Merlin XrayUI

[0.71.0] - 2026-11-04

- ADDED: The X-RAY Core version shows newer than tested when the installed Xray-core is newer than the version this XRAYUI release was tested with. (#451)
- ADDED: Each new Xray-core release is now checked automatically for config settings it renamed or dropped, before XRAYUI is tested with it. (#450)
- ADDED: TCP transport has Header obfuscation with Request path and Host. gRPC outbounds have Authority and Multi mode.
- ADDED: The update dialog lists recent XRAYUI releases, so you can install an older one (downgrade) or reinstall the current one. A downgrade asks for confirmation first, because an older version may not understand settings saved by a newer one. (#409)
- ADDED: TCP keepalive idle and TCP keepalive interval in an inbound's or outbound's Transport → Sockopt settings. Xray leaves keepalive off on inbound connections, so a client that vanished without closing its connection, for example a phone that lost signal, kept it open for hours and the router slowly ran out of memory. With, for example, 300 and 30 such connections are closed in under 10 minutes. Keepalive values already set in config.json are now shown in the UI too. (#427)
- ADDED: Manage Balancers has an Observatory type: the observatory XRAYUI sets up from Check connection to xray server, or burstObservatory with its own probe address, network check, interval, sampling and timeout. A burstObservatory written into the Xray configuration by hand loads into the page and is kept on save. Auto-fallback does not run with burstObservatory, because it reports no probe times. (#416)
- ADDED: Auto-restart Xray if it stops in General Options. When Xray stops unexpectedly, XRAYUI restarts it within the chosen Watchdog check interval and reapplies the firewall rules. The wait between attempts doubles up to an hour, and it gives up after Max restart attempts (0 means no limit). A stop from the page or the command line is respected, and each automatic restart is written to the system log. (#424)
- ADDED: Auto-refresh subscriptions can run Every 30 minutes or Every hour. Its hint now says what a refresh updates: outbounds in the Auto-fallback pool only while Auto-fallback is on, and outbounds with a Subscription URL only when Xray starts. (#439)
- ADDED: Apply stops with a message naming the outbound when a VLESS or Trojan outbound has no TLS or REALITY and its server address is public, because Xray 26.9.9 and later refuse to start with it. For VLESS, VLESS Encryption is enough. Since Xray 26.10.31 only 10.x, 172.16–31.x, 192.168.x, fc00::/7, loopback and link-local addresses count as private, so a CGNAT address such as Tailscale's 100.x needs TLS or REALITY too. Local names such as nas or router.lan are allowed. (#447)
- ADDED: Use the router's CA store in an outbound's TLS settings, with Xray 26.10.21 and later. Since that version Xray checks server certificates against its own built-in set of root CAs instead of the router's, so a server whose certificate comes from a CA only the router trusts, such as a private CA, stops connecting after a core update. This option brings the old behaviour back. (#448)
- ADDED: In Manage routing rules each rule's outbound or balancer can be changed in its row, without opening the rule. Reassign… changes many rules in one step, disabled rules included: it moves all rules from one outbound or balancer to another, or replaces one inbound with another. It can also remove an inbound from the rules before you delete it; a rule that lists only that inbound is left unchanged, because without it the rule would apply to traffic from every inbound. Deleting an outbound or inbound that rules still use now points to Reassign…. (#464)
- FIXED: Renaming an outbound or inbound changed the routing rules with every key pressed, so a tag typed on the way to the new name could merge another outbound's rules into it. The rules are now updated once, when the editor closes, and a new tag that another outbound or inbound already uses is changed back to the old one. Disabled rules, a balancer's fallback outbound and the Dealer Proxy of outbounds chained through the renamed one are now renamed too. An outbound that another outbound uses as its Dealer Proxy can no longer be deleted, as that outbound would stop connecting. (#464)
- FIXED: TCP outbounds with HTTP header obfuscation (headerType=http) lost the header on import and save, so the server reset every connection. (#417)
- FIXED: Accept PROXY protocol on TCP inbounds was not saved.
- FIXED: Imported gRPC links lost their Service name, and HTTPUpgrade links their path and host. (#423)
- FIXED: A burstObservatory added to the Xray configuration by hand ran next to the observatory XRAYUI adds for Check connection to xray server, so balancers could use the wrong results.
- FIXED: Stop could leave a second copy of Xray running, such as one started at boot by an old Entware Xray package, so the page still showed Xray as running.
- FIXED: A stopped Xray could start again by itself when a subscription update or auto-fallback changed a server in the Auto-fallback pool.
- FIXED: With Check clients online status turned on, the page could show a stopped Xray as running.
- FIXED: Xray ignored the XHTTP padding obfuscation, Uplink HTTP method, session, sequence and uplink data settings whenever another option such as Uplink/Downlink Separation, XMUX Settings or Performance Tuning was set. With Xray 26.6.22 and later, Session ID placement was ignored in every case. (#421)
- FIXED: Split XHTTP connections with Uplink/Downlink Separation failed against servers that require padding obfuscation, because padding could not be set for the download connection. An empty Download Server Port made Xray connect to port 0. (#420)
- FIXED: Transfer Mode offered no packet-up, so GET as Uplink HTTP method could stop Xray from starting. (#421)
- FIXED: Port hopping (Enable UDP Hop) on Hysteria outbounds did nothing with Xray-core 26.3.23 and later: it was saved where only older cores read it, and Xray ignored it. It is now saved where the installed core reads it, as the udphop finalmask from 26.9.9 on, and existing settings move there on the next Apply. Importing a hy2:// link keeps its port range. Inbounds no longer show the option, since it never did anything on a server. (#441)
- FIXED: Choosing xicmp as the finalmask type saved nothing. It now has Unprivileged ICMP Socket and IP Addresses, the settings Xray-core 26.6.1 and later read; entries that are not IP addresses are flagged and left out, because Xray does not start with them. (#443)
- FIXED: The xdns finalmask saved a domain, which Xray-core 26.4.13 and later refuse to start with. It is offered only for older cores now. (#443)
- FIXED: Finalmasks set in config.json by hand that XRAYUI has no editor for, such as realm or filter, were removed on save. They are now kept as they are.
- FIXED: Xray 26.7.11 and later do not start with a Shadowsocks outbound set to none or plain. These methods are now offered only with older Xray, an outbound that still uses one shows a warning, and Apply stops with a message naming it. Share links and subscription servers without encryption are refused with a message, and auto-fallback and Subscription URL outbounds skip them. (#442)
- FIXED: Shadowsocks inbound clients could be added with none or plain, which Xray never accepts for inbound clients, so Xray did not start. These methods are no longer offered there, and Apply stops with a message naming the inbound and the client. (#442)
- FIXED: A VMess outbound set to none or zero silently used auto on Xray 26.7.11 and later, and one with no security chosen, or imported from a link without one, was saved as none, which turned encryption off on older Xray. An empty security now means auto on every version. With Xray 26.7.11 and later, none and zero are no longer offered and are saved as auto. (#442)
- FIXED: WireGuard settings that Xray no longer reads looked active but did nothing. On WireGuard inbounds, KERNEL Mode is replaced by No kernel TUN, as on outbounds; an inbound with kernel mode turned off keeps it off. Workers is removed from WireGuard outbounds, and their Domain strategy is shown only with Xray older than 26.9.30. The next Apply writes the keys Xray reads. (#444)
- FIXED: With Check clients online status on and Check connection to xray server off, Xray sent a health check through every outbound at each probe interval, though nothing used the results. Idle and reserve outbounds kept connecting to their servers. Now only the outbounds that balancers need are checked, and none if no balancer needs it. (#466)
- FIXED: Deleting the last outbound a balancer selects was allowed. Without a fallback outbound, Xray then sends that balancer's traffic through the first outbound in the list, which may be direct. Deleting such an outbound is now refused with a message. Apply asks for confirmation when a balancer selects no outbound and has no fallback outbound, for example because of a typo in its selector. (#467)
- REMOVED: Settings that Xray no longer reads, so changing them had no effect: inbound port allocation, Domain matcher in routing and in routing rules, and TCP No Delay in Sockopt. ECH Force Query in TLS settings and UDP over TCP on Shadowsocks outbounds are shown only with Xray older than 26.6.22. The next Apply drops these keys from the Xray configuration. (#445)
- CHANGED: When auto-fallback finds no working server in the pool, it can fetch the subscription sources again after 15 minutes instead of an hour, so a server the provider replaced after a ban is picked up sooner. (#439)
- CHANGED: XHTTP settings that Xray ignored before take effect after the first Apply on this version. Apply stops with a message naming the inbound or outbound when an XHTTP setting cannot work in its Transfer Mode, such as GET without packet-up.
- CHANGED: A fresh install gets Xray-core 26.9.9, the version this XRAYUI release was tested with, instead of the newest release. Newer Xray-core releases often rename or drop settings, and Xray ignores those without an error. xrayui update xray latest and the X-RAY Core version dialog still install any release. (#451)
- IMPROVED: Importing a link keeps the XHTTP settings from its extra parameter. Most Performance Tuning fields accept a range such as 1000-2000.
- IMPROVED: The system log warns when the firmware's Parental Control or Network Services Filter is on. Neither applies to devices whose traffic goes through Xray, because their rules are in the FORWARD chain, which redirected traffic never passes. The Bypass/Redirect Policy documentation explains how to keep a schedule working. (#415)
- IMPROVED: When auto-fallback or a scheduled subscription update skips a server that the installed Xray rejects, the system log now gives Xray's reason, such as a VLESS server without TLS. (#447)

What's Changed
- fix: update changelog for 0.70.3; enhance Xray stop handling and impr….
- chore(deps): bump markdown-it from 15.0.1 to 15.0.2 in the npmandyarn group across 1 directory.
- fix: pin markdown-it's entities to 8.0.0 so app.js builds again.
- Refactor xHTTP Settings Handling.
- chore: add the XHTTP changes from #425 to the 0.71.0 changelog.
- chore(deps): bump the npmandyarn group across 1 directory with 2 updates.
- fix: keep tcp http header and grpc/httpupgrade params on import and save.
- Load kernel modules with firmware modprobe instead of Entware kmod.
- feat(update): add downgrade version list.
- feat: TCP keepalive idle and interval in Sockopt settings (#427).
- Add burstObservatory as an alternative to observatory for balancers.
- feat: optional watchdog that restarts Xray when it stops unexpectedly.
- fix(watchdog): log restart and counter reset at notice level.
- feat(subscriptions): 30 min and hourly auto-refresh, faster pool re-fetch on failover.
- fix(firewall): warn when firmware Parental Control is bypassed by Xray.
- fix: save Hysteria port hopping where the core reads it; fi…