What's Changed

• ea19cda0 feat: add rematch outbound type and REMATCH-NAME rule type (#2862) by @Peter Solomon
• d20e8508 feat: support custom peer-info for openvpn outbound (#2926) by @Easy-Ez
• 1686d563 feat: convert support session-table and session-length for xhttp-opts fields (#2889) by @legiz-ru
• 01111ffa feat: add handshake-timeout for masque by @wwqgtxx
• 1c4f7c4d feat: support shadow-tls for snell by @wwqgtxx
• 1f80d915 feat: support session-table and session-length for xhttp client by @wwqgtxx
• 2f510e86 feat: support tlsmirror for vmess by @wwqgtxx
• 7870f8f8 feat: add handshake-timeout for OpenVPN by @wwqgtxx
• 8c40e360 feat: support fallback-lazy-query for dns section by @wwqgtxx
• 8e2aba40 feat: support network: h3-l4proxy for masque outbound by @wwqgtxx
• a1985813 feat: support mkcp for vmess by @wwqgtxx
• a1c09adb feat: support restls for shadowsocks listener by @wwqgtxx
• ad730ae9 feat: support listen-routing-mark for dns section by @wwqgtxx
• be9164e5 feat: add default-selected for select group by @wwqgtxx
• d67572bb feat: support routing-mark for listeners except tun/redir/tproxy and top-level external-controller-routing-mark by @wwqgtxx
• e10a1a70 feat: support mekya for vmess by @wwqgtxx
• 85c1798f break(restful api): restore original Clash /proxies behavior by @xishang0128 BUG & Fix
• 1f933341 fix: udp WriteTo returned wrong count by @wwqgtxx
• 26edbaae fix: dualStackDialContext not close the fallback connection when the preferred IP family won by @kasumikira
• 2cd1443c fix: prevent snell pool from reusing unready connections (#2878) by @xream
• 42810015 fix: restore the original fallback concurrency behavior by @wwqgtxx
• 45ca4ae1 fix: preserve shadow-tls in-user for snell listeners (#2934) by @xream
• 578b8819 fix: add missing json tags to raw config structs (#2939) by @Chenx Dust
• 59ffb637 fix: scStreamUpServerSecs not working when xPaddingObfsMode is true by @wwqgtxx
• 5ab5eb31 fix: snell v2 listener can't pass test by @wwqgtxx
• 5b54b3ad fix: panic when dial failed in masque by @wwqgtxx
• 63e4d5a3 fix: TUIC v5 fragmented UDP reads in quicStreamPacketConn.ReadFrom (#2942) by @Aaron Chen
• 73740c77 fix: wrong realm resolver when only IPv6 is requested by @rumianoesa
• 793f61ec fix: crash in AmneziaWG receive path with slice bounds out of range when S4 is larger than incoming packet by @wwqgtxx
• 94a7a3f3 fix: udp write in sing-mux by @wwqgtxx
• d08c8853 fix: writeSem initiation in OpenVPN by @roy.lieu
• d924f1ca fix: CVE-2026-42505 for crypto/tls by @wwqgtxx
• e3972e78 fix: apply TUIC v5 UDP relay size clamp when building server options (#2943) by @Aaron Chen
• e64f58f3 fix: panic when rand.IntN calling on a nil slice by @wwqgtxx Maintenance
• 02dd143f chore: relax version restrictions for the snell listener by @wwqgtxx
• 084a09e4 chore: export internal function for api user by @wwqgtxx
• 0daa3ff7 chore: allow overriding inbound listen config for api user by @wwqgtxx
• 10950551 chore: upgrade bbolt to 1.5.0 by @wwqgtxx
• 174cba4c chore: update sing-tun by @wwqgtxx
• 1e76df73 chore: better group config parsing by @wwqgtxx
• 24b6de71 chore: lazy init reality server cert by @wwqgtxx
• 26e3d220 chore: peer should set to expire unconditionally in tailscale-wireguard-go by @wwqgtxx
• 27efee2d chore: cleanup unused code in OpenVPN by @wwqgtxx
• 2c6ff725 chore: bump mieru version to 3.34.0 (#2899) by @enfein
• 38fd8974 chore: sync common/maphash code by @wwqgtxx
• 3b85577f chore: make bbolt work on non-mmap supported platforms by @wwqgtxx
• 6414c563 chore: reduce one unnecessary slice copy operation by @wwqgtxx
• 7031b756 chore: update quic-go to 0.60.0 by @wwqgtxx
• 76bf8401 chore: code cleanup by @wwqgtxx
• 85c2f6a7 chore: change the type of the internal value being passed by @wwqgtxx
• 93d33faa chore: increase REALITY target TLS record buffer to 16 KiB by @wwqgtxx
• acbc92f0 chore: better mieru inbound test implementation by @wwqgtxx
• aff8dc73 chore: adjust struct name by @wwqgtxx
• bcfd434d chore: update chi to 5.3.0 by @wwqgtxx
• cbd11db1 chore: converter map hysteria2 port hopping and realm URI (#2947) by @Peter Solomon
• d41d7579 chore: rename listener config to tlsmirror-config by @wwqgtxx
• da28fe33 chore: more code sharing by @wwqgtxx
• dc5c2ecc chore: change http method from GET to POST in listener test by @wwqgtxx
• de51c4b8 chore: cleanup interop test code by @wwqgtxx
• e3d67b32 chore: strictly forbidden to fill in a proxy group for empty-fallback by @wwqgtxx
• eca44d08 chore: update tfo-go ready for go1.27 by @wwqgtxx
• f62ebd0d chore: cleanup interop test code by @wwqgtxx
• f74bd8ba chore: adjust internal function return type by @wwqgtxx Full Changelog: https://github.com/MetaCubeX/mihomo/compare/v1.19.27...v1.19.28