Surge Mac's Changelog

#Mac #Beta Version 6.9.0-12090 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### VM Gateway - Improved Gateway Mode IPv6 takeover: Fixed an issue where takeover could suddenly fail on some devices. - IPv6 RDNSS in Surge has now been restored under IPv6 takeover mode. - Updated the IPv6 fake IP range to avoid unnecessary browser local network permission prompts, with compatibility for previously cached addresses. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### DNS - Host rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.9.0-12080 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### VM Gateway - Improved Gateway Mode IPv6 takeover: Fixed an issue where takeover could suddenly fail on some devices. - IPv6 RDNSS in Surge has now been restored under IPv6 takeover mode. - Updated the IPv6 fake IP range to avoid unnecessary browser local network permission prompts, with compatibility for previously cached addresses. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### DNS - Host rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.9.0-12070 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### VM Gateway - Improved Gateway Mode IPv6 takeover: Fixed an issue where takeover could suddenly fail on some devices. - IPv6 RDNSS in Surge has now been restored under IPv6 takeover mode. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. - Fixed an issue where multiple macOS users on the same device had to reactivate Surge. - Fixed long-running VMess connections being terminated after the chunk counter wrapped. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.9.0-12040 ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with udp-relay=true. - TrustTunnel can now use HTTP/3 transport with h3=true. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with underlying-proxy or Through Another Proxy in the group editor view. ### HTTP API - Added a Prometheus-compatible /metrics endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. ### Surge CLI - The CLI’s interactive mode now supports features such as auto-completion and command history. - Added profile diff to compare the original profile with the effective profile after modules have been applied. - Added rule match to evaluate the active rule set without creating a real connection. Hostname, URL, process, source address, client device, protocol, and other matching attributes can be supplied. - Added rule explain to show why a request selected a particular policy, including the matched rule, each policy-group decision, Smart Group selection, and underlying proxy chain. - Added rule temp commands to list, add, remove, modify, or clear temporary rules. - Added dns lookup to resolve a domain through Surge’s DNS pipeline and report the result, responding server, interface, route, timing, and cache lifetime. - Added dns trace to include the complete resolver trace, with optional lookup through a specified network interface. - Added geoip to query the local GeoIP and ASN databases used by GEOIP and IP-ASN rules. - Added http probe to perform an HTTP HEAD request through a specified policy or the active rule system, reporting status, latency, selected policy, matched rule, and response headers. - Added dump performance to inspect engine memory usage, uptime, active requests, DNS cache entries, virtual IP entries, temporary rules, and security bans. - Added dump rule-usage to inspect per-rule match counters without clearing them. - Added targeted dump virtual-ip queries by IP address or domain substring. - Added benchmark rule-matching to measure the matching performance of the active rule set. - Added watch speed to continuously display real-time upload and download speeds. - Added security ban list and security ban clear to inspect or reset Controller unauthorized-access bans. - Improved CLI help output with command categories and detailed help for individual commands. ## Improvements - Proxy and policy-group editors now more clearly distinguish selecting a group as an underlying proxy from selecting one of its current members. - Saved and favorite requests are now consistently sorted by their actual start time. - HTTP proxy requests now preserve the original Host header when the absolute-form request target uses a different authority. - Reduced encryption benchmark memory usage by processing data in bounded batches. - Updated Simplified Chinese localizations for the new proxy, Terminal, and diagnostic features. ## Fixed - Fixed an issue where DNS-over-HTTP/3 and DNS-over-QUIC servers specified in local DNS mappings could fail bootstrap resolution. Official Channel: @SurgeTestFlightFeed

#Mac #Release Version 6.8.1-12030 - Fixed an issue where the Host field could be unexpectedly rewritten when handling requests in HTTP mode. - Fixed an issue in Gateway VM mode where unsolicited UDP packets sent to the gateway's own IP (such as NAT-PMP and unicast mDNS requests) could create excessive UDP sessions, causing high CPU usage. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.8.1-12030 - Fixed an issue where the Host field could be unexpectedly rewritten when handling requests in HTTP mode. - Fixed an issue in Gateway VM mode where unsolicited UDP packets sent to the gateway's own IP (such as NAT-PMP and unicast mDNS requests) could create excessive UDP sessions, causing high CPU usage. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.8.0-11780 ### DHCP - Upgrade ISC DHCP server to version 4.4.3-P1. - Patched the default behavior of ISC DHCP: IPs that have already been manually statically assigned will no longer be used by the dynamic IP pool. ### Tailscale - Optimize control logic - Optimize support for custom DERP servers. ### TLS - Added server-cert-verify-name to independently specify the hostname used for proxy server certificate verification. Valid for all TLS protocols. ### Codebase Refactoring - SSH & HTTP & HTTP3 We have completed a comprehensive review of Surge’s core functionality and resolved numerous implementation issues, edge cases, and long-standing inconsistencies. This ongoing refactoring effort improves maintainability and helps provide a more robust foundation for future development. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.8.0-11770 ### DHCP - Upgrade ISC DHCP server to version 4.4.3-P1. - Patched the default behavior of ISC DHCP: IPs that have already been manually statically assigned will no longer be used by the dynamic IP pool. ### Codebase Refactoring - SSH & HTTP & HTTP3 We have completed a comprehensive review of Surge’s core functionality and resolved numerous implementation issues, edge cases, and long-standing inconsistencies. This ongoing refactoring effort improves maintainability and helps provide a more robust foundation for future development. Official Channel: @SurgeTestFlightFeed

#Mac #Release Version 6.7.0-11730 ### Tailscale Support Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check the manual for more information: https://manual.nssurge.com/policy/tailscale.html ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Codebase Refactoring We have completed a comprehensive review of Surge’s core functionality and resolved numerous implementation issues, edge cases, and long-standing inconsistencies. This ongoing refactoring effort improves maintainability and helps provide a more robust foundation for future development. ### WireGuard WireGuard policies now use a dedicated native RTT test when no DNS server is configured, making them suitable for peer-to-peer access without requiring a reachable test URL. When a DNS server is configured, the policy is treated as a standard outbound proxy and continues to use the regular URL test process. WireGuard runtime information and diagnostics have also been updated to reflect the applicable testing mode. ### Renovation - Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. - Added proxy runtime details to the proxy page; right-click to view. ### Minor Improvements - The Smart Group algorithm has been reviewed and upgraded, fixing several potential issues. - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. - URL scheme actions are now supported in Surge Mac. Check manual for more information. - Enable the keep-alive mechanism for all QUIC-based protocols ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11730 ### Tailscale Support Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check the manual for more information: https://manual.nssurge.com/policy/tailscale.html ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Codebase Refactoring We have completed a comprehensive review of Surge’s core functionality and resolved numerous implementation issues, edge cases, and long-standing inconsistencies. This ongoing refactoring effort improves maintainability and helps provide a more robust foundation for future development. ### WireGuard WireGuard policies now use a dedicated native RTT test when no DNS server is configured, making them suitable for peer-to-peer access without requiring a reachable test URL. When a DNS server is configured, the policy is treated as a standard outbound proxy and continues to use the regular URL test process. WireGuard runtime information and diagnostics have also been updated to reflect the applicable testing mode. ### Renovation - Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. - Added proxy runtime details to the proxy page; right-click to view. ### Minor Improvements - The Smart Group algorithm has been reviewed and upgraded, fixing several potential issues. - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. - URL scheme actions are now supported in Surge Mac. Check manual for more information. - Enable the keep-alive mechanism for all QUIC-based protocols ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11650 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale #### Beta Updates - IPv6 DERP servers are now automatically disabled based on network conditions. ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Dashboard Renovation Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. ### Minor Improvements - The Smart Group algorithm has been reviewed and upgraded, fixing several potential issues. - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. - URL scheme actions are now supported in Surge Mac. Check manual for more information. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11620 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale #### Beta Updates - IPv6 DERP servers are now automatically disabled based on network conditions. ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Dashboard Renovation Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. ### Minor Improvements - The Smart Group algorithm has been reviewed and upgraded, fixing several potential issues. - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. - URL scheme actions are now supported in Surge Mac. Check manual for more information. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11610 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale #### Beta Updates - IPv6 DERP servers are now automatically disabled based on network conditions. ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Dashboard Renovation Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. ### Minor Improvements - The Smart Group algorithm has been reviewed and upgraded, fixing several potential issues. - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. - URL scheme actions are now supported in Surge Mac. Check manual for more information. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11600 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale #### Beta Updates - IPv6 DERP servers are now automatically disabled based on network conditions. ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Dashboard Renovation Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. ### Minor Improvements - The Smart Group algorithm has been reviewed and upgraded, fixing several potential issues. - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. - URL scheme actions are now supported in Surge Mac. Check manual for more information. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11570 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale #### Beta Updates - IPv6 DERP servers are now automatically disabled based on network conditions. ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Dashboard Renovation Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. ### Minor Improvements - The Smart Group algorithm has been reviewed and upgraded, fixing several potential issues. - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. - URL scheme actions are now supported in Surge Mac. Check manual for more information. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11550 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale #### Beta Updates - IPv6 DERP servers are now automatically disabled based on network conditions. ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Dashboard Renovation Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. ### Minor Improvements - The Smart Group algorithm has been reviewed and upgraded, fixing several potential issues. - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. - URL scheme actions are now supported in Surge Mac. Check manual for more information. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11520 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale #### Beta Updates - IPv6 DERP servers are now automatically disabled based on network conditions. ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Dashboard Renovation Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. ### Minor Improvements - The Smart Group algorithm has been reviewed and upgraded, fixing several potential issues. - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. - URL scheme actions are now supported in Surge Mac. Check manual for more information. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11510 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale #### Beta Updates - IPv6 DERP servers are now automatically disabled based on network conditions. ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Dashboard Renovation Surge Dashboard has received a comprehensive visual upgrade, along with optimized display of detailed request information. ### Minor Improvements - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11500 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Minor Improvements - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed

#Mac #Beta Version 6.7.0-11490 ### Tailscale Support (Beta) Surge now supports Tailscale as a policy. With this feature, Surge can join your Tailscale tailnet directly and route selected traffic through Tailscale peers using the existing Surge rule system. You can use Tailscale IPs, and tailnet-only services together with Surge policies, policy groups, DNS handling, traffic logging, and rule-based routing. Please check Surge Knowledge Base for more information: https://kb.nssurge.com/surge-knowledge-base/guidelines/tailscale ### Snell v6 Introduced Snell v6, featuring PSK-derived deployment-level protocol diversity that generates unique traffic characteristics for each deployment, reducing reliance on a single protocol fingerprint while preserving Snell’s core goals of performance, deployment simplicity, accurate error reporting, and full TCP semantics. Snell v6 also adds new IPv4/IPv6 network stack controls including dns-ip-preference and multi-address listen support, and is currently available for beta testing. Please check our blog for more information: https://nssurge.com/blog/snell-v6/ ### Minor Improvements - The header parameter for the HTTP proxy type can now override original fields, including Host field. - Added Gecko obfuscation support for Hysteria2, configured using the gecko-password parameter. - All TLS proxy protocols now support customizing ALPN using the alpn field. - When local DNS mapping is specified using server, multiple DNS servers can now be configured. ### Other - Optimize the performance of Surge Ponte. - The UI configuration interface has been completed for the recently added proxy protocol parameters, including Tailscale. - Fixed an issue where the header parameter did not take effect in HTTP/1.1 CONNECT mode. - Fix some issues when using SF Symbols for policy group icons. - Fixed compatibility issues between DoH3 and some servers. Official Channel: @SurgeTestFlightFeed