Surge 5

Smart Group

This is a new type of policy group, driven by our carefully designed algorithm engine, which can automatically select the appropriate policy from the sub-policies of this policy group. The goal of the Smart policy group is to replace the original automatic testing groups (url/load-balance/fallback), greatly optimizing the experience while minimizing the need for manual intervention in policy groups. Users only need to put the available policies into this group.

For details, see: https://kb.nssurge.com/surge-knowledge-base/guidelines/smart-group

Rule System
- Overall performance optimization of the rule system.
- Significant optimization of the indexing algorithm in large domain rule sets, improving the search efficiency by more than ten times for rule sets with more than 100,000 rules.
- Corrected the issue where sub-rules of logical rules within a rule set could not be covered by the `no-resolve` and `extended-matching` parameters of the rule set.
- Added a new rule type `DOMAIN-WILDCARD`, supporting `?` and `*` domain name matching.
- `DOMAIN-SET` and `RULE-SET` are changed to strict validation. If there are invalid lines in the file, the entire rule set will be invalidated to avoid problems caused by misuse.

IPv6
- The behavior of the `ipv6-vif` parameter has been modified. When set to always, IPv6 functionality will be enabled even if `ipv6=true` is not set.
- Added a warning for the `ipv6-vif=always` parameter.
- Adjusted the automatic retry mechanism. Accessing IPv6 addresses in a non-IPv6 network will no longer enter the retry process, and the request will fail immediately (solving the problem of some applications stalling when IPv6 VIF is enabled in a non-IPv6 environment, but the application will still continue to send IPv6 requests).

Other Optimizations
- Enhanced `$notification.post`, adding support for media resources, sound hints, and automatic dismissal.
- Optimized WireGuard failure handling.
- Reduced the power consumption of the TUIC protocol during sleep.
- Improved the precision of time statistics in the request log system, now accurate to µs level.
- Optimized various abnormal retry mechanisms, avoiding high resource usage caused by continuous retry in the face of some specific problems. For operations that need to be retried continuously (such as WireGuard reconnection, Ponte server reporting to iCloud), Surge will now retry after 0.1s, 0.5s, 1s, 5s, 10s, 30s after an error.
- Optimized the caching system for external resources.
- Added the profile line modifier `#!REQUIREMENT`.
- When the current network is found to be managed by Surge Mac Gateway, Surge iOS will now automatically pause. (This can be adjusted via the auto-suspend option, enabled by default.)
- Optimized TUN takeover and specific app performance compatibility issues.
- Optimized memory usage, infrequently used and large scripts will not be cached in memory anymore.
- The network diagnostics page adds SSID/BSSID with copy functionality.
- Now, when uploading logs in the log interface, the engine currently running will automatically generate the most recent verbose logs (the new version has cached 256KB of logs in memory), so when reporting problems, you can upload directly without needing to reproduce in verbose mode.
- For external resources related to policy groups and script types, the maximum size is now limited to 2MB, to avoid memory overflow in case of configuration errors.

Check the knowledge base for complete release note.

New Features
- New subscription feature: Body Rewrite. Surge now can rewrite the body of HTTP request or response, replacing the original content with regular expressions. If you need to make more flexible modifications, try scripting.

Improvements
- Comprehensive enhancement of the Mock (Map Local) function, adding data types such as text, tiny-gif, base64 to facilitate inline data return. Also added the ability to customize status codes.
- Optimized the request list filter, now displaying the filter at the top and allowing quick toggling of filter activation. Long-pressing a filter item displays a menu for deletion or reversing the item to a negative filter.
- Added recognition for STUN packets, which can be matched with PROTOCOL,STUN.
- Optimized the external resource management page.
- Optimized the script editor page.
- Optimized the module management page.
- Added a long-press shortcut menu to the Utilities tab.
- Added a new URL scheme for the iOS version: surge:///install-module?url=…

Optimizations
- When configuring Shortcuts to execute Surge scripts, the script list of the current configuration can now be directly accessed.
- Enhanced compatibility when decompressing HTTP Body.
- Optimized the script engine, limiting the number of concurrent JSC engine processes to 2 to avoid memory issues.
- The GeoIP database can now be updated by the main application without needing a restart to take effect.
- Optimized the request log, now displaying the specific rules matched for URL Rewrite and Header Rewrite.
- Adjusted the logic of the DNS engine handling empty results, now not waiting for all servers to respond with empty results when multiple DNS servers are configured, to avoid additional waiting when AAAA records do not exist..
- The module page allows undoing modifications to avoid misoperations that change the order of effectiveness.

Fixes
- Fixed the issue where warnings generated by module configurations were not displayed.
- Fixed a crash in Surge caused by passing some incorrect types of parameters in scripts.
- Fixed compatibility issues with non-https WebSockets in proxy mode with the new version of Safari.
- Fixed the issue where deleting an entry in the rule search page would delete all duplicate entries.
- Fixed some missing highlights in the editor.
- Other bug fixes.

Module
- Added several new official modules; official modules can now be dynamically updated.
- Modules have a new classification field for convenient access and categorization in the UI.
- Modules now accept parameter tables, supporting multiple parameters. Parameters will be used to modify module content through text replacement.

Script
- New script execution engine. Optimized execution performance and memory usage.
- $httpClient has added several practical parameters.
For more details on the updates above, see the documentation.

Enhancements
- Added desktop shortcut jumps for remote controllers; see the configuration guide at the bottom of the device page for details.
- New parameter: always-raw-tcp-keywords. For usage, refer to documentation.
- Added SRC-PORT rule to match client port numbers.
- IN-PORT/SRC-PORT/DEST-POT three rules are categorized as port number rule class, supporting more usages.
- The UI can now maintain pure empty lines from original configurations after editing.

Fixes
- Corrected a detail issue with QUIC flow control and optimized latency performance for Ponte/TUIC/Hysteria2 protocols.
- After editing a single rule, the notification-related parameters will be retained..
- Corrected an issue where switching outbound modes via widget was not possible in newer iOS versions.
- Fixed potential sudden memory overruns that could occur when when processing huge external resources leading to stops.

- Rewrote the virtual IP database, now the database can automatically clean up data based on last use time.
- Added viewing of the virtual IP table. (at the top right corner of the DNS result page)
- For DNS requests with illegal domain names, an empty result response will be generated instead of being ignored directly.
- Surge Ponte connections no longer validate peer addresses to ensure normal operation in certain special scenarios.
- Removed include-all-network option from UI to avoid misuse.
- Support configuring no-resolve for built-in rule sets/Inline rule sets.
- Other improvements and bug fixes.

Bug fixes

Rule Engine Optimizations

- The implementation of RULE-SET and DOMAIN-SET has been completely rewritten. Now, Surge automatically preprocesses and indexes rule sets during resource updates, significantly increasing the matching speed.
1. There is no longer any difference in performance and memory usage between RULE-SET and DOMAIN-SET types of rule sets, allowing flexible usage.
2. There is no longer a restriction in DOMAIN-SET rule sets that prevents the use of eTLDs.
3. The matching speed for DOMAIN, DOMAIN-SUFFIX, IP-CIDR, and IP-CIDR6 rules in RULE-SET has been greatly improved.
- A DOMAIN/DOMAIN-SUFFIX rule set with approximately 100,000 entries used to take 100ms for a single match in the old version; now, it only takes single-digit ms.
- An IP-CIDR rule set with approximately 10,000 entries used to take about 0.1ms for a single match in the old version. The new version only needs 0.0002ms, an improvement of about 500 times. The performance improvement for IP-CIDR6 rules is even greater.
4. In the new version, building a regional IP address collection using the IP-CIDR rule set offers the same performance as directly using the internal GEOIP rule.
5. The Inline Ruleset added in the previous version does not benefit from this optimization, but there is virtually no difference at the scale of hundreds of entries.
6. In previous versions, rules within a Ruleset were matched one by one from top to bottom. If rules requiring DNS resolution were included, DNS would only be triggered when starting to match that sub-rule. In the new version, if any rule requiring DNS resolution is included in the rule set, DNS resolution will occur before testing that rule set. (In most cases, there is no difference)
- Main ruleset matching efficiency has been slightly optimized.
- The efficiency of IP-CIDR6 rules has been significantly improved even in non-indexed situations.
- RULE-SET rules can now be configured directly with parameters no-resolve and extended-matching, which are equivalent to configuring all sub-rules with these parameters.
- DOMAIN-SET rule sets also support configuration with extended-matching.

Minor Optimizations

- Now, when performing MITM, the certificate used for signing will be sent to the client together, to support using intermediate certificates for MITM.
- All comments (at the beginning and end of lines) can now use `#`, `//`, `;` three common comment symbols.
- Profile error message prompt optimization, now it can give the exact line number where the error occurred more accurately.
- Fixed an issue that BSSID related matching rules might fail.
- Optimize Surge Ponte error handling process, correct the issue where device information is not automatically updated under certain errors.
- Bug fixes.

New Features
· New Inky icon
· Protocol sniffing
Requests to port 80 and 443 will wait for the client to send the first packet, then extract the SNI and other information for the rule system to judge.
· DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD rules add an optional parameter called extended-matching. When this parameter is enabled, the rule will try to match both the SNI and the HTTP Host Header (or :authority).
· Added a parameter called always-raw-tcp-hosts, used to forcibly turn off active protocol detection for specific hostnames.
· New proxy protocol support: Hysteria 2
Hysteria 2 is a proxy protocol optimized for unstable and packet-loss-prone network environments, based on UDP/QUIC.
· Automatic QUIC blocking
Since most proxy protocols are not suitable for forwarding QUIC traffic, Surge will now automatically block QUIC traffic to make it fallback to HTTPS/TCP protocol, ensuring performance. For QUIC traffic that hits the MITM hostname, it will also be automatically rejected.
· ECN (Explicit Congestion Notification) support for QUIC-based protocols
Significantly improved the performance of the Vector(Surge Ponte)/TUIC/Hysteria 2 protocol.

Optimizations
· Reworked HTTP capture functionality
· The related settings are no longer stored in the configuration, the [Replica] section has been deprecated.
· Added an automatic shut-off setting after turning on the capture switch, which can automatically stop capturing based on time, size, or the number of requests.
· Added automatic activation of MITM after turning on the capture switch, which can be additionally turned on for specific hostnames. (Even if the main MITM switch is off).
· Added an option to only save HTTP/HTTPS requests after turning on the capture switch.
· VIF performance optimization, tested to achieve full speed of a 2.5Gbps wired network card on iPhone 15 Pro with VIF taking over a single thread. (Proxy mode performs even better)
· Wi-Fi Assist and Hybrid features will only take effect after the device is unlocked, to avoid unnecessary power and data consumption.
· From this version on, the size of external resources is limited to no more than 10MB to prevent excessive memory usage caused by abnormal external resources. (Except for domain-set)
· The parameters udp-policy-not-supported-behaviour, include-apns, include-cellular-services have been added to the UI settings.
· Improved compatibility with some non-standard protocols.
· When testing the Ponte policy, the test URL has been changed from proxy-test-url to internet-test-url.
· Following the WireGuard protocol standard recommendation, WireGuard handshake packets will now be tagged with 0x88 (AF41) DSCP to increase the success rate.
· When forwarding UDP packets via WireGuard, it supports retaining the TOS(DSCP/ECN) tag of packets inside the tunnel.
· Based on the WireGuard protocol standard recommendation, Surge will copy the ECN tag from packets inside the tunnel to packets outside. When receiving packets with an ECN tag, they will be strictly merged according to RFC6040. (ecn=true must be set for the strategy).
· UDP NAT can close the UDP session early based on ICMP messages.
· Improved PMTU support for QUIC.

Bug Fixes
· Fixed the issue where the external resources of rule sets needed to be reloaded to take effect after updates.
· After a network switch, it will forcefully break the original long connection of DoH/DoQ/DoH3 to avoid obtaining results that are not suitable for the current network environment.
· Fixed the issue where invalid certificates might cause the key store interface to crash.
· Fixed the issue where the Ponte device option in the policy group page might not display text.
· When performing MITM on HTTPS requests that directly connect using an IP address, the IP address should not be sent as SNI, as this might cause compatibility issues.
· Other bug fixes.

New Features

· Surge tvOS is now available. All users who have purchased Surge iOS can use it directly without any additional purchase.
· Supports interactive widgets for the latest system.
· Added full-text search support for HTTP request's header and body.
· Web Dashboard updated to version 2.0.
· Inline Ruleset, allowing the Ruleset to be written directly in the main profile.

Minor Improvements

· Optimized the script logging system, ensuring that script logs in request logs do not display content from other sessions during concurrent execution.
· Removed the Wi-Fi Assist notification.
· When using UI to edit policy groups, you can now select Ponte devices.
· When creating temporary rules for remote devices, Ponte devices can be selected.
· Remote controllers support viewing and updating external resources of remote devices, compatible with Surge Mac and Surge tvOS.
· Icons for Ponte devices now display the device type.
· Improved details related to accessibility.
· Improved some UI details.

Bug Fixes

· Fixed some potential issues when editing the MITM Hostname list.
· Fixed an issue where, when creating rules for remote devices, the policy options might be local policies instead of remote policies.
· Fixed an issue where, when using iCloud sync, the local module selection might be deselected if the cache was cleared.
· Fixed an issue where switching to Dropbox sync was not possible.
· Fixed a problem where some card backgrounds were incomplete when expanded.
· Fixed an issue where modules added via Basic Auth URL could not auto-update.
· Fixed a problem in quick switch mode where, after switching from an IPv6 network to a non-IPv6 network, the v6-vif didn't correctly auto-turn off when set to auto.

Enhancements
· Comprehensive optimization of the request list page
· Ponte device sharing can now be initiated and managed directly on iOS
· The name of the source device will be displayed when viewing external requests
· Profile list added Create Linked Profile option for quick creation of detached profile
· Changed the logic of accessing the data protection area, now Surge can be properly activated in the locked screen state. (Except after rebooting)
· Will prompt when a CA certificate expiration is detected
· Single request exported .zip files support import back into Surge iOS, and will be displayed in the favorite requests
· Performance optimization

Problem Fixes
· Fixed the issue that in the same round of policy testing, if different test URLs are mixed, the HTTP Header constructed in the secondary test may be incorrect, leading to abnormal test results
· Fixed the issue that the Panel refresh may not be executed correctly after the main program is opened from the background
· Fixed the issue that the policy group title options under the list policy group view may not update in time
· Fixed the issue that using the DIRECT strategy as underlying proxy might cause UDP failure
· Fixed the issue that when using the SSH protocol, if the server side is configured with a banner, it cannot handshake properly
· Fixed some issues that may occur under the Lucid theme on iPad
· Fixed the issue that SSID related functions may not work correctly in some cases
· Fixed some problems that may occur when using TUIC v5 as underlying-proxy
· Fixed the issue that when directly using IPv6 address as vmess hostname, if WebSocket is enabled, the WebSocket request cannot be correctly constructed
· Fixed the issue that the use of certain invalid data in the DOMAIN-SET rule may cause a crash
· Fixed the crash that may be caused by profile errors
· Fixed the issue that the returned data of the replayed request cannot be viewed if there is compression
· Fixed the issue that the device list cannot be loaded when there is only a shared Ponte device
· Fixed some crashes that may occur with DNS over HTTP3
· Fixed the issue that when Surge Ponte is in a subnet CIDR not a multiple of 8, it will judge incorrectly leading to non-use of LAN direct connection
· Fixed some problems that may occur when using Surge Ponte
· Optimized the logic of re-establishing the main connection after network switching in TUIC/Ponte

Bug fixes

· Support for QUIC's PMTU discovery improves the performance of Surge Ponte and TUIC protocols.
· Optimized the display logic of Widget status, now Surge status can be displayed correctly even after system restart.
· Added a large number of preset card backgrounds.
· Other bug fixes.

Remote Controller
* Supports adding and modifying temporary rules remotely.
* The device management now groups devices by active and non-active devices. (whether there is a request)
* Supports directly adding temporary or permanent rules for devices.
* Other detail optimizations.

Others
* Added support for TUIC v5 protocol.
* The policy group menu adds the option to display hidden groups.
* In traffic statistics, the subdomains of apple.com will be processed separately, facilitating the observation of the traffic consumption of system services.
* After external resources are updated, now only the update of the policy group will cause the group page to reload, other types will no longer cause the group page to reload.
* Optimized the performance of Surge Ponte/TUIC.
* Optimized the request Note recording when the strategy group is abnormal.
* Fixed the problem that connection reuse was not done correctly under MITM H2 mode.
* Fixed the problem that the request of $httpClient/DoH may sometimes be accidentally cancelled.
* Other bug fixes.

Interface
· New UI theme Lucid, derived from the design language of Surge Mac 5. (Feature Subscription required)
· Remote control device management supports remote modification of device icons. (Surge Mac needs to be updated to version 5.1.0)

Surge Ponte
· Surge Ponte supports cross-iCloud account sharing. (Surge Mac needs to be updated to version 5.1.0)
· Fixed issues that might occur when accessing HTTP/1.0 servers via Surge Ponte or TUIC protocol. (e.g. ASUS router management page)

Proxy Protocol Related
· Supports ShadowTLS v3. (Feature Subscription required)
· New feature: Adaptive TLS Fingerprint, see the manual for details.
· Fixed an issue where the reuse feature could not work properly under Snell V4.
· SSH protocol adds server public key fingerprint designation, see the manual for usage.
· Added UDP forwarding support for VMess protocol.

Scripts
· Scripts' $httpClient supports binary mode.
· The body of the request supports TypedArray.
· Passing in binary-mode: true in the request parameters allows the return result to be returned as TypedArray.
· Fixed the problem that `http-request` type scripts could not use binary data directly as response.

Others
· Policy group adds parameter `external-policy-modifier`, which can be used to adjust external policies.
· Optimized the request log system
· Added category marks to the logs.
· Rule system adds more output for DNS and rulesets.
· Swipe right on temporary rules to write the rules into permanent rules.
· Other bug fixes and optimizations.

Surge Ponte
Surge Ponte is a private mesh network between your devices running Surge Mac & iOS.

· Zero configuration required
· Surge automatically chooses the most appropriate channel to establish connections.
· Always end-to-end encryption.
· The device information and encryption keys are synchronized via your iCloud, and none of your data passes through third-party servers, except the proxy server if you choose.

Surge Ponte needs to be used with Surge Mac 5.

WireGuard-related optimizations
· Significantly optimized handshake-related logic.
· WireGuard's Client ID supports UI configuration and adds support for 0xabcdef and 6-character base64 formats.

Other updates
· Redesigned the network diagnostics page and optimized the information display.
· Optimized peak bandwidth performance and CPU usage for QUIC.
· Requests matched by the REJECT rule will be marked as Rejected and distinguished by gray, no longer classified as Failed.
· Optimized the switch control logic for various functions to avoid accidentally turning off/on a function in some cases.
· When using MITM, prioritize using the client-reported SNI to generate certificates and use the accessed domain name when SNI is not reported.
· Increased the wake-up speed of executing Surge scripts via shortcuts when Surge is not enabled.
· Changed the display of SOCKS5 proxy request type to TCP. You may confirm in Notes that it was taken over by SOCKS5 proxy.
· Support for configuring DNS over QUIC/H3 for specific domain names in [Host].
· Introduced the FAILED built-in policy for marking request failures in special cases (e.g., policy group cannot be loaded) instead of using REJECT.
· Fixed an issue where rules would not match if the client accidentally sent a domain name with uppercase letters during rule matching.
· Fixed a problem where policy group decisions would fail if multiple external policy groups used the same name for policies with different actual content.
· DNS Local Mapping allows configuring multiple IPs for a domain name to be used concurrently.
· Other issues fixed.

Please note that starting with iOS 16.4, the system no longer allows reading the MCC/MNC of cellular networks. Related functions may become invalid.

- Support for customizing the reserved bits of WireGuard, also known as the client ID or routing ID.
- Improved WireGuard handshake logic.
- Fixed some UDP forwarding problems.
- Fixed some text editor issues.

New Subscription Feature: Temporary Rules
We have added the temporary rules feature in Surge Mac to the iOS version. Temporary rules will automatically disappear after Surge is stopped and will not be written to the profile for some temporary usage scenarios.

New subscription feature: Whois lookup
Quickly perform a Whois lookup to identify the domain or IP owner in the request details menu.

New feature: Proxy Detail View

Traffic statistics have been enhanced:
- In addition to traffic statistics, the number of requests will now be recorded as well.
- In addition to this month's data, last month's data will also be kept.

Bug fixes and minor improvements:
- JSON and text viewers support search on iOS 16
- Network switching no longer interrupts in-progress $httpClient requests.
- Fixed an issue where scripted requests would sometimes accidentally carry the x-surge header handled internally by Surge
- Fixed an issue that some requests constructed in a special way could not be matched by MITM hostnames.
- Fixed an issue that the LAN proxy and Dashboard may not be accessible if the fast-switch is configured.
- Fixed an issue that could occur when using the expanded card layout on iPad
- Fixed an issue that the Panel button is not showing on iOS 14.

New Feature
- Gaming Optimization. Enabling it will prioritize UDP packets when the system load is very high, and packet processing is delayed.
- SOCKS5 proxy now supports UDP forwarding, as the server side does not consistently support UDP forwarding, the parameter udp-relay=true needs to be explicitly configured.

Minor Improvements
- URL regular expressions for Script, Rewrite, Mock, etc. will try to match URLs constructed in many different ways (e.g. Host field in Header) to solve the problem that some apps use custom DNS logic to request directly to IP addresses.
- Removed the silencing mechanism after UDP forwarding errors to avoid extra waiting time after switching networks.
- Added a workaround for suspend and subnet settings that may occur when the SSID is temporarily not available under iOS 16.
- The log view supports freezing now.
- The IPv6 switch no longer prevents direct access to IPv6 addresses when turned off. The switch is now limited to controlling whether the DNS Client requests AAAA records.
- Automatic disabling of AAAA queries due to DNS issues will be prompted in the Event Center instead of just in the logs.
- Fixed handling issue of generating IPv6 fragmentation when forwarding IPv6 UDP packets via WireGuard.
- The external policy group will skip the line and continue processing when it encounters invalid content instead of returning an error directly.
- Adjusted the buffering mechanism of raw TCP forwarding to avoid conflicts with some apps.
- Fixed REJECT requests not being marked as failed under MITM H2.
- Adjusted the output text under diagnostics.
- Other bug fixes.

New Feature
- Gaming Optimization. Enabling it will prioritize UDP packets when the system load is very high, and packet processing is delayed.
- SOCKS5 proxy now supports UDP forwarding, as the server side does not consistently support UDP forwarding, the parameter udp-relay=true needs to be explicitly configured.

Minor Improvements
- URL regular expressions for Script, Rewrite, Mock, etc. will try to match URLs constructed in many different ways (e.g. Host field in Header) to solve the problem that some apps use custom DNS logic to request directly to IP addresses.
- Removed the silencing mechanism after UDP forwarding errors to avoid extra waiting time after switching networks.
- Added a workaround for suspend and subnet settings that may occur when the SSID is temporarily not available under iOS 16.
- The log view supports freezing now.
- The IPv6 switch no longer prevents direct access to IPv6 addresses when turned off. The switch is now limited to controlling whether the DNS Client requests AAAA records.
- Automatic disabling of AAAA queries due to DNS issues will be prompted in the Event Center instead of just in the logs.
- Fixed handling issue of generating IPv6 fragmentation when forwarding IPv6 UDP packets via WireGuard.
- The external policy group will skip the line and continue processing when it encounters invalid content instead of returning an error directly.
- Adjusted the buffering mechanism of raw TCP forwarding to avoid conflicts with some apps.
- Fixed REJECT requests not being marked as failed under MITM H2.
- Adjusted the output text under diagnostics.
- Other bug fixes.

Support New Proxy Protocol
- Snell V4.
- TUIC
- Shadow TLS

See the online manual for more information.

Other Improvements
- A new expanded card style for the Policy Group view.
- Refined the Route Table view.
- shadowsocks now supports the none cipher.
- Modified the handshake packet construction logic when forwarding HTTPS requests to proxies, which can slightly optimize latency.
- Surge HTTP requests for proxy testing no longer contain a User-Agent header.

Bug fixes
- Fixed an issue that when using Subnet Suspend, the switch in the interface did not display the status correctly.
- Fixed an issue that the module could not configure the MITM h2 parameter.
- Fixed some keyboard-related layout problems.
- Fixed an issue that may not work properly when nesting proxy chains with a specific protocol combination.
- Fixed an issue where UI jumping may occur when starting Surge if iCloud Drive is used.
- Fixed a memory leak that could occur when HTTP capturing is enabled.

- Added a delayed update mode to the view of the recent request, which will automatically start when too many requests are received, to avoid the Surge main application from getting jammed.
- Optimized the check logic of ICMP traffic limit to avoid the alarm triggered by high concurrency in a very short period.
- Added a lock screen widget that can be used to quickly open Surge.
- Added a view to examine the modified profile after modules are applied.
- Added a new Siri action: enable or disable modules, which can be used with Shortcut.

Bug fixes

IPv6 Improvements
- Support UDP forwarding with IPv6 VIF, including local and proxy forwarding.
- Support ICMPv6 local forwarding with IPv6 VIF.
- Fixed an issue that IPv6 address could not be used when using Surge Private DDNS.
- IPv6 handling details refined.

WireGuard IPv6 Tunneling
- WireGuard policy now supports IPv6 Tunneling (the previous version already supports connecting to an endpoint with IPv6, this version adds IPv6 support inside the tunnel)
- Read the manual for more information.

Text Editor
- A toolbar was added to the text editor.
- Fixed a crash in text editing.
- You can search text in the text editor now.

Other updates
- Optimize the proxy failure handling policy. Now when the TCP handshake time to the proxy server is greater than the test-timeout parameter, it is directly determined as failure in order to trigger the policy group to retest faster.
- TabBar shortcut menu added module shortcut opening and closing.
- External resources view allows side-swipe to edit local resources file.
- All types of scripts that use $httpClient to initiate requests are now viewable in the view of the recent request.
- Adjusted script concurrency limit policy to avoid deadlock when multiple scripts refer to each other.
- Other minor bug fixes and improvements.

IPv6 Improvements
- Support UDP forwarding with IPv6 VIF, including local and proxy forwarding.
- Support ICMPv6 local forwarding with IPv6 VIF.
- Fixed an issue that IPv6 address could not be used when using Surge Private DDNS.
- IPv6 handling details refined.

WireGuard IPv6 Tunneling
- WireGuard policy now supports IPv6 Tunneling (the previous version already supports connecting to an endpoint with IPv6, this version adds IPv6 support inside the tunnel)
- Read the manual for more information.

Text Editor
- A toolbar was added to the text editor.
- Fixed a crash in text editing.
- You can search text in the text editor now.

Other updates
- Optimize the proxy failure handling policy. Now when the TCP handshake time to the proxy server is greater than the test-timeout parameter, it is directly determined as failure in order to trigger the policy group to retest faster.
- TabBar shortcut menu added module shortcut opening and closing.
- External resources view allows side-swipe to edit local resources file.
- All types of scripts that use $httpClient to initiate requests are now viewable in the view of the recent request.
- Adjusted script concurrency limit policy to avoid deadlock when multiple scripts refer to each other.
- Other minor bug fixes and improvements.

- Fixed a bug that the text editor may be unable to save content.

- You may now flush the DNS cache in the DNS result view.
- Improved the script editor and log viewer.
- Other bug fixes and minor improvements.