3X-UI Files

🚀 Live Shadowsocks Client Edits, Lighter Node Sync & Complete vmess Link Import

• 🔄 Shadowsocks hot apply — Client changes on multi-user Shadowsocks inbounds no longer drop every live connection on the port.
• 🗄️ Node sync load — The 5-second node traffic merge now writes only rows that actually changed, ending slow or timed-out client renews on large multi-node setups.
• 🔗 vmess link import — XHTTP, mKCP and finalmask settings in vmess links now survive import, so imported outbounds connect.
• 🛡️ MTProto handshake limit — A new per-IP cap on pending handshakes keeps one address from starving other clients.
• 💥 Core crash reports — Xray crash logs now contain the full panic and traceback instead of a 7-byte stub.
• 🪟 Windows build — The Windows executable is now 3x-ui.exe with version info and an icon, reducing antivirus false positives.
• 🕵️ Less panel fingerprinting — Sponsor data is fetched from a shared hostname that no longer identifies a server as running the panel.

---

⚠️ Before you upgrade

Action required

• The Windows release zip now ships 3x-ui.exe instead of x-ui.exe — do this: update any service definition, scheduled task, shortcut or script that launches x-ui.exe, and remove the old executable after replacing the files.

Automatic — no action needed

• Existing MTProto inbounds render a byte-identical config and are not restarted; the new handshake limit is written only when set above 0.
• The panel sidebar no longer shows a sponsor card; sponsors appear only on the Sponsors page.

Requirements

Go 1.27.2 · Xray-core v26.10.10

---

🔐 Security

• The panel's sponsor-data fetch no longer reveals in the TLS SNI that a server is running 3x-ui; it now uses a widely shared hostname with the path kept inside TLS (35b5e098)

🆕 New

• MTProto inbounds expose the sidecar's per-IP pending-handshake limit, closing new connections from an address that already holds that many unauthenticated handshakes (b177b98c)
• The Windows executable is renamed to 3x-ui.exe and carries version info, a manifest and the 3X icon, which lowers heuristic antivirus detections (db8b01b8)
• The Sponsors page lists only real sponsors in larger cards, and the sidebar sponsor slot is removed (6f1dd0d7)

⚡ Improved

• The bundled OpenSSL for Windows is updated to 4.0.3 (MSI installer) (c45ffcda)

🐞 Fixed

Xray & inbounds

• Adding, editing, renewing, resetting or auto-disabling a client on a multi-user Shadowsocks inbound (including 2022 ciphers) is applied in place instead of restarting the inbound and dropping live connections (a66b360c)
• Xray crash reports capture the whole panic and traceback, each report gets a unique file name, and ordinary log lines mentioning "panic" are no longer swallowed from the panel log (760f428c)

Nodes

• The node traffic merge skips unchanged client rows and stops flipping shared client fields between inbounds, so renewing a client on many inbounds no longer times out behind sync writes (f8b72de9)

Links & subscriptions

• vmess links now import their XHTTP settings (session/sequence placement, padding obfuscation, xmux and more), so XHTTP outbounds from subscriptions or external links connect (#6808) @jayhemnani9910
• vmess links now import the mKCP header, seed, MTU/TTI and finalmask, so mKCP outbounds from subscriptions, external links or the link import connect (#6809) @jayhemnani9910
• Clash subscriptions export Hysteria2 Gecko obfuscation with its packet-size range instead of plain salamander, so those clients can complete the handshake (cb4f2ec9)
• Client-specific subscription routing no longer leaks one client app's routing headers into another's response, while the shared JSON routing profile is still sent to both (#6810) @mvanhorn

Panel

• Long sponsor titles and descriptions wrap inside their card instead of spilling onto neighbouring cards (319e6932)

---

Reports

Full Changelog: https://github.com/MHSanaei/3x-ui/compare/v3.10.0...v3.10.2