你准备续订么，这次功能量看起来非常大。

Surge Version 6.8.0 Release Notes

• Version: 6.8.0
• Build: 11990
• Release Date: August 6, 2026
• License: Renewal Required

---

What’s New

macOS 27

• Began adapting the Surge interface for macOS 27.
• Added workarounds for macOS system bugs that could cause crashes when:
  • Opening remote connections.
  • Presenting modal sheets while the system text-completion interface was active.

---

Snell v6 Server

Added Snell v6 support to the built-in Snell proxy server.

Use the following configuration in the [Snell Server] section to enable it:

version=6

Existing configurations continue to use Snell v1 by default.

New capabilities include:

• Supports default, unshaped, and unsafe-raw modes through the mode parameter.
• Supports reusable encrypted TCP transports.
• Supports UDP tunneling.
• Improved:
  • Snell handshake validation.
  • Connection lifecycle handling.
  • EOF processing.
  • Malformed UDP packet handling.

---

DHCP

• Statically assigned IP addresses are now automatically excluded from the dynamic address pool, preventing duplicate allocation.
• Upgraded the ISC DHCP server to version 4.4.3-P1.

---

TLS

Added server-cert-verify-name to independently specify the hostname used for proxy server certificate verification without changing SNI.

This parameter applies to all TLS- and QUIC-based proxy protocols.

---

ECN

Reworked ECN configuration and packet handling across:

• QUIC
• WireGuard
• Tailscale
• Ponte
• Nested UDP tunnels

Changes include:

• Correctly preserves ECN and DSCP/TOS metadata across IPv4 and IPv6 encapsulation and decapsulation.
• For QUIC-based proxy protocols:
  • When ECN is enabled, anomalies are automatically detected.
  • Surge will fall back to non-ECN handling if necessary.
• ECN is now enabled by default for QUIC-based proxy protocols on supported systems.
• WireGuard and Tailscale remain disabled by default.
• Use the following parameters to explicitly override the default:

ecn=false

or:

ecn=true

• Surge Ponte now also has ECN enabled by default.
• The client-use-ecn parameter has been removed.

---

DNS

Improved prefer-v4 / prefer-v6

Optimized TCP connection establishment for prefer-v4 and prefer-v6.

Previously, these parameters determined which record to use when a domain had both A and AAAA records.

Now:

1. A or AAAA records are preferentially used during the TCP handshake.
2. If the handshake cannot be completed within 3 seconds, other available records begin to be tried.

DNS-over-TCP

Added DNS-over-TCP support.

DNS server settings now accept:

tcp://hostname[:port]

---

Tailscale

Interactive Sign-In

• Added interactive Tailscale sign-in on iOS and macOS.
• Resolves an issue where some enterprise users are unable to obtain an auth key.

Automatic Routing

Added automatic Tailscale routing.

Surge can now discover:

• The tailnet’s MagicDNS suffix.
• Peer IPv4 addresses.
• Peer IPv6 addresses.

It then automatically routes matching domains and peer IP traffic through the corresponding Tailscale policy.

Automatic routing is enabled by default.

To disable it:

auto-add-magic-dns-rule = false

Session and Recovery Improvements

• Improved Tailscale session warm-up and recovery.
• Sessions now retry MagicDNS discovery after:
  • Startup failures.
  • Network changes.
• Matching traffic no longer needs to arrive first to trigger retry.
• Tailscale sessions now stay active by default.
• The following values keep the session always active:
  • Omitted idle-keepalive.
  • idle-keepalive = 0.
  • idle-keepalive = -1.
• Set a positive value to enable idle teardown.
• Tailscale can now begin handling traffic as soon as a valid network map is received, without waiting for the home DERP connection to be established.
• Improved recovery after network changes and control-server reconnections by:
  • Preserving the last known home DERP region.
  • Retrying peer handshakes at the appropriate time.
• Aligned DERP measurement and selection behavior with the official Tailscale client.
• Improved compatibility with:
  • Custom DERP maps.
  • STUN-only nodes.
  • Fallback probes.
  • Temporarily unavailable control connections.
• Sensitive values such as authentication keys and authorization URLs are now redacted from verbose Tailscale control logs.

---

Surge as MTProto Server

Surge can now operate as an incoming MTProto proxy server for Telegram.

See the Surge manual for configuration details:

https://manual.nssurge.com/

---

CLI & AI Skills

Surge CLI has been significantly expanded into a comprehensive command-line management and diagnostics interface.

New commands and details:

https://nssurge.com/blog/surge-cli-updates/

---

Core Version Alignment

Starting with:

• Surge Mac 6.8.0
• Surge iOS 5.21.0

the Core Version is derived directly from the corresponding Surge Mac version.

A separate Core Version number no longer needs to be maintained.

See the manual for details:

https://manual.nssurge.com/

---

Codebase Refactoring

After more than a decade of development, the Surge codebase has grown into a large and complex project.

To further improve reliability, Surge has introduced AI-assisted code review across the entire codebase.

Every code change is independently reviewed by:

1. Fable 5
2. GPT-5.6 Sol
3. A human developer

before being merged.

The goal is to identify:

• Potential security issues.
• Rare crash scenarios.
• Subtle correctness problems.

---

Improvements & Fixes

DHCP

Improved DHCP server and IPv6 Router Advertisement detection, including:

• Interface binding.
• Packet validation.
• Timeout handling.
• Filtering of invalid responses.

---

TLS

• Fixed a potential crash caused by reentrant TLS cleanup while pending BIO data was being flushed, particularly with nested TLS connections.
• Improved MITM hostname matching for TLS and QUIC traffic on nonstandard ports while continuing to respect exclusion rules.
• Improved MITM certificate and keystore validation and lifecycle reliability.
• Fixed a possible macOS crash when keystore entries were edited while TLS or SSH connections were reading them.

---

DNS

Local DNS mappings can now specify multiple upstream DNS servers using a comma-separated list.

This also fixes an issue where the previous implementation did not take effect correctly.

---

SSH

Key Support & Verification

• Added support for importing SSH P-521 keys.
• Improved error reporting for unsupported elliptic curves.
• Strengthened server host-key verification when server-fingerprint is configured.
• A one-time security warning is now emitted when connecting without a configured fingerprint.

Protocol Compatibility

Fixed compatibility with:

• Fragmented identification banners.
• Pre-banner lines.
• Small channel windows.
• Non-ASCII credentials.
• Modern RSA/SHA-2 authentication.

Rekey & Validation

• Added complete bidirectional rekey support.
• Corrected:
  • Key switching.
  • Deferred channel operations.
  • Connection cleanup during rekey.
• Added strict validation and size limits for:
  • Transport packets.
  • Key-exchange fields.
  • Signatures.
  • Channel parameters.
  • Cryptographic values.

Reliability

Fixed:

• Channel read/write timeouts.
• Completion reporting.
• Malformed-key handling.
• Several memory and resource leaks.

---

HTTP & HTTP/3

HTTP Parsing & Framing

• Added compatibility with clients that send unbracketed IPv6 addresses in HTTP CONNECT requests.
• Added strict and consistent parsing for:
  • Request headers.
  • Response headers.
  • Content-Length.
  • Transfer-Encoding.
  • Chunked coding.
  • Trailers.
  • Request targets.
  • Status-specific body semantics.
• Ambiguous or malformed framing is now rejected consistently.
• This includes conflicting Content-Length and Transfer-Encoding values.
• Fixed HTTP/1.1 pipelining boundaries so request bodies are forwarded strictly according to their declared length.

HTTP/1 & HTTP/2

Improved response handling for:

• Interim responses.
• Lowercase HEAD requests.
• Simultaneous GOAWAY shutdown.

Improved HTTP/2 request and response rewriting, including:

• Correct handling of empty header values.
• Correct UTF-8 header lengths.
• Removal of forbidden connection-specific fields.
• Correct processing of decoded bodies by scripts.

Resource Limits

Added input and buffering limits to:

• Protocol detection.
• HTTP Controller.
• JSVM server endpoints.
• Script body processing.
• Proxy responses.
• HTTP/3 full-response tasks such as DoH3.

HTTP/3 Reliability

Improved:

• Stream reset.
• Connection close.
• Callback completion.
• Shutdown behavior.

This reduces stalled requests and reentrant teardown issues.

Response Semantics

Improved handling of:

• HEAD
• 204
• 205
• 304

Script/rewrite header mutations are now transactional to prevent inconsistent wire framing.

---

Policy Selection

Smart Group

• Added UDP-aware Smart Group scoring.
• Surge now learns from:
  • UDP response latency.
  • Silent relay failures.
• This improves policy selection for UDP traffic.
• Smart Group connections that receive no response data within 3 seconds are now marked as failed, allowing faster fallback to another policy.

Concurrency & Configuration Reloads

Fixed:

• Potential crashes when policy lookups occurred concurrently with a configuration reload.
• Inconsistent routing decisions during configuration reloads.
• Site history or runtime data potentially being lost during configuration updates.
• The "most used" policy score becoming incorrect after an extended idle period.

Rule Evaluation

Fixed several paths that could:

• Stall indefinitely.
• Reuse a canceled evaluation.
• Produce results from an outdated configuration.

Additional changes:

• Added safeguards against unexpected policy-group reference loops.
• Fixed URL-Test groups ignoring an explicitly configured:

tolerance=0

---

Surge Ponte

Security & Validation

• Added strict validation for device PSKs and encrypted payloads.
• Prevents invalid or damaged iCloud device records from causing a crash.
• Restricted Ponte confirmation links to valid iCloud CloudKit share URLs.

Dual-Stack Reliability

• Fixed Ponte connections entering an incorrect state when IPv4 and IPv6 setup operations completed synchronously.
• Improved dual-stack handling:
  • If one IPv4 or IPv6 connector fails during setup, Ponte can continue using the remaining connector.
• Fixed IPv6 server channels failing to recover automatically when a previously unavailable network interface becomes available.
• Failed channels no longer publish stale external addresses to other devices.

CloudKit Synchronization

• Serialized CloudKit device-record updates to prevent:
  • Duplicated updates.
  • Lost updates.
  • Conflicting updates.
• Improved CloudKit synchronization for:
  • Ponte information.
  • Remote-device information.

Vector / QUIC

Improved Vector UDP and QUIC stream lifecycle handling, including more reliable:

• Setup.
• Teardown.
• Error reporting.

Applies to both Ponte and regular Vector connections.

Startup & Migration

Fixed:

• Legacy configuration migration issues.
• Server startup edge cases involving:
  • Duplicate direct channels.
  • Unavailable STUN addresses.

---

TCP Connection Establishment

• Fixed an unreachable cached "previously successful" address preventing fallback to other available addresses after a network change.
• Improved connection-attempt error handling so every attempt reaches a definite:
  • Success state.
  • Failure state.
• Corrected TCP connection statistics collection for sockets that never completed establishment.

---

Connection Management

TCP Pacing

Reworked TCP pacing to:

• Adapt to connection latency.
• Reduce traffic bursts on:
  • Gateway Mode.
  • WireGuard-based connections.
• Exclude local tunnel peers that do not require pacing.
• Improve general TCP robustness.

Long-Lived Connections

Fixed memory growth and journal performance degradation on long-lived multiplexed connections such as:

• SSH.
• Hysteria.
• TUIC.
• Vector.
• HTTP/2.

Connection Pooling

• Fixed a race where an idle master connection could close immediately after being assigned to a new request.
• Improved connector abort handling so cleanup and policy failure reporting occur only once.
• Connector pools now:
  • Remove empty entries.
  • Stop unnecessary maintenance timers.
• Connections abandoned while waiting in the reuse pool now automatically retry with a new connection.
• This reduces intermittent failures after:
  • Network changes.
  • Idle periods.

Statistics & Thread Safety

Fixed:

• TCP packet-loss statistics not being collected during common disconnection paths.
• Inaccurate traffic statistics under concurrent, high-volume requests.
• Pending traffic data potentially being lost during daily or monthly statistics rollover.

Improved thread safety when:

• Recording recent proxy errors.
• Accessing connector state across queues.

DNS Mapping Consistency

When a local DNS mapping contains multiple candidates:

• One result is now used consistently throughout a logical connection.
• A new result can still be selected after:
  • Connector reuse.
  • Configuration updates.

DIRECT Resolution

Fixed underlying proxy groups resolving to DIRECT taking an unnecessary intermediate connector path.

TLS 1.3

• Improved general connection cleanup and error propagation across:
  • HTTP.
  • HTTP/3.
  • TLS.
  • Internal HTTP clients.
• Improved TLS 1.3 connection reliability.
• Prevented session reuse across incompatible:
  • SNI.
  • ALPN.
  • Certificate verification settings.

Smart Group Recovery

Improved Smart Group recovery following transient failures on reusable:

• AnyTLS connections.
• Snell connections.

Snell

• Fixed potential memory growth in Snell v6 UDP relay when the receiving client is slow or unresponsive.
• Fixed Snell v6 incorrectly using the QUIC proxy mode intended only for Snell v5.

Proxy Protocol Reliability

Improved reliability and security of:

• AnyTLS.
• Snell.
• Shadowsocks.
• VMess.
• Hysteria.
• TUIC.
• Vector.
• ShadowTLS.
• Trojan.
• TrustTunnel.
• WebSocket.
• SOCKS5.

AnyTLS

Fixed a serious AnyTLS connection reuse issue that could route data to an incorrect logical stream.

Also fixed several AnyTLS and Snell connection-reuse issues that could:

• Return terminated connections to the pool.
• Cause requests to hang.

TrustTunnel

Fixed TrustTunnel connections occasionally:

• Stalling.
• Losing the end of a response.

This primarily affected multiplexed or slow-transfer conditions.

SOCKS5

Fixed SOCKS5 UDP relay failures caused by:

• Fragmented responses.
• Multi-address DNS results.
• Domain-form response addresses.

Hysteria / TUIC / Vector

• Fixed Hysteria response-header validation rejecting or mishandling certain responses.
• Fixed Hysteria, TUIC, and Vector connections incorrectly rejecting valid fragmented handshake responses.

WebSocket

Enforced the WebSocket message-size limit while data is being received.

This prevents oversized messages from consuming excessive memory before validation completes.

UDP & Malformed Input

• Fixed UDP proxy handling for internationalized domain names.
• Fixed malformed proxy responses potentially causing the Surge tunnel process to terminate.
• Fixed several cases where malformed or incomplete proxy data could:
  • Cause connections to hang.
  • Consume excessive memory.
• Added stricter limits and validation for:
  • UDP fragmentation.
  • Protocol buffering.

---

UDP Reliability

• Improved synchronization of local address and destination state across socket queues.
• UDP receive backpressure now takes effect immediately instead of continuing to deliver additional batches after reads are paused.
• Moved large batched receive buffers off the worker-thread stack, reducing the risk of stack exhaustion under heavy UDP traffic.
• Fixed UDP packets with IPv6 scope differences being incorrectly rejected on metadata-enabled send paths.
• Improved QUIC reliability on lossy networks by preventing legitimate duplicate retransmissions from triggering the protocol abuse limiter.

---

Gateway Mode

Lifecycle & Configuration

Improved:

• Startup.
• Shutdown.
• Rollback.
• Configuration handling.

Gateway Mode can now start VMNET when its DHCP interface appears later.

Partial failures no longer leave Gateway Mode in an incorrect state.

Networking

Improved handling of:

• IPv6 router changes.
• Tagged Ethernet frames.
• Malformed packets.
• Fast-path failures.

UDP fast-path blacklist changes now also apply to existing connections.

Long-Running Stability

Improved long-running stability with:

• Limits on learned devices.
• Limits on idle UDP states.
• More frequent cleanup.
• More reliable DHCP startup.
• Better logging.
• More reliable LAN device CSV imports.

---

Network Testing & Diagnostics

Proxy Tests

Fixed proxy tests:

• Continuing to run after cancellation.
• Remaining permanently marked as active when canceled before deferred startup completed.

UDP Tests

UDP tests now reliably report:

• Invalid parameters.
• Timeouts.
• Cancellation.
• Connector failures.

to every caller.

URL Tests

Added a 64 KB response-header limit to URL tests.

…

---