Surge TestFlight's Changelog

#iOS #TestFlight Surge 5 5.102.0 (3821) is ready to test on iOS. What to Test ### Profile System Updates The #include directive can now be freely combined with other content within a section. The following usage patterns are supported: 1. Dedicated Include [Proxy] #include proxy.dconf When a section consists of a single #include directive, it remains fully editable in the UI. Any changes made through the UI will be correctly written back to proxy.dconf. 2. Multiple Includes [Proxy] #include a.dconf, b.dconf This combines content from multiple files into a single section. Since the UI cannot determine how changes should be written back to the individual files, the section becomes read-only and cannot be modified through the UI. 3. Mixed Content and Includes (New) [Rule] #include common-rule-a.dconf DEST-PORT,123,DIRECT #include common-rule-b.dconf #include directives can now be freely mixed with regular content within the same section. As with multiple includes, the UI cannot determine the appropriate write-back behavior, so the section will be read-only. Note: When using this feature in the [Rule] section, keep in mind that a FINAL rule immediately terminates rule matching. Any rules included or defined after it will therefore never be evaluated.### Tailscale - Improved compatibility with the Tailscale administration console. Surge devices are no longer incorrectly reported as using an outdated client, enabling version-gated operations such as editing the device IP address. ### iOS - Fixed managed-profile `icon-url` icons being hidden by automatically generated placeholder icons. - Custom policy-group icons now behave consistently across Lucid and Gradient themes, with a **Default** option available in both. - Module download, parsing, file-writing, and installation-information failures are now reported instead of failing silently. - Refined the Script Editor toolbar and file-selection layout on iOS 26. - Improved context-menu previews on iOS 26 by following the system’s native corner styling. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3820) is ready to test on iOS. What to Test ### Smart Group - Added a graphical Policy Priority editor for Smart Groups on. ### Tailscale - Interactive sign-in now supports tailnets that require administrator device approval. Surge clearly indicates when sign-in has completed but the device is still awaiting approval. - Fixed Tailscale traffic becoming unavailable when the control server assigned the device a new tailnet address. - Improved recovery after network changes by retrying temporarily failed UDP bindings and refreshing direct-connect endpoints. - Improved WireGuard and Tailscale handling of multiple peers and expired connections. ### Profile and Automation - On iOS, profile changes made on disk or received through iCloud now reload automatically. If the updated profile is invalid, Surge keeps the working configuration active and reports the error. - Event scripts can now respond to `engine-started` and `profile-reloaded`, in addition to `network-changed`. ### Notifications - Added notification controls for new proxy clients, script notifications, and rule-matched notifications. - Local and remote notification category settings now correctly apply to dynamically generated alerts. - Disabling policy-group change notifications now also suppresses temporary group-override alerts. ### Fixed - Improved MITM certificate generation by using separate keys for generated leaf certificates and correcting the transmitted certificate chain. - Fixed QUIC connections potentially stalling after receive-side backpressure. - Fixed rare deadlocks involving cron-script shutdown and Vector UDP connections, including Ponte traffic. - Improved stability under heavy connection churn and local-port exhaustion. - Other small UI issues. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3819) is ready to test on iOS. What to Test ### Profile Format - Added wildcard detached-section includes for `[Ruleset *]`, `[WireGuard *]`, and `[Tailscale *]`. A single `#!include` can now load all matching named sections from another local or remote profile file. - Added `DEVICE_NAME` to the profile environment, enabling device-specific conditions in `#!REQUIREMENT`. - Fixed `[General]` values containing `#`, `//`, or `;` being truncated or changed after the profile was saved and reloaded. ### Tailscale - Improved interactive Tailscale sign-in reliability. Interrupted or silently disconnected login sessions now reconnect and continue the existing browser authorization flow instead of becoming stuck. ### Fixed - Fixed a rare crash when an HTTP/3 or other QUIC session closed synchronously while pending data was being processed. - Other fixes Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3818) is ready to test on iOS. What to Test ### UI - When navigating to a new page, the bottom tab bar is no longer hidden. This change was made to avoid triggering known UIKit UI glitches that can occur when the tab bar is hidden during push transitions. - The Script Editor now opens in a dedicated modal interface, with an updated toolbar, close action, and improved keyboard layout. - Remote Controller and Ponte Diagnostics are now available for all Ponte devices, including devices shared by another iCloud account. - Other UI improvements. ### Other Improvements - Updated the IPv6 fake-IP range to avoid unnecessary browser local-network permission prompts, while retaining compatibility with previously cached addresses. - Proxy connections closed during the protocol handshake now provide a clearer error message, with guidance to verify credentials, encryption methods, and protocol settings. - Fixed rare crashes that could occur when proxy connections were synchronously closed while data was being written. - Fixed recursive HTTP/3 timer processing that could cause a stack overflow under certain conditions. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3815) is ready to test on iOS. What to Test - Fix the issue where groups configured with an underlying proxy cannot be operated in the UI. - [Host] rules now support specifying a dedicated DNS server for domain aliases, for example: foo.com = bar.com, server:https://example/dns-query. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3813) is ready to test on iOS. What to Test We’ve launched @SurgeBeta, a new X account for detailed updates on the latest Surge Beta releases. It will stay in sync with our existing Telegram Channel. Follow to keep up with the latest Beta changes and improvements. -------------- New Feature: Terminal You can now operate Surge directly through the CLI on Surge iOS. - CLI mode includes a comprehensive set of debugging and diagnostic tools for troubleshooting. For example, the rule explain command can be used to inspect how rules are evaluated and how policy groups make their decisions. - The new virtual Terminal provides a full interactive experience, including command auto-completion and history. For details on available commands, refer to the Surge Manual or simply run help in the Terminal. Other reasons why you might want to use Surge from the CLI: - It’s cool. Maybe even cooler when you’re using it on an iPhone Fold later this year. - Bringing full CLI capabilities to iOS also lays the groundwork for future AI Agent features on Surge iOS. New Icons: Arctic & Pulse - The former Surge Enterprise icon now has a new name: Arctic, and is available for everyone to use. - Added a new icon: Pulse. ### Protocol Updates - Added MASQUE proxy support, using HTTP/3 CONNECT for multiplexed TCP tunnels and CONNECT-UDP datagrams. - HTTP/2 CONNECT proxies can now relay UDP traffic with `udp-relay=true`. - TrustTunnel can now use HTTP/3 transport with `h3=true`. ### Poilcy Group - Added group-level proxy chaining. A policy group can specify an underlying proxy, and all concrete proxy members in that group will connect through it. This can be configured with `underlying-proxy` or **Through Another Proxy** in the group editor view. ### HTTP API - Added a Prometheus-compatible `/metrics` endpoint to the HTTP Controller, exposing build information, uptime, memory usage, active requests, DNS cache size, security bans, interface traffic, and per-policy traffic. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3811) is ready to test on iOS. What to Test 5.21.1 Release Candidate Fixed an issue where the Host field could be unexpectedly rewritten when handling requests in HTTP mode. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3806) is ready to test on iOS. What to Test 5.21.0 Release Candidate 3 * Fixed an issue where users were unable to accept Ponte shares due to behavioral changes in iCloud China (GCBD) * Fixed an issue where UDP traffic was not correctly tagged with the interface traffic statistics marker, resulting in blank entries * Fixed an issue where WireGuard did not correctly use an MTU of 1280 when no MTU value was explicitly specified Official Channel: @SurgeTestFlightFeed

#tvOS #TestFlight Surge 5 5.102.0 (3799) is ready to test on tvOS. What to Test Sync iOS version changes Fix the issue preventing control via Ponte Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3800) is ready to test on iOS. What to Test 5.21.0 Release Candidate 2 - Optimized content usage when a large number of modules are enabled - Removed strict validation for modules; invalid lines no longer invalidate the entire module - Relaxed some HTTP engine validations to improve compatibility with non-standard HTTP services - HTTP header fields that are not modified by scripts are now forwarded directly in their original binary form to improve compatibility. - Other small fixes and improvements. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3797) is ready to test on iOS. What to Test 5.21.0 Release Candidate - Further trimmed unused code and resources, reducing the application package size. - Fixed the issue where GeoIP database could not be updated. - Improved the reliability of tunnel startup, environment changes, Always-On settings, widgets, and App Intent operations. - Fixed several Safari extension issues that could cause the extension to hang when processing invalid pages or when loading or saving a profile failed. - Fixed crashes when opening an empty packet capture session or inspecting malformed capture data. - Fixed text editor crashes with empty content, missing discard confirmations, and read-only files remaining editable. - Improved remote device management, temporary rules, policy changes, profile reloads, and SSID editing so that local state is updated only after the remote operation succeeds. - Improved error handling for network and Ponte diagnostics, including restoring the restart controls after a failed test. - Fixed concurrency and stale-result issues in traffic statistics, live log viewing, device icon loading, and network-change handling. - Fixed Picture in Picture resource leaks and cleanup issues. - Improved compatibility with profiles containing sections introduced by newer versions by suppressing unnecessary warnings for unrecognized sections. - Improved profile, module, script, local mapping, external resource, and keystore editing to preserve user input and report an error when saving fails. - Fixed an issue where a failed profile write could start the tunnel using an outdated configuration. - Hardened archive extraction against unsafe paths. - Fixed Vector UDP setup, teardown, and error-reporting races affecting both Ponte and regular Vector connections. - Improved QUIC stream handling to prevent unexpected callback re-entry. - Fixed Ponte diagnostics resources not being released when a test was cancelled. Official Channel: @SurgeTestFlightFeed

#tvOS #TestFlight Surge 5 5.102.0 (3794) is ready to test on tvOS. What to Test Synchronize iOS version changes and fix profile reload crashes. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3793) is ready to test on iOS. What to Test ## Networking and Compatibility - Added compatibility with clients that send unbracketed IPv6 addresses in HTTP `CONNECT` requests. - MTProto Server now warns when Telegram IPv6 connections repeatedly fail, suggesting an incompatible proxy or the use of `ipv6 = false`. - Improved TCP protocol robustness and excluded local tunnel peers from unnecessary TCP pacing. - Updated the MaxMind database library for improved compatibility and reliability. ## Profile Management - Profile imports, replacements, upgrades, and backups are now performed atomically on macOS and iOS, reducing the risk of partial or corrupted files. - Improved managed-profile updates with stricter response validation and safer replacement behavior. - Profile name collisions are now detected more reliably, including case-insensitive collisions on iOS. - Fixed profile renaming or switching storage providers potentially losing files or disrupting cloud synchronization. - Ruleset and managed-profile cache write failures are now reported instead of being silently ignored. - Downloaded profile responses are now validated before installation. ## iOS Improvements - Installing a module from an external URL now requires explicit user confirmation. - Improved tunnel preference updates, provider-message validation, error reporting, and handling of tunnel-extension memory termination. - Fixed UI settings potentially being lost when a policy group was renamed. - Improved Home card state restoration, configurable card validation, dismissal persistence, and presentation reliability. ## Script - Relax the single-line log length limit from 64 KB to 512 KB. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3792) is ready to test on iOS. What to Test ## New Features - Added UDP-aware Smart Group scoring. Surge now learns from UDP response latency and silent relay failures to improve policy selection for UDP traffic. - Added `\"` and `\\` escape sequences inside double-quoted profile values, allowing values containing quotes to be saved and reloaded safely. - Core Version Alignment: Starting with Surge Mac 6.8.0 and Surge iOS 5.21.0, Core Version is derived directly from the corresponding Surge Mac version, eliminating the need to maintain a separate Core Version number. Check manual for more information. ## Networking Improvements - Reworked TCP pacing to adapt to connection latency and reduce traffic bursts on Gateway Mode and WireGuard-based connections. - Improved MITM hostname matching for TLS and QUIC traffic on nonstandard ports while continuing to respect exclusion rules. - Improved HTTP/1 and HTTP/2 response handling, including interim responses, lowercase `HEAD` requests, and simultaneous `GOAWAY` shutdown. - Fixed Hysteria response-header validation rejecting or mishandling certain responses. - Fixed Ponte connections entering an incorrect state when IPv4 and IPv6 setup operations completed synchronously. - Enforced the WebSocket message-size limit while data is being received, preventing oversized messages from consuming excessive memory. ## Security and Compatibility - Removed unsupported legacy Shadowsocks ciphers including `bf-cfb`, `camellia-*-cfb`, `cast5-cfb`, `des-cfb`, `idea-cfb`, `rc2-cfb`, and `seed-cfb`. - Hardened downloaded profile names and GeoIP archive extraction against unsafe paths. - Improved license refresh and device identifier stability, especially when the Keychain is temporarily unavailable. - Added support for importing SSH P-521 keys and improved errors for unsupported elliptic curves. - Policy priorities must now be positive values; zero and negative values are rejected during profile validation. ## Profiles and Cloud Sync - Fixed iCloud synchronization potentially deadlocking, dropping pending uploads, or deleting profiles that had not yet synchronized. - Fixed Dropbox synchronization potentially overwriting newer local profile edits with an older remote copy. - Improved retry behavior and completion reporting when Dropbox synchronization encounters persistent errors. - Managed profiles are now protected from local writes that would accidentally remove their managed status. - Improved CloudKit synchronization for Ponte and remote-device information. - Settings storage failures are now reported instead of silently losing pending changes. ## Logbook and UI - Improved Logbook search performance and fixed records disappearing when identifiers were duplicated. - Script timeout and exception records now display their result details correctly. - Fixed Dashboard potentially closing when sorting remote records with missing timestamps. - Fixed “Copy as cURL” output for URLs, headers, methods, or request bodies containing apostrophes. - Fixed missing or corrupted SSID History entries during concurrent app and tunnel-extension access. - Fixed the iOS color picker saving invalid values when selecting black or white. - Fixed option-selection screens showing a stale checkmark after changing the selected value. - Improved icon caching and added safeguards against excessively large downloaded images. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3791) is ready to test on iOS. What to Test ## New Features * Added automatic routing for Tailscale peer IPv4 and IPv6 addresses (IP-CIDR/IP-CIDR6 rules are inserted automatically.). Routes are kept synchronized as the tailnet changes. * Tailscale sessions now remain active by default. An omitted `idle-keepalive`, `0`, or `-1` keeps the session active; use a positive value to enable idle teardown. * Invalid entries in external rule sets are now skipped with warnings, allowing the remaining valid rules to continue working. ## Improvements * Smart Group connections that receive no response data within three seconds are now marked as failed, allowing faster fallback to another policy. * Improved configuration validation and diagnostics for policies, rules, modules, scripts, panels, MITM, port forwarding, WireGuard, Tailscale, MTProto, and Snell server settings. * Surge now warns when a quoted profile value cannot be safely preserved during serialization. * Improved DNS, IP, UDP, ruleset, and MMDB processing to handle malformed input safely without disrupting the tunnel. * Improved MITM certificate and keystore validation and lifecycle reliability. * Improved tvOS profile deployment so modules are filtered and evaluated using the correct tvOS environment. ## Bug Fixes * Fixed rewrite rules containing quotes or spaces potentially becoming corrupted after saving and reloading the profile. * Fixed values containing ` #`, ` //`, or ` ;` inside quotes being incorrectly treated as inline comments. * Fixed profiles with invalid text encoding potentially being interpreted as an empty profile and subsequently overwritten. * Fixed policy comments, group state, local-mapping payloads, subnet values, and other metadata potentially being lost during profile editing or copying. * Fixed malformed CIDR masks potentially being interpreted as `/0` and matching all traffic. * Fixed underlying-proxy loops not always being detected during configuration validation. * Fixed false port-conflict warnings for listeners bound to different network addresses. * Fixed sensitive values not being consistently redacted when exporting profiles, including WireGuard preshared keys and port-forwarding credentials. * Fixed redacted MTProto and other secret placeholders potentially being rejected or lost during remote profile editing. * Fixed several malformed DNS or network packets potentially causing the tunnel process to terminate. Official Channel: @SurgeTestFlightFeed

#tvOS #TestFlight Surge 5 5.102.0 (3790) is ready to test on tvOS. What to Test * Sync all updates from the iOS version. * Fixed a bug that could cause abnormal resource usage. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3789) is ready to test on iOS. What to Test ## New Features - Added interactive Tailscale sign-in on iOS and macOS. Resolve the issue where some enterprise users are unable to obtain the auth key. - DNS lookup results now display the network interface used on iOS, macOS Dashboard, and the command-line interface. ## Improvements - Fixed an issue where the Surge UI might not be displayed when using secondary screen output on iOS. - Improved TLS 1.3 connection reliability and prevented session reuse across incompatible SNI, ALPN, or certificate verification settings. - Improved Smart Group recovery following transient failures on reusable AnyTLS and Snell connections. - Fixed potential memory growth in Snell v6 UDP relay when the receiving client is slow or unresponsive. - Fixed Snell v6 incorrectly using the QUIC proxy mode intended only for Snell v5. - Fixed inaccurate traffic statistics under concurrent, high-volume requests. - Fixed pending traffic data potentially being lost during daily or monthly statistics rollover. - Fixed Logbook record-type filters not being applied correctly. - Fixed the iOS Tailscale `idle-keepalive` field not reliably accepting `-1`. - Improved the reliability and security of AnyTLS, Snell, Shadowsocks, VMess, Hysteria, TUIC, Vector, ShadowTLS, Trojan, TrustTunnel, WebSocket, and SOCKS5 connections. - Connections abandoned while waiting in the reuse pool now automatically retry with a new connection, reducing intermittent failures after network changes or idle periods. - Improved handling of fragmented protocol responses, preventing valid connections from being incorrectly rejected or left waiting indefinitely. - Added stricter limits and validation for UDP fragmentation and protocol buffering to reduce excessive memory usage. - Fixed a serious AnyTLS connection reuse issue that could route data to an incorrect logical stream. - Fixed several AnyTLS and Snell connection reuse issues that could return terminated connections to the pool or cause requests to hang. - Fixed TrustTunnel connections occasionally stalling or losing the end of a response under multiplexed or slow-transfer conditions. - Fixed SOCKS5 UDP relay failures caused by fragmented responses, multi-address DNS results, and domain-form response addresses. - Fixed Hysteria, TUIC, and Vector connections incorrectly rejecting valid fragmented handshake responses. - Fixed UDP proxy handling for internationalized domain names. - Fixed malformed proxy responses potentially causing the Surge tunnel process to terminate. - Fixed several cases where malformed or incomplete proxy data could cause connections to hang or consume excessive memory. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3788) is ready to test on iOS. What to Test ### Suspend - Optimized access to the Ponte management page. It can now be used even when Surge is in the Suspend state. - Added manual suspension controls to the Start context menu: - Suspend: forces Surge into suspended mode. In the suspended state, Surge only refrains from configuring VIF interception; all other functions, including scripts and HTTP/SOCKS5/MTProto proxy servers, work normally. - Bypass Suspension: temporarily overrides automatic suspension caused by the current Wi-Fi network or Surge Gateway detection. You can long-press the Start Page tab or the Start button in the upper-right corner of the Cards page to access this menu. ### Senll Server - Snell proxy servers can now be configured and used on iOS and tvOS. ### DNS - Added DNS-over-TCP support. DNS server settings now accept `tcp://hostname[:port]`. ### MTProto & Proxy Services - Modules can now include an `[MTProto]` section, using the same validation rules as the main profile. - The MTProto server now supports using 0.0.0.0 to provide services to LAN devices. ### Misc - Editing a proxy or policy group now preserves line conditions such as `#!IOS-ONLY` and `#!MACOS-ONLY`. - JavaScript sessions now execute user code in a scoped block, preventing top-level declarations from leaking into subsequent executions. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3786) is ready to test on iOS. What to Test ### New Feature: Surge as MTProto Server Surge now can operate as an incoming MTProto proxy server for Telegram. Please read manual for more information: https://manual.nssurge.com/ TL;DR Using MTProto instead of SOCKS or VIF to take over Telegram can: 1. Telegram has a notorious SOCKS5 bug in which it can put an IPv6 destination address into an IPv4 request. The malformed destination causes a large number of invalid connection attempts to be sent to Surge. MTProto avoids this path entirely. 2. Force connections to Telegram servers over IPv6. Telegram’s IPv4 servers have a bug that can easily cause the connection to hang without responding. IPv6 nodes do not have this issue, and MTProto allows the intermediary proxy to determine the specific DC service address. Therefore, setting `ipv6=true` can resolve this persistent problem. (The proxy server must support IPv6 forwarding.) ### Tailscale - Added automatic MagicDNS routing. Surge can discover the tailnet’s MagicDNS suffix and automatically route matching domains through the corresponding Tailscale policy. - Automatic MagicDNS routing is enabled by default for newly created policies and can be disabled with `auto-add-magic-dns-rule = false`. - Improved Tailscale session warm-up and recovery. Sessions now retry MagicDNS discovery after startup failures and network changes without requiring matching traffic to arrive first. - Changed `idle-keepalive` semantics: `0` now uses the default value of 600 seconds, while `-1` keeps the Tailscale session always active. ### External Resources - External resource pages on macOS and iOS now display live updating, ready, and failure states more accurately. - Remote-device management now reports the current update state and detailed errors for each external resource. - “Update All” now reports actual failures instead of completing successfully when one or more resources could not be updated. - HTTP error responses are no longer accepted as external resource content. - Ruleset and domain-set indexes are now generated transactionally. If downloaded content cannot be parsed or indexed, the last working index is preserved. - Active resources referenced by the current profile are no longer removed by age-based cache cleanup. - Fixed custom update intervals being lost when the same resource was referenced from multiple profile sections. - Profiles now reject using the same external resource as both a `RULE-SET` and a `DOMAIN-SET`. ### Configuration & Proxy Policies - Fixed multi-value ALPN settings being corrupted or partially lost when proxy policies were copied or serialized. - Improved configuration parsing for quoted separators, empty quoted values, Unicode text, and limited-component splitting. ### Stability & Correctness - Fixed a potential crash when the GeoIP database was reloaded while traffic was being processed. - Improved DDNS synchronization and error reporting, including complete CloudKit pagination and correct handling when the public IP address cannot be obtained. - Fixed potential crashes caused by malformed RDAP responses or missing/corrupted icon bundle data. - Improved WHOIS/RDAP support for internationalized domains and reduced bootstrap loading time by downloading missing datasets concurrently. - Fixed route-table diagnostics potentially terminating the app or leaking memory when system route information could not be read. - Fixed stale incoming-proxy ban records not being cleaned up correctly and potentially weakening repeated-failure blocking. - Fixed several correctness issues affecting official module updates, HAR export status text and progress, RDAP CIDR rendering, network-quality notifications, and log upload callbacks. Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight Surge 5 5.102.0 (3784) is ready to test on iOS. What to Test Fix the issue where MITM cannot load the CA certificate Official Channel: @SurgeTestFlightFeed