#Mac#Release
Version 5.9.0-3025
### New Features
- Added pre-matching rules for low-overhead request rejection. Please refer to the documentation for details. https://manual.nssurge.com/policy/reject.html
- Body Rewrite supports using JQ expressions to manipulate JSON.
- The shadowsocks protocol adds support for the 2022-blake3-aes-256-gcm and 2022-blake3-aes-128-gcm encryption modes
### Improvements
- The URL-REGEX rule now supports extended-matching tags.
- Allow the use of Ponte policy as an underlying proxy.
- Modify the termination logic of HTTP scripts. If a request needs to be interrupted, use $done({abort: true}). Other failures will not modify or terminate the request.
- Overall optimization and improvement of UDP forwarding.
### Bug Fixes
- Fix the issue where DNS requests cannot select the correct interface according to the routing table in enhanced mode.
- Fix the issue of not being able to obtain system routes on macOS 12.
- Fix the issue where determining the existence of IPv6 might be incorrect in some cases.
- Fix the issue where an incorrect message might sometimes indicate that the proxy settings have been modified by another program.
- Other bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.8.2-2946
- Fix the issue where IPv6 VIF cannot take over requests when the gateway-restricted-to-lan parameter is enabled.
- DNS lookup of use-application-dns.net will return NXDOMAIN, causing Firefox to automatically disable application DNS, (i.e., DoH). Using encrypted DNS directly in the browser will prevent Surge from correctly obtaining the requested domain names.
- Bug fixes and minor improvements.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
⚠️版本回撤‼️
Version 5.8.1-2929
- New parameters: proxy-restricted-to-lan/gateway-restricted-to-lan
It has been found that some users, due to a lack of understanding of network security knowledge, accidentally expose proxy and gateway services to the Internet (e.g., configured DMZ). Therefore, these two parameters have been added to restrict proxy and gateway services to only accept devices from the current subnet. These two parameters are enabled by default.
- Fix the compatibility between enhanced mode and PPPoE direct dialing.
- Support using ETag to avoid downloading duplicate data when requesting external resources.
- Surge now supports handling the system's DNS search domain settings.
- Other bug fixes and compatibility improvements.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.8.2-2946
- Fix the issue where IPv6 VIF cannot take over requests when the gateway-restricted-to-lan parameter is enabled.
- DNS lookup of use-application-dns.net will return NXDOMAIN, causing Firefox to automatically disable application DNS, (i.e., DoH). Using encrypted DNS directly in the browser will prevent Surge from correctly obtaining the requested domain names.
- Improved HTTP engine compatibility with non-standard requests
- Enhanced error handling logic for encrypted DNS, retrying immediately upon encountering errors
- Other bug fixes and minor improvements.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.8.1-2929
- New parameters: proxy-restricted-to-lan/gateway-restricted-to-lan
It has been found that some users, due to a lack of understanding of network security knowledge, accidentally expose proxy and gateway services to the Internet (e.g., configured DMZ). Therefore, these two parameters have been added to restrict proxy and gateway services to only accept devices from the current subnet. These two parameters are enabled by default.
- Fix the compatibility between enhanced mode and PPPoE direct dialing.
- Support using ETag to avoid downloading duplicate data when requesting external resources.
- Surge now supports handling the system's DNS search domain settings.
- Other bug fixes and compatibility improvements.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.8.0-2900
### Network Extension
- Due to numerous issues arising from the traditional utun takeover solution in newer system versions, starting from Surge Mac 5.8.0, Surge Mac will use Network Extension as the enhanced mode to take over the system network.
- The minimum system version requirement for Surge Mac is raised to macOS 12.
- Due to different required permissions, manual authorization operations is needed after updating.
- The vif-mode parameter will no longer be effective.
- Enhanced mode can now be used in conjunction with network sharing functionality, meaning you can directly create a Wi-Fi managed by Surge (requires wired network)
### Port Hopping
Hysteria2 and TUIC protocol now support port hopping to improve ISP's QoS issues with UDP. See the server documentation for details.
Proxy = hysteria2, 1.2.3.4, 443, password=pwd, port-hopping="1234;5000-6000;7044;8000-9000", port-hopping-interval=30
After configuring the port-hopping parameter, the primary port number configured in the front will no longer be effective.
Parameters:
- port-hopping: Used to configure the range of ports. Separated by commas and supports ranges configured with a hyphen.
- port-hopping-interval: The interval for changing port numbers. Defaults to 30 seconds
### Other Improvments
- Due to the large amount of features requiring permissions in the new macOS system, a dedicated page has been added for managing system permissions.
- The syslib keyword for local DNS mapping can now be used in enhanced mode. However, in non-enhanced mode, the resolution is entirely handled by the system. In enhanced mode, Surge resolves it using the system's DNS address.
- Added [General] parameter show-error-page, which is used to control whether Surge's HTTP error page is displayed when an error occurs. This parameter is enabled by default, and the behavior is consistent with previous versions.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.7.5-2826
- The panel is now available in Surge Mac.
- DNS Forwarding Subsystem Optimization
- When the domain of a DNS query is one that should not be forwarded to the public network (e.g., .home.arpa, 1.0.168.192.in-addr.arpa), it will automatically determine the upstream DNS address and only forward to LAN DNS servers.
- Surge can now correctly respond to PTR requests for fake IPs, meaning that using the dig -x 198.18.23.87 command can be used to determine the original domain name corresponding to a fake IP.
- The DNS forwarder will now forward DNS requests to specific upstream servers based on [Host] section configuration.
- Directly respond with NOTIMP to unsupported DNS-SD PTR requests for fake IPs, without forwarding.
- When adding a rule for the current webpage, you can choose to add to an existing ruleset.
- Bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.7.4-2806
- Due to the sudden shutdown of a public STUN server that Surge Ponte relies on, resulting in the unavailability of Surge Ponte, we have carried out an emergency replacement. Additionally, we will build our own STUN server in the future to avoid such issues.
- Enhance compatibility with VPN and multiple network cards
In previous versions, if the enhanced mode was enabled, all outgoing packets would be forced to use the primary interface due to Surge overriding the system's routing table. This bypassed the routing table to avoid creating a loop.
However, this also caused issues where packets could not be sent from the correct interface in cases with multiple network cards or other VPNs.
This version improves on that design. Now, in enhanced mode, Surge will automatically check routes and still use standard routing for TCP/UDP packets if there are higher priority sub-routes present, enhancing compatibility.
- Fix an issue where DOMAIN-SUFFIX rules may become invalid if duplicate DOMAIN and DOMAIN-SUFFIX rules are included in the rule set
- Other bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
⚠️版本回撤‼️
Version 5.7.4-2805
- Due to the sudden shutdown of a public STUN server that Surge Ponte relies on, resulting in the unavailability of Surge Ponte, we have carried out an emergency replacement. Additionally, we will build our own STUN server in the future to avoid such issues.
- Enhance compatibility with VPN and multiple network cards
In previous versions, if the enhanced mode was enabled, all outgoing packets would be forced to use the primary interface due to Surge overriding the system's routing table. This bypassed the routing table to avoid creating a loop.
However, this also caused issues where packets could not be sent from the correct interface in cases with multiple network cards or other VPNs.
This version improves on that design. Now, in enhanced mode, Surge will automatically check routes and still use standard routing for TCP/UDP packets if there are higher priority sub-routes present, enhancing compatibility.
- Fix an issue where DOMAIN-SUFFIX rules may become invalid if duplicate DOMAIN and DOMAIN-SUFFIX rules are included in the rule set
- Other bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.7.4-2806
- Due to the sudden shutdown of a public STUN server that Surge Ponte relies on, resulting in the unavailability of Surge Ponte, we have carried out an emergency replacement. Additionally, we will build our own STUN server in the future to avoid such issues.
- Enhance compatibility with VPN and multiple network cards
In previous versions, if the enhanced mode was enabled, all outgoing packets would be forced to use the primary interface due to Surge overriding the system's routing table. This bypassed the routing table to avoid creating a loop.
However, this also caused issues where packets could not be sent from the correct interface in cases with multiple network cards or other VPNs.
This version improves on that design. Now, in enhanced mode, Surge will automatically check routes and still use standard routing for TCP/UDP packets if there are higher priority sub-routes present, enhancing compatibility.
- Fix an issue where DOMAIN-SUFFIX rules may become invalid if duplicate DOMAIN and DOMAIN-SUFFIX rules are included in the rule set
- Other bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
⚠️版本回撤‼️
Version 5.7.4-2805
- Due to the sudden shutdown of a public STUN server that Surge Ponte relies on, resulting in the unavailability of Surge Ponte, we have carried out an emergency replacement. Additionally, we will build our own STUN server in the future to avoid such issues.
- Enhance compatibility with VPN and multiple network cards
In previous versions, if the enhanced mode was enabled, all outgoing packets would be forced to use the primary interface due to Surge overriding the system's routing table. This bypassed the routing table to avoid creating a loop.
However, this also caused issues where packets could not be sent from the correct interface in cases with multiple network cards or other VPNs.
This version improves on that design. Now, in enhanced mode, Surge will automatically check routes and still use standard routing for TCP/UDP packets if there are higher priority sub-routes present, enhancing compatibility.
- Fix an issue where DOMAIN-SUFFIX rules may become invalid if duplicate DOMAIN and DOMAIN-SUFFIX rules are included in the rule set
- Other bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.7.4-2806
- Due to the sudden shutdown of a public STUN server that Surge Ponte relies on, resulting in the unavailability of Surge Ponte, we have carried out an emergency replacement. Additionally, we will build our own STUN server in the future to avoid such issues.
- Enhance compatibility with VPN and multiple network cards
In previous versions, if the enhanced mode was enabled, all outgoing packets would be forced to use the primary interface due to Surge overriding the system's routing table. This bypassed the routing table to avoid creating a loop.
However, this also caused issues where packets could not be sent from the correct interface in cases with multiple network cards or other VPNs.
This version improves on that design. Now, in enhanced mode, Surge will automatically check routes and still use standard routing for TCP/UDP packets if there are higher priority sub-routes present, enhancing compatibility.
- Fix an issue where DOMAIN-SUFFIX rules may become invalid if duplicate DOMAIN and DOMAIN-SUFFIX rules are included in the rule set
- Other bug fixes.
Official Channel: @SurgeTestFlightFeed