v1.13.0

## :memo: Release Notes

Important changes since 1.12:

* Add NaiveProxy outbound **1**
* Add pre-match support for `auto_redirect` **2**
* Improve `auto_redirect` **3**
* Add Chrome Root Store certificate option **4**
* Add new options for ACME DNS-01 challenge providers **5**
* Add Wi-Fi state support for Linux and Windows **6**
* Add curve preferences, pinned public key SHA256, mTLS and ECH `query_server_name` for TLS options **7**
* Add kTLS support **8**
* Add ICMP echo (ping) proxy support **9**
* Add `interface_address`, `network_interface_address` and `default_interface_address` rule items **10**
* Add `preferred_by` route rule item **11**
* Improve `local` DNS server **12**
* Add `disable_tcp_keep_alive`, `tcp_keep_alive` and `tcp_keep_alive_interval` options for listen and dial fields **13**
* Add `bind_address_no_port` option for dial fields **14**
* Add system interface and relay server options for Tailscale endpoint **15**
* Add Claude Code Multiplexer service **16**
* Add OpenAI Codex Multiplexer service **17**
* Apple/Android: Refactor GUI
* Apple/Android: Add support for sharing configurations via [QRS](https://github.com/qifi-dev/qrs)
* Android: Add support for resisting VPN detection via Xposed
* Drop support for go1.23 **18**
* Drop support for Android 5.0 **19**
* Update uTLS to v1.8.2 **20**
* Update quic-go to v0.59.0
* Update gVisor to v20250811
* Update Tailscale to v1.92.4

**1**:

NaiveProxy outbound now supports QUIC, ECH, UDP over TCP, and configurable QUIC congestion control.

Only available on Apple platforms, Android, Windows and some Linux architectures.
Each Windows release includes `libcronet.dll` —
ensure this file is in the same directory as `sing-box.exe` or in a directory listed in `PATH`.

See [NaiveProxy outbound](https://sing-box.sagernet.org/configuration/outbound/naive/).

**2**:

`auto_redirect` now allows you to bypass sing-box for connections based on routing rules.

A new rule action `bypass` is introduced to support this feature. When matched during pre-match, the connection will bypass sing-box and connect directly.

This feature requires Linux with `auto_redirect` enabled.

See [Pre-match](https://sing-box.sagernet.org/configuration/shared/pre-match/) and [Rule Action](https://sing-box.sagernet.org/configuration/route/rule_action/#bypass).

**3**:

`auto_redirect` now rejects MPTCP connections by default to fix compatibility issues.
You can change it to bypass sing-box via the new `exclude_mptcp` option.

Adds a fallback iproute2 rule checked after system default rules (32766: main, 32767: default),
ensuring traffic is routed to the sing-box table when no route is found in system tables.
The rule index can be customized via `auto_redirect_iproute2_fallback_rule_index` (default: 32768).

See [TUN](https://sing-box.sagernet.org/configuration/inbound/tun/#exclude_mptcp).

**4**:

Adds `chrome` as a new certificate store option alongside `mozilla`.
Both stores filter out China-based CA certificates.

See [Certificate](https://sing-box.sagernet.org/configuration/certificate/#store).

**5**:

See [DNS-01 Challenge](https://sing-box.sagernet.org/configuration/shared/dns01_challenge/).

**6**:

sing-box can now monitor Wi-Fi state on Linux and Windows to enable routing rules based on `wifi_ssid` and `wifi_bssid`.

See [Wi-Fi State](https://sing-box.sagernet.org/configuration/shared/wifi-state/).

**7**:

See [TLS](https://sing-box.sagernet.org/configuration/shared/tls/).

**8**:

Adds `kernel_tx` and `kernel_rx` options for TLS inbound.
Enables kernel-level TLS offloading via `splice(2)` on Linux 5.1+ with TLS 1.3.

See [TLS](https://sing-box.sagernet.org/configuration/shared/tls/).

**9**:

sing-box can now proxy ICMP echo (ping) requests.
A new `icmp` network type is available for route rules.
Supported from TUN, WireGuard and Tailscale inbounds to Direct, WireGuard and Tailscale outbounds.
The `reject` action can also reply to ICMP echo requests.

**10**:

New rule items for matching based on interface IP addresses, available in route rules, DNS rules and rule-sets.

**11**:

Matches outbounds' preferred routes.
For Tailscale: MagicDNS domains and peers' allowed IPs. For WireGuard: peers' allowed IPs.

**12**:

The `local` DNS server now uses platform-native resolution:
`getaddrinfo`/libresolv on Apple platforms, systemd-resolved DBus on Linux.
A new `prefer_go` option is available to opt out.

See [Local DNS](https://sing-box.sagernet.org/configuration/dns/server/local/).

**13**:

The default TCP keep-alive initial period has been updated from 10 minutes to 5 minutes.

See [Dial Fields](https://sing-box.sagernet.org/configuration/shared/dial/#tcp_keep_alive).

**14**:

Adds the Linux socket option `IP_BIND_ADDRESS_NO_PORT` support when explicitly binding to a source address.

This allows reusing the same source port for multiple connections, improving scalability for high-concurrency proxy scenarios.

See [Dial Fields](https://sing-box.sagernet.org/configuration/shared/dial/#bind_address_no_port).

**15**:

Tailscale endpoint can now create a system TUN interface to handle traffic directly.
New `relay_server_port` and `relay_server_static_endpoints` options for incoming relay connections.

See [Tailscale endpoint](https://sing-box.sagernet.org/configuration/endpoint/tailscale/).

**16**:

CCM (Claude Code Multiplexer) service allows you to access your local Claude Code subscription remotely through custom tokens, eliminating the need for OAuth authentication on remote clients.

See [CCM](https://sing-box.sagernet.org/configuration/service/ccm).

**17**:

See [OCM](https://sing-box.sagernet.org/configuration/service/ocm).

**18**:

Due to maintenance difficulties, sing-box 1.13.0 requires at least Go 1.24 to compile.

**19**:

Due to maintenance difficulties, sing-box 1.13.0 will be the last version to support Android 5.0,
and only through a separate legacy build (with `-legacy-android-5` suffix).

For standalone binaries, the minimum Android version has been raised to Android 6.0,
since Termux requires Android 7.0 or later.

**20**:

This update fixes missing padding extension for Chrome 120+ fingerprints.

Also, documentation has been updated with a warning about uTLS fingerprinting vulnerabilities.
uTLS is not recommended for censorship circumvention due to fundamental architectural limitations;
use NaiveProxy instead for TLS fingerprint resistance.