New Features
• Added support for VLESS-TCP-REALITY

Improvements
• Improved compatibility with Shadowsocks 2022

Fixes
• Fixed an issue where the Start button might disappear when using large fonts on iPadOS
• Fixed an issue where StashLink speed tests might get stuck

Fixes
• Fixed an issue where the start button might not appear when using large text on iPadOS
• Fixed an issue where the visual editor AnyTLS might fail to save
• Optimized TUIC compatibility

Fixes
• Fixed an issue where the left-side interface on iPad could appear too small in some cases
• Fixed an issue where settings or tools could not be tapped in windowing mode on iPadOS 26

• New Features
- Added dialer-proxy, allowing upstream proxies to be specified in proxy configurations, with support for TCP and UDP relay.
- Added support for AnyTLS.
- Added a Script Persistent Data management page.
- Added GeoSite Browser, allowing GEOSITE rules to be selected directly via a browser when adding GEOSITE-type rules, without manual input.
- Providers now support custom paths, initialization via payload files, and synchronization through iCloud.
- iPerf network bandwidth testing now supports chart visualization.
- Added support for binding network requests to specific interfaces (Wi-Fi / Cellular) on iOS.
- The Active Connections page now supports adding rules directly for current connections.
- Rewrite URL / Header / Body / Mock now each have independent editors.

• Optimizations & Improvements
- Overall optimization of the Override interface.
- Refactored the Third-Party Services page.
- Refactored the HTTP engine to improve performance when handling multiple Rewrite scenarios.
- Improved empty-state page display.
- Remote devices now support swipe-left to delete.
- Remote controller now shows proper prompts when remote devices disconnect.

• Bug Fixes
- Fixed an issue where filters were not displayed on iOS 26.
- Fixed several multilingual description issues.

• Fixes
- Fixed an issue where running iPadOS Stash using MacCatalyst would cause unexpected behavior
- Fixed an issue where the navigation bar displayed incorrectly on iPadOS when using enlarged text
- Fixed a layout issue on iPadOS 26

• Fixes
- Fixed an issue where running iPadOS Stash using MacCatalyst would cause unexpected behavior
- Fixed an issue where the navigation bar displayed incorrectly on iPadOS when using enlarged text

• Optimizations
- Optimized the profile button style on the iOS 26 home page

• New
- Added support for setting CNAME as hosts
- Added proxy-hosts: you can configure proxy-hosts to specify the IP requested by a remote server
- HTTP rewrite now supports Mock
Configuration details: https://stash.wiki/http-engine/rewrite#mock

- Added Collapsed Tile
To provide more customization space for “Third-Party Service” checks, we added Collapsed Tile, which uses the same script API as Tile. Collapsed Tile will appear in “Availability” and “Long Press Proxy - Proxy Information”. We also provide sample Tiles, which will be prompted for download when updating to Stash 3.2. Details: https://stash.wiki/script/tile

- Stash now generates a random API key upon first installation. All API operations require authentication via the HTTP header Authorization: Bearer ${secret}. The API key can be changed in “More Settings”.
The API key is automatically synced via the user’s iCloud. When accessing other Stash devices under the same iCloud through “Tools” → “Remote Controller”, the API key will be filled in automatically.

- Added “Network Quality Test” page to evaluate network status via DNS response latency. Remote Controller can also view network quality of other devices (requires remote device version ≥ 3.2.0)
- “HTTP Inspection” page now supports showing request details before and after rewrite for easier debugging (remote debugging requires remote device version ≥ 3.2.0)
- Proxy list now supports switching sorting method: “By Configuration File” or “By Benchmark Results”
- Added long-press proxy information in Remote Controller (requires remote device version ≥ 3.2.0)
- Redesigned Override interface
- Transparent rewrite now supports regex parameters
- Added filter to Connections page
- Added filter to HTTP Inspection page
- Added local override for policy group icons
- Added background refresh for YAML configuration files
- Added “Reset Settings” in “More Settings” to restore Stash to default configuration

• Optimizations
- Optimized Connections interface
- Optimized HTTP Inspection interface
- Optimized DNS Inspection interface
- Optimized Override installation flow
- Optimized iPerf
- Optimized QUIC
- UI improvements on several pages, added transition animations (requires iOS 17 or later)

• Fixes
- Fixed compatibility issues between WireGuard and IPv6
- Fixed XUDP IPv6 connections
- Fixed Relay policy group not performing automatic speed tests in some cases
- Fixed issue where pinging domain names in Enhanced Mode may return incorrect IPs
- Fixed URL Transparent rewrite not correctly parsing parameters
- Fixed DNS hijacking compatibility with non-standard DNS queries

• New
- Added support for setting CNAME as hosts
- Added proxy-hosts: you can configure proxy-hosts to specify the IP requested by a remote server
- HTTP rewrite now supports Mock
Configuration details: https://stash.wiki/http-engine/rewrite#mock

- Added Collapsed Tile
To provide more customization space for “Third-Party Service” checks, we added Collapsed Tile, which uses the same script API as Tile. Collapsed Tile will appear in “Availability” and “Long Press Proxy - Proxy Information”. We also provide sample Tiles, which will be prompted for download when updating to Stash 3.2. Details: https://stash.wiki/script/tile

- Stash now generates a random API key upon first installation. All API operations require authentication via the HTTP header Authorization: Bearer ${secret}. The API key can be changed in “More Settings”.
The API key is automatically synced via the user’s iCloud. When accessing other Stash devices under the same iCloud through “Tools” → “Remote Controller”, the API key will be filled in automatically.

- Added “Network Quality Test” page to evaluate network status via DNS response latency. Remote Controller can also view network quality of other devices (requires remote device version ≥ 3.2.0)
- “HTTP Inspection” page now supports showing request details before and after rewrite for easier debugging (remote debugging requires remote device version ≥ 3.2.0)
- Proxy list now supports switching sorting method: “By Configuration File” or “By Benchmark Results”
- Added long-press proxy information in Remote Controller (requires remote device version ≥ 3.2.0)
- Redesigned Override interface
- Transparent rewrite now supports regex parameters
- Added filter to Connections page
- Added filter to HTTP Inspection page
- Added local override for policy group icons
- Added background refresh for YAML configuration files
- Added “Reset Settings” in “More Settings” to restore Stash to default configuration

• Optimizations
- Optimized Connections interface
- Optimized HTTP Inspection interface
- Optimized DNS Inspection interface
- Optimized Override installation flow
- Optimized iPerf
- Optimized QUIC
- UI improvements on several pages, added transition animations (requires iOS 17 or later)

• Fixes
- Fixed compatibility issues between WireGuard and IPv6
- Fixed XUDP IPv6 connections
- Fixed Relay policy group not performing automatic speed tests in some cases
- Fixed issue where pinging domain names in Enhanced Mode may return incorrect IPs
- Fixed URL Transparent rewrite not correctly parsing parameters
- Fixed DNS hijacking compatibility with non-standard DNS queries

• New Features
- Support for VLESS XTLS-Vision
- Support for VLESS XTLS-REALITY
- Remote Rule Set now support MRS format rules
- Shadowsocks / Shadowsocks2022 now support configuring udp-port
- Shadowsocks / Shadowsocks2022 now support configuring udp-over-tcp v1 / v2
- Support for VLESS XUDP
- Added "benchmark-disabled" option for individual proxy latency test; setting it to true completely disables latency testing
- Proxy in the Visualization Editor now supports right-swipe to copy proxies
- Support for importing stoverride files from other apps or Files into Stash

• Optimizations
- Optimized "HTTP Inspection" page
  - Improved display of long text
  - Matching rule and proxy are shown in the list
  - Can jump to the Connection Details page of the HTTP request
  - Search box remembers the last search
- Optimized "Connections" page
  - Supports displaying more protocol types
  - Click on the hostname to jump to the related DNS query record
- Optimized "DNS Inspection" page
- Optimized "Remote Resources" page
- Fixed inaccurate IP info display on the homepage
- Optimized console.log in scripts — now supports logging objects, null, and undefined
- Reduced memory usage when rewriting large requests with scripts
- Refactored Remote Rule Set logic for improved performance and lower memory usage
- Improved GEOSITE performance
- Optimized latency test logic for Proxy Groups that include REJECT-DROP and REJECT type proxies
- Improved Stash Core stability

• Bug Fixes
- Fixed an issue where UDP might mistakenly send Fake IPs
- Fixed unnecessary DNS resolution under certain conditions
- Fixed bad udp address error in VLESS network diagnostics
- Fixed incorrect formatting of remote rule sets containing regex
- Fixed UDP error in VMess under some conditions
- Fixed request failures when using $httpClient in some scripts
- Fixed issues with certain requests failing during script rewriting
- Fixed inaccurate rule count statistics in some Remote Rule Set
- Fixed UI misalignment in some parts
- Fixed some crash

• New Features
- Support for VLESS XTLS-Vision
- Support for VLESS XTLS-REALITY
- Remote Rule Set now support MRS format rules
- Shadowsocks / Shadowsocks2022 now support configuring udp-port
- Shadowsocks / Shadowsocks2022 now support configuring udp-over-tcp v1 / v2
- Support for VLESS XUDP
- Added "benchmark-disabled" option for individual proxy latency test; setting it to true completely disables latency testing
- Proxy in the Visualization Editor now supports right-swipe to copy proxies
- Support for importing stoverride files from other apps or Files into Stash

• Optimizations
- Optimized "HTTP Inspection" page
  - Improved display of long text
  - Matching rule and proxy are shown in the list
  - Can jump to the Connection Details page of the HTTP request
  - Search box remembers the last search
- Optimized "Connections" page
  - Supports displaying more protocol types
  - Click on the hostname to jump to the related DNS query record
- Optimized "DNS Inspection" page
- Optimized "Remote Resources" page
- Fixed inaccurate IP info display on the homepage
- Optimized console.log in scripts — now supports logging objects, null, and undefined
- Reduced memory usage when rewriting large requests with scripts
- Refactored Remote Rule Set logic for improved performance and lower memory usage
- Improved GEOSITE performance
- Optimized latency test logic for Proxy Groups that include REJECT-DROP and REJECT type proxies
- Improved Stash Core stability

• Bug Fixes
- Fixed an issue where UDP might mistakenly send Fake IPs
- Fixed unnecessary DNS resolution under certain conditions
- Fixed bad udp address error in VLESS network diagnostics
- Fixed incorrect formatting of remote rule sets containing regex
- Fixed UDP error in VMess under some conditions
- Fixed request failures when using $httpClient in some scripts
- Fixed issues with certain requests failing during script rewriting
- Fixed inaccurate rule count statistics in some Remote Rule Set
- Fixed UI misalignment in some parts
- Fixed some crash

- Fixed an issue where UDP might unintentionally send a Fake IP
- Fixed compatibility issues between the HTTP Engine and certain servers
- Fixed a problem where Reject might incorrectly performs a DNS query

- Updated Social Media account information
X (Twitter): @StashAppDev / https://x.com/StashAppDev
Chat Group: @StashFans / https://t.me/StashFans
Channel: @StashFeed / https://t.me/StashFeed

• New Features
- Added support for the ShadowSocks2022 protocol
- Added support for ShadowTLS
- Added support for AND, OR, NOT logical rules
- Added DOMAIN-WILDCARD rule
- Added DOMAIN-REGEX rule
- Added NETWORK rule with selectable values: tcp, udp
- Added PROTOCOL rule with selectable values: TCP, HTTP, HTTPS, UDP, QUIC
- Added URL-REGEX rule
- Added USER-AGENT rule
- Added body-rewrite feature, supporting:
  - request-jq, request-replace-regex, request-json-replace, request-json-add, request-json-del
  - response-jq, response-replace-regex, response-json-replace, response-json-add, response-json-del
- Added support for sniffing TLS Client Hello to obtain SNI domain names
- When establishing a UDP connection, the system now attempts to use the target proxy to perform DNS queries to determine the destination IP
- Added support for sniffing QUIC / HTTP3
- The Connections page now displays more detailed TCP / UDP protocol information
- DoH and DoH3 now support User-Agent configuration
- Added BGP.Tools as an IP information provider
- Rewrites now support reading the zstd compression algorithm
- Visual editor:
  - Added support for reject-drop
  - Now supports modifying url-rewrite, header-rewrite, and body-rewrite
  - Now supports modifying scripts
- Long press to copy icon URLs

• Optimizations
- Significantly improved power efficiency, especially under low-load scenarios
- Optimized QUIC sniffing
- Optimized performance for bulk remote resource updates
- Optimized memory usage under high UDP concurrency
- Optimized memory pool allocation strategy
- Optimized long text display in the visual editor
- Optimized ECH implementation

• Bug Fixes
- Fixed an issue where icons might fail to import on the second attempt
- Fixed sorting issues in the visual editor

• New Features
- Added support for the ShadowSocks2022 protocol
- Added support for ShadowTLS
- Added support for AND, OR, NOT logical rules
- Added DOMAIN-WILDCARD rule
- Added DOMAIN-REGEX rule
- Added NETWORK rule with selectable values: tcp, udp
- Added PROTOCOL rule with selectable values: TCP, HTTP, HTTPS, UDP, QUIC
- Added URL-REGEX rule
- Added USER-AGENT rule
- Added body-rewrite feature, supporting:
  - request-jq, request-replace-regex, request-json-replace, request-json-add, request-json-del
  - response-jq, response-replace-regex, response-json-replace, response-json-add, response-json-del
- Added support for sniffing TLS Client Hello to obtain SNI domain names
- When establishing a UDP connection, the system now attempts to use the target proxy to perform DNS queries to determine the destination IP
- Added support for sniffing QUIC / HTTP3
- The Connections page now displays more detailed TCP / UDP protocol information
- DoH and DoH3 now support User-Agent configuration
- Added BGP.Tools as an IP information provider
- Rewrites now support reading the zstd compression algorithm
- Visual editor:
  - Added support for reject-drop
  - Now supports modifying url-rewrite, header-rewrite, and body-rewrite
  - Now supports modifying scripts
- Long press to copy icon URLs

• Optimizations
- Significantly improved power efficiency, especially under low-load scenarios
- Optimized QUIC sniffing
- Optimized performance for bulk remote resource updates
- Optimized memory usage under high UDP concurrency
- Optimized memory pool allocation strategy
- Optimized long text display in the visual editor
- Optimized ECH implementation

• Bug Fixes
- Fixed an issue where icons might fail to import on the second attempt
- Fixed sorting issues in the visual editor

Happy New Year!

- Fixed an issue where certain service provider configurations could cause crashes

• New Features
- iOS 18 Control Widget
- Added REJECT-DROP Policy
- Added GEOIP database updates during Stash runtime
- Added basic rewrite editing via a visual editor
- Added ip.im IP information provider
- Icons adapted for iOS 18 Dark and Tinted modes

• Improvements
- When updating remote resources, Stash will now use ETag for cache negotiation. If the resource hasn't changed, Stash won't re-download it, saving bandwidth for both users and rule set providers.
- When setting server-cert-fingerprint, there's no need to set skip-cert-verify to true
- Improved multilingual translations
- Optimized system DNS

• Fixes
- Fixed an issue where configuration file names would occasionally appear abnormal

- Fixed an issue in version 2.6.5 where YAML whitespace could cause configuration file recognition errors
- Optimized QUIC

- Optimized Sniffing
When connecting to a domain, Stash will initiate a TCP handshake for all resolved results simultaneously and use the connection that succeeds the fastest. Upon sniffing a domain, Stash triggers a DNS resolution to perform the above function. If the domain has no resolution in public DNS servers, it may cause a connection error. This version improves compatibility with unresolved domains.

- Enhanced HTTP Engine Compatibility for Hosts with Ports
- Happy Eyeballs Dual Stack Moved from Experimental to Stable. Enabling this will improve compatibility between IPv4 and IPv6 dual stack.
- Support for setting benchmark-url and benchmark-timeout in Proxy Providers
- Fixed Unexpected Jumping in Some UI Lists

• New Features
- Support for Hysteria 2 port hopping feature
- Added support for SSH protocol
- Added support for Juicity protocol
- Shortcuts now support match_geosite syntax
- MitM feature will automatically disable when CA certificate is untrusted
- Ability to delete created certificates in the MitM settings page
- Added support for Russian language

• Improvements
- Optimized QUIC protocol 0-RTT
- Enhanced script Header compatibility
- Improved interaction on the Skip Proxy / Skip Tun page
- Reduced app size
- Optimized CA certificate logic, with issued certificates now valid for 10 years
- Improved interaction logic for installing CA certificates

• Fixes
- Fixed potential UI misalignment issue during drag-and-drop sorting in visual editing
- Fixed excessive space usage by cached files in some cases

- Optimized the stability of WireGuard connections
- Improved the compatibility of Hysteria2 0-RTT on certain networks
- Enhanced the runtime MitM certificate generation process, reducing redundant calculations, improving performance, and saving power consumption
- Improved WireGuard using underlying-proxy to automatically recover from connection errors
- Fixed the issue where scripts could not run on systems below version 15.4

- Fixed the issue where $persistentStore might not save correctly in certain situations.

• New
- Stash is now optimized for sniffing, supporting more STOverrides under "Tunnel Proxy Only" mode.
- Now supports sniffing possible HTTP requests in TCP connections, including Method, Host, and URL.
- Supports DNS over HTTP/3.
- Supports Server Certificate Fingerprint Pinning for proxy servers, verifying the server certificate's SHA256 fingerprint during the TLS handshake when enabled.
- Added Script Hub to the tools.
- Supports collapsing policy groups by clicking on the policy group icon.

• Optimization
- Optimized script performance and memory usage, significantly improving script performance.
- Optimized performance based on the QUIC protocol.
- Optimized the speed when disconnecting VPN connections.

• Fixes
- Fixed the issue where QR codes could not be scanned on iPads.
- Fixed a potential crash in the visual editor.
- Fixed a recent issue with delayed memory release in scripts.
- Fixed incorrect exception handling in script $httpClient.
- Fixed the issue where $persistentStore.write could not save when the value passed was null or undefined.
- Fixed the issue where the status might not refresh after toggling switches in the Today Widget.
- Fixed script timeout exceptions.
- Fixed issues causing some scripts to fail execution.

• New Features
- Added support for iOS 17 Interactive Widget
- Replaced JavaScript engine with a new engine that supports WebAPI
- Added support for DNS query following rules
- Added support for classical text rule sets
- Added support for one-click update for all overrides
- Added override categorization
- Added override icons
- Added support for proxying "Apple Push Notifications", "Wi-Fi Calling, MMS, SMS", "AirPlay, AirDrop"
- Script $environment now supports device-model
- Script $httpClient now supports parameters: timeout, insecure, auto-cookie, auto-redirect

• Enhancements
- Enhanced UDP compatibility
- Optimized Script memory usage
- Optimized override previews
- Optimized script $httpClient compatibility, fixing potential communication issues with some servers
- Enhanced visual DNS editing, now accessible from the homepage

• Fixes
- Fixed an issue with DNS over QUIC response timeouts
- Corrected the behavior of script $argument parameters; when not set, $argument is now undefined
- Addressed potential inaccuracies in matching with some large rule sets
- Fixed potential disconnection issues with doq
- Corrected an issue where connections from Stash internals were not properly recognized
- Fixed unresponsive import configuration issue
- Fixed a policy group crash
- Fixed an issue where overrides with the same name couldn't be installed

- Fixed an issue where the toggle button state was incorrect in some cases
- Fixed an issue where some converted scripts could not be installed
- Corrected issues with concurrent scripts behaving abnormally in certain situations
- Optimized script memory usage
- The script's setTimeout() now supports parameters:
setTimeout(function, delay, param1, param2, /* …, */ paramN)

- Fixed the issue of memory anomalies causing disconnections when using scripts in the previous version