> ## Documentation Index
> Fetch the complete documentation index at: https://e-gurl.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> DNS-MNS version history and release notes

# Changelog

## v10.0.6 (February 24, 2026)

<Note>
  **Patch Release — BPB Subscription Fix** - Critical fix for BPB Panel custom config subscriptions that caused VPN routing loops and timeout errors in the Android app.
</Note>

### 📱 Android App v0.0.6-beta

<Accordion title="BPB Panel Subscription Fix">
  * **Custom Config Import:** Extract remarks field for proper display names; strip non-standard version field from BPB JSON configs
  * **TUN Routing Patch:** Added `tun` to inboundTag arrays and inserted DNS routing rule for TUN traffic in custom configs
  * **VPN Routing Loop Fix:** Fixed critical bug where custom configs had `profile.server = null`, causing VPN service to not exclude proxy server IP from routes — resulting in 8000+ connection loops per second
  * **Proxy Server Extraction:** New `extractProxyServerFromCustomConfig()` helper scans xray outbounds for proxy protocols and extracts server address from `settings.vnext[0].address` or `settings.servers[0].address`
</Accordion>

***

## v10.0.5 (February 24, 2026)

<Note>
  **Minor Release — Android App Features & UI Polish** - Major feature additions (subscriptions, per-app VPN, in-app updates, QR sharing) plus comprehensive UI/UX polish for the Android app.
</Note>

### 📱 Android App v0.0.5-beta

<Accordion title="New Features">
  * **QR Code Export & Sharing:** Export server configs as QR codes and share v2ray URLs
  * **About Screen:** Accessible from hamburger menu drawer with app info and links
  * **Event Notifications:** Connect/disconnect event notifications for VPN state changes
  * **Subscription System:** Full subscription storage with CRUD, import, and refresh flow
  * **Subscription Groups:** Group UI with drawer navigation and screen wiring
  * **Auto-Update Subscriptions:** WorkManager-based subscription auto-update with per-subscription toggle
  * **Per-App VPN Exclusion:** UI to exclude specific apps from VPN routing
  * **In-App Updates:** Check and install updates directly from GitLab releases
  * **Android 13+ Notifications:** POST\_NOTIFICATIONS runtime permission support
</Accordion>

<Accordion title="UI/UX Polish">
  * **VPN Tab Redesign:** Full-width dropdowns, readable VPN group headers, collapsible subscription groups
  * **8dp Grid Spacing:** Standardized all VPN server card spacing to Material Design 8dp grid
  * **Unified Corner Radii:** Replaced hardcoded RoundedCornerShape values with MaterialTheme.shapes tokens
  * **Icon Buttons:** Replaced text buttons with icon buttons for VPN server card actions (Select/Test/Real)
  * **Group Header Alignment:** Proper padding alignment between group headers and card content
  * **Collapse Toggle Fix:** Fixed collapse/expand toggle that was always forcing expanded state
</Accordion>

### 🔧 Bug Fixes

<Accordion title="Android Fixes">
  * **DNS Routing:** Always route port-53 DNS through Xray in VPN/TUN mode
  * **ANR Prevention:** Moved measureDelay() calls to Dispatchers.IO to prevent Application Not Responding errors
  * **Permission Handling:** Gracefully handle missing WRITE\_SECURE\_SETTINGS permission in Set DNS
  * **Button Import Cleanup:** Removed unused Button import from AppScreen
</Accordion>

***

## v10.0.4 (February 21, 2026)

<Note>
  **Minor Release — Android UI/UX Redesign** - Complete Material 3 redesign of the Android app with custom theming, modular architecture, and per-ABI APK builds.
</Note>

### 📱 Android App v0.0.4-beta

<Accordion title="Complete Material 3 UI/UX Redesign">
  * **Custom Theme:** Teal color palette, M3 typography, shapes, and design tokens replacing hardcoded colors/dimensions
  * **Modular Architecture:** Decomposed monolithic `AppScreen.kt` into per-tab modules (`HomeTab`, `DnsTab`, `TunnelTab`, `SettingsScreen`) with a shared component library (10 reusable components)
  * **Navigation Overhaul:** M3 Scaffold with `NavigationBar`, `TopAppBar`, and `SnackbarHost`
  * **Home Tab:** Dashboard cards with animated status indicators and pull-to-refresh
  * **DNS Tab:** Improved benchmark UX, M3 dropdown menus, and pull-to-refresh
  * **Tunnel Tab:** Redesigned profiles, logs viewer, and pull-to-refresh
  * **Settings Screen:** New dedicated settings screen with persistent dynamic color (Material You) toggle via SharedPreferences
  * **Accessibility:** Content descriptions, semantic roles, and keyboard navigation support
  * **Animations:** Animated visibility transitions, branded loading screen, and error screens
  * **First-Run Dialog:** Welcome dialog for new users
  * **@Preview Composables:** Preview annotations for all major screens
</Accordion>

<Accordion title="Per-ABI APK Builds">
  * **New:** Platform-specific APKs for `arm64-v8a`, `armeabi-v7a`, `x86`, and `x86_64` alongside the universal APK
  * **Benefit:** Smaller download size (\~60% reduction) for users who only need their device's architecture
</Accordion>

### 🔧 Bug Fixes

<Accordion title="Dynamic Color Override Fix">
  * **Issue:** On Android 12+ devices, Material You dynamic colors silently overrode the custom teal theme, making the app look inconsistent across devices
  * **Fix:** Changed `dynamicColor` default to `false` in `Theme.kt`; added `LocalDynamicColor` and `LocalSetDynamicColor` composition locals backed by SharedPreferences for user-controlled toggle
  * **Impact:** The custom teal theme is now the default; users can opt into dynamic colors via Settings
</Accordion>

<Accordion title="String Resource & Deprecation Fixes">
  * **Fix:** Replaced `stringResource` calls in non-composable lambdas with pre-resolved values
  * **Fix:** Converted multiple `%s` format specifiers to positional format (`%1$s`, `%2$s`)
  * **Fix:** Replaced deprecated `Icons.Outlined.Article` with `Icons.AutoMirrored.Outlined.Article`
</Accordion>

***

## v10.0.3 (February 21, 2026)

<Note>
  **Patch Release — Android VPN Fix** - Fixes an Android VPN connect-without-internet/DNS failure on newer Android targets by moving proxy hostname resolution + VPN setup off the main thread.
</Note>

### 📱 Android

<Accordion title="Android App v0.0.3-beta">
  * **Version bump:** versionCode 3, versionName `0.0.3-beta`
  * **Fix:** VPN startup now resolves the proxy hostname and establishes the VPN on a background IO coroutine before starting the engine, preventing a DNS loop (VPN “connected” but no traffic).
</Accordion>

***

## v10.0.2 (February 20, 2026)

<Note>
  **Patch Release — Transport Error & Data Race Fix** - Fixes a silent VPN connectivity failure with xhttp/splithttp transport and a data race in the SOCKS5 tunnel handler.
</Note>

### 🔧 Bug Fixes

<Accordion title="xhttp/splithttp Transport Now Returns Explicit Error">
  * **Issue:** When an xhttp or splithttp transport was configured, the engine silently fell through to bare TCP VLESS instead of returning an error. The VPN appeared connected but passed no traffic.
  * **Fix:** `engine/vpn_uri.go` now returns an explicit error for unsupported transports, surfacing the problem immediately rather than silently degrading.
  * **Impact:** Users with xhttp/splithttp configs will now see a clear error message instead of a broken-but-seemingly-connected VPN.
</Accordion>

<Accordion title="connCount Data Race Fixed in SOCKS5 Tunnel Handler">
  * **Issue:** `connCount` in `engine/vpn_tun.go` (`socks5TunHandler.NewConnectionEx`) was incremented and decremented with `++`/`--` without synchronization, causing a data race under concurrent connections.
  * **Fix:** Replaced with `sync/atomic.AddInt64` for thread-safe access.
  * **Impact:** Eliminates a potential crash/corruption under high concurrency.
</Accordion>

### 📱 Android

<Accordion title="Android App v0.0.2-beta">
  * **Version bump:** versionCode 2, versionName `0.0.2-beta`
  * **Includes:** both bug fixes above in the bundled engine binary
</Accordion>

***

## v10.0.1 (February 20, 2026)

<Note>
  **Patch Release — Android Beta & VPN Fix** - Introduces the first Android app (beta) and fixes a VPN traffic routing issue on Linux.
</Note>

### 📱 Android App (Beta)

<Accordion title="DNS-MNS for Android v0.0.1-beta">
  * **New:** First public Android release as a standalone APK
  * **Features:** VPN-based DNS tunnel, one-tap DNS configuration, light/dark mode toggle
  * **Architectures:** arm64-v8a, armeabi-v7a, x86, x86\_64
  * **Status:** Beta — expect rough edges. Feedback and bug reports are welcome.
  * **Download:** `dns-mns-android-0.0.1-beta.apk` from the [Releases page](https://gitlab.com/E-Gurl/dns-mns/-/releases)
</Accordion>

### 🔧 Bug Fixes

<Accordion title="VPN Traffic Routing Fix (Linux)">
  * **Issue:** VPN tunnel on Linux could fail to route traffic correctly due to a file descriptor splice error in the TUN device handler
  * **Fix:** Corrected the splice call in `engine/vpn_tun.go` to properly handle bidirectional traffic
  * **Impact:** VPN connections on Linux are now stable and route traffic as expected
</Accordion>

### 📱 App Improvements

<Accordion title="Light/Dark Mode Toggle">
  * **Feature:** Added a persistent light/dark mode toggle button to the Android app
  * **Storage:** Theme preference saved via SharedPreferences, persists across app restarts
</Accordion>

***

## v10.0.0 (February 18, 2026)

<Note>
  **Major Release — Tunnel Suite** - Adds a unified tunnel workflow (DNSTT/Slipstream/Paqet) across CLI, interactive menu, and Bubble Tea TUI.
</Note>

### 🛰️ New Features

<Accordion title="Unified Tunnel Suite (DNSTT / Slipstream / Paqet)">
  * **CLI:** New `dns-mns tunnel` command group:
    * `profile` CRUD + validation + import/export (file/URL)
    * `scan` resolver scoring + `test` resolver health probes
    * `status`, `logs`, `stop`
    * `health` enable/disable/check with resolver auto-switch helpers
    * Transport commands: `dnstt`, `slipstream`, `paqet`
  * **Interactive menu:** Advanced Evasion Suite → Tunnel Suite
  * **Bubble Tea TUI:** New top-level `Tunnels` screen with profile/runtime actions
  * **Guardrails:** Single active tunnel runtime policy to prevent port conflicts
</Accordion>

<Accordion title="Profile System and Compatibility Import">
  * Profiles stored under the user config directory (`~/.config/dns-mns/tunnel/`)
  * JSON import/export for sharing profiles
  * Compatibility mapper for common upstream field naming (transport/mode/listen/remote/resolvers)
</Accordion>

### 🧪 Testing and Reliability

<Accordion title="Tunnel test coverage">
  * Added tests for:
    * profile validation and compatibility parsing
    * adapter command builders (DNSTT/Slipstream/Paqet)
    * runner lifecycle (start/stop/log tail)
    * manager lifecycle and state persistence
</Accordion>

### 📚 Documentation

* Added a Tunnel Suite documentation page and updated CLI/TUI/evasion docs and README/USAGE to include the new workflows.

***

## v9.0.2 (February 17, 2026)

<Note>
  **Security & Maintenance Update** - Fixes security issues and updates dependencies. Recommended for all users.
</Note>

### 🔒 Security Fixes

<Accordion title="Hysteria2 Salt Generation (CRITICAL)">
  * **Issue:** Hysteria2 obfuscation used `time.Now().UnixNano()` for salt generation, which is not cryptographically secure
  * **Impact:** Predictable salt values could weaken the obfuscation security
  * **Fix:** Now uses `crypto/rand` for proper cryptographically secure random salt generation
  * **Files:** `internal/hysteria2/hysteria2.go`
</Accordion>

### 🔧 Bug Fixes

<Accordion title="Context Leak in Sing-box">
  * **Issue:** Context cancel function was discarded (`_ = cancel`), potentially causing resource leaks
  * **Fix:** Added `cancel` field to Proxy struct and properly call it during Stop()
  * **Files:** `internal/singbox/singbox.go`
</Accordion>

### 📦 Dependency Updates

<Accordion title="Updated 20+ Dependencies">
  * **golang.org/x/crypto:** v0.46.0 → v0.48.0
  * **golang.org/x/net:** v0.48.0 → v0.50.0
  * **golang.org/x/sys:** v0.39.0 → v0.41.0
  * **golang.org/x/text:** v0.32.0 → v0.34.0
  * **github.com/AdguardTeam/golibs:** v0.32.7 → v0.35.8
  * **github.com/libdns/cloudflare:** v0.2.2-0.202... → v0.2.2
  * **github.com/libdns/alidns:** v1.0.5 → v1.0.6
  * **github.com/sagernet/gvisor:** v0.0.0-202503... → v0.0.0-202508...
  * **github.com/sagernet/netlink:** Updated to latest
  * **github.com/sagernet/nftables:** Updated to latest
  * **github.com/charmbracelet/colorprofile:** v0.4.1 → v0.4.2
  * **github.com/mattn/go-runewidth:** v0.0.19 → v0.0.20
  * **github.com/mdlayher/netlink:** Updated to latest
  * **github.com/klauspost/compress:** v1.17.11 → v1.18.4
  * **Plus additional indirect dependency updates**
</Accordion>

***

## v9.0.0 (February 17, 2026)

<Note>
  **Codebase Cleanup** - Removed framework-only, library-only, and legacy features that were either incomplete, deceptive, or fully superseded.
</Note>

### 🗑️ Removed Features

<Accordion title="AmneziaWG (Obfuscated WireGuard) — Framework Only">
  * **Reason:** No real WireGuard tunnel was ever established. DNS queries resolved directly, bypassing the "proxy" entirely. This gave a false sense of security.
  * **Files removed:** `internal/amneziawg/`, `docs/usage/amneziawg.mdx`
</Accordion>

<Accordion title="Standalone ShadowTLS proxy — Framework Only">
  * **Reason:** Same as AmneziaWG — no real tunnel. The ShadowTLS protocol as a sing-box transport is preserved.
  * **Files removed:** `internal/shadowtls/`, `docs/usage/shadowtls.mdx`
</Accordion>

<Accordion title="Oblivious DoH (ODoH) — Incomplete Encryption">
  * **Reason:** HPKE encryption was never implemented. Queries were forwarded in plaintext through the relay, providing no privacy benefit.
  * **Files removed:** `internal/odoh/`, `docs/usage/odoh.mdx`
</Accordion>

<Accordion title="DNS over QUIC (DoQ) — Library Only">
  * **Reason:** Never exposed as a CLI command. QUIC-based DNS is already covered by Hysteria2/sing-box.
  * **Files removed:** `internal/doq/`, `docs/usage/doq.mdx`
</Accordion>

<Accordion title="Geneva Genetic Algorithm Engine — Library Only">
  * **Reason:** Complex DPI evasion engine that was never reachable from the CLI. TLS fragmentation modes (`sni`, `half`, `chunked`, `random`) are retained in `internal/fragment/`.
  * **Files removed:** `internal/geneva/`
</Accordion>

<Accordion title="Smart Protocol Selector — Library Only">
  * **Reason:** Never reached CLI. Superseded by `dns-mns proxy` auto-fallback which already tests and selects the best protocol.
  * **Files removed:** `internal/selector/`
</Accordion>

<Accordion title="Phantun UDP-to-TCP — Incomplete Library">
  * **Reason:** Incomplete TCP header parsing, never reached CLI, no clear path to completion.
  * **Files removed:** `internal/phantun/`
</Accordion>

<Accordion title="Legacy dns-mns.sh Shell Script">
  * **Reason:** 54KB Bash script fully superseded by the Go binary in all capabilities. Maintenance burden with no unique value.
  * **Files removed:** `dns-mns.sh`, `tests/bash/test_script.bats`
</Accordion>

### 📚 Documentation

* Merged `docs/usage/utls.mdx` into `docs/usage/dpi-evasion.mdx` (uTLS is an internal detail, not a user command)
* Cleaned all references to removed features from installation, contributing, and troubleshooting docs

***

## v8.0.4 (February 16, 2026)

<Note>
  **Web Dashboard Design Overhaul** - Complete visual redesign of the DNS Leak Test web dashboard to match the TUI's purple identity.
</Note>

### 🎨 Web Dashboard Redesign

<Accordion title="New Purple-Themed Color System">
  * **Change:** Replaced the old gray/blue "Home Assistant" color scheme with a web-optimized purple palette inspired by the TUI's "Purple Hair Palette"
  * **Dark mode:** Deep violet backgrounds (`#0a0812`, `#110f1d`), vibrant lavender accent (`#a78bfa`), high-contrast text (`#f0ecf7`)
  * **Light mode:** Soft purple-tinted whites (`#f5f3fa`), deep purple accent (`#7c3aed`), clean borders (`#e0dae8`)
  * **Impact:** Cohesive visual identity between TUI and web dashboard
  * **Files:** `internal/leaktestdashboard/templates/dashboard.html`, `internal/leaktestdashboard/templates/report.html`
</Accordion>

<Accordion title="SVG Icons Replace All Emojis">
  * **Change:** Replaced all emoji icons with clean inline Feather-style SVG icons
  * **Icons:** Shield (header), Globe (connection), Server (DNS resolvers), Network (IPv6), Video (WebRTC), BarChart (EDNS), Clock (history), Moon/Sun (theme toggle)
  * **Impact:** Professional appearance across all platforms with consistent rendering
  * **Files:** `internal/leaktestdashboard/templates/dashboard.html`
</Accordion>

<Accordion title="Modern UI Components">
  * **Status indicators:** Replaced emoji badges with CSS dot indicators featuring glow effects
  * **Score ring:** Updated SVG progress circle with accent color gradient
  * **Header:** Sticky header with backdrop blur effect
  * **Layout:** Compact, information-dense design (\~650 lines, down from \~1350)
  * **Typography:** JetBrains Mono for code/numbers, Inter for body text
  * **Files:** `internal/leaktestdashboard/templates/dashboard.html`, `internal/leaktestdashboard/templates/report.html`
</Accordion>

<Accordion title="Report Template Redesign">
  * **Change:** Matching redesign of the HTML export report template
  * **Features:** Same purple color system, clean key-value grid layout, updated recommendations section with purple accent
  * **Size:** \~320 lines (down from \~500)
  * **Files:** `internal/leaktestdashboard/templates/report.html`
</Accordion>

***

## v8.0.3 (February 16, 2026)

<Note>
  **Dependency Updates & Maintenance** - Keeping dependencies current for security and performance.
</Note>

### 🔧 Dependency Updates

<Accordion title="sing-box v1.12.21 → v1.12.22">
  * **Change:** Updated sing-box universal proxy platform to latest stable release
  * **Impact:** Bug fixes and improvements for VLESS/REALITY proxy support
  * **Files:** `go.mod`, `go.sum`
</Accordion>

<Accordion title="dnscrypt v2.3.0 → v2.4.0">
  * **Change:** Updated DNSCrypt client library to v2.4.0
  * **Impact:** Latest DNSCrypt protocol improvements and bug fixes
  * **Files:** `go.mod`, `go.sum`, `internal/dnscrypt/`
</Accordion>

<Accordion title="certmagic v0.23.0 → v0.25.1">
  * **Change:** Updated automatic HTTPS certificate management library
  * **Impact:** Improved ACME client support and certificate handling
  * **Files:** `go.mod`, `go.sum`
</Accordion>

<Accordion title="fsnotify v1.7.0 → v1.9.0">
  * **Change:** Updated file system notification library
  * **Impact:** Better file watching performance and reliability
  * **Files:** `go.mod`, `go.sum`
</Accordion>

<Accordion title="brotli v1.1.0 → v1.2.0">
  * **Change:** Updated Brotli compression library
  * **Impact:** Improved compression performance
  * **Files:** `go.mod`, `go.sum`
</Accordion>

<Accordion title="cloudflare/circl v1.3.7 → v1.6.3">
  * **Change:** Updated Cloudflare cryptographic library
  * **Impact:** Latest cryptographic primitives and security improvements
  * **Files:** `go.mod`, `go.sum`
</Accordion>

<Accordion title="Additional Indirect Dependencies">
  * **AdguardTeam/golibs:** v0.20.3 → v0.32.7
  * **libdns/libdns:** v1.1.0 → v1.1.1
  * **mholt/acmez:** v3.1.2 → v3.1.4
  * **go.uber.org/zap:** v1.27.0 → v1.27.1
  * **golang.org/x/time:** v0.9.0 → v0.11.0
  * **klauspost/cpuid/v2:** v2.2.10 → v2.3.0
  * **gofrs/uuid/v5:** v5.3.2 → v5.4.0
  * **caddyserver/zerossl:** v0.1.3 → v0.1.4
</Accordion>

### 🧪 Test Fixes

<Accordion title="Updated test expectations for version 8.0.3">
  * **Fix:** Updated all test files to expect version 8.0.3
  * **Files:** `internal/leaktestdashboard/dashboard_test.go`, `internal/app/app_test.go`, `internal/app/utility_test.go`
</Accordion>

***

## v8.0.2 (February 16, 2026)

<Note>
  **Full TUI Feature Parity** - All CLI features are now accessible from the interactive TUI. The TUI is no longer considered incomplete.
</Note>

### 🆕 TUI Feature Parity

<Accordion title="Set DNS directly from benchmark results">
  * **Feature:** Pressing Enter on any reachable result row in the benchmark results table now calls `setter.SetDNS()` to apply that server system-wide.
  * **Shows:** Spinner during application, then a confirmation (or error) result screen with server name, primary/secondary IPs, and latency stats.
  * **Files:** `internal/app/benchmark.go`
</Accordion>

<Accordion title="System Diagnostics screen">
  * **Feature:** New TUI menu item 🩺 System Diagnostics runs `diagnose.Run()` and displays OS info, network interfaces, current DNS, permissions, and DNS capabilities.
  * **Files:** `internal/app/app.go`, `internal/app/utility.go`
</Accordion>

<Accordion title="Update checker in Settings">
  * **Feature:** New Settings action checks for updates via `updater.CheckForUpdate()`, shows current vs latest version and a download link if an update is available.
  * **Files:** `internal/app/utility.go`
</Accordion>

<Accordion title="DNSCrypt proxy start/stop in Encrypted DNS">
  * **Feature:** New Encrypted DNS actions start and stop a local DNSCrypt proxy on `127.0.0.1:5356`, using the first working provider from `dnscrypt.GetWorkingProviders()`.
  * **Files:** `internal/app/utility.go`
</Accordion>

<Accordion title="Blocked domains check in Security">
  * **Feature:** New Security action checks commonly censored domains (Twitter, YouTube, Telegram, Instagram, Facebook, GitHub, Google, Cloudflare, Twitch) for poisoning/blocking status.
  * **Files:** `internal/app/utility.go`
</Accordion>

<Accordion title="DoH health check in Encrypted DNS">
  * **Feature:** New Encrypted DNS action checks DoH JSON API health for common domains (google.com, cloudflare.com, github.com, youtube.com) with latency display.
  * **Files:** `internal/app/utility.go`
</Accordion>

<Accordion title="AmneziaWG and ShadowTLS setup guides in Evasion">
  * **Feature:** New Advanced Evasion actions show informational setup guides for AmneziaWG and ShadowTLS protocols, including CLI commands.
  * **Files:** `internal/app/utility.go`
</Accordion>

***

## v8.0.1 (February 16, 2026)

<Note>
  **Interactive TUI & UX Improvements** - Introduces an experimental Bubble Tea-based terminal UI. The TUI is experimental and may change in future releases.
</Note>

### 🆕 Interactive TUI (Experimental)

<Accordion title="New Bubble Tea Terminal UI">
  * **Feature:** Full interactive terminal user interface built with Bubble Tea and Lipgloss.
  * **Includes:** Keyboard-navigable menu system, ASCII art banner, real-time screens for all features (dashboard, benchmark, recommendations, security, leak test, encrypted DNS, proxy, evasion, settings).
  * **Status:** Experimental. The TUI is functional but may receive significant changes in future versions.
  * **Files:** `internal/app/app.go`, `internal/app/utility.go`, `internal/app/benchmark.go`, `internal/ui/components/`, `internal/ui/theme/`
</Accordion>

### 🔧 UX Improvements

<Accordion title="Centered TUI Layouts">
  * **Issue:** Dashboard, benchmark results, leak test results, and help views were rendered in the top-left corner of the terminal.
  * **Fix:** All views now use `lipgloss.Place()` for proper horizontal and vertical centering within the terminal.
  * **Files:** `internal/app/utility.go`, `internal/app/benchmark.go`, `internal/app/app.go`, `internal/dashboard/dashboard.go`, `internal/leaktestdashboard/dashboard.go`
</Accordion>

<Accordion title="Live Dashboard Auto-Refresh">
  * **Issue:** Dashboard snapshot required manual re-entry to refresh data.
  * **Fix:** Dashboard now auto-starts on entry and refreshes every 10 seconds for continuous real-time DNS health monitoring.
  * **Files:** `internal/app/utility.go`
</Accordion>

<Accordion title="DNS Leak Test Results Layout Fix">
  * **Issue:** Leak test notes text could overflow the terminal width, preventing horizontal centering.
  * **Fix:** Notes text is now wrapped to `width - 16` to ensure proper centering on narrow terminals.
  * **Files:** `internal/app/utility.go`
</Accordion>

***

## v7.0.2 (February 15, 2026)

<Warning>
  **Security, Reliability & Release-Quality Update** - Recommended for all users.
</Warning>

### 🔒 Security & Trustworthiness

<Accordion title="ODoH Encryption Status Clarified (Critical)">
  * **Issue:** ODoH code path still used an insecure placeholder instead of HPKE, while docs/changelog messaging implied full encryption.
  * **Fix:** Added explicit STUB/INSECURE warnings in code and runtime; aligned README/docs/changelog to state HPKE is not yet implemented.
  * **Impact:** Prevents false privacy assumptions; users are clearly warned not to rely on current ODoH path for confidentiality.
  * **Files:** `internal/odoh/odoh.go`, `internal/odoh/odoh_test.go`, `docs/usage/odoh.mdx`, `README.md`, `docs/reference/changelog.mdx`
</Accordion>

### 🐛 Reliability Fixes

<Accordion title="Fallback Proxy Shutdown Deadlock">
  * **Issue:** `Stop()` could wait on goroutines while holding `p.mu`, causing lock/wait deadlock with health-check path.
  * **Fix:** Refactored stop flow to release lock before `wg.Wait()` and re-acquire for final cleanup.
  * **Files:** `internal/fallback/fallback.go`
</Accordion>

<Accordion title="DoQ Partial Length Read">
  * **Issue:** Response length prefix used `Read()` instead of `io.ReadFull`, allowing short-read parsing bugs.
  * **Fix:** Switched to `io.ReadFull` and added zero-length validation.
  * **Files:** `internal/doq/doq.go`
</Accordion>

<Accordion title="OpenWrt Lifecycle Idempotency">
  * **Issue:** Multiple components used unguarded `close(stopCh)`, causing panic on repeated stop/restart flows.
  * **Fix:** Added idempotent stop-channel guards and restart-safe reinitialization where applicable.
  * **Files:** `internal/openwrt/mdns/resolver.go`, `internal/openwrt/vpn/monitor.go`, `internal/openwrt/multiwan/router.go`, `internal/openwrt/logging/logger.go`, `internal/openwrt/integration.go`
</Accordion>

<Accordion title="Scheduler Race & Stop-Path Panics">
  * **Issue:** Scheduler loop could race on mutable ticker pointer and panic on repeated close paths.
  * **Fix:** Reworked loop to use local ticker ownership, made stop close idempotent, and reinitialized stop channels on start.
  * **Files:** `internal/openwrt/scheduler/scheduler.go`
</Accordion>

<Accordion title="Sing-box JSON Config Loading">
  * **Issue:** `NewFromJSON` ignored user JSON and synthesized defaults.
  * **Fix:** Added JSON validation and direct raw-config usage in startup path.
  * **Files:** `internal/singbox/singbox.go`
</Accordion>

<Accordion title="Fallback Sing-box Probe Logic">
  * **Issue:** Health probe called `TestConnection()` on non-running temporary sing-box proxies.
  * **Fix:** Probe now checks only running instances and avoids invalid temporary probe path.
  * **Files:** `internal/fallback/fallback.go`
</Accordion>

### 📚 Documentation & Release Process

<Accordion title="Feature Maturity Labels and Consistency Gate">
  * Added explicit maturity labels (`Framework Only`, `Library Only`, `Experimental`) in README for partially integrated features.
  * Added release-time docs/runtime consistency script and Make target:
    * `scripts/check-feature-consistency.sh`
    * `make check-features`
  * **Impact:** Reduces drift between implementation status and public documentation.
</Accordion>

<Accordion title="Linux Diagnose Timeout Helper">
  * **Issue:** `runWithTimeout` ignored timeout argument.
  * **Fix:** Implemented context-based command timeout handling.
  * **Files:** `internal/diagnose/diagnose_linux.go`
</Accordion>

***

## v7.0.1 (February 14, 2026)

<Warning>
  **Critical Security & Stability Release** - All users must upgrade immediately.
</Warning>

### 🔒 Security Fixes

<Accordion title="Race Condition with Global Proxy Variables (CRITICAL)">
  * **Issue:** Global proxy variables accessed from multiple goroutines without synchronization
  * **Impact:** Nil pointer dereferences, inconsistent proxy state, crashes during start/stop
  * **Fix:** Added `sync.RWMutex` protection and thread-safe getter/setter functions
  * **Files:** `cmd/dns-mns/main.go` (40+ locations updated)
</Accordion>

<Accordion title="Ignored Network Write Errors (CRITICAL)">
  * **Issue:** UDP/TCP DNS response write errors were silently ignored
  * **Impact:** Clients waiting indefinitely, silent packet loss, difficult debugging
  * **Fix:** Added proper error handling with `OnError` callback in all send functions
  * **Files:** `internal/singbox/singbox.go`, `internal/amneziawg/amneziawg.go`, `internal/shadowtls/shadowtls.go`
</Accordion>

### 🚀 Improvements

<Accordion title="Framework-Only Proxy Warnings">
  * **AmneziaWG:** Added prominent WARNING logs indicating framework-only implementation
  * **ShadowTLS:** Added prominent WARNING logs indicating framework-only implementation
  * **Note:** These proxies do NOT provide actual encrypted tunneling
</Accordion>

<Accordion title="Sing-box DNS Routing Documentation">
  * Added comprehensive documentation about tunnel routing requirements
  * Clarified system configuration needed for proper DNS tunneling
</Accordion>

***

## v6.6.4 (February 14, 2026)

<Warning>
  **Security & Stability Release** - All users are encouraged to upgrade immediately.
</Warning>

### 🔒 Security Fixes

<Accordion title="MikroTik TLS Certificate Verification">
  * **Issue:** TLS certificate verification was hardcoded to `InsecureSkipVerify: true`
  * **Fix:** Made `InsecureSkipVerify` configurable via `ConnectionConfig.InsecureSkipVerify`
  * **Impact:** Users can now control certificate verification behavior (defaults to secure)
  * **File:** `internal/mikrotik/client.go`
</Accordion>

### 🐛 Stability Fixes

<Accordion title="DNSCrypt Double-Close Panic">
  * **Issue:** Potential panic when `Stop()` is called multiple times due to double-closing channel
  * **Fix:** Added nil-check and clear `stopCertRefresh` channel after closing
  * **File:** `internal/dnscrypt/proxy.go`
</Accordion>

<Accordion title="Race Condition in Statistics">
  * **Issue:** Inconsistent atomic value reads in singbox `GetStatus()`
  * **Fix:** Load all atomic values once for a consistent snapshot
  * **File:** `internal/singbox/singbox.go`
</Accordion>

<Accordion title="Partial TCP Reads">
  * **Issue:** Potential short reads in TCP DNS handlers using `conn.Read()`
  * **Fix:** Use `io.ReadFull()` instead across singbox, amneziawg, and shadowtls
  * **Files:** `internal/singbox/singbox.go`, `internal/amneziawg/amneziawg.go`, `internal/shadowtls/shadowtls.go`
</Accordion>

### 🔧 Resource Management

<Accordion title="HTTP Connection Leaks">
  * **Issue:** Connection pool exhaustion in fallback transport
  * **Fix:** Added `CloseIdleConnections()` to cleanup idle connections
  * **File:** `internal/fallback/transport.go`
</Accordion>

<Accordion title="Panic Recovery">
  * **Issue:** Goroutine panics could crash the entire application
  * **Fix:** Added `recover()` in all goroutine handlers
  * **Files:** `internal/singbox/singbox.go`, `internal/amneziawg/amneziawg.go`, `internal/shadowtls/shadowtls.go`
</Accordion>

### 🛡️ Bounds Checking

<Accordion title="TLS Fragmentation SNI Parsing">
  * **Issue:** Out-of-bounds read on malformed ClientHello packets
  * **Fix:** Changed minimum length check from 43 to 44 bytes
  * **File:** `internal/fragment/fragment.go`
</Accordion>

### 📝 Error Handling

<Accordion title="Ignored Write Errors">
  * **Issue:** DNS response write errors were silently ignored
  * **Fix:** Added proper error logging for `WriteMsg()` failures
  * **File:** `internal/fallback/fallback.go`
</Accordion>

<Accordion title="Zero-Length Message Validation">
  * **Issue:** Zero-length DNS messages weren't rejected
  * **Fix:** Added validation to reject `msgLen == 0`
  * **Files:** TCP handlers in singbox, amneziawg, shadowtls
</Accordion>

***

## v6.6.3 (February 14, 2026)

### 🔧 Bug Fixes

* **Version Consistency:** Fixed version mismatch between shell script (6.0.0) and binary (6.6.2) - now both report 6.6.2
* **Nil Pointer Protection:** Added empty path check in `runClearCommand` to prevent potential nil pointer dereference
* **Race Condition Fix:** Fixed concurrent write race condition in benchmark results slice
* **IP Validation:** Enhanced IP validation in shell script to reject octets > 255 (e.g., 999.999.999.999)
* **Linux DNS Setter:** Critical errors (systemd-resolved restart, nmcli operations) now properly return errors instead of silently failing
* **DoH JSON Resolver:** Added fallback to Cloudflare, Google, and OpenDNS when primary resolver fails; fixed User-Agent version

***

## v6.6.2 (February 14, 2026)

### 🔒 Security Fixes

<Accordion title="ODoH Encryption (Still Incomplete)">
  * **Issue:** `EncryptQuery` used trivial XOR obfuscation, not actual HPKE encryption
  * **Status:** HPKE encryption is still NOT implemented. The XOR placeholder remains. ODoH queries are forwarded through the relay in plaintext. A proper HPKE library (e.g. `github.com/cisco/go-hpke`) is required to complete this feature.
  * **Impact:** ODoH does NOT provide end-to-end encryption. Do not rely on it for privacy until HPKE integration is complete.
</Accordion>

<Accordion title="uTLS Library Integration (Critical)">
  * **Issue:** Module used standard `crypto/tls` instead of actual uTLS library
  * **Fix:** Added proper integration with `github.com/metacubex/utls`
  * **Impact:** TLS fingerprint spoofing now actually works
</Accordion>

<Accordion title="Memory Corruption Fix (High)">
  * **Issue:** `Write()` method modified caller's buffer directly in TLS fragmentation
  * **Fix:** Buffer is now copied before modification
  * **Impact:** Eliminates memory corruption and potential crashes
</Accordion>

### 🔧 Functional Fixes

* **Sing-box DNS Routing:** Fixed DNS queries bypassing the tunnel
* **macOS DNS Detection:** Fixed pattern matching for `scutil --dns` output
* **DNSCrypt Certificate Refresh:** Added auto-refresh every 24 hours
* **DNSCrypt Race Condition:** Fixed shutdown race condition
* **MikroTik Validation:** Now accepts hostname-based DNS servers
* **Recommendation Engine:** Fixed division by zero crash

***

## v6.6.1 (February 13, 2026)

### 🔧 Bug Fixes

* Minor bug fixes and stability improvements

***

## v6.6.0 (February 13, 2026)

### 🆕 New Features

**MikroTik RouterOS Integration**

* Auto-detection of MikroTik routers on your network
* DNS configuration directly on the router
* DoH/DoT support for RouterOS 7+
* Static DNS entry management
* Backup and restore functionality
* Secure API and API-SSL communication

***

## v6.5.0

### 🆕 Passwall Integration

* Cooperative Mode: DNS-MNS and Passwall work independently
* Integrated Mode: DNS-MNS routes queries through Passwall
* Override Mode: DNS-MNS takes over Passwall's DNS
* Auto-detection of Passwall installation
* Gaming-optimized DNS recommendations

***

## v6.2.0

### 🆕 Advanced Censorship Circumvention

* **DNS over QUIC (DoQ)** - 95% effectiveness (RFC 9250)
* **Oblivious DoH (ODoH)** - Maximum privacy with IP/query separation
* **Geneva Genetic Algorithm Engine** - AI-discovered packet manipulation
* **JA3/JA4 Fingerprint Randomization** - uTLS-based browser spoofing
* **Hysteria2 with Salamander** - QUIC-based HTTP/3 proxy

***

## v6.1.0

### 🆕 OpenWrt Router Support

* Full support for OpenWrt routers
* Upstream mode (recommended): Works alongside dnsmasq
* Direct mode: Replaces dnsmasq on port 53
* Static binaries for x86\_64, MIPS, ARM, ARM64

***

## v6.0.0

### 🆕 Groundbreaking Features

* **AmneziaWG** - WireGuard with junk packet injection
* **ShadowTLS v4** - Hides proxy behind legitimate TLS
* **Smart Protocol Selector** - Auto-selects best protocol
* **Phantun UDP-to-TCP** - Enables UDP when blocked
* **Enhanced Censorship Diagnostics**

***

## Earlier Versions

See [GitLab Releases](https://gitlab.com/E-Gurl/dns-mns/-/releases) for older changelogs.