Yet Another Public Notification Channel

sing-box 1.14.0-alpha.48 has been released. * Add SSO support for AnyConnect 1 * Add Linux support for the desktop client application 2 * Fixes and improvements 1: The OpenConnect Client endpoint now supports SSO (single sign-on) authentication for Cisco AnyConnect servers, available through the sing-box graphical clients. 2: The sing-box for Desktop client is now available for Linux (x64 / arm64 / armv7l) from GitHub Releases. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.48

sing-box 1.14.0-alpha.47 has been released. • Add OpenVPN client and server support 1 • Add OpenConnect client support 2 • Fixes and improvements 1: The new OpenVPN Client and OpenVPN Server endpoints are compatible with standard OpenVPN clients and servers. Interactive client authentication is available through the sing-box graphical clients and Dashboard. 2: The new OpenConnect Client endpoint supports Cisco AnyConnect, GlobalProtect, Fortinet, F5, Pulse Connect Secure, and Juniper Network Connect VPN servers. Interactive authentication is available through the sing-box graphical clients and Dashboard. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.47

sing-box 1.14.0-alpha.46 has been released. • Add multiple tags support to rule-sets 1 • Add new UDP NAT options 2 • Fixes and improvements 1: The rule-set tag field now accepts a list of tags to define multiple rule-sets sharing other options at once, with the {tag} placeholder in path or url replaced by each tag. 2: The new UDP NAT fields udp_mapping, udp_filtering and udp_nat_max configure the NAT mapping and filtering behaviors and the maximum number of UDP NAT sessions for TUN and TProxy inbounds and the WireGuard endpoint. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.46

sing-box 1.14.0-alpha.45 has been released. • Improve the Windows client application 1 • Fixes and improvements 1: The Windows client now includes an updater, adds support for Windows native sharing of sing-box profile and JSON files, and fixes the Tailscale SSH terminal. The Tailscale SSH server can now open sessions for any local user in the graphical client, while the command line client remains limited to the user sing-box runs as. Additionally, configurations that use privileges unrelated to networking are now rejected by default; an insecure mode is available to allow them. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.45

sing-box 1.14.0-alpha.44 has been released. • Introducing our new Windows client application 1 • Fixes and improvements 1: The new Windows client provides an experience equal to other standard sing-box graphical clients, is available for Windows 10+ (x64 / x86 / arm64), and is distributed as an installer from GitHub Releases (SFW-<version>-<architecture>.exe). https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.44

sing-box 1.14.0-alpha.43 has been released. * Add network namespace support 1 * Fixes and improvements 1: The new network_namespaces option defines Linux network namespaces for inbounds and outbounds, referenced by tag from the new tun netns field and the existing Listen and Dial netns fields. The unshare type creates the namespace at startup without requiring root privileges: a rootless sing-box can provide a tun (including auto_route and auto_redirect) inside a namespace, which can be entered with nsenter. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.43

sing-box 1.14.0-alpha.42 has been released. • Fixes and improvements https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.42

sing-box 1.14.0-alpha.41 has been released. * Add windows bridge 1 * Add preferred_by support for bridge 2 * Add hysteria2 realm IP version restriction 3 * Add hysteria2 realm port mapping 4 * Fixes and improvements 1: The bridge outbound is now supported on Windows, implemented via WinDivert and requiring Administrator privileges. 2: The bridge outbound now works with the preferred_by route rule item. It is recommended to use preferred_by as a gate in the route rule: it only matches in pre-match and excludes local addresses that cannot be routed. 3: The new realm.ip_version inbound and outbound field restricts realm connections (STUN, hole punching, and the resulting QUIC path) to a single IP version. 4: The new realm.port_mapping inbound and outbound field maintains a UDP port mapping on the local gateway via UPnP or NAT-PMP, improving hole-punching reliability behind gateways that support it. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.41

sing-box 1.14.0-alpha.40 has been released. * Add bridge outbound 1 * Fixes and improvements 1: The new bridge outbound is the L3 counterpart of direct: it forwards L3 traffic (TCP, UDP and ICMP) from a TUN or other L3 endpoints directly out of a network interface, without going through L3 to L4 translation. It requires privileges and is supported on Linux, macOS, rooted Android, and jailbroken iOS. See Bridge. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.40

sing-box 1.14.0-alpha.39 has been released. * Add L3 forwarding support 1 * Fixes and improvements 1: Building on the ICMP proxy support introduced in sing-box 1.13.0, TCP and UDP traffic from L3 inbounds (TUN, WireGuard, and Tailscale) can now be forwarded directly to WireGuard and Tailscale endpoints at L3, without going through L3 to L4 translation. See Pre-match. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.39

sing-box 1.14.0-alpha.38 has been released. * Add Snell protocol support 1 * Fixes and improvements 1: Surge believes that being closed-source and not proliferated can keep Snell covert, but this is already impossible in 2026; considering that Snell still has advantages that other random-traffic protocols do not possess, such as multiplexing support with complete TCP semantics and traffic-characteristic diversity, we implemented it in Go instead of reinventing the wheel, with all features except the v5 QUIC proxy, behavior as consistent with the official implementation as possible, and performance at least on par with it. See Snell Inbound and Snell Outbound. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.38

sing-box 1.14.0-alpha.37 has been released. • Fixes and improvements https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.37

sing-box 1.14.0-alpha.36 has been released. • Fixes and improvements https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.36

sing-box 1.14.0-alpha.35 has been released. • Fixes and improvements https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.35

sing-box 1.13.14 has been released. * Fixes and improvements https://github.com/SagerNet/sing-box/releases/tag/v1.13.14

sing-box 1.14.0-alpha.34 has been released. * Fixes and improvements https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.34

sing-box 1.14.0-alpha.33 has been released. - Add iOS jailbreak release 1 - Fixes and improvements 1: A new jailbreak build of the iOS sing-box for Apple client is available, distributed as a .deb for rootless iOS 15.0+ from GitHub Releases (SFI-iphoneos-arm64.deb). Unlike the App Store and TestFlight builds, it can run a Tailscale SSH server on the device and supports process matching (process_name, process_path, user, and so on) in route and DNS rules. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.33

sing-box 1.14.0-alpha.32 has been released. • Add dashboard support for the API service 1 • Add USB/IP service 2 • Fixes and improvements 1: The sing-box API service can now download, update and serve sing-box-dashboard directly over its listener, configured via the new dashboard option. 2: New USB/IP Server and USB/IP Client services export and import USB devices over the USB/IP protocol, built on sing-usbip, which adds hotplug while staying interoperable with standard USB/IP. Exporting config-selected local devices (provider: default) runs via the CLI on Linux, Windows, and macOS and requires elevated privileges (macOS additionally needs a CGO build and disabled System Integrity Protection). With provider: dynamic, devices are instead supplied at runtime through the API service by the graphical clients on macOS and Android, or the sing-box Dashboard. https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.32

sing-box 1.14.0-alpha.31 has been released. * Fixes and improvements https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.31

sing-box 1.14.0-alpha.30 has been released. * Introducing sing-box API service 1 * Apple/Android: Introducing remote control 2 * Introducing sing-box Dashboard 3 * Fixes and improvements 1: The new sing-box API service is a gRPC server for observing and controlling the running sing-box instance, exposing the same interface the graphical clients use locally: service status, logs, outbound groups (selection and URL tests), Clash mode, connection tracking, and tools such as network quality tests, STUN tests, and Tailscale operations. The server also accepts gRPC-Web requests, including the WebSocket transport of @improbable-eng/grpc-web for bidirectional streaming methods, so browsers can connect directly. Clients authenticate via the secret field; TLS and CORS options are available. Connection tracking and Clash mode methods require the Clash API to be configured. 2: The graphical clients for Apple platforms and Android can now control remote sing-box instances running the API service. Remote servers (URL and secret) are managed in settings; the dashboard, logs, connections, groups, and tools pages can then switch between the local service and remote instances. 3: sing-box Dashboard is a new web client for the API service, providing almost the same experience as the graphical clients. A public instance is available at http://sing-box-dashboard.sagernet.org (shortcut: dash.sing-box.app). https://github.com/SagerNet/sing-box/releases/tag/v1.14.0-alpha.30