3, but it uses QUIC datagram to relay UDP, which will add a cleartext max_datagram_frame_size parameter to QUIC Client Hello and make it different from a normal QUIC Client Hello of HTTP/3. By modifying QUIC, Hysteria 2.8.2 does not send max_datagram_frame_size but it is still able to use QUIC datagram. This is a breaking change and does not comply with QUIC datagram specification. If the Hysteria 2 server does not support this breaking change, UDP will be unusable. ↩

shadowquic-plugin-0.3.5

Update plugin submodules

0.17.39

• Upgrade Go from 1.25 to 1.26 ¹.
• Fixes and improvements.

---

Notable Go 1.26 changes:

• The hybrid SecP256r1MLKEM768 and SecP384r1MLKEM1024 post-quantum key exchanges are added to TLS.
• Malformed URLs containing colons in the host subcomponent (such as http://::1/ or http://localhost:80:80/) are now rejected by the URL parser. URLs containing bracketed IPv6 addresses, such as http://[::1]/ are still accepted.

---

1. Fix #329 (golang/go#77621) and #51 (golang/go#46893). ↩

0.17.38

• Fix Hysteria 2 port hopping interval.
• Fix Hysteria 2 port hopping stuck on close.

0.17.37

• Replace SimpleMenuPreference with a custom DropDownPreference to resolve various display issues.
• Fix Mux.Cool XUDP crash.
• Skip Mux.Cool PacketAddr for domain name destination addresses.

0.17.36

• Merge Hysteria 2.8.2 changes except for the meaningless breaking change that breaks UDP forwarding.
• Update mieru to 3.32.0.
• Fix XHTTP browser dialer CSRF token.

0.17.35

• Refactor the IPC mechanism between the proxy core and Exclave to prevent Exclave itself being blocked by some overkilled blocking rules. No functions will become unavailable with SOCKS5 inbound disabled.
• Display a warning if both username/password authentication and UDP are enabled for SOCKS5 inbound. SOCKS5 UDP is not protected by username/password authentication. If UDP is enabled, the authentication can be bypassed easily.
• Refine the multiplexing of HTTP/3 proxy and TrustTunnel.
• Add "use group front proxy" and "use group landing proxy" for balancer (by @akellavk).
• Replace Takisoft PreferenceX with AndroidX Preference and replace Takisoft's SimpleMenuPreference with Rikka's SimpleMenuPreference.

0.17.34

Compared to 0.17.31-beta.1:

• Revert the polluted French translation.
• Update mieru to 3.31.0. This is a breaking change of the mieru protocol. Old versions of this app will not be able to connect to a server with the updated mieru protocol enforced.
• Fix TLS-based protocols unable to connect if SNI is not filled.
• Routing rule import and export include package name rules.

0.17.33

Compared to 0.17.31-beta.1:

• Revert the polluted French translation.
• Update mieru to 3.31.0. This is a breaking change of the mieru protocol. Old versions of this app will not be able to connect to a server with the updated mieru protocol enforced.
• Fix TLS-based protocols unable to connect if SNI is not filled.

0.17.31-beta.1

• Fix HTTP/2 outbound panic on error.
• Fix package name matching error on non-main users.
• Remove TrustTunnel HTTP/1.1 support and use HTTP/2 or quic-go HTTP/3 internal connection pool.
• Allow to disable SOCKS5 inbound, disable SOCKS5 inbound UDP support, and set username and password for SOCKS5 and HTTP inbounds. However, if SOCKS5 inbound or SOCKS5 inbound UDP support is disabled, the function of some additional tools will be limited.
• Allow to manually specify custom package name or UID in routing instead of using the internal app picker.
• Change how custom configuration works. This is a breaking change. See the wiki for details.

See here for the statement regarding the so-called "critical vulnerability" farce.