七麦数据

- Bug fixes and improvements.

Bug fixes

New Features
- Added pre-matching rules for low-overhead request rejection. Please refer to the documentation for details. https://manual.nssurge.com/policy/reject.html
- Body Rewrite supports using JQ expressions to manipulate JSON.
- The shadowsocks protocol adds support for the `2022-blake3-aes-256-gcm` and `2022-blake3-aes-128-gcm` encryption modes
- Adapted icon mode for iOS 18.
- New Control Center control for HTTP capture.
- DNS now supports system search domain settings
- Added parameter proxy-restricted-to-lan to restrict the proxy to only accept devices from the same subnet
- When updating external resources, ETag will be recorded and sent; re-download will not be triggered if the resource has not changed

Improvements
- Overall optimization and improvement of UDP forwarding.
- The policy group list view supports configuring custom icons.
- Resolved issues with real-time display on iOS 18
- Optimized the display effect of policy group icons
- Improved HTTP engine compatibility with non-standard requests
- More explicit error prompts when Surge is activated without a network connection
- Enhanced error handling logic for encrypted DNS, retrying immediately upon encountering errors
- Added warning messages for excessive [Host] entries
- The URL-REGEX rule now supports `extended-matching` tags.
- Allow the use of Ponte policy as an underlying proxy.

Bug Fixes
- Fixed an issue where Control Center/home screen widgets would still show as active even when Surge was turned off
- Fixed a memory leak issue in encrypted DNS under certain errors
- Corrected subscription cycle constraint errors for new icons
- Other bug fixes

- Control Center Widget: On iOS 18, you can now quickly toggle Surge in the Control Center.
- New Icon: Sapphire.
- Added Ponte diagnostic function for quickly locating Ponte-related issues, accessible from the Ponte device page.
- Port Hopping: Hysteria2 and TUIC protocol now support port hopping to improve ISP's QoS issues with UDP. See the server documentation for details.
- Added `[General]` parameter `show-error-page`, which is used to control whether Surge's HTTP error page is displayed when an error occurs. This parameter is enabled by default, and the behavior is consistent with previous versions.
- Bug fixes.

- New subscription feature: Custom policy group icons.
- Refactor the Surge tvOS profile deployment process using CloudKit, significantly improving stability. Please note that both Surge iOS and tvOS need to be upgraded to the latest version before you can use the profile deployment feature, and the tvOS version needs to be launched once for registration.
- When using the add rule function in the request list, you can choose to add it to an existing rule set. (Supports local rule files and inline rule sets).
- Optimized behavior when enabling IPv6 VIF under No Default Route mode.
- Other optimizations and bug fixes.

- Support turning off Surge via widgets/Shortcuts when the always-on switch is turned on.
- Support turning on Surge via widgets/Shortcuts when the Surge VPN Profile is not selected (or when other VPNs are running).
- Fix an issue where DOMAIN-SUFFIX rules may become invalid if duplicate DOMAIN and DOMAIN-SUFFIX rules are included in the rule set.
- Optimizations related to No Default Route mode, significantly improving usability.
- Other bug fixes.

- Now you can see the number of times a rule has been used in the rule list.
- Optimized the implementation method of blocking QUIC traffic to increase the likelihood of clients correctly falling back.
- The Smart group will use the SUBSTITUTE policy (DIRECT) instead of failing directly when there are no sub-policies.
- Fixed an issue where the `server-cert-fingerprint-sha256` parameter was not effective for TLS-like protocols with sni=off settings.
- Added a new rule type `HOSTNAME-TYPE`, used to determine the type of request hostname. Optional values are: `IPv4`, `IPv6`, `DOMAIN`, `SIMPLE`. (`SIMPLE` refers to hostnames without a dot, such as `localhost`)
- Optimized DNS request logs. Now more information is displayed. Additionally, if DIRECT policy connects directly without triggering DNS in the rule system, related DNS logs can still be shown.
- When deleting a policy that is being used by a policy group, it is now allowed to delete it directly and automatically remove it from all policy groups.
- Bug fixes and other Improvements.

- Optimize the matching performance of small rule sets, especially evident on older model CPUs.
- The external resource update page can display error information generated by rule set processing.
- Automatically ignore invalid empty lines in the rule set.
- Corrected the issue where applying temporary rules and then experiencing a policy change does not disrupt existing connections.
- Corrected the issue when using Ponte policy within Smart group, if the target device is itself, it failed to automatically switch to DIRECT policy.
- Corrected the problem of incorrect time displayed in request logs for Ponte device requests.
- Corrected crashes that may occur when external policy groups change.
- Fixed an issue where configuration upgrade functionality did not correctly take effect for managed configurations and enterprise configurations.
- During Smart group initialization phase, no longer displays most frequently used tags to avoid misunderstanding.
- Fixed an issue where local script files could not be automatically reloaded after being edited.
- Optimized indexing process for large rule sets.
- Limited maximum number of files for iCloud background auto auto-sync to 200 to avoid memory usage issues.
- Fixed potential UI display issues when adjusting policies through remote controller。

Smart Group

This is a new type of policy group, driven by our carefully designed algorithm engine, which can automatically select the appropriate policy from the sub-policies of this policy group. The goal of the Smart policy group is to replace the original automatic testing groups (url/load-balance/fallback), greatly optimizing the experience while minimizing the need for manual intervention in policy groups. Users only need to put the available policies into this group.

For details, see: https://kb.nssurge.com/surge-knowledge-base/guidelines/smart-group

Rule System
- Overall performance optimization of the rule system.
- Significant optimization of the indexing algorithm in large domain rule sets, improving the search efficiency by more than ten times for rule sets with more than 100,000 rules.
- Corrected the issue where sub-rules of logical rules within a rule set could not be covered by the `no-resolve` and `extended-matching` parameters of the rule set.
- Added a new rule type `DOMAIN-WILDCARD`, supporting `?` and `*` domain name matching.
- `DOMAIN-SET` and `RULE-SET` are changed to strict validation. If there are invalid lines in the file, the entire rule set will be invalidated to avoid problems caused by misuse.

IPv6
- The behavior of the `ipv6-vif` parameter has been modified. When set to always, IPv6 functionality will be enabled even if `ipv6=true` is not set.
- Added a warning for the `ipv6-vif=always` parameter.
- Adjusted the automatic retry mechanism. Accessing IPv6 addresses in a non-IPv6 network will no longer enter the retry process, and the request will fail immediately (solving the problem of some applications stalling when IPv6 VIF is enabled in a non-IPv6 environment, but the application will still continue to send IPv6 requests).

Other Optimizations
- Enhanced `$notification.post`, adding support for media resources, sound hints, and automatic dismissal.
- Optimized WireGuard failure handling.
- Reduced the power consumption of the TUIC protocol during sleep.
- Improved the precision of time statistics in the request log system, now accurate to µs level.
- Optimized various abnormal retry mechanisms, avoiding high resource usage caused by continuous retry in the face of some specific problems. For operations that need to be retried continuously (such as WireGuard reconnection, Ponte server reporting to iCloud), Surge will now retry after 0.1s, 0.5s, 1s, 5s, 10s, 30s after an error.
- Optimized the caching system for external resources.
- Added the profile line modifier `#!REQUIREMENT`.
- When the current network is found to be managed by Surge Mac Gateway, Surge iOS will now automatically pause. (This can be adjusted via the auto-suspend option, enabled by default.)
- Optimized TUN takeover and specific app performance compatibility issues.
- Optimized memory usage, infrequently used and large scripts will not be cached in memory anymore.
- The network diagnostics page adds SSID/BSSID with copy functionality.
- Now, when uploading logs in the log interface, the engine currently running will automatically generate the most recent verbose logs (the new version has cached 256KB of logs in memory), so when reporting problems, you can upload directly without needing to reproduce in verbose mode.
- For external resources related to policy groups and script types, the maximum size is now limited to 2MB, to avoid memory overflow in case of configuration errors.

Check the knowledge base for complete release note.

New Features
- New subscription feature: Body Rewrite. Surge now can rewrite the body of HTTP request or response, replacing the original content with regular expressions. If you need to make more flexible modifications, try scripting.

Improvements
- Comprehensive enhancement of the Mock (Map Local) function, adding data types such as text, tiny-gif, base64 to facilitate inline data return. Also added the ability to customize status codes.
- Optimized the request list filter, now displaying the filter at the top and allowing quick toggling of filter activation. Long-pressing a filter item displays a menu for deletion or reversing the item to a negative filter.
- Added recognition for STUN packets, which can be matched with PROTOCOL,STUN.
- Optimized the external resource management page.
- Optimized the script editor page.
- Optimized the module management page.
- Added a long-press shortcut menu to the Utilities tab.
- Added a new URL scheme for the iOS version: surge:///install-module?url=…

Optimizations
- When configuring Shortcuts to execute Surge scripts, the script list of the current configuration can now be directly accessed.
- Enhanced compatibility when decompressing HTTP Body.
- Optimized the script engine, limiting the number of concurrent JSC engine processes to 2 to avoid memory issues.
- The GeoIP database can now be updated by the main application without needing a restart to take effect.
- Optimized the request log, now displaying the specific rules matched for URL Rewrite and Header Rewrite.
- Adjusted the logic of the DNS engine handling empty results, now not waiting for all servers to respond with empty results when multiple DNS servers are configured, to avoid additional waiting when AAAA records do not exist..
- The module page allows undoing modifications to avoid misoperations that change the order of effectiveness.

Fixes
- Fixed the issue where warnings generated by module configurations were not displayed.
- Fixed a crash in Surge caused by passing some incorrect types of parameters in scripts.
- Fixed compatibility issues with non-https WebSockets in proxy mode with the new version of Safari.
- Fixed the issue where deleting an entry in the rule search page would delete all duplicate entries.
- Fixed some missing highlights in the editor.
- Other bug fixes.