v1.19.20

What's Changed

• 828fd30 chore: support connection reuse for DoT by @H1JK
• 3c526ae feat: add query-server-name for ech-opts by @wwqgtxx
• dede56f feat: add proxy-server-nameserver-policy to dns section by @wwqgtxx
• e45c896 feat: support masque outbound by @wwqgtxx
• f94da9f chore: fingerprint verifier handle non-leaf certificate will check the SNI matches the certificate's DNS name by @wwqgtxx

BUG & Fix

• 2cfc4ba fix: CVE-2025-68121 for crypto/tls again and again by @wwqgtxx
• 3279966 fix: quic data race for crypto/tls by @wwqgtxx
• 3ac6215 fix: race condition of tcpConcurrent in dialer (#2556) by @chenx Dust
• 75a0cd5 fix: file exists when tun start by @wwqgtxx
• 85c024a fix: snat key in sudoku packet listener by @wwqgtxx
• d18a14a fix: snat key in trojan packet listener by @wwqgtxx
• e3b8fc2 fix: hy2 listener panic with http/https masquerade by @wwqgtxx
• f52c935 fix: CVE-2025-68121 for crypto/tls again by @wwqgtxx

Maintenance

• 022f677 chore: cleanup hostValue code by @wwqgtxx
• 034f1d1 chore: disallow empty proxy-server-nameserver when proxy-server-nameserver-policy is set by @wwqgtxx
• 0c995a2 chore: move proxiesWithProviders to hub/route internal to disallow external usage of this poorly implemented function by @wwqgtxx
• 18d139a chore: rollback tls to restore the session resumption functionality in quic-go by @wwqgtxx
• 1e1434d chore: remove an unnecessary variable by @wwqgtxx
• 26052ba chore: remove confused varbin using in sing by @wwqgtxx
• 27a3ca6 chore: converter support fingerprint for vmess/vless/trojan by @wwqgtxx
• 3bca69c chore: add some comments for the fingerprint verifier by @wwqgtxx
• 46ee164 chore: hy2 listener fellow hysteria2's code skip verify in https masquerade by @wwqgtxx
• 5516ca1 chore: code cleanup by @wwqgtxx
• 5e1b133 chore: more callback support for utls by @wwqgtxx
• 5fda87d chore: update sing-tun by @wwqgtxx
• 65c3d3e chore: remove unreachable code in sudoku by @wwqgtxx
• 6aaabc9 chore: decrease unneeded string convert in socks5 addr parsing by @wwqgtxx
• 707fe8b chore: remove auto IDNA conversion in domain rules by @wwqgtxx
• 710772f chore: add simple validation for static dialer-proxy config (#2551) by @sleshep
• 7573aff chore: better logging in masque outbound by @wwqgtxx
• 86257fc chore: remove reflect-based provider override code by @wwqgtxx
• 8b0bcb6 chore: better generator by @wwqgtxx
• 97f2525 chore: code cleanup by @wwqgtxx
• 98b3060 chore: optimize timeout control in DoH TLS probe by @wwqgtxx
• 993595d chore: switch to our own common/orderedmap package, remove two unneeded json dependence by @wwqgtxx
• b901006 chore: using mihomo's global pool in DoQ by @wwqgtxx
• c33c90d chore: clean up duplicate code in sudoku by @wwqgtxx
• d36b024 chore: align sudoku with upstream v0.2.0 (#2549) by @saba-futai
• e03ba23 chore: update logrus by @wwqgtxx
• f2222b5 chore: code cleanup by @wwqgtxx

Full Changelog: v1.19.19...v1.19.20