Conversation
… improved WinUI, and release hardening.
## Shadowsocks Reborn 5.2.22
This release focuses on **DNS privacy, update reliability, WinUI stability, and release security**.
### Highlights
* **DNSCrypt management**
* DNSCrypt and DoH resolver support
* ODoH remains disabled by default
* Resolver search and filtering
* Improved DNSCrypt configuration generation
* Updated localization for DNSCrypt management
* **Safer automatic updates**
* SHA-256 verification for release packages
* Additional integrity verification for the staged updater
* Protection against updater replacement between verification and execution
* Safer UAC/elevated update handoff
* Rollback and cleanup handling preserved
* Canonical update assets:
* `Shadowsocks-win-x64.zip`
* `Shadowsocks-win-x64.zip.sha256`
* **Protocol handler fixes**
* Fixed `ss://` registration when Shadowsocks is located in a path containing spaces
* Properly quoted executable path and URL arguments
* **Windows compatibility**
* Windows 10 build **19041+** remains the minimum supported version
* WinUI builds against a newer Windows SDK while preserving the Windows 10 compatibility baseline
* **Release and security hardening**
* Updated .NET 10 SDK baseline
* NuGet vulnerability audit is now enforced for release builds
* Release build fails if the vulnerability feed cannot be checked
* Published `Shadowsocks.exe` version is verified against the requested release version
* Product assembly versions synchronized to **5.2.22**
* Additional repository validation and regression checks
* **Quality fixes**
* Fixed `SelfUpdater` compilation regressions
* Fixed DNSCrypt TOML unit-test matching
* Added missing DNSCrypt localization entries
* Improved CI and release validation
* Removed remaining legacy WPF/WinForms references from release tooling
### Version
`5.2.22`
### Platform
* Windows 10 2004 / build 19041 or newer
* Windows 11
* x64
### Distribution
Shadowsocks Reborn continues to use a portable, self-contained distribution with `Shadowsocks.exe` as the primary application binary.
Fix validator
Sorry
… routing, plugin, Windows 10/11 UI, and update-system release focused on making the client safer and more predictable in real-world use. This release improves DNSCrypt bootstrap and resolver verification, server lifecycle and routing strategies, SIP003 plugin handling, startup/session restoration, WinDivert administration mode, PAC behavior, automatic updates, localization, Windows 10 compatibility, and release validation. Highlights Improved DNSCrypt integration and first-run experience Fixed DNSCrypt resolver catalog verification with current upstream Minisign signatures Preserved existing DNSCrypt configuration without silently overwriting user preferences New DNSCrypt installations enable recommended defaults automatically, except IPv6 DNSCrypt runtime correctly requires a valid Shadowsocks SOCKS5 endpoint when routing through Shadowsocks DNS preferences are preserved when no server is configured, while dependent runtime features remain inactive Improved DNSCrypt fail-closed behavior and bootstrap validation Server management Removed the synthetic empty Server 1 entry Zero configured servers is now a valid application state DNS, PAC and system-proxy functionality is disabled when no usable Shadowsocks server exists Invalid or incomplete server profiles are excluded from routing strategies, tray selection and hotkeys Fixed selected-server preservation after configuration sorting and subscription refresh Profiles sharing the same host and port are no longer incorrectly treated as the same logical server Fixed server-selection edge cases after online configuration updates Routing Improved Balancing and High Availability strategies Fixed possible negative server index generation in balancing mode High Availability state is now maintained per actual server profile rather than only by endpoint TCP timeout now follows the server actually selected by the routing strategy Invalid server entries can no longer be selected by Balancing or HA SIP003 plugins Improved plugin lifecycle management Separate profiles using the same server endpoint no longer incorrectly share one SIP003 process Known missing plugins can be offered for installation instead of immediately failing Fixed QTun Windows asset detection Verified Xray/V2Ray Windows release asset conventions PAC and proxy behavior Local PAC user rules remain directly editable Local managed-routing controls are hidden when Online PAC is active Server-dependent proxy/DNS/PAC options are disabled when no working server exists System Proxy cannot remain accidentally enabled without a valid Shadowsocks server Startup and Windows session restoration Application state is restored across Windows restart/logoff: window visible before restart → window restored application in tray → application remains in tray Fixed interaction between Windows Restart Manager and Start with Windows Fixed shutdown/session-ending edge cases Self-update now preserves the current UI state instead of the state from the original process startup UI and Windows compatibility Added missing busy/progress indicators for operations such as Start with Windows and Administrator capture Improved first-run DNSCrypt progress feedback Server editor is correctly disabled when no server is selected Replaced Windows 11-only icon assumptions with Windows 10-compatible Segoe MDL2 glyphs Fixed missing Logs and UAC/Admin icons on Windows 10 Improved visibility and consistency of conditional UI options Updates and packaging Improved automatic self-update handoff and state restoration Release pipeline continues to produce a single portable Shadowsocks.exe Strengthened repository and packaging validation Added validation for invalid WinUI IsEnabled usage Fixed DNSCrypt validation scripts and logging-schema validation Updated GitHub Actions release/CI compatibility checks Reliability fixes Fixed DNSCrypt test/runtime assumptions introduced by the new secure first-run defaults Fixed DNS policy being incorrectly reset to System when the last server was removed Fixed several configuration-index and selection integrity edge cases Fixed CA1859 analyzer warning in online server refresh logic Added regression coverage for routing, DNSCrypt, server persistence, startup restoration, plugin handling and WinUI state Documentation The GitHub Wiki has been reviewed and synchronized with 5.2.31: English, Russian and Chinese release documentation updated Broken Wiki-local image references fixed DNSCrypt behavior documented according to the actual runtime model Serverless-state behavior clarified Plugin and routing changes documented Internal Wiki links validated Platform Windows 10 / Windows 11 x64 .NET 10 Portable single-file distribution
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Describe what changed and why.
Validation
packaging/Build-Release.ps1when build/publish/runtime packaging changed.Notes
Include exact commands, runtime scenarios, screenshots and known limitations when relevant.