📝 Release Notes

• Unify HTTP client 1
• Add Apple HTTP and TLS engines 2
• Unify HTTP/2 and QUIC parameters 3
• Add TLS spoof 4
• Fixes and improvements

1:

The new top-level http_clients option defines reusable HTTP clients (engine, version, dialer, TLS, HTTP/2 and QUIC parameters). Components that make outbound HTTP requests — remote rule-sets, ACME and Cloudflare Origin CA certificate providers, DERP verify_client_url, and the Tailscale control_http_client — now accept an inline HTTP client object or the tag of an http_clients entry, replacing the dial and TLS fields previously inlined in each component. When the field is omitted, ACME, Cloudflare Origin CA, DERP and Tailscale dial direct (their existing default).

Remote rule-sets are the only HTTP-using component whose default for an omitted http_client has historically resolved to the default outbound, not to direct, and a typical configuration contains many of them. To avoid repeating the same http_client block in every rule-set, route.default_http_client selects a default rule-set client by tag and is the only field that consults it. If default_http_client is empty and http_clients is non-empty, the first entry is used automatically. The legacy fallback (use the default outbound when http_clients is empty altogether) is preserved with a deprecation warning and will be removed in sing-box 1.16.0, together with the legacy download_detour remote rule-set option and the legacy dialer fields on Tailscale endpoints.

2:

A new apple engine is available on Apple platforms in two independent places:

• HTTP client engine — routes HTTP requests through NSURLSession.
• Outbound TLS engine — routes the TLS handshake through Network.framework for direct TCP TLS client connections.

The default remains go. Both engines come with additional CGO and framework memory overhead and platform restrictions documented on each field.

3:

HTTP/2 and QUIC parameters (idle_timeout, keep_alive_period, stream_receive_window, connection_receive_window, max_concurrent_streams, initial_packet_size, disable_path_mtu_discovery) are now shared across QUIC-based outbounds (Hysteria, Hysteria2, TUIC) and HTTP clients running HTTP/2 or HTTP/3.

This deprecates the Hysteria v1 tuning fields recv_window_conn, recv_window, recv_window_client, max_conn_client and disable_mtu_discovery; they will be removed in sing-box 1.16.0.

4:

Added outbound TLS spoof and spoof_method fields. When enabled, a forged ClientHello carrying a whitelisted SNI is sent before the real handshake to fool SNI-filtering middleboxes. Requires CAP_NET_RAW + CAP_NET_ADMIN or root on Linux and macOS, and Administrator privileges on Windows (ARM64 is not supported). IP-literal server names are rejected.

📝 Release Notes

• Fix fake-ip DNS server should return SUCCESS when another address type is not configured
• Fixes and improvements

📝 Release Notes

• Update naiveproxy to v147.0.7727.49-1
• Fix fake-ip DNS server should return SUCCESS when address type is not configured
• Fixes and improvements

📝 Release Notes

• Add optimistic DNS cache 1
• Update NaiveProxy to 147.0.7727.49
• Fixes and improvements

1:

Optimistic DNS cache returns an expired cached response immediately while refreshing it in the background, reducing tail latency for repeated queries. Enabled via optimistic in DNS options, and can be persisted across restarts with the new store_dns cache file option. A per-query disable_optimistic_cache field is also available on DNS rule actions and the resolve route rule action.

This deprecates the independent_cache DNS option (the DNS cache now always keys by transport) and the store_rdrc cache file option (replaced by store_dns); both will be removed in sing-box 1.16.0. See Migration.

📝 Release Notes

• Add evaluate DNS rule action and Response Match Fields 1
• ip_version and query_type now also take effect on internal DNS lookups 2
• Add package_name_regex route, DNS and headless rule item 3
• Add cloudflared inbound 4
• Fixes and improvements

1:

Response Match Fields (response_rcode, response_answer, response_ns, and response_extra) match the evaluated DNS response. They are gated by the new match_response field and populated by a preceding evaluate DNS rule action; the evaluated response can also be returned directly by a respond action.

This deprecates the Legacy Address Filter Fields (ip_cidr, ip_is_private without match_response) in DNS rules, the Legacy strategy DNS rule action option, and the Legacy rule_set_ip_cidr_accept_empty DNS rule item; all three will be removed in sing-box 1.16.0. See Migration.

2:

ip_version and query_type in DNS rules, together with query_type in referenced rule-sets, now take effect on every DNS rule evaluation, including matches from internal domain resolutions that do not target a specific DNS server (for example a resolve route rule action without server set). In earlier versions they were silently ignored in that path. Combining these fields with any of the legacy DNS fields deprecated in 1 in the same DNS configuration is no longer supported and is rejected at startup. See Migration.

3:

See Route Rule, DNS Rule and Headless Rule.

4:

See Cloudflared.

📝 Release Notes

• Fixes and improvements

📝 Release Notes

• Fixes and improvements

📝 Release Notes

• Fixes and improvements

📝 Release Notes

• Add BBR profile and hop interval randomization for Hysteria2 1
• Fixes and improvements

1:

See Hysteria2 Inbound and Hysteria2 Outbound.

📝 Release Notes

• Fixes and improvements