Surge's Changelog

#iOS #TestFlight Surge 5 5.102.0 (3820) is ready to test on iOS. What to Test ### Smart Group - Added a graphical Policy Priority editor for Smart Groups on. ### Tailscale - Interactive sign-in now supports tailnets that require administrator device approval. Surge clearly indicates when sign-in has completed but the device is still awaiting approval. - Fixed Tailscale traffic becoming unavailable when the control server assigned the device a new tailnet address. - Improved recovery after network changes by retrying temporarily failed UDP bindings and refreshing direct-connect endpoints. - Improved WireGuard and Tailscale handling of multiple peers and expired connections. ### Profile and Automation - On iOS, profile changes made on disk or received through iCloud now reload automatically. If the updated profile is invalid, Surge keeps the working configuration active and reports the error. - Event scripts can now respond to `engine-started` and `profile-reloaded`, in addition to `network-changed`. ### Notifications - Added notification controls for new proxy clients, script notifications, and rule-matched notifications. - Local and remote notification category settings now correctly apply to dynamically generated alerts. - Disabling policy-group change notifications now also suppresses temporary group-override alerts. ### Fixed - Improved MITM certificate generation by using separate keys for generated leaf certificates and correcting the transmitted certificate chain. - Fixed QUIC connections potentially stalling after receive-side backpressure. - Fixed rare deadlocks involving cron-script shutdown and Vector UDP connections, including Ponte traffic. - Improved stability under heavy connection churn and local-port exhaustion. - Other small UI issues. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3819) is ready to test on iOS. What to Test ### Profile Format - Added wildcard detached-section includes for `[Ruleset *]`, `[WireGuard *]`, and `[Tailscale *]`. A single `#!include` can now load all matching named sections from another local or remote profile file. - Added `DEVICE_NAME` to the profile environment, enabling device-specific conditions in `#!REQUIREMENT`. - Fixed `[General]` values containing `#`, `//`, or `;` being truncated or changed after the profile was saved and reloaded. ### Tailscale - Improved interactive Tailscale sign-in reliability. Interrupted or silently disconnected login sessions now reconnect and continue the existing browser authorization flow instead of becoming stuck. ### Fixed - Fixed a rare crash when an HTTP/3 or other QUIC session closed synchronously while pending data was being processed. - Other fixes Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3818) is ready to test on iOS. What to Test ### UI - When navigating to a new page, the bottom tab bar is no longer hidden. This change was made to avoid triggering known UIKit UI glitches that can occur when the tab bar is hidden during push transitions. - The Script Editor now opens in a dedicated modal interface, with an updated toolbar, close action, and improved keyboard layout. - Remote Controller and Ponte Diagnostics are now available for all Ponte devices, including devices shared by another iCloud account. - Other UI improvements. ### Other Improvements - Updated the IPv6 fake-IP range to avoid unnecessary browser local-network permission prompts, while retaining compatibility with previously cached addresses. - Proxy connections closed during the protocol handshake now provide a clearer error message, with guidance to verify credentials, encryption methods, and protocol settings. - Fixed rare crashes that could occur when proxy connections were synchronously closed while data was being written. - Fixed recursive HTTP/3 timer processing that could cause a stack overflow under certain conditions. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.9.0-12090 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### VM Gateway - Improved Gateway Mode IPv6 takeover: Fixed an issue where takeover could suddenly fail on some devices. - IPv6 RDNSS in Surge has now been restored under IPv6 takeover mode. - Updated the IPv6 fake IP range to avoid unnecessary browser local network permission prompts, with compatibility for previously cached addresses. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### DNS - Host rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3815) is ready to test on iOS. What to Test - Fix the issue where groups configured with an underlying proxy cannot be operated in the UI. - [Host] rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.9.0-12080 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### VM Gateway - Improved Gateway Mode IPv6 takeover: Fixed an issue where takeover could suddenly fail on some devices. - IPv6 RDNSS in Surge has now been restored under IPv6 takeover mode. - Updated the IPv6 fake IP range to avoid unnecessary browser local network permission prompts, with compatibility for previously cached addresses. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### DNS - Host rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.9.0-12070 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### VM Gateway - Improved Gateway Mode IPv6 takeover: Fixed an issue where takeover could suddenly fail on some devices. - IPv6 RDNSS in Surge has now been restored under IPv6 takeover mode. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3813) is ready to test on iOS. What to Test We’ve launched @SurgeBeta, a new X account for detailed updates on the latest Surge Beta releases. It will stay in sync with our existing Telegram Channel. Follow to keep up with the latest Beta changes and improvements. -------------- New Feature: Terminal You can now operate Surge directly through the CLI on Surge iOS. - CLI mode includes a comprehensive set of debugging and diagnostic tools for troubleshooting. For example, the rule explain command can be used to inspect how rules are evaluated and how policy groups make their decisions. - The new virtual Terminal provides a full interactive experience, including command auto-completion and history. For details on available commands, refer to the Surge Manual or simply run help in the Terminal. Other reasons why you might want to use Surge from the CLI: - It’s cool. Maybe even cooler when you’re using it on an iPhone Fold later this year. - Bringing full CLI capabilities to iOS also lays the groundwork for future AI Agent features on Surge iOS. New Icons: Arctic & Pulse - The former Surge Enterprise icon now has a new name: Arctic, and is available for everyone to use. - Added a new icon: Pulse. ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with `udp-relay=true`. - TrustTunnel can now use HTTP/3 transport with `h3=true`. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with `underlying-proxy` or **Through Another Proxy** in the group editor view. ### HTTP API - Added a Prometheus-compatible `/metrics` endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.9.0-12040 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Improvements - Proxy and policy-group editors now more clearly distinguish selecting a group as an underlying proxy from selecting one of its current members. - Saved and favorite requests are now consistently sorted by their actual start time. - HTTP proxy requests now preserve the original Host header when the absolute-form request target uses a different authority. - Reduced encryption benchmark memory usage by processing data in bounded batches. - Updated Simplified Chinese localizations for the new proxy, Terminal, and diagnostic features. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. Official Channel: @SurgeTestFlightFeed

#Mac #Release Version 6.8.1-12030 - Fixed an issue where the Host field could be unexpectedly rewritten when handling requests in HTTP mode. - Fixed an issue in Gateway VM mode where unsolicited UDP packets sent to the gateway's own IP (such as NAT-PMP and unicast mDNS requests) could create excessive UDP sessions, causing high CPU usage. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.8.1-12030 - Fixed an issue where the Host field could be unexpectedly rewritten when handling requests in HTTP mode. - Fixed an issue in Gateway VM mode where unsolicited UDP packets sent to the gateway's own IP (such as NAT-PMP and unicast mDNS requests) could create excessive UDP sessions, causing high CPU usage. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3811) is ready to test on iOS. What to Test 5.21.1 Release Candidate Fixed an issue where the Host field could be unexpectedly rewritten when handling requests in HTTP mode. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3806) is ready to test on iOS. What to Test 5.21.0 Release Candidate 3 * Fixed an issue where users were unable to accept Ponte shares due to behavioral changes in iCloud China (GCBD) * Fixed an issue where UDP traffic was not correctly tagged with the interface traffic statistics marker, resulting in blank entries * Fixed an issue where WireGuard did not correctly use an MTU of 1280 when no MTU value was explicitly specified Official Channel: @SurgeTestFlightFeed

#tvOS #TestFlight Surge 5 5.102.0 (3799) is ready to test on tvOS. What to Test Sync iOS version changes Fix the issue preventing control via Ponte Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3800) is ready to test on iOS. What to Test 5.21.0 Release Candidate 2 - Optimized content usage when a large number of modules are enabled - Removed strict validation for modules; invalid lines no longer invalidate the entire module - Relaxed some HTTP engine validations to improve compatibility with non-standard HTTP services - HTTP header fields that are not modified by scripts are now forwarded directly in their original binary form to improve compatibility. - Other small fixes and improvements. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3797) is ready to test on iOS. What to Test 5.21.0 Release Candidate - Further trimmed unused code and resources, reducing the application package size. - Fixed the issue where GeoIP database could not be updated. - Improved the reliability of tunnel startup, environment changes, Always-On settings, widgets, and App Intent operations. - Fixed several Safari extension issues that could cause the extension to hang when processing invalid pages or when loading or saving a profile failed. - Fixed crashes when opening an empty packet capture session or inspecting malformed capture data. - Fixed text editor crashes with empty content, missing discard confirmations, and read-only files remaining editable. - Improved remote device management, temporary rules, policy changes, profile reloads, and SSID editing so that local state is updated only after the remote operation succeeds. - Improved error handling for network and Ponte diagnostics, including restoring the restart controls after a failed test. - Fixed concurrency and stale-result issues in traffic statistics, live log viewing, device icon loading, and network-change handling. - Fixed Picture in Picture resource leaks and cleanup issues. - Improved compatibility with profiles containing sections introduced by newer versions by suppressing unnecessary warnings for unrecognized sections. - Improved profile, module, script, local mapping, external resource, and keystore editing to preserve user input and report an error when saving fails. - Fixed an issue where a failed profile write could start the tunnel using an outdated configuration. - Hardened archive extraction against unsafe paths. - Fixed Vector UDP setup, teardown, and error-reporting races affecting both Ponte and regular Vector connections. - Improved QUIC stream handling to prevent unexpected callback re-entry. - Fixed Ponte diagnostics resources not being released when a test was cancelled. Official Channel: @SurgeTestFlightFeed

#tvOS #TestFlight Surge 5 5.102.0 (3794) is ready to test on tvOS. What to Test Synchronize iOS version changes and fix profile reload crashes. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3793) is ready to test on iOS. What to Test ## Networking and Compatibility - Added compatibility with clients that send unbracketed IPv6 addresses in HTTP `CONNECT` requests. - MTProto Server now warns when Telegram IPv6 connections repeatedly fail, suggesting an incompatible proxy or the use of `ipv6 = false`. - Improved TCP protocol robustness and excluded local tunnel peers from unnecessary TCP pacing. - Updated the MaxMind database library for improved compatibility and reliability. ## Profile Management - Profile imports, replacements, upgrades, and backups are now performed atomically on macOS and iOS, reducing the risk of partial or corrupted files. - Improved managed-profile updates with stricter response validation and safer replacement behavior. - Profile name collisions are now detected more reliably, including case-insensitive collisions on iOS. - Fixed profile renaming or switching storage providers potentially losing files or disrupting cloud synchronization. - Ruleset and managed-profile cache write failures are now reported instead of being silently ignored. - Downloaded profile responses are now validated before installation. ## iOS Improvements - Installing a module from an external URL now requires explicit user confirmation. - Improved tunnel preference updates, provider-message validation, error reporting, and handling of tunnel-extension memory termination. - Fixed UI settings potentially being lost when a policy group was renamed. - Improved Home card state restoration, configurable card validation, dismissal persistence, and presentation reliability. ## Script - Relax the single-line log length limit from 64 KB to 512 KB. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3792) is ready to test on iOS. What to Test ## New Features - Added UDP-aware Smart Group scoring. Surge now learns from UDP response latency and silent relay failures to improve policy selection for UDP traffic. - Added `\"` and `\\` escape sequences inside double-quoted profile values, allowing values containing quotes to be saved and reloaded safely. - Core Version Alignment: Starting with Surge Mac 6.8.0 and Surge iOS 5.21.0, Core Version is derived directly from the corresponding Surge Mac version, eliminating the need to maintain a separate Core Version number. Check manual for more information. ## Networking Improvements - Reworked TCP pacing to adapt to connection latency and reduce traffic bursts on Gateway Mode and WireGuard-based connections. - Improved MITM hostname matching for TLS and QUIC traffic on nonstandard ports while continuing to respect exclusion rules. - Improved HTTP/1 and HTTP/2 response handling, including interim responses, lowercase `HEAD` requests, and simultaneous `GOAWAY` shutdown. - Fixed Hysteria response-header validation rejecting or mishandling certain responses. - Fixed Ponte connections entering an incorrect state when IPv4 and IPv6 setup operations completed synchronously. - Enforced the WebSocket message-size limit while data is being received, preventing oversized messages from consuming excessive memory. ## Security and Compatibility - Removed unsupported legacy Shadowsocks ciphers including `bf-cfb`, `camellia-*-cfb`, `cast5-cfb`, `des-cfb`, `idea-cfb`, `rc2-cfb`, and `seed-cfb`. - Hardened downloaded profile names and GeoIP archive extraction against unsafe paths. - Improved license refresh and device identifier stability, especially when the Keychain is temporarily unavailable. - Added support for importing SSH P-521 keys and improved errors for unsupported elliptic curves. - Policy priorities must now be positive values; zero and negative values are rejected during profile validation. ## Profiles and Cloud Sync - Fixed iCloud synchronization potentially deadlocking, dropping pending uploads, or deleting profiles that had not yet synchronized. - Fixed Dropbox synchronization potentially overwriting newer local profile edits with an older remote copy. - Improved retry behavior and completion reporting when Dropbox synchronization encounters persistent errors. - Managed profiles are now protected from local writes that would accidentally remove their managed status. - Improved CloudKit synchronization for Ponte and remote-device information. - Settings storage failures are now reported instead of silently losing pending changes. ## Logbook and UI - Improved Logbook search performance and fixed records disappearing when identifiers were duplicated. - Script timeout and exception records now display their result details correctly. - Fixed Dashboard potentially closing when sorting remote records with missing timestamps. - Fixed “Copy as cURL” output for URLs, headers, methods, or request bodies containing apostrophes. - Fixed missing or corrupted SSID History entries during concurrent app and tunnel-extension access. - Fixed the iOS color picker saving invalid values when selecting black or white. - Fixed option-selection screens showing a stale checkmark after changing the selected value. - Improved icon caching and added safeguards against excessively large downloaded images. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3791) is ready to test on iOS. What to Test ## New Features * Added automatic routing for Tailscale peer IPv4 and IPv6 addresses (IP-CIDR/IP-CIDR6 rules are inserted automatically.). Routes are kept synchronized as the tailnet changes. * Tailscale sessions now remain active by default. An omitted `idle-keepalive`, `0`, or `-1` keeps the session active; use a positive value to enable idle teardown. * Invalid entries in external rule sets are now skipped with warnings, allowing the remaining valid rules to continue working. ## Improvements * Smart Group connections that receive no response data within three seconds are now marked as failed, allowing faster fallback to another policy. * Improved configuration validation and diagnostics for policies, rules, modules, scripts, panels, MITM, port forwarding, WireGuard, Tailscale, MTProto, and Snell server settings. * Surge now warns when a quoted profile value cannot be safely preserved during serialization. * Improved DNS, IP, UDP, ruleset, and MMDB processing to handle malformed input safely without disrupting the tunnel. * Improved MITM certificate and keystore validation and lifecycle reliability. * Improved tvOS profile deployment so modules are filtered and evaluated using the correct tvOS environment. ## Bug Fixes * Fixed rewrite rules containing quotes or spaces potentially becoming corrupted after saving and reloading the profile. * Fixed values containing ` #`, ` //`, or ` ;` inside quotes being incorrectly treated as inline comments. * Fixed profiles with invalid text encoding potentially being interpreted as an empty profile and subsequently overwritten. * Fixed policy comments, group state, local-mapping payloads, subnet values, and other metadata potentially being lost during profile editing or copying. * Fixed malformed CIDR masks potentially being interpreted as `/0` and matching all traffic. * Fixed underlying-proxy loops not always being detected during configuration validation. * Fixed false port-conflict warnings for listeners bound to different network addresses. * Fixed sensitive values not being consistently redacted when exporting profiles, including WireGuard preshared keys and port-forwarding credentials. * Fixed redacted MTProto and other secret placeholders potentially being rejected or lost during remote profile editing. * Fixed several malformed DNS or network packets potentially causing the tunnel process to terminate. Official Channel: @SurgeTestFlightFeed