Surge TestFlight's Changelog

#iOS #TestFlight

Surge 5 5.102.0 (3851) is ready to test on iOS.

What to Test

- Inline rule sets with the same name now merge across the main profile and modules instead of replacing one another, preserving rules contributed by each source.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3850) is ready to test on iOS.

What to Test

- Made global adjustments to the UI layout logic and optimized details for iPhone Duo support.
- Fixed horizontal scrolling in the iOS policy group category selector when categories exceed the available width.
- Improved UDP test diagnostics for peer-to-peer Tailscale and WireGuard policies without Internet egress, reporting unsupported tests instead of waiting for a timeout.
- Fixed logical rules incorrectly parsing policy names containing parentheses.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3848) is ready to test on iOS.

What to Test

- Performance and memory usage optimizations
- Optimized the Add Rule page. Domain rules can now also be added for SNI sniffing requests, and rule-specific additional configurations can be selected directly.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3842) is ready to test on iOS.

What to Test

- A `category` parameter has been added to policy groups for grouped display. It can be used when there are many policy groups.
- All `test-url` parameters now support configuring HTTPS URLs for testing. The test result remains the latency of a single HTTP RTT, but due to the TLS handshake, the test duration may increase significantly when there are many policies.
- In the previous version, MITM security was strengthened by generating a separate key pair for each distinct domain name. This caused noticeable delays when performing MITM concurrently on a large number of different domains. After evaluation, this change has been reverted.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3837) is ready to test on iOS.

What to Test

5.22.1 Release Candidate 2

- Compiled with the iOS 27 SDK
- Policy group Widgets support the extra-large size on iOS 27

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3836) is ready to test on iOS.

What to Test

5.22.1 Release Candidate 1

- Added UNKNOWN support to GEOIP and IP-ASN rules, allowing you to match destination IP addresses with no corresponding country or ASN database entry. Supported in both individual rules and rule sets.
- Fixed a bug that caused results to fall short of expectations under extreme upload throughput performance testing.
- Fixed an issue where a failed cellular backup connection in Wi-Fi Assist or Hybrid mode could prematurely abort an ongoing Wi-Fi connection attempt, including connections to local network destinations.
- Fixed Pre-Matching remaining enabled after switching a rule to a non-reject policy or an unsupported rule type in the iOS and macOS rule editors.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3835) is ready to test on iOS.

What to Test

- Added a medium-sized iOS widget that combines start/stop controls, running status, and one-tap switching between Rule-Based Proxy, Direct Outbound, and Global Proxy.
- Fixed Hysteria UDP traffic failing with servers where HTTP/3 Datagram negotiation interfered with UDP forwarding.
- Fixed SF Symbol policy group icons on iOS not adapting correctly to appearance changes.
- Fixed a bug that caused results to fall short of expectations under extreme throughput performance testing.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3833) is ready to test on iOS.

What to Test

- Fixed missing traffic statistics for UDP connections through proxies and tunnels, including WireGuard and Tailscale.
- Fixed a rare issue where a UDP proxy connection closing during packet reception could stall other traffic handled by Surge.
- Improved resource updates on iOS: pending automatic updates resume when the app becomes active, duplicate downloads are avoided, and outdated errors clear after a successful background refresh.

Official Channel: @SurgeTestFlightFeed

#iOS #AppStore

Version 5.21.1
Release Date: 2026/8/11 20:07:07(UTC+08:00)

What’s New:

What's New

Surge as MTProto Server
- Surge now can operate as an incoming MTProto proxy server for Telegram. Please read manual for more information: https://manual.nssurge.com/

Tailscale
- Added interactive Tailscale sign-in on iOS and macOS. Resolve the issue where some enterprise users are unable to obtain the auth key.
- Added automatic Tailscale routing. Surge can discover the tailnet’s MagicDNS suffix and peer IPv4/IPv6 addresses, then automatically route matching domains and peer IP traffic through the corresponding Tailscale policy.
- Automatic Tailscale routing is enabled by default and can be disabled with auto-add-magic-dns-rule = false.
- Improved Tailscale session warm-up and recovery. Sessions now retry MagicDNS discovery after startup failures and network changes without requiring matching traffic to arrive first.
- Tailscale sessions now stay active by default. An omitted idle-keepalive, 0, or -1 keeps the session always active; set a positive value to enable idle teardown.
- Tailscale can now begin handling traffic as soon as a valid network map is received, without waiting for the home DERP connection to be established.
- Improved recovery after network changes and control-server reconnections by preserving the last known home DERP region and retrying peer handshakes at the appropriate time.
- Aligned DERP measurement and selection behavior with official Tailscale client, improving compatibility with custom DERP maps, STUN-only nodes, fallback probes, and temporarily unavailable control connections.
- Sensitive values such as authentication keys and authorization URLs are now redacted from verbose Tailscale control logs.

TLS
- Added server-cert-verify-name to independently specify the hostname used for proxy server certificate verification without changing SNI. This parameter applies to all TLS- and QUIC-based proxy protocols.

ECN
- Reworked ECN configuration and packet handling across QUIC, WireGuard, Tailscale, Ponte, and nested UDP tunnels.
- Correctly preserves ECN and DSCP/TOS metadata across IPv4 and IPv6 encapsulation and decapsulation.
- For QUIC-based proxy protocols, when ECN is enabled, anomalies will be automatically detected and fallback to non-ECN handling.
- ECN is now enabled by default for QUIC-based proxy protocols on supported systems. WireGuard and Tailscale remain disabled by default. Use ecn=false or ecn=true to override the default explicitly.
- Surge Ponte now also has ECN enabled by default, and the client-use-ecn parameter has been removed.

DNS
- Optimized TCP connection establishment for prefer-v4 and prefer-v6. In earlier versions, these two parameters indicated which record to use when a domain name had both A and AAAA records. Now, during the TCP handshake, A or AAAA records are used preferentially; if the handshake cannot be completed within 3 seconds, other records will start to be tried.
- Added DNS-over-TCP support. DNS server settings now accept tcp://hostname[:port].

iOS
- Raised the minimum system requirement to iOS 17.
- Reworked Shortcuts and App Intent support and improved the reliability of App Intent operations.
- Added manual Suspend and Bypass Suspension controls. The Ponte management page, scripts, and local proxy services remain available while Surge is suspended.
- Snell Server can now be configured and used on iOS and tvOS.

Codebase Refactoring

After more than a decade of development, the Surge codebase has grown into a large and complex project. To further improve reliability, we have introduced AI-assisted code review across the entire codebase.

Every code change is independently reviewed by Fable 5, GPT-5.6 Sol, and a human developer before being merged, helping us identify potential security issues, rare crash scenarios, and subtle correctness problems.

Due to the large number of updates, please refer to the Mac version release notes for details: https://nssurge.com/support/mac/release-notes

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3830) is ready to test on iOS.

What to Test

5.22.0 Release Candidate 3

- Fixed issues that may occur when filenames contain certain special emojis.
- Optimized the handling logic for low-memory mode.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3829) is ready to test on iOS.

What to Test

5.22.0 Release Candidate 2

- Crash fixes

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3828) is ready to test on iOS.

What to Test

5.22.0 Release Candidate 1

- Minor bug fixes

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3825) is ready to test on iOS.

What to Test

### Improved

- Nested rulesets now work reliably: inline rulesets can reference other inline rulesets or external `RULE-SET` and `DOMAIN-SET` sources. Circular references are rejected with a clear reference chain instead of causing recursive matching.
- The local ruleset editor now preserves blank lines, standalone and trailing comments, and disabled rules more accurately. Invalid entries report their source file and line number, while comment rows use the same readable presentation as the main rule editor.
- Virtual IP records and search results on iOS now use self-sizing rows, preventing longer domains and usage details from being clipped.

### Fixed

- Fixed rules added inside a ruleset or logical rule on iOS incorrectly retaining a hidden policy value when saved.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3824) is ready to test on iOS.

What to Test

- Fixed long-running Ponte and Vector sessions eventually failing to open new relayed connections after handling many connections over the same QUIC session.
- Other bug fixes

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3823) is ready to test on iOS.

What to Test

- Tailscale can now establish peer-relay paths through eligible tailnet devices when a direct connection is unavailable, with Direct > Peer Relay > DERP path priority. Runtime details identify Peer Relay connections and display their latency.
- Local-file and inline rulesets can now be edited graphically on macOS and iOS. Add or modify standard rules, logical rules, nested rulesets, and comments, then reorder or remove entries as needed. Create new inline rulesets directly from the rule editor and store them as named `[Ruleset ...]` sections in the profile.
- The previously added mixed use of `#include` will no longer affect UI write-back for the corresponding sections. Surge will automatically select the write-back target as accurately as possible based on the changes.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3822) is ready to test on iOS.

What to Test

### Profile Diagnostics

- WireGuard and Tailscale policies now produce a clear warning when their referenced configuration section is missing.
- The warning also explains that a named `#!include` loads only the identically named section from the included file.

### Modules and Cloud Sync

- Module installation information is no longer governed by iCloud data, in order to avoid various issues caused by iCloud. iCloud is only used to synchronize installation information across devices.
- Cloud synchronization now excludes `.git` and `node_modules` directories and no longer interprets their absence in the cloud as a request to delete local content.

### iOS

- Fixed policy-group icon changes sometimes being lost after the profile reloaded.
- Refined module menus on iOS 26 to avoid overlapping context-menu animations and improve Liquid Glass presentation.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3821) is ready to test on iOS.

What to Test

### Profile System Updates

The #include directive can now be freely combined with other content within a section. The following usage patterns are supported:

1. Dedicated Include

[Proxy]
#include proxy.dconf

When a section consists of a single #include directive, it remains fully editable in the UI. Any changes made through the UI will be correctly written back to proxy.dconf.

2. Multiple Includes

[Proxy]
#include a.dconf, b.dconf

This combines content from multiple files into a single section. Since the UI cannot determine how changes should be written back to the individual files, the section becomes read-only and cannot be modified through the UI.

3. Mixed Content and Includes (New)

[Rule]
#include common-rule-a.dconf
DEST-PORT,123,DIRECT
#include common-rule-b.dconf

#include directives can now be freely mixed with regular content within the same section. As with multiple includes, the UI cannot determine the appropriate write-back behavior, so the section will be read-only.

Note: When using this feature in the [Rule] section, keep in mind that a FINAL rule immediately terminates rule matching. Any rules included or defined after it will therefore never be evaluated.### Tailscale

- Improved compatibility with the Tailscale administration console. Surge devices are no longer incorrectly reported as using an outdated client, enabling version-gated operations such as editing the device IP address.

### iOS

- Fixed managed-profile `icon-url` icons being hidden by automatically generated placeholder icons.
- Custom policy-group icons now behave consistently across Lucid and Gradient themes, with a **Default** option available in both.
- Module download, parsing, file-writing, and installation-information failures are now reported instead of failing silently.
- Refined the Script Editor toolbar and file-selection layout on iOS 26.
- Improved context-menu previews on iOS 26 by following the system’s native corner styling.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3820) is ready to test on iOS.

What to Test

### Smart Group

- Added a graphical Policy Priority editor for Smart Groups on.

### Tailscale

- Interactive sign-in now supports tailnets that require administrator device approval. Surge clearly indicates when sign-in has completed but the device is still awaiting approval.
- Fixed Tailscale traffic becoming unavailable when the control server assigned the device a new tailnet address.
- Improved recovery after network changes by retrying temporarily failed UDP bindings and refreshing direct-connect endpoints.
- Improved WireGuard and Tailscale handling of multiple peers and expired connections.

### Profile and Automation

- On iOS, profile changes made on disk or received through iCloud now reload automatically. If the updated profile is invalid, Surge keeps the working configuration active and reports the error.
- Event scripts can now respond to `engine-started` and `profile-reloaded`, in addition to `network-changed`.

### Notifications

- Added notification controls for new proxy clients, script notifications, and rule-matched notifications.
- Local and remote notification category settings now correctly apply to dynamically generated alerts.
- Disabling policy-group change notifications now also suppresses temporary group-override alerts.

### Fixed

- Improved MITM certificate generation by using separate keys for generated leaf certificates and correcting the transmitted certificate chain.
- Fixed QUIC connections potentially stalling after receive-side backpressure.
- Fixed rare deadlocks involving cron-script shutdown and Vector UDP connections, including Ponte traffic.
- Improved stability under heavy connection churn and local-port exhaustion.
- Other small UI issues.

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3819) is ready to test on iOS.

What to Test

### Profile Format

- Added wildcard detached-section includes for `[Ruleset *]`, `[WireGuard *]`, and `[Tailscale *]`. A single `#!include` can now load all matching named sections from another local or remote profile file.
- Added `DEVICE_NAME` to the profile environment, enabling device-specific conditions in `#!REQUIREMENT`.
- Fixed `[General]` values containing `#`, `//`, or `;` being truncated or changed after the profile was saved and reloaded.

### Tailscale

- Improved interactive Tailscale sign-in reliability. Interrupted or silently disconnected login sessions now reconnect and continue the existing browser authorization flow instead of becoming stuck.

### Fixed

- Fixed a rare crash when an HTTP/3 or other QUIC session closed synchronously while pending data was being processed.
- Other fixes

Official Channel: @SurgeTestFlightFeed

#iOS #TestFlight

Surge 5 5.102.0 (3818) is ready to test on iOS.

What to Test

### UI

- When navigating to a new page, the bottom tab bar is no longer hidden. This change was made to avoid triggering known UIKit UI glitches that can occur when the tab bar is hidden during push transitions.
- The Script Editor now opens in a dedicated modal interface, with an updated toolbar, close action, and improved keyboard layout.
- Remote Controller and Ponte Diagnostics are now available for all Ponte devices, including devices shared by another iCloud account.
- Other UI improvements.

### Other Improvements

- Updated the IPv6 fake-IP range to avoid unnecessary browser local-network permission prompts, while retaining compatibility with previously cached addresses.
- Proxy connections closed during the protocol handshake now provide a clearer error message, with guidance to verify credentials, encryption methods, and protocol settings.
- Fixed rare crashes that could occur when proxy connections were synchronously closed while data was being written.
- Fixed recursive HTTP/3 timer processing that could cause a stack overflow under certain conditions.

Official Channel: @SurgeTestFlightFeed