#Mac#Release
Version 5.7.1-2758
- Optimize the matching performance of small rule sets, especially evident on older CPU models.
- The external resource update page can display error information generated by rule set processing.
- Automatically ignore invalid empty lines in the rule set.
- Fixed an issue where applying temporary rules would not interrupt existing connections if a policy change occurred.
- Fixed an issue when using Ponte policy within Smart group, if the target device is itself, it was not automatically switched to DIRECT policy.
- Corrected the time error displayed in request logs for Ponte device requests.
- Fixed a low probability crash that occurs when external policy group content changes.
- During the initialization phase of Smart group, no longer display most used tags to avoid misunderstanding .
- Fixed a crash that could occur when adding a policy group if an external policy was selected but no URL was provided.
- Corrected an issue where items did not correctly display their storage location after being moved on the key management page.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.7.1-2757
- Optimize the matching performance of small rule sets, especially evident on older CPU models.
- The external resource update page can display error information generated by rule set processing.
- Automatically ignore invalid empty lines in the rule set.
- Fixed an issue where applying temporary rules would not interrupt existing connections if a policy change occurred.
- Fixed an issue when using Ponte policy within Smart group, if the target device is itself, it was not automatically switched to DIRECT policy.
- Corrected the time error displayed in request logs for Ponte device requests.
- Fixed a low probability crash that occurs when external policy group content changes.
- During the initialization phase of Smart group, no longer display most used tags to avoid misunderstanding .
- Fixed a crash that could occur when adding a policy group if an external policy was selected but no URL was provided.
- Corrected an issue where items did not correctly display their storage location after being moved on the key management page.
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 5.6.1-2612
### Fixes
- Bug fixes.
#Mac#Release
Version 5.5.0-2589
#### Module
- Added several new official modules; official modules can now be dynamically updated.
- Modules have a new classification field for convenient access and categorization in the UI.
- Modules now accept parameter tables, supporting multiple parameters. Parameters will be used to modify module content through text replacement.
#### Script
- New script execution engine. Optimized execution performance and memory usage.
- $httpClient has added several practical parameters.
For more details on the updates above, see the documentation.
#### Enhancements
- New parameter: always-raw-tcp-keywords. For usage, refer to documentation.
- Added SRC-PORT rule for matching client port numbers.
- IN-PORT/SRC-PORT/DEST-PORT three rules are categorized as port number rule types, supporting three kinds of expressions:
- Directly writing the port number, such as IN-PORT,6153
- Port number closed interval: such as DEST-PORT,10000-20000
- Using >, <, <=, >= operators, such as SRC-PORT,>=50000
- The UI can now maintain pure empty lines from original configurations after editing.
### Fixes
- Corrected a detail issue with QUIC flow control and optimized latency performance for Ponte/TUIC/Hysteria2 protocols.
- Other bug fixes.
#Mac#Release
Version 5.5.0-2588
#### Module
- Added several new official modules; official modules can now be dynamically updated.
- Modules have a new classification field for convenient access and categorization in the UI.
- Modules now accept parameter tables, supporting multiple parameters. Parameters will be used to modify module content through text replacement.
#### Script
- New script execution engine. Optimized execution performance and memory usage.
- $httpClient has added several practical parameters.
For more details on the updates above, see the documentation.
#### Enhancements
- New parameter: always-raw-tcp-keywords. For usage, refer to documentation.
- Added SRC-PORT rule for matching client port numbers.
- IN-PORT/SRC-PORT/DEST-PORT three rules are categorized as port number rule types, supporting three kinds of expressions:
- Directly writing the port number, such as IN-PORT,6153
- Port number closed interval: such as DEST-PORT,10000-20000
- Using >, <, <=, >= operators, such as SRC-PORT,>=50000
- The UI can now maintain pure empty lines from original configurations after editing.
### Fixes
- Corrected a detail issue with QUIC flow control and optimized latency performance for Ponte/TUIC/Hysteria2 protocols.
- Other bug fixes.
#Mac#Release
Version 5.5.0-2586
#### Module
- Added several new official modules; official modules can now be dynamically updated.
- Modules have a new classification field for convenient access and categorization in the UI.
- Modules now accept parameter tables, supporting multiple parameters. Parameters will be used to modify module content through text replacement.
#### Script
- New script execution engine. Optimized execution performance and memory usage.
- $httpClient has added several practical parameters.
For more details on the updates above, see the documentation.
#### Enhancements
- New parameter: always-raw-tcp-keywords. For usage, refer to documentation.
- Added SRC-PORT rule for matching client port numbers.
- IN-PORT/SRC-PORT/DEST-PORT three rules are categorized as port number rule types, supporting three kinds of expressions:
- Directly writing the port number, such as IN-PORT,6153
- Port number closed interval: such as DEST-PORT,10000-20000
- Using >, <, <=, >= operators, such as SRC-PORT,>=50000
- The UI can now maintain pure empty lines from original configurations after editing.
### Fixes
- Corrected a detail issue with QUIC flow control and optimized latency performance for Ponte/TUIC/Hysteria2 protocols.
- Other bug fixes.
#Mac#Release
Version 5.4.3-2540
- Rewrote the virtual IP database, now the database can automatically clean up data based on the last time of use.
- Fixed some issues that may occur when using Snell v4 with WireGuard and enabling reuse.
- For DNS requests with illegal domain names, an empty result response will be generated instead of being directly ignored.
- tun-included-routes and tun-excluded-routes parameters now supports IPv6 CIDR block when IPv6 VIF is enabled.
- Support configuring no-resolve for built-in rule sets/Inline rule sets.
- Surge Ponte connections no longer validate peer addresses to ensure normal operation in certain special scenarios.
- Bug fixes.
#Mac#Release
Version 5.4.2-2502
- Fixed an issue that the built-in rule set LAN failed to correctly trigger DNS resolution.
- Fixed an issue that could cause a crash when handling some malformed UDP packets.
- Fixed an issue that the system that could potentially misjudge has been restarted, causing the Fake IP table to be cleared.
- Compatible with some non-standard SOCKS5 UDP server implementations, adjusted errors to warnings.
- Other bug fixes.
#Mac#Release
Version 5.4.1-2495
#### Rule Engine Optimizations
- The implementation of RULE-SET and DOMAIN-SET has been completely rewritten. Now, Surge automatically preprocesses and indexes rule sets during resource updates, significantly increasing the matching speed.
1. There is no longer any difference in performance and memory usage between RULE-SET and DOMAIN-SET types of rule sets, allowing flexible usage.
2. There is no longer a restriction in DOMAIN-SET rule sets that prevents the use of eTLDs.
3. The matching speed for DOMAIN, DOMAIN-SUFFIX, IP-CIDR, and IP-CIDR6 rules in RULE-SET has been greatly improved.
- A DOMAIN/DOMAIN-SUFFIX rule set with approximately 100,000 entries used to take 100ms for a single match in the old version; now, it only takes single-digit ms.
- An IP-CIDR rule set with approximately 10,000 entries used to take about 0.1ms for a single match in the old version. The new version only needs 0.0002ms, an improvement of about 500 times. The performance improvement for IP-CIDR6 rules is even greater.
4. In the new version, building a regional IP address collection using the IP-CIDR rule set offers the same performance as directly using the internal GEOIP rule.
5. The Inline Ruleset added in the previous version does not benefit from this optimization, but there is virtually no difference at the scale of hundreds of entries.
6. In previous versions, rules within a Ruleset were matched one by one from top to bottom. If rules requiring DNS resolution were included, DNS would only be triggered when starting to match that sub-rule. In the new version, if any rule requiring DNS resolution is included in the rule set, DNS resolution will occur before testing that rule set. (In most cases, there is no difference)
- Main ruleset matching efficiency has been slightly optimized.
- The efficiency of IP-CIDR6 rules has been significantly improved even in non-indexed situations.
- RULE-SET rules can now be configured directly with parameters no-resolve and extended-matching, which are equivalent to configuring all sub-rules with these parameters.
- DOMAIN-SET rule sets also support configuration with extended-matching.
#### Minor Optimizations
- Now, when performing MITM, the certificate used for signing will be sent to the client together, to support using intermediate certificates for MITM.
- All comments (at the beginning and end of lines) can now use #, //, ; three common comment symbols.
- Profile error message prompt optimization, now it can give the exact line number where the error occurred more accurately.
- Optimize Surge Ponte error handling process, correct the issue where device information is not automatically updated under certain errors.
- Bug fixes.
#Mac#Release
Version 5.4.0-2470
#### New Features
* Protocol sniffing
Requests to port 80 and 443 will wait for the client to send the first packet, then extract the SNI and other information for the rule system to judge.
- DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD rules add an optional parameter called extended-matching. When this parameter is enabled, the rule will try to match both the SNI and the HTTP Host Header (or :authority).
- Added a parameter called always-raw-tcp-hosts, used to forcibly turn off active protocol detection for specific hostnames.
* New proxy protocol support: Hysteria 2
Hysteria 2 is a proxy protocol optimized for unstable and packet-loss-prone network environments, based on UDP/QUIC.
* Automatic QUIC blocking
Since most proxy protocols are not suitable for forwarding QUIC traffic, Surge will now automatically block QUIC traffic to make it fallback to HTTPS/TCP protocol, ensuring performance. For QUIC traffic that hits the MITM hostname, it will also be automatically rejected.
* ECN (Explicit Congestion Notification) support for QUIC-based protocols
Significantly improved the performance of the Vector(Surge Ponte)/TUIC/Hysteria 2 protocol.
#### Optimizations
- Reworked HTTP capture functionality
- The related settings are no longer stored in the configuration, the [Replica] section has been deprecated.
- Added an automatic shut-off setting after turning on the capture switch, which can automatically stop capturing based on time, size, or the number of requests.
- Added automatic activation of MITM after turning on the capture switch, which can be additionally turned on for specific hostnames. (Even if the main MITM switch is off).
- Added an option to only save HTTP/HTTPS requests after turning on the capture switch.
- Improved compatibility with some non-standard protocols.
- When testing the Ponte policy, the test URL has been changed from proxy-test-url to internet-test-url.
- Following the WireGuard protocol standard recommendation, WireGuard handshake packets will now be tagged with 0x88 (AF41) DSCP to increase the success rate.
- When forwarding UDP packets via WireGuard, it supports retaining the TOS(DSCP/ECN) tag of packets inside the tunnel.
- Based on the WireGuard protocol standard recommendation, Surge will copy the ECN tag from packets inside the tunnel to packets outside. When receiving packets with an ECN tag, they will be strictly merged according to RFC6040. (ecn=true must be set for the strategy).
- UDP NAT can close the UDP session early based on ICMP messages.
- Improved PMTU support for QUIC.
#### Bug Fixes
- Fixed the issue where the external resources of rule sets needed to be reloaded to take effect after updates.
- After a network switch, it will forcefully break the original long connection of DoH/DoQ/DoH3 to avoid obtaining results that are not suitable for the current network environment.
- Fixed the issue where invalid certificates might cause the key store interface to crash.
- When performing MITM on HTTPS requests that directly connect using an IP address, the IP address should not be sent as SNI, as this might cause compatibility issues.
- Other bug fixes.
#Mac#Release
Version 6.5.0-10960
### Agent Skill
- Surge now fully supports AI agent skill operations. We have built in instructions on how to use surge-cli to operate Surge, and have fully exposed all capabilities of surge-cli. Tell the following to your agent that supports skills to use it:
Install the skill from the /Applications/Surge.app/Contents/Resources/Skills/ directory using a symbolic link to ensure the skill can be updated along with the application bundle.
### Policy Group Icon
- It is now supported, as in the iOS version, to configure an icon for a policy group for display. You need to configure the icon-url field. There is currently no UI setting; you need to modify the configuration manually.
### DHCP Section
Added support for a new DHCP configuration section to customize DHCP settings. You can now control max-lease-time, default-lease-time, min-lease-time, one-lease-per-client, and ping-check directly from profile parameters.
[DHCP]
max-lease-time = 86400
default-lease-time = 43200
min-lease-time = 600
one-lease-per-client = true
ping-check = true
This feature is only provided for users with special needs; generally, the default settings are sufficient and no configuration is required.
### Other Improvements
- Added support for the X25519MLKEM768 post-quantum hybrid key exchange group for all TLS-related features (such as proxy clients and MITM), combining X25519 with ML-KEM-768 for quantum-resistant key exchange.
- Experimental support for compatibility-mode = 5
Official Channel: @SurgeTestFlightFeed
#Mac#Release
Version 6.4.4-10660
### Throughput Test
Now you can customize all the parameters of the throughput test.
[Testing]
download-url =
upload-url =
download-url-proxy = // If not provided, use download-url
upload-url-proxy = // If not provided, use upload-url
download-concurrency = // Default is 4
upload-concurrency = // Default is 4
download-duration-limit = // Default is 10s
upload-size-limit = // Default is 1GB
upload-duration-limit = // Default is 10s
### Proxy Protocol
Experimental support for the Trust Tunnel proxy protocol, which is developed and maintained by AdGuard. (Although the project promotes Trust Tunnel as a VPN protocol, it is actually a proxy protocol.)
- This protocol is based on TLS, so all TLS-related parameters can be configured and used.
- Currently, only the HTTP/2 (TCP)-based operating mode is supported.
- UDP forwarding support has not been completed yet.
Configuration example: proxy = trust-tunnel, 192.168.20.62, 443, username=test, password=test
### Minor Improvements
- Fixed an issue where AnyTLS could get stuck in reuse mode when used with certain servers.
- Support drag-and-drop reordering on the proxy view and local DNS mapping view.
- Fix the issue where the related statistics for the DIRECT policy were not saved correctly.
- Bug fixes.
Official Channel: @SurgeTestFlightFeed