1.14.0-beta.1

📝 Release Notes

• Correct undefined rule-set matching semantics 1
• Add search domain rule items 2
• Add parallel DNS response evaluation support 3
• Fixes and improvements

1:

Rule-set matching has always been described as merged matching: fields of rule-set rules are considered merged into the referencing rule. However, this description is only intuitive when a rule-set contains only a single default rule without invert. Merged matching is now limited to exactly this case; any other referenced rule-set is matched as an other field, which matches when any of its rules matches on its own. Since the previous behavior in the corrected cases was effectively undefined, counterintuitive, and hard to understand, we do not consider this a breaking change — except for configurations that worked without their author understanding why.

2:

The new DNS rule items domain_label_count and search_domain_available match the number of labels in the query name and whether a DNS server currently holds search domains; combined with racing, they allow unqualified name queries to race a server that can expand them against a public resolver. Additionally, preferred_by now matches search domain suffixes and supports local and dhcp servers.

3:

The evaluate action can now assign a tag to each response, allowing multiple evaluated responses to coexist and be selected through tagged match_response rules. The new race field allows response-dependent rules to compete in parallel, with the first matching rule taking effect and the remaining queries canceled. The new speculative option can start evaluate and route queries while race rules are still pending, reducing latency at the cost of potentially unused queries.

1.14.0-alpha.50

📝 Release Notes

• Improve OpenVPN interoperability 1
• Improve OpenConnect interoperability 2
• Add Fortinet host check support 3
• Fixes and improvements

1:

The OpenVPN client and server now interoperate with more existing deployments through static-key mode, additional legacy ciphers and digests, and OpenVPN-compatible certificate purpose, key usage, extended key usage, and certificate profile checks. They also support more OpenVPN options for tunnel addressing, MSS calculation, replay windows, timers, and TLS renegotiation. The new OpenVPN DNS server can use both modern and legacy DNS options pushed by OpenVPN servers, while the sing-box server can push both forms.

2:

The OpenConnect client now supports existing authentication sessions, OIDC Bearer authentication, additional platform and AnyConnect mobile identity fields, AnyConnect compression, and controls for MTU, DPD and reconnect timing, TCP keep alive, and TLS trust and certificate pinning. The new OpenConnect DNS server can use pushed split-DNS resolvers and, when enabled, general pushed resolvers.

3:

The OpenConnect Client endpoint can now submit Fortinet host check results using the new fortinet_host_check option. This behavior is modeled after openfortivpn and is not an OpenConnect feature. sing-box only submits explicitly configured values when requested by the Fortinet server and does not collect system information automatically.

1.14.0-alpha.48

📝 Release Notes

• Add SSO support for AnyConnect 1
• Add Linux support for the desktop client application 2
• Fixes and improvements

1:

The OpenConnect Client endpoint now supports SSO (single sign-on) authentication for Cisco AnyConnect servers, available through the sing-box graphical clients.

2:

The sing-box for Desktop client is now available for Linux (x64 / arm64 / armv7l) from GitHub Releases.

1.14.0-alpha.47

📝 Release Notes

• Add OpenVPN client and server support 1
• Add OpenConnect client support 2
• Fixes and improvements

1:

The new OpenVPN Client and OpenVPN Server endpoints are compatible with standard OpenVPN clients and servers. Interactive client authentication is available through the sing-box graphical clients and Dashboard.

2:

The new OpenConnect Client endpoint supports Cisco AnyConnect, GlobalProtect, Fortinet, F5, Pulse Connect Secure, and Juniper Network Connect VPN servers. Interactive authentication is available through the sing-box graphical clients and Dashboard.

1.14.0-alpha.46

📝 Release Notes

• Add multiple tags support to rule-sets 1
• Add new UDP NAT options 2
• Fixes and improvements

1:

The rule-set tag field now accepts a list of tags to define multiple rule-sets sharing other options at once, with the {tag} placeholder in path or url replaced by each tag.

2:

The new UDP NAT fields udp_mapping, udp_filtering and udp_nat_max configure the NAT mapping and filtering behaviors and the maximum number of UDP NAT sessions for TUN and TProxy inbounds and the WireGuard endpoint.

1.14.0-alpha.45

📝 Release Notes

• Improve the Windows client application 1
• Fixes and improvements

1:

The Windows client now includes an updater, adds support for Windows native sharing of sing-box profile and JSON files, and fixes the Tailscale SSH terminal. The Tailscale SSH server can now open sessions for any local user in the graphical client, while the command line client remains limited to the user sing-box runs as. Additionally, configurations that use privileges unrelated to networking are now rejected by default; an insecure mode is available to allow them.

1.14.0-alpha.44

📝 Release Notes

• Introducing our new Windows client application 1
• Fixes and improvements

1:

The new Windows client provides an experience equal to other standard sing-box graphical clients, is available for Windows 10+ (x64 / x86 / arm64), and is distributed as an installer from GitHub Releases (SFW-<version>-<architecture>.exe).

1.14.0-alpha.43

📝 Release Notes

• Add network namespace support 1
• Fixes and improvements

1:

The new network_namespaces option defines Linux network namespaces for inbounds and outbounds, referenced by tag from the new tun netns field and the existing Listen and Dial netns fields.

The unshare type creates the namespace at startup without requiring root privileges: a rootless sing-box can provide a tun (including auto_route and auto_redirect) inside a namespace, which can be entered with nsenter.

1.14.0-alpha.42

📝 Release Notes

• Fixes and improvements

1.14.0-alpha.41

📝 Release Notes

• Add windows bridge 1
• Add preferred_by support for bridge 2
• Add hysteria2 realm IP version restriction 3
• Add hysteria2 realm port mapping 4
• Fixes and improvements

1:

The bridge outbound is now supported on Windows, implemented via WinDivert and requiring Administrator privileges.

2:

The bridge outbound now works with the preferred_by route rule item. It is recommended to use preferred_by as a gate in the route rule: it only matches in pre-match and excludes local addresses that cannot be routed.

3:

The new realm.ip_version inbound and outbound field restricts realm connections (STUN, hole punching, and the resulting QUIC path) to a single IP version.

4:

The new realm.port_mapping inbound and outbound field maintains a UDP port mapping on the local gateway via UPnP or NAT-PMP, improving hole-punching reliability behind gateways that support it.