#Mac#Release
Version 6.5.0-10960
### Agent Skill
- Surge now fully supports AI agent skill operations. We have built in instructions on how to use surge-cli to operate Surge, and have fully exposed all capabilities of surge-cli. Tell the following to your agent that supports skills to use it:
Install the skill from the /Applications/Surge.app/Contents/Resources/Skills/ directory using a symbolic link to ensure the skill can be updated along with the application bundle.
### Policy Group Icon
- It is now supported, as in the iOS version, to configure an icon for a policy group for display. You need to configure the icon-url field. There is currently no UI setting; you need to modify the configuration manually.
### DHCP Section
Added support for a new DHCP configuration section to customize DHCP settings. You can now control max-lease-time, default-lease-time, min-lease-time, one-lease-per-client, and ping-check directly from profile parameters.
[DHCP]
max-lease-time = 86400
default-lease-time = 43200
min-lease-time = 600
one-lease-per-client = true
ping-check = true
This feature is only provided for users with special needs; generally, the default settings are sufficient and no configuration is required.
### Other Improvements
- Added support for the X25519MLKEM768 post-quantum hybrid key exchange group for all TLS-related features (such as proxy clients and MITM), combining X25519 with ML-KEM-768 for quantum-resistant key exchange.
- Experimental support for compatibility-mode = 5
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.4.4-10660
### Throughput Test
Now you can customize all the parameters of the throughput test.
[Testing]
download-url =
upload-url =
download-url-proxy = // If not provided, use download-url
upload-url-proxy = // If not provided, use upload-url
download-concurrency = // Default is 4
upload-concurrency = // Default is 4
download-duration-limit = // Default is 10s
upload-size-limit = // Default is 1GB
upload-duration-limit = // Default is 10s
### Proxy Protocol
Experimental support for the Trust Tunnel proxy protocol, which is developed and maintained by AdGuard. (Although the project promotes Trust Tunnel as a VPN protocol, it is actually a proxy protocol.)
- This protocol is based on TLS, so all TLS-related parameters can be configured and used.
- Currently, only the HTTP/2 (TCP)-based operating mode is supported.
- UDP forwarding support has not been completed yet.
Configuration example: proxy = trust-tunnel, 192.168.20.62, 443, username=test, password=test
### Minor Improvements
- Fixed an issue where AnyTLS could get stuck in reuse mode when used with certain servers.
- Support drag-and-drop reordering on the proxy view and local DNS mapping view.
- Fix the issue where the related statistics for the DIRECT policy were not saved correctly.
- Bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.4.3-10320
### Proxy Protocol
- Support for a new proxy protocol: AnyTLS.
- Supports Salamander obfuscation mode of Hysteria 2, with the configuration parameter salamander-password.
- The QUIC block behavior for all proxy protocols is now set to block by default.
### Browser Integration
- Add support for the Brave browser.
### Proxy Editing Improvements
- When you hold down the Option key and click the Surge main menu, hidden policy groups will now be displayed.
- You can now directly test whether the current proxy parameters are correct during the process of editing the proxy.
### New DNS Mapping Keyword
- Added the force-syslib keyword for DNS mapping.
- The original system and syslib keywords have exactly the same effect: when enhanced mode is not enabled, the system library will be used for resolution; when enhanced mode is enabled, Surge will perform resolution using the system's DNS server.
- When using the force-syslib keyword, the system library will be used for resolution regardless of whether enhanced mode is enabled. Please note that this may cause recursive request issues. This option is designed for special domains such as mDNS; do not configure this parameter for general domains.
### Dashboard Improvements
- Enhanced the Host view of the request list. Now all IP address requests can be viewed grouped by AS.
### CLI Improvements
- Now you can use the surge-cli -c profile.conf command to check whether a profile is valid.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.4.2-9830
- It is now possible to enable or disable the UDP Fast Path feature for individual devices.
- IPv6 RA override no longer broadcasts new DNS addresses to ensure maximum compatibility.
- Adjusted the storage mechanism for traffic statistics. In previous versions, changes to a policy's configuration caused the policy's traffic statistics to be reset. Now, traffic statistics rely solely on the policy name (and the policy group name for external policies), so modifying the configuration will no longer result in the loss of statistical data.
- Surge Enterprise is being renamed to Surge Team, which will be used for team licensing and profile management. We will provide more information later.
- Bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.4.1-9550
- Improved the stability of the UDP Fast Path, preventing previous UDP connections from being affected by fast path fallback.
- Other bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.4.0-9300
### Surge Gateway VM UDP Fast Path
- Currently, when using Surge in gateway mode to take over a device, if P2P applications (such as BT downloads, game installers, live streaming, etc.) are used on the device, it may result in a large number of connections appearing in the Dashboard, slowing down overall speed. If the number of connections is extremely high, it may even exhaust system resources and force Surge to restart.
- The cause of this issue is that Surge operates as a layer 4 proxy, and for every UDP packet with a different quadruple, it needs to be handled as a new connection. For most applications, even if UDP is used, only a few logical connections are typically generated, so the overhead is completely acceptable. However, for P2P applications, nearly a thousand logical connections may be generated within a few seconds.
- Therefore, this version introduces a UDP Fast Path defense mechanism. When a client initiates a large number of UDP connections in a short period of time (10 within 1 second or 30 within 10 seconds), UDP Fast Path will be enabled for that client, downgrading UDP packet processing to L3. In this mode, performance is extremely high, far exceeding the physical network card speed limit, so there is no longer a need to worry about resource consumption issues.
Additionally:
- Packets under UDP Fast Path will be forwarded directly and cannot go through the proxy.
- For UDP packets with a destination port number less than 1024, they will always be forwarded using the normal processing mode to avoid affecting regular applications.
### Bug Fixes
- Fix the issue where the HTTP engine might get stuck when handling consecutive requests.
- Fixed the issue where using Snell v3 to carry UDP traffic could cause a crash.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.3.1-8860
- The proxy diagnostic tool has added upload and download bandwidth testing.
- According to mainstream operating system conventions, adjust all traffic and statistics from a 1024 base to a 1000 base.
- Optimized the menu for adding rules in the Dashboard
- Fixed the issue where the MAC-ADDRESS rule was not taking effect correctly.
- Fixed the issue where some application icons could not be displayed on macOS 26.1.
- Fixed a potential issue where reloading the profile could cause a freeze when Surge Ponte is enabled.
- Fix potential memory leaks when using TLS-based proxy protocols.
- Fixed some color issues on macOS 26.
- Bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.3.0-8560
- Ready for macOS 26.
- Bug fixes.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.10.5-3350
- Ready for Surge Mac 6.
- Fix the issue of incorrect main menu text color in dark mode on macOS 26 beta.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.2.0-8310
### Core Improvements
- The interface parameter in policies can now also take effect on DNS queries. Enable this feature for the policy configuration dns-follow-interface=true. DNS requests that match the policy will use the specified interface for resolution. (If DNS is triggered during the rule matching phase, a specific interface will not be used.)
- The network quality detection subsystem has been rewritten with more comprehensive checking logic, so notifications are no longer triggered frequently when the network is unstable.
### Ponte Server Upgrade
- Optional active standby mode: When Surge detects that the main network interface is unavailable for a period of time, Ponte will automatically switch to another interface (such as 5G USB modem or multi-WAN scenarios). At the same time, iCloud will temporarily use this interface to complete new address announcements.
- IPv6 can be configured to take effect on specific interfaces or enabled for all interfaces, suitable for multi-WAN scenarios.
- Supports cross-subnet intranet connections such as multiple VLANs.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.1.0-8010
### New
- The Surge Gateway VM and DHCP functions have been decoupled, so now the Gateway VM can be enabled without enabling DHCP. Additionally, the configuration page for gateway mode has been redesigned, allowing direct modification of the configuration.
- Added a new rule type MAC-ADDRESS for directly matching specific clients using MAC addresses.
- The client-source-address parameter of [MITM] now supports specifying MAC addresses in addition to IPs, to address the issue of client IPv6 request address changes.
### Improvements
- Optimized the behavior of Ponte NAT traversal mode to always use local port 6208 in order to improve the success rate of traversal.
- Support automatically configuring system proxy settings when only listening with IPv6 interface.
- Improve the compatibility of IPv6 RA override with Windows clients.
- gQUIC support has been added to the QUIC Mode of Snell v5.
### Fixes
- Fixed a potential no network issue that could occur under high concurrency.
- Fix compatibility issues with large UDP packets in the new version of Hysteria 2.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.0.2-7560
- Improve the compatibility of IPv6 RA override with Windows clients.
- Improve the stability of VMNET on older versions of macOS.
- Fixed a potential unexpected drop in throughput under HTTP mode.
- Fixed the issue where the Dashboard device list could not be sorted by MAC address.
- Fixed some interface layout issues on devices without a connected touchpad.
Official Channel: @SurgeTestFlightFeed