Xray-core v25.5.16

REALITY practice: Support X25519MLKEM768 for TLS' communication

REALITY 抗量子更新第一弹来袭！升级服务端、客户端至该版本，REALITY target 支持 X25519MLKEM768 时将自动启用

X25519MLKEM768 可有效预防被“现在记录、以后拿量子计算机解密 TLS 流量”，此外 #3813 (comment)

最近有越来越多的网站开始支持 X25519MLKEM768 了，所以服务端一定要及时升级，避免新版客户端连不上

感谢 @yuhan6665 对 REALITY 仓库的维护，以及 @mingyech @BRUHItsABunny 对 uTLS 仓库的维护

有人觉得这次是 breaking，其实不尽然，因为我发得早，现在已经支持 X25519MLKEM768 的就技术前沿像 CF、Google 这样的，它们都没人偷，等一两个月后其它网站陆续开始支持了，大家的服务端早就升级、兼容了，所以我必须让 v25.5.16 成为新的稳定版

Shadowrocket TF 版已支持 XHTTP，大家可以测测，如果有问题请反馈过去

此外从上个版本开始，auto mode 的 XHTTP TLS 默认改为 packet-up，XHTTP REALITY 默认仍为 stream-one

请支持一个 REALITY NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2

如果你有余力，请支持一个 Project X NFT：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1

该版本升级了一些依赖，并使用 Go 1.24.3 编译，已 tag v1.250516.0，感谢所有贡献者，详见下方 change log

What's Changed

• README.md: Add Remnawave to Web Panels by @iambabyninja in #4498
• API: Fix data race in online ipList by @Fangliding in #4513
• DNS: Ensure order for DNS server match by @Fangliding in #4510
• DNS: Add allowUnexpectedIPs for DnsServerObject by @patterniha in #4497
• DNS: Add tag for DnsServerObject by @Fangliding in #4515
• DNS: Retry with EDNS0 when response is truncated by @Fangliding in #4516
• DNS: Add timeoutMs for DnsServerObject by @patterniha in #4523
• Sockopt: Fix Windows UDP interface bind; Allow Linux customSockopt work for UDP by @Fangliding in #4504
• DNS DoH: Use EDNS0 with 100-300 padding by default (body padding) by @RPRX in 607c2a6
• Env: Add XRAY_LOCATION_CERT variable by @patterniha @RPRX in #4536
• DNS: Support returning upstream TTL to clients by @Meo597 in #4526
• DNS: Add expectedIPs as an alias of expectIPs by @patterniha in #4551
• HTTP inbound: Directly forward plain HTTP 1xx response header by @Fangliding in #4547
• Chore: Optimize .gitignore by @Pk-web6936 in #4564
• DNS: Use cache for NXDOMAIN (rcode 3 error) by @patterniha in #4560
• Sockopt: Fix Windows Multicast interface bind by @xqzr in #4568
• WireGuard: Improve config error handling; Prevent panic in case of errors during server initialization by @IlyaGulya in #4566
• Dialer: Do not use ListenSystemPacket() when dialing UDP by @RPRX in 8284a0e
• Sockopt: Fix Darwin (macOS, iOS...) UDP interface bind by @92613hjh in #4530
• Sockopt: Allow listen v6only work for Windows & Darwin by @xqzr @RPRX in #4571
• Config: Implement missing MarshalJSON for structs having custom UnmarshalJSON by @ragavpr in #4585
• Sockopt: Use Windows syscall by @xqzr in #4581
• Fix issues related to android client by @Cl-He-O in #4616
• Sockopt: Allow customSockopt work for Windows & Darwin by @Fangliding in #4576
• README.md: Add Loon to Others by @RPRX in 8212325
• README.md: Rename Clash.Meta to mihomo in Others by @RPRX in 2916b1b
• XHTTP client: Set packet-up as the default mode (auto) when using TLS by @RPRX in 0995fa4
• Sockopt: Fix Windows IP_MULTICAST_IF & IPV6_MULTICAST_IF by @xqzr in #4627
• DNS log: Optimize IP address display by @ddatsh in #4630
• uTLS: Add new fingerprints by @yuhan6665 in a608c5a
• QUIC sniffer: Full support for handling multiple initial packets by @j2rong4cn @RPRX @Vigilans @xiaokangwang @dyhkwong in #4642
• buffer.go: Ensure extended part by Extend() & Resize() are all-zero by @RPRX in 2eed70e
• QUIC sniffer: Optimize the code by @j2rong4cn in #4655
• Sockopt: Fix some domainStrategy & dialerProxy bugs by @patterniha in #4661
• DNS: Fix some bugs; Refactors; Optimizations by @patterniha in #4659
• Workflows: Build Android(7+) using NDK; Add Android(7+) amd64 build by @j2rong4cn in #4664
• Chore: Update gVisor to the latest version; Fmt .go files by @Pk-web6936 in #4663
• Improve random IP compatibility: support IPv4, add srcip option, and sync client source IP via sendthrough by @ImAubrey in #4671
• DNS: Extend hosts Abilities by @patterniha in #4673
• Workflows: Authenticating the GitHub API call with GitHub token by @yin1999 in #4703
• DNS-Hosts: appending matched-results again by @patterniha @Fangliding in #4702
• Workflows: Ensure Geodat exists by @Meo597 in #4680
• Removing code that was not being executed and should not be executed. by @patterniha in #4721
• REALITY practice: Support X25519MLKEM768 for TLS' communication by @RPRX in 7ddc4a2
• REALITY protocol: Remove ChaCha20-Poly1305 support for REALITY's session id auth by @RPRX in 09d84c4
• Sniffer: Fix potential infinite loop by @patterniha @Fangliding in #4726
• QUIC sniffer: Fix potential slice panic by @Fangliding in #4732

New Contributors

• @Meo597 made their first contribution in #4526
• @Pk-web6936 made their first contribution in #4564
• @IlyaGulya made their first contribution in #4566
• @92613hjh made their first contribution in #4530
• @ragavpr made their first contribution in #4585
• @Cl-He-O made their first contribution in #4616
• @ddatsh made their first contribution in #4630
• @j2rong4cn made their first contribution in #4642

Full Changelog: v25.3.6...v25.5.16