diff --git a/.github/update.log b/.github/update.log
index 3f21cbf576..0b2df56a08 100644
--- a/.github/update.log
+++ b/.github/update.log
@@ -1189,3 +1189,4 @@ Update On Tue Nov 18 19:40:59 CET 2025
 Update On Wed Nov 19 19:39:59 CET 2025
 Update On Thu Nov 20 19:39:36 CET 2025
 Update On Fri Nov 21 19:35:09 CET 2025
+Update On Sat Nov 22 19:36:29 CET 2025
diff --git a/clash-meta/adapter/outbound/mieru.go b/clash-meta/adapter/outbound/mieru.go
index 8ef9cfd758..d9feeba08f 100644
--- a/clash-meta/adapter/outbound/mieru.go
+++ b/clash-meta/adapter/outbound/mieru.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"net/netip"
 	"strconv"
 	"sync"
 
@@ -40,6 +41,20 @@ type MieruOption struct {
 	HandshakeMode string `proxy:"handshake-mode,omitempty"`
 }
 
+type mieruPacketDialer struct {
+	C.Dialer
+}
+
+var _ mierucommon.PacketDialer = (*mieruPacketDialer)(nil)
+
+func (pd mieruPacketDialer) ListenPacket(ctx context.Context, network, laddr, raddr string) (net.PacketConn, error) {
+	rAddrPort, err := netip.ParseAddrPort(raddr)
+	if err != nil {
+		return nil, fmt.Errorf("invalid address %s: %w", raddr, err)
+	}
+	return pd.Dialer.ListenPacket(ctx, network, laddr, rAddrPort)
+}
+
 // DialContext implements C.ProxyAdapter
 func (m *Mieru) DialContext(ctx context.Context, metadata *C.Metadata) (C.Conn, error) {
 	if err := m.ensureClientIsRunning(); err != nil {
@@ -102,6 +117,7 @@ func (m *Mieru) ensureClientIsRunning() error {
 		return err
 	}
 	config.Dialer = dialer
+	config.PacketDialer = mieruPacketDialer{Dialer: dialer}
 	if err := m.client.Store(config); err != nil {
 		return err
 	}
@@ -158,23 +174,21 @@ func (m *Mieru) Close() error {
 }
 
 func metadataToMieruNetAddrSpec(metadata *C.Metadata) mierumodel.NetAddrSpec {
+	spec := mierumodel.NetAddrSpec{
+		Net: metadata.NetWork.String(),
+	}
 	if metadata.Host != "" {
-		return mierumodel.NetAddrSpec{
-			AddrSpec: mierumodel.AddrSpec{
-				FQDN: metadata.Host,
-				Port: int(metadata.DstPort),
-			},
-			Net: "tcp",
+		spec.AddrSpec = mierumodel.AddrSpec{
+			FQDN: metadata.Host,
+			Port: int(metadata.DstPort),
 		}
 	} else {
-		return mierumodel.NetAddrSpec{
-			AddrSpec: mierumodel.AddrSpec{
-				IP:   metadata.DstIP.AsSlice(),
-				Port: int(metadata.DstPort),
-			},
-			Net: "tcp",
+		spec.AddrSpec = mierumodel.AddrSpec{
+			IP:   metadata.DstIP.AsSlice(),
+			Port: int(metadata.DstPort),
 		}
 	}
+	return spec
 }
 
 func buildMieruClientConfig(option MieruOption) (*mieruclient.ClientConfig, error) {
@@ -182,7 +196,13 @@ func buildMieruClientConfig(option MieruOption) (*mieruclient.ClientConfig, erro
 		return nil, fmt.Errorf("failed to validate mieru option: %w", err)
 	}
 
-	transportProtocol := mierupb.TransportProtocol_TCP.Enum()
+	var transportProtocol = mierupb.TransportProtocol_UNKNOWN_TRANSPORT_PROTOCOL.Enum()
+	switch option.Transport {
+	case "TCP":
+		transportProtocol = mierupb.TransportProtocol_TCP.Enum()
+	case "UDP":
+		transportProtocol = mierupb.TransportProtocol_UDP.Enum()
+	}
 	var server *mierupb.ServerEndpoint
 	if net.ParseIP(option.Server) != nil {
 		// server is an IP address
@@ -284,8 +304,8 @@ func validateMieruOption(option MieruOption) error {
 		}
 	}
 
-	if option.Transport != "TCP" {
-		return fmt.Errorf("transport must be TCP")
+	if option.Transport != "TCP" && option.Transport != "UDP" {
+		return fmt.Errorf("transport must be TCP or UDP")
 	}
 	if option.UserName == "" {
 		return fmt.Errorf("username is empty")
diff --git a/clash-meta/adapter/outbound/mieru_test.go b/clash-meta/adapter/outbound/mieru_test.go
index 086b791044..d80b27696c 100644
--- a/clash-meta/adapter/outbound/mieru_test.go
+++ b/clash-meta/adapter/outbound/mieru_test.go
@@ -34,7 +34,7 @@ func TestNewMieru(t *testing.T) {
 				Name:      "test",
 				Server:    "example.com",
 				Port:      10003,
-				Transport: "TCP",
+				Transport: "UDP",
 				UserName:  "test",
 				Password:  "test",
 			},
diff --git a/clash-meta/docs/config.yaml b/clash-meta/docs/config.yaml
index e71b06f482..8a5ec1f7d3 100644
--- a/clash-meta/docs/config.yaml
+++ b/clash-meta/docs/config.yaml
@@ -1027,7 +1027,7 @@ proxies: # socks5
     server: 1.2.3.4
     port: 2999
     # port-range: 2090-2099 #（不可同时填写 port 和 port-range）
-    transport: TCP # 只支持 TCP
+    transport: TCP # 支持 TCP 或者 UDP
     udp: true # 支持 UDP over TCP
     username: user
     password: password
diff --git a/clash-meta/go.mod b/clash-meta/go.mod
index 90362be0c6..2047d0eb11 100644
--- a/clash-meta/go.mod
+++ b/clash-meta/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/bahlo/generic-list-go v0.2.0
 	github.com/coreos/go-iptables v0.8.0
 	github.com/dlclark/regexp2 v1.11.5
-	github.com/enfein/mieru/v3 v3.22.1
+	github.com/enfein/mieru/v3 v3.23.0
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/render v1.0.3
 	github.com/gobwas/ws v1.4.0
diff --git a/clash-meta/go.sum b/clash-meta/go.sum
index 0bec36121a..bc29d7fef7 100644
--- a/clash-meta/go.sum
+++ b/clash-meta/go.sum
@@ -23,8 +23,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/enfein/mieru/v3 v3.22.1 h1:/XGYYXpEhEJlxosmtbpEJkhtRLHB8IToG7LB8kU2ZDY=
-github.com/enfein/mieru/v3 v3.22.1/go.mod h1:zJBUCsi5rxyvHM8fjFf+GLaEl4OEjjBXr1s5F6Qd3hM=
+github.com/enfein/mieru/v3 v3.23.0 h1:f/dd3UAoi36FD9DZ9x49t6Ps0oHeSjrVSgWzvEstn0E=
+github.com/enfein/mieru/v3 v3.23.0/go.mod h1:zJBUCsi5rxyvHM8fjFf+GLaEl4OEjjBXr1s5F6Qd3hM=
 github.com/ericlagergren/aegis v0.0.0-20250325060835-cd0defd64358 h1:kXYqH/sL8dS/FdoFjr12ePjnLPorPo2FsnrHNuXSDyo=
 github.com/ericlagergren/aegis v0.0.0-20250325060835-cd0defd64358/go.mod h1:hkIFzoiIPZYxdFOOLyDho59b7SrDfo+w3h+yWdlg45I=
 github.com/ericlagergren/polyval v0.0.0-20220411101811-e25bc10ba391 h1:8j2RH289RJplhA6WfdaPqzg1MjH2K8wX5e0uhAxrw2g=
diff --git a/clash-meta/listener/inbound/common_test.go b/clash-meta/listener/inbound/common_test.go
index 72874c7b54..4178035b27 100644
--- a/clash-meta/listener/inbound/common_test.go
+++ b/clash-meta/listener/inbound/common_test.go
@@ -59,11 +59,13 @@ func init() {
 }
 
 type TestTunnel struct {
-	HandleTCPConnFn   func(conn net.Conn, metadata *C.Metadata)
-	HandleUDPPacketFn func(packet C.UDPPacket, metadata *C.Metadata)
-	NatTableFn        func() C.NatTable
-	CloseFn           func() error
-	DoTestFn          func(t *testing.T, proxy C.ProxyAdapter)
+	HandleTCPConnFn    func(conn net.Conn, metadata *C.Metadata)
+	HandleUDPPacketFn  func(packet C.UDPPacket, metadata *C.Metadata)
+	NatTableFn         func() C.NatTable
+	CloseFn            func() error
+	DoTestFn           func(t *testing.T, proxy C.ProxyAdapter)
+	DoSequentialTestFn func(t *testing.T, proxy C.ProxyAdapter)
+	DoConcurrentTestFn func(t *testing.T, proxy C.ProxyAdapter)
 }
 
 func (tt *TestTunnel) HandleTCPConn(conn net.Conn, metadata *C.Metadata) {
@@ -86,6 +88,14 @@ func (tt *TestTunnel) DoTest(t *testing.T, proxy C.ProxyAdapter) {
 	tt.DoTestFn(t, proxy)
 }
 
+func (tt *TestTunnel) DoSequentialTest(t *testing.T, proxy C.ProxyAdapter) {
+	tt.DoSequentialTestFn(t, proxy)
+}
+
+func (tt *TestTunnel) DoConcurrentTest(t *testing.T, proxy C.ProxyAdapter) {
+	tt.DoConcurrentTestFn(t, proxy)
+}
+
 type TestTunnelListener struct {
 	ch     chan net.Conn
 	ctx    context.Context
@@ -213,6 +223,40 @@ func NewHttpTestTunnel() *TestTunnel {
 		}
 		assert.Equal(t, httpData[:size], data)
 	}
+
+	sequentialTestFn := func(t *testing.T, proxy C.ProxyAdapter) {
+		// Sequential testing for debugging
+		t.Run("Sequential", func(t *testing.T) {
+			testFn(t, proxy, "http", len(httpData))
+			testFn(t, proxy, "https", len(httpData))
+		})
+	}
+
+	concurrentTestFn := func(t *testing.T, proxy C.ProxyAdapter) {
+		// Concurrent testing to detect stress
+		t.Run("Concurrent", func(t *testing.T) {
+			wg := sync.WaitGroup{}
+			num := len(httpData) / 1024
+			for i := 1; i <= num; i++ {
+				i := i
+				wg.Add(1)
+				go func() {
+					testFn(t, proxy, "https", i*1024)
+					defer wg.Done()
+				}()
+			}
+			for i := 1; i <= num; i++ {
+				i := i
+				wg.Add(1)
+				go func() {
+					testFn(t, proxy, "http", i*1024)
+					defer wg.Done()
+				}()
+			}
+			wg.Wait()
+		})
+	}
+
 	tunnel := &TestTunnel{
 		HandleTCPConnFn: func(conn net.Conn, metadata *C.Metadata) {
 			defer conn.Close()
@@ -252,36 +296,11 @@ func NewHttpTestTunnel() *TestTunnel {
 		},
 		CloseFn: ln.Close,
 		DoTestFn: func(t *testing.T, proxy C.ProxyAdapter) {
-
-			// Sequential testing for debugging
-			t.Run("Sequential", func(t *testing.T) {
-				testFn(t, proxy, "http", len(httpData))
-				testFn(t, proxy, "https", len(httpData))
-			})
-
-			// Concurrent testing to detect stress
-			t.Run("Concurrent", func(t *testing.T) {
-				wg := sync.WaitGroup{}
-				num := len(httpData) / 1024
-				for i := 1; i <= num; i++ {
-					i := i
-					wg.Add(1)
-					go func() {
-						testFn(t, proxy, "https", i*1024)
-						defer wg.Done()
-					}()
-				}
-				for i := 1; i <= num; i++ {
-					i := i
-					wg.Add(1)
-					go func() {
-						testFn(t, proxy, "http", i*1024)
-						defer wg.Done()
-					}()
-				}
-				wg.Wait()
-			})
+			sequentialTestFn(t, proxy)
+			concurrentTestFn(t, proxy)
 		},
+		DoSequentialTestFn: sequentialTestFn,
+		DoConcurrentTestFn: concurrentTestFn,
 	}
 	return tunnel
 }
diff --git a/clash-meta/listener/inbound/mieru_test.go b/clash-meta/listener/inbound/mieru_test.go
index d163b49dcc..12aa680ccc 100644
--- a/clash-meta/listener/inbound/mieru_test.go
+++ b/clash-meta/listener/inbound/mieru_test.go
@@ -149,12 +149,18 @@ func TestNewMieru(t *testing.T) {
 }
 
 func TestInboundMieru(t *testing.T) {
-	t.Run("HANDSHAKE_STANDARD", func(t *testing.T) {
+	t.Run("TCP_HANDSHAKE_STANDARD", func(t *testing.T) {
 		testInboundMieruTCP(t, "HANDSHAKE_STANDARD")
 	})
-	t.Run("HANDSHAKE_NO_WAIT", func(t *testing.T) {
+	t.Run("TCP_HANDSHAKE_NO_WAIT", func(t *testing.T) {
 		testInboundMieruTCP(t, "HANDSHAKE_NO_WAIT")
 	})
+	t.Run("UDP_HANDSHAKE_STANDARD", func(t *testing.T) {
+		testInboundMieruUDP(t, "HANDSHAKE_STANDARD")
+	})
+	t.Run("UDP_HANDSHAKE_NO_WAIT", func(t *testing.T) {
+		testInboundMieruUDP(t, "HANDSHAKE_NO_WAIT")
+	})
 }
 
 func testInboundMieruTCP(t *testing.T, handshakeMode string) {
@@ -168,7 +174,7 @@ func testInboundMieruTCP(t *testing.T, handshakeMode string) {
 
 	inboundOptions := inbound.MieruOption{
 		BaseOption: inbound.BaseOption{
-			NameStr: "mieru_inbound",
+			NameStr: "mieru_inbound_tcp",
 			Listen:  "127.0.0.1",
 			Port:    strconv.Itoa(port),
 		},
@@ -194,7 +200,7 @@ func testInboundMieruTCP(t *testing.T, handshakeMode string) {
 		return
 	}
 	outboundOptions := outbound.MieruOption{
-		Name:          "mieru_outbound",
+		Name:          "mieru_outbound_tcp",
 		Server:        addrPort.Addr().String(),
 		Port:          int(addrPort.Port()),
 		Transport:     "TCP",
@@ -210,3 +216,57 @@ func testInboundMieruTCP(t *testing.T, handshakeMode string) {
 
 	tunnel.DoTest(t, out)
 }
+
+func testInboundMieruUDP(t *testing.T, handshakeMode string) {
+	t.Parallel()
+	l, err := net.ListenPacket("udp", "127.0.0.1:0")
+	if !assert.NoError(t, err) {
+		return
+	}
+	port := l.LocalAddr().(*net.UDPAddr).Port
+	l.Close()
+
+	inboundOptions := inbound.MieruOption{
+		BaseOption: inbound.BaseOption{
+			NameStr: "mieru_inbound_udp",
+			Listen:  "127.0.0.1",
+			Port:    strconv.Itoa(port),
+		},
+		Transport: "UDP",
+		Users:     map[string]string{"test": "password"},
+	}
+	in, err := inbound.NewMieru(&inboundOptions)
+	if !assert.NoError(t, err) {
+		return
+	}
+
+	tunnel := NewHttpTestTunnel()
+	defer tunnel.Close()
+
+	err = in.Listen(tunnel)
+	if !assert.NoError(t, err) {
+		return
+	}
+	defer in.Close()
+
+	addrPort, err := netip.ParseAddrPort(in.Address())
+	if !assert.NoError(t, err) {
+		return
+	}
+	outboundOptions := outbound.MieruOption{
+		Name:          "mieru_outbound_udp",
+		Server:        addrPort.Addr().String(),
+		Port:          int(addrPort.Port()),
+		Transport:     "UDP",
+		UserName:      "test",
+		Password:      "password",
+		HandshakeMode: handshakeMode,
+	}
+	out, err := outbound.NewMieru(outboundOptions)
+	if !assert.NoError(t, err) {
+		return
+	}
+	defer out.Close()
+
+	tunnel.DoSequentialTest(t, out)
+}
diff --git a/clash-meta/tunnel/dns_dialer.go b/clash-meta/tunnel/dns_dialer.go
index c141d96648..364cba699d 100644
--- a/clash-meta/tunnel/dns_dialer.go
+++ b/clash-meta/tunnel/dns_dialer.go
@@ -70,7 +70,9 @@ func (d *DNSDialer) DialContext(ctx context.Context, network, addr string) (net.
 		} else {
 			var ok bool
 			proxyAdapter, ok = Proxies()[proxyName]
-			if !ok {
+			if ok {
+				metadata.SpecialProxy = proxyName // just for log
+			} else {
 				opts = append(opts, dialer.WithInterface(proxyName))
 			}
 		}
@@ -158,7 +160,9 @@ func (d *DNSDialer) ListenPacket(ctx context.Context, network, addr string) (net
 		} else {
 			var ok bool
 			proxyAdapter, ok = Proxies()[proxyName]
-			if !ok {
+			if ok {
+				metadata.SpecialProxy = proxyName // just for log
+			} else {
 				opts = append(opts, dialer.WithInterface(proxyName))
 			}
 		}
diff --git a/clash-meta/tunnel/tunnel.go b/clash-meta/tunnel/tunnel.go
index fc901eb354..1b2f41365e 100644
--- a/clash-meta/tunnel/tunnel.go
+++ b/clash-meta/tunnel/tunnel.go
@@ -627,7 +627,7 @@ func logMetadataErr(metadata *C.Metadata, rule C.Rule, proxy C.ProxyAdapter, err
 func logMetadata(metadata *C.Metadata, rule C.Rule, remoteConn C.Connection) {
 	switch {
 	case metadata.SpecialProxy != "":
-		log.Infoln("[%s] %s --> %s using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), metadata.SpecialProxy)
+		log.Infoln("[%s] %s --> %s using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), remoteConn.Chains().String())
 	case rule != nil:
 		if rule.Payload() != "" {
 			log.Infoln("[%s] %s --> %s match %s using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), fmt.Sprintf("%s(%s)", rule.RuleType().String(), rule.Payload()), remoteConn.Chains().String())
@@ -639,7 +639,7 @@ func logMetadata(metadata *C.Metadata, rule C.Rule, remoteConn C.Connection) {
 	case mode == Direct:
 		log.Infoln("[%s] %s --> %s using DIRECT", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress())
 	default:
-		log.Infoln("[%s] %s --> %s doesn't match any rule using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), remoteConn.Chains().Last())
+		log.Infoln("[%s] %s --> %s doesn't match any rule using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), remoteConn.Chains().String())
 	}
 }
 
diff --git a/filebrowser/CHANGELOG.md b/filebrowser/CHANGELOG.md
index 5f7ccd26ae..49f40267a7 100644
--- a/filebrowser/CHANGELOG.md
+++ b/filebrowser/CHANGELOG.md
@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version) for commit guidelines.
 
+## [2.49.0](https://github.com/filebrowser/filebrowser/compare/v2.48.2...v2.49.0) (2025-11-22)
+
+
+### Features
+
+* add "copy download link to clipboard" button to Share prompt ([#5173](https://github.com/filebrowser/filebrowser/issues/5173)) ([d48f566](https://github.com/filebrowser/filebrowser/commit/d48f5665d6975c4cbbdf9be20dc2e0106db02f01))
+* add Bulgarian language ([8db2411](https://github.com/filebrowser/filebrowser/commit/8db2411cd43a23ae3292a817e3524cfdb5ae9b86))
+* Updates for project File Browser ([#5566](https://github.com/filebrowser/filebrowser/issues/5566)) ([54306bd](https://github.com/filebrowser/filebrowser/commit/54306bdc8700fac489326ae81e28ac5db0580d13))
+
+
+### Bug Fixes
+
+* display friendly error message for password validation on signup ([#5563](https://github.com/filebrowser/filebrowser/issues/5563)) ([6d5aa35](https://github.com/filebrowser/filebrowser/commit/6d5aa355e433d613e5a3ae137f410c63baeddf0f))
+
 ## [2.48.2](https://github.com/filebrowser/filebrowser/compare/v2.48.1...v2.48.2) (2025-11-18)
 
 
diff --git a/filebrowser/frontend/pnpm-lock.yaml b/filebrowser/frontend/pnpm-lock.yaml
index f3ebe665ae..8b38a2a40f 100644
--- a/filebrowser/frontend/pnpm-lock.yaml
+++ b/filebrowser/frontend/pnpm-lock.yaml
@@ -82,7 +82,7 @@ importers:
         version: 4.5.5(@vueuse/core@14.0.0(vue@3.5.24(typescript@5.9.3)))(@vueuse/integrations@14.0.0(focus-trap@7.6.2)(jwt-decode@4.0.0)(vue@3.5.24(typescript@5.9.3)))(focus-trap@7.6.2)(vue@3.5.24(typescript@5.9.3))
       vue-i18n:
         specifier: ^11.1.10
-        version: 11.1.12(vue@3.5.24(typescript@5.9.3))
+        version: 11.2.1(vue@3.5.24(typescript@5.9.3))
       vue-lazyload:
         specifier: ^3.0.0
         version: 3.0.0
@@ -98,7 +98,7 @@ importers:
     devDependencies:
       '@intlify/unplugin-vue-i18n':
         specifier: ^11.0.1
-        version: 11.0.1(@vue/compiler-dom@3.5.24)(eslint@9.39.1)(rollup@4.53.3)(typescript@5.9.3)(vue-i18n@11.1.12(vue@3.5.24(typescript@5.9.3)))(vue@3.5.24(typescript@5.9.3))
+        version: 11.0.1(@vue/compiler-dom@3.5.24)(eslint@9.39.1)(rollup@4.53.3)(typescript@5.9.3)(vue-i18n@11.2.1(vue@3.5.24(typescript@5.9.3)))(vue@3.5.24(typescript@5.9.3))
       '@tsconfig/node24':
         specifier: ^24.0.2
         version: 24.0.3
@@ -122,7 +122,7 @@ importers:
         version: 10.2.0(eslint@9.39.1)(prettier@3.6.2)
       '@vue/eslint-config-typescript':
         specifier: ^14.6.0
-        version: 14.6.0(eslint-plugin-vue@10.5.1(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1)))(eslint@9.39.1)(typescript@5.9.3)
+        version: 14.6.0(eslint-plugin-vue@10.6.0(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1)))(eslint@9.39.1)(typescript@5.9.3)
       '@vue/tsconfig':
         specifier: ^0.8.1
         version: 0.8.1(typescript@5.9.3)(vue@3.5.24(typescript@5.9.3))
@@ -140,7 +140,7 @@ importers:
         version: 5.5.4(eslint-config-prettier@10.1.8(eslint@9.39.1))(eslint@9.39.1)(prettier@3.6.2)
       eslint-plugin-vue:
         specifier: ^10.5.1
-        version: 10.5.1(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1))
+        version: 10.6.0(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1))
       postcss:
         specifier: ^8.5.6
         version: 8.5.6
@@ -887,18 +887,22 @@ packages:
       vue-i18n:
         optional: true
 
-  '@intlify/core-base@11.1.12':
-    resolution: {integrity: sha512-whh0trqRsSqVLNEUCwU59pyJZYpU8AmSWl8M3Jz2Mv5ESPP6kFh4juas2NpZ1iCvy7GlNRffUD1xr84gceimjg==}
+  '@intlify/core-base@11.2.1':
+    resolution: {integrity: sha512-2V1A4yaN9ElAnQ6ih3HHEc+jZ+sHV6BlQHjCsnIVlOotL5NCUgJElIxgUFiJs6zV4puoAq3hHuQIfWNp+J+8yQ==}
     engines: {node: '>= 16'}
 
-  '@intlify/message-compiler@11.1.12':
-    resolution: {integrity: sha512-Fv9iQSJoJaXl4ZGkOCN1LDM3trzze0AS2zRz2EHLiwenwL6t0Ki9KySYlyr27yVOj5aVz0e55JePO+kELIvfdQ==}
+  '@intlify/message-compiler@11.2.1':
+    resolution: {integrity: sha512-J2454D3Agg3Kvgaj14gxTleJU8/H06Sisz7C2BwiHF0/i5Soyfb5ySpwn8GCL6yscDbOGj6xM+lUe6gO6BFQyg==}
     engines: {node: '>= 16'}
 
   '@intlify/shared@11.1.12':
     resolution: {integrity: sha512-Om86EjuQtA69hdNj3GQec9ZC0L0vPSAnXzB3gP/gyJ7+mA7t06d9aOAiqMZ+xEOsumGP4eEBlfl8zF2LOTzf2A==}
     engines: {node: '>= 16'}
 
+  '@intlify/shared@11.2.1':
+    resolution: {integrity: sha512-O67LZM4dbfr70WCsZLW+g+pIXdgQ66laLVd/FicW7iYgP/RuH0X1FDGSh+Hr9Gou/8TeldUE6KmTGdLwX2ufIA==}
+    engines: {node: '>= 16'}
+
   '@intlify/unplugin-vue-i18n@11.0.1':
     resolution: {integrity: sha512-nH5NJdNjy/lO6Ne8LDtZzv4SbpVsMhPE+LbvBDmMeIeJDiino8sOJN2QB3MXzTliYTnqe3aB9Fw5+LJ/XVaXCg==}
     engines: {node: '>= 20'}
@@ -1664,8 +1668,8 @@ packages:
       eslint-config-prettier:
         optional: true
 
-  eslint-plugin-vue@10.5.1:
-    resolution: {integrity: sha512-SbR9ZBUFKgvWAbq3RrdCtWaW0IKm6wwUiApxf3BVTNfqUIo4IQQmreMg2iHFJJ6C/0wss3LXURBJ1OwS/MhFcQ==}
+  eslint-plugin-vue@10.6.0:
+    resolution: {integrity: sha512-TsoFluWxOpsJlE/l2jJygLQLWBPJ3Qdkesv7tBIunICbTcG0dS1/NBw/Ol4tJw5kHWlAVds4lUmC29/vlPUcEQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       '@stylistic/eslint-plugin': ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0
@@ -2144,8 +2148,8 @@ packages:
     resolution: {integrity: sha512-afRERtHn54AlwaF2/+LFszyAANTCggGilmcmILUzEjvs3XgFZT+xE6+QWQcAGmu4xajy+Xtj7acLOPdx5/eXWQ==}
     hasBin: true
 
-  postcss-selector-parser@6.1.2:
-    resolution: {integrity: sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==}
+  postcss-selector-parser@7.1.0:
+    resolution: {integrity: sha512-8sLjZwK0R+JlxlYcTuVnyT2v+htpdrjDOKuMcOVdYjt52Lh8hWRYpxBPoKx/Zg+bcjc3wx6fmQevMmUztS/ccA==}
     engines: {node: '>=4'}
 
   postcss-value-parser@4.2.0:
@@ -2492,8 +2496,8 @@ packages:
       focus-trap: '>=7.2.0'
       vue: '>=3.2.0'
 
-  vue-i18n@11.1.12:
-    resolution: {integrity: sha512-BnstPj3KLHLrsqbVU2UOrPmr0+Mv11bsUZG0PyCOzsawCivk8W00GMXHeVUWIDOgNaScCuZah47CZFE+Wnl8mw==}
+  vue-i18n@11.2.1:
+    resolution: {integrity: sha512-cc3Wx4eJZac9WMS8mxhfYiCipm9PBQ2Dz15piWYm7DwNcCehaKRgpolEdiqrjjT27T3Wijz3xJ7NeIc8ofIWAA==}
     engines: {node: '>= 16'}
     peerDependencies:
       vue: ^3.0.0
@@ -3355,9 +3359,9 @@ snapshots:
 
   '@humanwhocodes/retry@0.4.3': {}
 
-  '@intlify/bundle-utils@11.0.1(vue-i18n@11.1.12(vue@3.5.24(typescript@5.9.3)))':
+  '@intlify/bundle-utils@11.0.1(vue-i18n@11.2.1(vue@3.5.24(typescript@5.9.3)))':
     dependencies:
-      '@intlify/message-compiler': 11.1.12
+      '@intlify/message-compiler': 11.2.1
       '@intlify/shared': 11.1.12
       acorn: 8.15.0
       esbuild: 0.25.12
@@ -3367,26 +3371,28 @@ snapshots:
       source-map-js: 1.2.1
       yaml-eslint-parser: 1.2.3
     optionalDependencies:
-      vue-i18n: 11.1.12(vue@3.5.24(typescript@5.9.3))
+      vue-i18n: 11.2.1(vue@3.5.24(typescript@5.9.3))
 
-  '@intlify/core-base@11.1.12':
+  '@intlify/core-base@11.2.1':
     dependencies:
-      '@intlify/message-compiler': 11.1.12
-      '@intlify/shared': 11.1.12
+      '@intlify/message-compiler': 11.2.1
+      '@intlify/shared': 11.2.1
 
-  '@intlify/message-compiler@11.1.12':
+  '@intlify/message-compiler@11.2.1':
     dependencies:
-      '@intlify/shared': 11.1.12
+      '@intlify/shared': 11.2.1
       source-map-js: 1.2.1
 
   '@intlify/shared@11.1.12': {}
 
-  '@intlify/unplugin-vue-i18n@11.0.1(@vue/compiler-dom@3.5.24)(eslint@9.39.1)(rollup@4.53.3)(typescript@5.9.3)(vue-i18n@11.1.12(vue@3.5.24(typescript@5.9.3)))(vue@3.5.24(typescript@5.9.3))':
+  '@intlify/shared@11.2.1': {}
+
+  '@intlify/unplugin-vue-i18n@11.0.1(@vue/compiler-dom@3.5.24)(eslint@9.39.1)(rollup@4.53.3)(typescript@5.9.3)(vue-i18n@11.2.1(vue@3.5.24(typescript@5.9.3)))(vue@3.5.24(typescript@5.9.3))':
     dependencies:
       '@eslint-community/eslint-utils': 4.9.0(eslint@9.39.1)
-      '@intlify/bundle-utils': 11.0.1(vue-i18n@11.1.12(vue@3.5.24(typescript@5.9.3)))
+      '@intlify/bundle-utils': 11.0.1(vue-i18n@11.2.1(vue@3.5.24(typescript@5.9.3)))
       '@intlify/shared': 11.1.12
-      '@intlify/vue-i18n-extensions': 8.0.0(@intlify/shared@11.1.12)(@vue/compiler-dom@3.5.24)(vue-i18n@11.1.12(vue@3.5.24(typescript@5.9.3)))(vue@3.5.24(typescript@5.9.3))
+      '@intlify/vue-i18n-extensions': 8.0.0(@intlify/shared@11.1.12)(@vue/compiler-dom@3.5.24)(vue-i18n@11.2.1(vue@3.5.24(typescript@5.9.3)))(vue@3.5.24(typescript@5.9.3))
       '@rollup/pluginutils': 5.3.0(rollup@4.53.3)
       '@typescript-eslint/scope-manager': 8.46.4
       '@typescript-eslint/typescript-estree': 8.46.4(typescript@5.9.3)
@@ -3397,7 +3403,7 @@ snapshots:
       unplugin: 2.3.10
       vue: 3.5.24(typescript@5.9.3)
     optionalDependencies:
-      vue-i18n: 11.1.12(vue@3.5.24(typescript@5.9.3))
+      vue-i18n: 11.2.1(vue@3.5.24(typescript@5.9.3))
     transitivePeerDependencies:
       - '@vue/compiler-dom'
       - eslint
@@ -3405,14 +3411,14 @@ snapshots:
       - supports-color
       - typescript
 
-  '@intlify/vue-i18n-extensions@8.0.0(@intlify/shared@11.1.12)(@vue/compiler-dom@3.5.24)(vue-i18n@11.1.12(vue@3.5.24(typescript@5.9.3)))(vue@3.5.24(typescript@5.9.3))':
+  '@intlify/vue-i18n-extensions@8.0.0(@intlify/shared@11.1.12)(@vue/compiler-dom@3.5.24)(vue-i18n@11.2.1(vue@3.5.24(typescript@5.9.3)))(vue@3.5.24(typescript@5.9.3))':
     dependencies:
       '@babel/parser': 7.28.5
     optionalDependencies:
       '@intlify/shared': 11.1.12
       '@vue/compiler-dom': 3.5.24
       vue: 3.5.24(typescript@5.9.3)
-      vue-i18n: 11.1.12(vue@3.5.24(typescript@5.9.3))
+      vue-i18n: 11.2.1(vue@3.5.24(typescript@5.9.3))
 
   '@jridgewell/gen-mapping@0.3.13':
     dependencies:
@@ -3886,11 +3892,11 @@ snapshots:
     transitivePeerDependencies:
       - '@types/eslint'
 
-  '@vue/eslint-config-typescript@14.6.0(eslint-plugin-vue@10.5.1(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1)))(eslint@9.39.1)(typescript@5.9.3)':
+  '@vue/eslint-config-typescript@14.6.0(eslint-plugin-vue@10.6.0(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1)))(eslint@9.39.1)(typescript@5.9.3)':
     dependencies:
       '@typescript-eslint/utils': 8.37.0(eslint@9.39.1)(typescript@5.9.3)
       eslint: 9.39.1
-      eslint-plugin-vue: 10.5.1(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1))
+      eslint-plugin-vue: 10.6.0(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1))
       fast-glob: 3.3.3
       typescript-eslint: 8.37.0(eslint@9.39.1)(typescript@5.9.3)
       vue-eslint-parser: 10.2.0(eslint@9.39.1)
@@ -4223,13 +4229,13 @@ snapshots:
     optionalDependencies:
       eslint-config-prettier: 10.1.8(eslint@9.39.1)
 
-  eslint-plugin-vue@10.5.1(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1)):
+  eslint-plugin-vue@10.6.0(@typescript-eslint/parser@8.37.0(eslint@9.39.1)(typescript@5.9.3))(eslint@9.39.1)(vue-eslint-parser@10.2.0(eslint@9.39.1)):
     dependencies:
       '@eslint-community/eslint-utils': 4.9.0(eslint@9.39.1)
       eslint: 9.39.1
       natural-compare: 1.4.0
       nth-check: 2.1.1
-      postcss-selector-parser: 6.1.2
+      postcss-selector-parser: 7.1.0
       semver: 7.7.3
       vue-eslint-parser: 10.2.0(eslint@9.39.1)
       xml-name-validator: 4.0.0
@@ -4673,7 +4679,7 @@ snapshots:
     dependencies:
       '@babel/runtime': 7.28.4
 
-  postcss-selector-parser@6.1.2:
+  postcss-selector-parser@7.1.0:
     dependencies:
       cssesc: 3.0.0
       util-deprecate: 1.0.2
@@ -5015,10 +5021,10 @@ snapshots:
       focus-trap: 7.6.2
       vue: 3.5.24(typescript@5.9.3)
 
-  vue-i18n@11.1.12(vue@3.5.24(typescript@5.9.3)):
+  vue-i18n@11.2.1(vue@3.5.24(typescript@5.9.3)):
     dependencies:
-      '@intlify/core-base': 11.1.12
-      '@intlify/shared': 11.1.12
+      '@intlify/core-base': 11.2.1
+      '@intlify/shared': 11.2.1
       '@vue/devtools-api': 6.6.4
       vue: 3.5.24(typescript@5.9.3)
 
diff --git a/filebrowser/frontend/src/components/prompts/Share.vue b/filebrowser/frontend/src/components/prompts/Share.vue
index 3ce2b1fda1..282902fb68 100644
--- a/filebrowser/frontend/src/components/prompts/Share.vue
+++ b/filebrowser/frontend/src/components/prompts/Share.vue
@@ -12,6 +12,7 @@
             <th>{{ $t("settings.shareDuration") }}</th>
             <th></th>
             <th></th>
+            <th></th>
           </tr>
 
           <tr v-for="link in links" :key="link.hash">
@@ -24,7 +25,7 @@
             </td>
             <td class="small">
               <button
-                class="action copy-clipboard"
+                class="action"
                 :aria-label="$t('buttons.copyToClipboard')"
                 :title="$t('buttons.copyToClipboard')"
                 @click="copyToClipboard(buildLink(link))"
@@ -32,6 +33,17 @@
                 <i class="material-icons">content_paste</i>
               </button>
             </td>
+            <td class="small">
+              <button
+                class="action"
+                :aria-label="$t('buttons.copyDownloadLinkToClipboard')"
+                :title="$t('buttons.copyDownloadLinkToClipboard')"
+                :disabled="!!link.password_hash"
+                @click="copyToClipboard(buildDownloadLink(link))"
+              >
+                <i class="material-icons">content_paste_go</i>
+              </button>
+            </td>
             <td class="small">
               <button
                 class="action"
@@ -132,7 +144,7 @@
 <script>
 import { mapActions, mapState } from "pinia";
 import { useFileStore } from "@/stores/file";
-import { share as api } from "@/api";
+import * as api from "@/api/index";
 import dayjs from "dayjs";
 import { useLayoutStore } from "@/stores/layout";
 import { copy } from "@/utils/clipboard";
@@ -172,7 +184,7 @@ export default {
   },
   async beforeMount() {
     try {
-      const links = await api.get(this.url);
+      const links = await api.share.get(this.url);
       this.links = links;
       this.sort();
 
@@ -211,9 +223,14 @@ export default {
         let res = null;
 
         if (!this.time) {
-          res = await api.create(this.url, this.password);
+          res = await api.share.create(this.url, this.password);
         } else {
-          res = await api.create(this.url, this.password, this.time, this.unit);
+          res = await api.share.create(
+            this.url,
+            this.password,
+            this.time,
+            this.unit
+          );
         }
 
         this.links.push(res);
@@ -231,7 +248,7 @@ export default {
     deleteLink: async function (event, link) {
       event.preventDefault();
       try {
-        await api.remove(link.hash);
+        await api.share.remove(link.hash);
         this.links = this.links.filter((item) => item.hash !== link.hash);
 
         if (this.links.length == 0) {
@@ -245,7 +262,16 @@ export default {
       return dayjs(time * 1000).fromNow();
     },
     buildLink(share) {
-      return api.getShareURL(share);
+      return api.share.getShareURL(share);
+    },
+    buildDownloadLink(share) {
+      return api.pub.getDownloadURL(
+        {
+          hash: share.hash,
+          path: "",
+        },
+        true
+      );
     },
     sort() {
       this.links = this.links.sort((a, b) => {
diff --git a/filebrowser/frontend/src/css/styles.css b/filebrowser/frontend/src/css/styles.css
index 892611666d..5ac7d8d516 100644
--- a/filebrowser/frontend/src/css/styles.css
+++ b/filebrowser/frontend/src/css/styles.css
@@ -98,7 +98,8 @@ main .spinner .bounce2 {
   position: relative;
 }
 
-.action.disabled {
+.action.disabled,
+.action[disabled] {
   opacity: 0.2;
   cursor: not-allowed;
 }
@@ -460,4 +461,4 @@ html[dir="rtl"] .card-content .small + input {
 html[dir="rtl"] .card.floating .card-content .file-list {
   direction: ltr;
   text-align: left;
-}
\ No newline at end of file
+}
diff --git a/filebrowser/frontend/src/i18n/ar.json b/filebrowser/frontend/src/i18n/ar.json
index ebf6a92b33..5e736eaabb 100644
--- a/filebrowser/frontend/src/i18n/ar.json
+++ b/filebrowser/frontend/src/i18n/ar.json
@@ -102,6 +102,7 @@
     "username": "إسم المستخدم",
     "usernameTaken": "إسم المستخدم غير متاح",
     "wrongCredentials": "بيانات دخول خاطئة",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/bg.json b/filebrowser/frontend/src/i18n/bg.json
index 82fa6b1b95..e71fa87b02 100644
--- a/filebrowser/frontend/src/i18n/bg.json
+++ b/filebrowser/frontend/src/i18n/bg.json
@@ -102,6 +102,7 @@
     "username": "Потребителско име",
     "usernameTaken": "Потребителското име вече се използва",
     "wrongCredentials": "Грешни потребителско име и/или парола",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "Бяхте разлогнати поради неактивност"
     }
diff --git a/filebrowser/frontend/src/i18n/ca.json b/filebrowser/frontend/src/i18n/ca.json
index e895ca7870..9c23e6781c 100644
--- a/filebrowser/frontend/src/i18n/ca.json
+++ b/filebrowser/frontend/src/i18n/ca.json
@@ -102,6 +102,7 @@
     "username": "Usuari",
     "usernameTaken": "Nom d'usuari no disponible",
     "wrongCredentials": "Usuari i/o contrasenya incorrectes",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/cs.json b/filebrowser/frontend/src/i18n/cs.json
index 2d84ced712..ba0119fcd6 100644
--- a/filebrowser/frontend/src/i18n/cs.json
+++ b/filebrowser/frontend/src/i18n/cs.json
@@ -102,6 +102,7 @@
     "username": "Uživatelské jméno",
     "usernameTaken": "Uživatelské jméno již existuje",
     "wrongCredentials": "Nesprávné přihlašovací údaje",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/de.json b/filebrowser/frontend/src/i18n/de.json
index 52cd2fc3db..de34b6e210 100644
--- a/filebrowser/frontend/src/i18n/de.json
+++ b/filebrowser/frontend/src/i18n/de.json
@@ -102,6 +102,7 @@
     "username": "Benutzername",
     "usernameTaken": "Benutzername ist bereits vergeben",
     "wrongCredentials": "Falsche Zugangsdaten",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/el.json b/filebrowser/frontend/src/i18n/el.json
index 0d98e90a6c..1826047c9c 100644
--- a/filebrowser/frontend/src/i18n/el.json
+++ b/filebrowser/frontend/src/i18n/el.json
@@ -102,6 +102,7 @@
     "username": "Όνομα χρήστη",
     "usernameTaken": "Το όνομα χρήστη χρησιμοποιείται ήδη",
     "wrongCredentials": "Λάθος όνομα ή/και κωδικός πρόσβασης",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/es.json b/filebrowser/frontend/src/i18n/es.json
index 9d0b0b99e5..2ad3e6fd2b 100644
--- a/filebrowser/frontend/src/i18n/es.json
+++ b/filebrowser/frontend/src/i18n/es.json
@@ -102,6 +102,7 @@
     "username": "Usuario",
     "usernameTaken": "Nombre usuario no disponible",
     "wrongCredentials": "Usuario y/o contraseña incorrectos",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/fa.json b/filebrowser/frontend/src/i18n/fa.json
index f3b5bc174e..db61992483 100644
--- a/filebrowser/frontend/src/i18n/fa.json
+++ b/filebrowser/frontend/src/i18n/fa.json
@@ -102,6 +102,7 @@
     "username": "نام کاربری",
     "usernameTaken": "نام کاربری تکراری",
     "wrongCredentials": "خطا در اعتبارسنجی",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/fr.json b/filebrowser/frontend/src/i18n/fr.json
index 421d4cc45a..b9bba59a7f 100644
--- a/filebrowser/frontend/src/i18n/fr.json
+++ b/filebrowser/frontend/src/i18n/fr.json
@@ -102,6 +102,7 @@
     "username": "Utilisateur·ice",
     "usernameTaken": "Le nom d'utilisateur·ice est déjà pris",
     "wrongCredentials": "Identifiants incorrects !",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/he.json b/filebrowser/frontend/src/i18n/he.json
index d932b0ae61..29bc684226 100644
--- a/filebrowser/frontend/src/i18n/he.json
+++ b/filebrowser/frontend/src/i18n/he.json
@@ -102,6 +102,7 @@
     "username": "שם משתמש",
     "usernameTaken": "שם המשתמש כבר קיים",
     "wrongCredentials": "פרטי התחברות שגויים",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/hr.json b/filebrowser/frontend/src/i18n/hr.json
index 5c241dafe1..04bcfa2ef8 100644
--- a/filebrowser/frontend/src/i18n/hr.json
+++ b/filebrowser/frontend/src/i18n/hr.json
@@ -102,6 +102,7 @@
     "username": "Korisničko ime",
     "usernameTaken": "Korisničko ime zauzeto",
     "wrongCredentials": "Neispravno korisničko ime/lozinka",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "Odjavljeni ste zbog neaktivnosti."
     }
diff --git a/filebrowser/frontend/src/i18n/hu.json b/filebrowser/frontend/src/i18n/hu.json
index 79396c7216..565fb076d4 100644
--- a/filebrowser/frontend/src/i18n/hu.json
+++ b/filebrowser/frontend/src/i18n/hu.json
@@ -102,6 +102,7 @@
     "username": "Felhasználói név",
     "usernameTaken": "A felhasználói név már foglalt",
     "wrongCredentials": "Hibás hitelesítő adatok",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/is.json b/filebrowser/frontend/src/i18n/is.json
index e67a4bab59..ac114dc9c0 100644
--- a/filebrowser/frontend/src/i18n/is.json
+++ b/filebrowser/frontend/src/i18n/is.json
@@ -102,6 +102,7 @@
     "username": "Notendanafn",
     "usernameTaken": "Þetta norendanafn er þegar í notkun",
     "wrongCredentials": "Rangar notendaupplýsingar",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/it.json b/filebrowser/frontend/src/i18n/it.json
index 7e04c40f91..50170b7034 100644
--- a/filebrowser/frontend/src/i18n/it.json
+++ b/filebrowser/frontend/src/i18n/it.json
@@ -102,6 +102,7 @@
     "username": "Nome utente",
     "usernameTaken": "Username già usato",
     "wrongCredentials": "Credenziali errate",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/ja.json b/filebrowser/frontend/src/i18n/ja.json
index bda66d09f1..870d38c722 100644
--- a/filebrowser/frontend/src/i18n/ja.json
+++ b/filebrowser/frontend/src/i18n/ja.json
@@ -102,6 +102,7 @@
     "username": "ユーザー名",
     "usernameTaken": "ユーザー名はすでに取得されています",
     "wrongCredentials": "ユーザー名またはパスワードが間違っています",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/ko.json b/filebrowser/frontend/src/i18n/ko.json
index 498c08122e..cae58cae9b 100644
--- a/filebrowser/frontend/src/i18n/ko.json
+++ b/filebrowser/frontend/src/i18n/ko.json
@@ -102,6 +102,7 @@
     "username": "사용자 이름",
     "usernameTaken": "사용자 이름이 존재합니다",
     "wrongCredentials": "사용자 이름 또는 비밀번호를 확인하십시오",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/nl-be.json b/filebrowser/frontend/src/i18n/nl-be.json
index b587a79b94..83bf3ce045 100644
--- a/filebrowser/frontend/src/i18n/nl-be.json
+++ b/filebrowser/frontend/src/i18n/nl-be.json
@@ -102,6 +102,7 @@
     "username": "Gebruikersnaam",
     "usernameTaken": "Gebruikersnaam reeds in gebruik",
     "wrongCredentials": "Verkeerde inloggegevens",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/no.json b/filebrowser/frontend/src/i18n/no.json
index b7a885ebce..918ef19fc6 100644
--- a/filebrowser/frontend/src/i18n/no.json
+++ b/filebrowser/frontend/src/i18n/no.json
@@ -102,6 +102,7 @@
     "username": "Brukernavn",
     "usernameTaken": "Brukernavn er allerede i bruk",
     "wrongCredentials": "Feil legitimasjon",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "Du har blitt logget ut på grunn av inaktivitet"
     }
diff --git a/filebrowser/frontend/src/i18n/pl.json b/filebrowser/frontend/src/i18n/pl.json
index e34c1c07c1..177909352c 100644
--- a/filebrowser/frontend/src/i18n/pl.json
+++ b/filebrowser/frontend/src/i18n/pl.json
@@ -102,6 +102,7 @@
     "username": "Nazwa użytkownika",
     "usernameTaken": "Ta nazwa użytkownika jest zajęta",
     "wrongCredentials": "Błędne dane logowania",
+    "passwordTooShort": "Wymagana minimalna liczba znaków hasła: {min}",
     "logout_reasons": {
       "inactivity": "Wylogowano z powodu braku aktywności."
     }
diff --git a/filebrowser/frontend/src/i18n/pt-br.json b/filebrowser/frontend/src/i18n/pt-br.json
index 54b8234b2b..f6ef04e62b 100644
--- a/filebrowser/frontend/src/i18n/pt-br.json
+++ b/filebrowser/frontend/src/i18n/pt-br.json
@@ -102,6 +102,7 @@
     "username": "Nome do usuário",
     "usernameTaken": "Nome de usuário já existe",
     "wrongCredentials": "Ops! Dados incorretos.",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/pt.json b/filebrowser/frontend/src/i18n/pt.json
index fb44edbad3..38e5f89b7e 100644
--- a/filebrowser/frontend/src/i18n/pt.json
+++ b/filebrowser/frontend/src/i18n/pt.json
@@ -102,6 +102,7 @@
     "username": "Nome de utilizador",
     "usernameTaken": "O nome de utilizador já está registado",
     "wrongCredentials": "Dados errados",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/ro.json b/filebrowser/frontend/src/i18n/ro.json
index 92c40d200d..a2072b2eb0 100644
--- a/filebrowser/frontend/src/i18n/ro.json
+++ b/filebrowser/frontend/src/i18n/ro.json
@@ -102,6 +102,7 @@
     "username": "Utilizator",
     "usernameTaken": "Utilizatorul există",
     "wrongCredentials": "Informații greșite",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/ru.json b/filebrowser/frontend/src/i18n/ru.json
index b3307f452e..1cadeb3b07 100644
--- a/filebrowser/frontend/src/i18n/ru.json
+++ b/filebrowser/frontend/src/i18n/ru.json
@@ -102,6 +102,7 @@
     "username": "Имя пользователя",
     "usernameTaken": "Данное имя пользователя уже занято",
     "wrongCredentials": "Неверные данные",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/sk.json b/filebrowser/frontend/src/i18n/sk.json
index 95a344861e..9cb1c94115 100644
--- a/filebrowser/frontend/src/i18n/sk.json
+++ b/filebrowser/frontend/src/i18n/sk.json
@@ -102,6 +102,7 @@
     "username": "Používateľské meno",
     "usernameTaken": "Meno je už obsadené",
     "wrongCredentials": "Nesprávne prihlasovacie údaje",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "Boli ste odhlásení z dôvodu nečinnosti."
     }
diff --git a/filebrowser/frontend/src/i18n/sv-se.json b/filebrowser/frontend/src/i18n/sv-se.json
index e4e899110b..4cced166a2 100644
--- a/filebrowser/frontend/src/i18n/sv-se.json
+++ b/filebrowser/frontend/src/i18n/sv-se.json
@@ -102,6 +102,7 @@
     "username": "Användarnamn",
     "usernameTaken": "Användarnamn upptaget",
     "wrongCredentials": "Fel inloggning",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "Du har blivit utloggad på grund av inaktivitet."
     }
diff --git a/filebrowser/frontend/src/i18n/tr.json b/filebrowser/frontend/src/i18n/tr.json
index 6d3fbc5c19..144cf73d29 100644
--- a/filebrowser/frontend/src/i18n/tr.json
+++ b/filebrowser/frontend/src/i18n/tr.json
@@ -102,6 +102,7 @@
     "username": "Kullanıcı adı",
     "usernameTaken": "Kullanıcı adı mevcut",
     "wrongCredentials": "Yanlış hesap bilgileri",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/uk.json b/filebrowser/frontend/src/i18n/uk.json
index 3c78b2288a..465c0364ec 100644
--- a/filebrowser/frontend/src/i18n/uk.json
+++ b/filebrowser/frontend/src/i18n/uk.json
@@ -102,6 +102,7 @@
     "username": "Ім'я користувача",
     "usernameTaken": "Ім'я користувача вже використовується",
     "wrongCredentials": "Неправильне ім'я користувача або пароль",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/vi.json b/filebrowser/frontend/src/i18n/vi.json
index aa2a527913..77e7655ecf 100644
--- a/filebrowser/frontend/src/i18n/vi.json
+++ b/filebrowser/frontend/src/i18n/vi.json
@@ -102,6 +102,7 @@
     "username": "Tên người dùng",
     "usernameTaken": "Tên người dùng đã tồn tại",
     "wrongCredentials": "Thông tin đăng nhập không đúng",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/zh-cn.json b/filebrowser/frontend/src/i18n/zh-cn.json
index def97e9ace..fd927ce327 100644
--- a/filebrowser/frontend/src/i18n/zh-cn.json
+++ b/filebrowser/frontend/src/i18n/zh-cn.json
@@ -102,6 +102,7 @@
     "username": "用户名",
     "usernameTaken": "用户名已经被使用",
     "wrongCredentials": "用户名或密码错误",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/filebrowser/frontend/src/i18n/zh-tw.json b/filebrowser/frontend/src/i18n/zh-tw.json
index 4644ad90c7..3682852288 100644
--- a/filebrowser/frontend/src/i18n/zh-tw.json
+++ b/filebrowser/frontend/src/i18n/zh-tw.json
@@ -102,6 +102,7 @@
     "username": "帳號",
     "usernameTaken": "用戶名已存在",
     "wrongCredentials": "帳號或密碼錯誤",
+    "passwordTooShort": "Password must be at least {min} characters",
     "logout_reasons": {
       "inactivity": "You have been logged out due to inactivity."
     }
diff --git a/mieru/Makefile b/mieru/Makefile
index 11b2ea2e75..af0330b9ef 100644
--- a/mieru/Makefile
+++ b/mieru/Makefile
@@ -32,7 +32,7 @@ PROJECT_NAME=$(shell basename "${ROOT}")
 # - pkg/version/current.go
 #
 # Use `tools/bump_version.sh` script to change all those files at one shot.
-VERSION="3.22.1"
+VERSION="3.23.0"
 
 # With .ONESHELL, each recipe is executed in a single shell instance.
 # This allows `cd` to affect subsequent commands in the same recipe.
diff --git a/mieru/build/package/mieru/amd64/debian/DEBIAN/control b/mieru/build/package/mieru/amd64/debian/DEBIAN/control
index 102fc2a1c7..f0f9760bbe 100755
--- a/mieru/build/package/mieru/amd64/debian/DEBIAN/control
+++ b/mieru/build/package/mieru/amd64/debian/DEBIAN/control
@@ -1,5 +1,5 @@
 Package: mieru
-Version: 3.22.1
+Version: 3.23.0
 Section: net
 Priority: optional
 Architecture: amd64
diff --git a/mieru/build/package/mieru/amd64/rpm/mieru.spec b/mieru/build/package/mieru/amd64/rpm/mieru.spec
index 24931a539a..28a3c3f5dd 100644
--- a/mieru/build/package/mieru/amd64/rpm/mieru.spec
+++ b/mieru/build/package/mieru/amd64/rpm/mieru.spec
@@ -1,5 +1,5 @@
 Name: mieru
-Version: 3.22.1
+Version: 3.23.0
 Release: 1%{?dist}
 Summary: Mieru proxy client
 License: GPLv3+
diff --git a/mieru/build/package/mieru/arm64/debian/DEBIAN/control b/mieru/build/package/mieru/arm64/debian/DEBIAN/control
index d4429c384c..a6d2fb10d6 100755
--- a/mieru/build/package/mieru/arm64/debian/DEBIAN/control
+++ b/mieru/build/package/mieru/arm64/debian/DEBIAN/control
@@ -1,5 +1,5 @@
 Package: mieru
-Version: 3.22.1
+Version: 3.23.0
 Section: net
 Priority: optional
 Architecture: arm64
diff --git a/mieru/build/package/mieru/arm64/rpm/mieru.spec b/mieru/build/package/mieru/arm64/rpm/mieru.spec
index 24931a539a..28a3c3f5dd 100644
--- a/mieru/build/package/mieru/arm64/rpm/mieru.spec
+++ b/mieru/build/package/mieru/arm64/rpm/mieru.spec
@@ -1,5 +1,5 @@
 Name: mieru
-Version: 3.22.1
+Version: 3.23.0
 Release: 1%{?dist}
 Summary: Mieru proxy client
 License: GPLv3+
diff --git a/mieru/build/package/mita/amd64/debian/DEBIAN/control b/mieru/build/package/mita/amd64/debian/DEBIAN/control
index 13365f83d9..f6bc87d34f 100755
--- a/mieru/build/package/mita/amd64/debian/DEBIAN/control
+++ b/mieru/build/package/mita/amd64/debian/DEBIAN/control
@@ -1,5 +1,5 @@
 Package: mita
-Version: 3.22.1
+Version: 3.23.0
 Section: net
 Priority: optional
 Architecture: amd64
diff --git a/mieru/build/package/mita/amd64/rpm/mita.spec b/mieru/build/package/mita/amd64/rpm/mita.spec
index b392fbe939..fd8f4f960b 100644
--- a/mieru/build/package/mita/amd64/rpm/mita.spec
+++ b/mieru/build/package/mita/amd64/rpm/mita.spec
@@ -1,5 +1,5 @@
 Name: mita
-Version: 3.22.1
+Version: 3.23.0
 Release: 1%{?dist}
 Summary: Mieru proxy server
 License: GPLv3+
diff --git a/mieru/build/package/mita/arm64/debian/DEBIAN/control b/mieru/build/package/mita/arm64/debian/DEBIAN/control
index 47b639d69a..3de011dd1f 100755
--- a/mieru/build/package/mita/arm64/debian/DEBIAN/control
+++ b/mieru/build/package/mita/arm64/debian/DEBIAN/control
@@ -1,5 +1,5 @@
 Package: mita
-Version: 3.22.1
+Version: 3.23.0
 Section: net
 Priority: optional
 Architecture: arm64
diff --git a/mieru/build/package/mita/arm64/rpm/mita.spec b/mieru/build/package/mita/arm64/rpm/mita.spec
index 319eb3e38e..ddcec1428b 100644
--- a/mieru/build/package/mita/arm64/rpm/mita.spec
+++ b/mieru/build/package/mita/arm64/rpm/mita.spec
@@ -1,5 +1,5 @@
 Name: mita
-Version: 3.22.1
+Version: 3.23.0
 Release: 1%{?dist}
 Summary: Mieru proxy server
 License: GPLv3+
diff --git a/mieru/docs/server-install.md b/mieru/docs/server-install.md
index 86e69989e6..c274fb82bf 100644
--- a/mieru/docs/server-install.md
+++ b/mieru/docs/server-install.md
@@ -18,32 +18,32 @@ Or you can manually install and configure proxy server using the steps below.
 
 ```sh
 # Debian / Ubuntu - X86_64
-curl -LSO https://github.com/enfein/mieru/releases/download/v3.22.1/mita_3.22.1_amd64.deb
+curl -LSO https://github.com/enfein/mieru/releases/download/v3.23.0/mita_3.23.0_amd64.deb
 
 # Debian / Ubuntu - ARM 64
-curl -LSO https://github.com/enfein/mieru/releases/download/v3.22.1/mita_3.22.1_arm64.deb
+curl -LSO https://github.com/enfein/mieru/releases/download/v3.23.0/mita_3.23.0_arm64.deb
 
 # RedHat / CentOS / Rocky Linux - X86_64
-curl -LSO https://github.com/enfein/mieru/releases/download/v3.22.1/mita-3.22.1-1.x86_64.rpm
+curl -LSO https://github.com/enfein/mieru/releases/download/v3.23.0/mita-3.23.0-1.x86_64.rpm
 
 # RedHat / CentOS / Rocky Linux - ARM 64
-curl -LSO https://github.com/enfein/mieru/releases/download/v3.22.1/mita-3.22.1-1.aarch64.rpm
+curl -LSO https://github.com/enfein/mieru/releases/download/v3.23.0/mita-3.23.0-1.aarch64.rpm
 ```
 
 ## Install mita package
 
 ```sh
 # Debian / Ubuntu - X86_64
-sudo dpkg -i mita_3.22.1_amd64.deb
+sudo dpkg -i mita_3.23.0_amd64.deb
 
 # Debian / Ubuntu - ARM 64
-sudo dpkg -i mita_3.22.1_arm64.deb
+sudo dpkg -i mita_3.23.0_arm64.deb
 
 # RedHat / CentOS / Rocky Linux - X86_64
-sudo rpm -Uvh --force mita-3.22.1-1.x86_64.rpm
+sudo rpm -Uvh --force mita-3.23.0-1.x86_64.rpm
 
 # RedHat / CentOS / Rocky Linux - ARM 64
-sudo rpm -Uvh --force mita-3.22.1-1.aarch64.rpm
+sudo rpm -Uvh --force mita-3.23.0-1.aarch64.rpm
 ```
 
 Those instructions can also be used to upgrade the version of mita software package.
diff --git a/mieru/docs/server-install.zh_CN.md b/mieru/docs/server-install.zh_CN.md
index aedaffc684..5311ecb6d0 100644
--- a/mieru/docs/server-install.zh_CN.md
+++ b/mieru/docs/server-install.zh_CN.md
@@ -18,32 +18,32 @@ sudo python3 setup.py --lang=zh
 
 ```sh
 # Debian / Ubuntu - X86_64
-curl -LSO https://github.com/enfein/mieru/releases/download/v3.22.1/mita_3.22.1_amd64.deb
+curl -LSO https://github.com/enfein/mieru/releases/download/v3.23.0/mita_3.23.0_amd64.deb
 
 # Debian / Ubuntu - ARM 64
-curl -LSO https://github.com/enfein/mieru/releases/download/v3.22.1/mita_3.22.1_arm64.deb
+curl -LSO https://github.com/enfein/mieru/releases/download/v3.23.0/mita_3.23.0_arm64.deb
 
 # RedHat / CentOS / Rocky Linux - X86_64
-curl -LSO https://github.com/enfein/mieru/releases/download/v3.22.1/mita-3.22.1-1.x86_64.rpm
+curl -LSO https://github.com/enfein/mieru/releases/download/v3.23.0/mita-3.23.0-1.x86_64.rpm
 
 # RedHat / CentOS / Rocky Linux - ARM 64
-curl -LSO https://github.com/enfein/mieru/releases/download/v3.22.1/mita-3.22.1-1.aarch64.rpm
+curl -LSO https://github.com/enfein/mieru/releases/download/v3.23.0/mita-3.23.0-1.aarch64.rpm
 ```
 
 ## 安装 mita 软件包
 
 ```sh
 # Debian / Ubuntu - X86_64
-sudo dpkg -i mita_3.22.1_amd64.deb
+sudo dpkg -i mita_3.23.0_amd64.deb
 
 # Debian / Ubuntu - ARM 64
-sudo dpkg -i mita_3.22.1_arm64.deb
+sudo dpkg -i mita_3.23.0_arm64.deb
 
 # RedHat / CentOS / Rocky Linux - X86_64
-sudo rpm -Uvh --force mita-3.22.1-1.x86_64.rpm
+sudo rpm -Uvh --force mita-3.23.0-1.x86_64.rpm
 
 # RedHat / CentOS / Rocky Linux - ARM 64
-sudo rpm -Uvh --force mita-3.22.1-1.aarch64.rpm
+sudo rpm -Uvh --force mita-3.23.0-1.aarch64.rpm
 ```
 
 上述指令也可以用来升级 mita 软件包的版本。
diff --git a/mieru/pkg/version/current.go b/mieru/pkg/version/current.go
index c159b4402a..81b40a896b 100644
--- a/mieru/pkg/version/current.go
+++ b/mieru/pkg/version/current.go
@@ -16,5 +16,5 @@
 package version
 
 const (
-	AppVersion = "3.22.1"
+	AppVersion = "3.23.0"
 )
diff --git a/mihomo/adapter/outbound/mieru.go b/mihomo/adapter/outbound/mieru.go
index 8ef9cfd758..d9feeba08f 100644
--- a/mihomo/adapter/outbound/mieru.go
+++ b/mihomo/adapter/outbound/mieru.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"net/netip"
 	"strconv"
 	"sync"
 
@@ -40,6 +41,20 @@ type MieruOption struct {
 	HandshakeMode string `proxy:"handshake-mode,omitempty"`
 }
 
+type mieruPacketDialer struct {
+	C.Dialer
+}
+
+var _ mierucommon.PacketDialer = (*mieruPacketDialer)(nil)
+
+func (pd mieruPacketDialer) ListenPacket(ctx context.Context, network, laddr, raddr string) (net.PacketConn, error) {
+	rAddrPort, err := netip.ParseAddrPort(raddr)
+	if err != nil {
+		return nil, fmt.Errorf("invalid address %s: %w", raddr, err)
+	}
+	return pd.Dialer.ListenPacket(ctx, network, laddr, rAddrPort)
+}
+
 // DialContext implements C.ProxyAdapter
 func (m *Mieru) DialContext(ctx context.Context, metadata *C.Metadata) (C.Conn, error) {
 	if err := m.ensureClientIsRunning(); err != nil {
@@ -102,6 +117,7 @@ func (m *Mieru) ensureClientIsRunning() error {
 		return err
 	}
 	config.Dialer = dialer
+	config.PacketDialer = mieruPacketDialer{Dialer: dialer}
 	if err := m.client.Store(config); err != nil {
 		return err
 	}
@@ -158,23 +174,21 @@ func (m *Mieru) Close() error {
 }
 
 func metadataToMieruNetAddrSpec(metadata *C.Metadata) mierumodel.NetAddrSpec {
+	spec := mierumodel.NetAddrSpec{
+		Net: metadata.NetWork.String(),
+	}
 	if metadata.Host != "" {
-		return mierumodel.NetAddrSpec{
-			AddrSpec: mierumodel.AddrSpec{
-				FQDN: metadata.Host,
-				Port: int(metadata.DstPort),
-			},
-			Net: "tcp",
+		spec.AddrSpec = mierumodel.AddrSpec{
+			FQDN: metadata.Host,
+			Port: int(metadata.DstPort),
 		}
 	} else {
-		return mierumodel.NetAddrSpec{
-			AddrSpec: mierumodel.AddrSpec{
-				IP:   metadata.DstIP.AsSlice(),
-				Port: int(metadata.DstPort),
-			},
-			Net: "tcp",
+		spec.AddrSpec = mierumodel.AddrSpec{
+			IP:   metadata.DstIP.AsSlice(),
+			Port: int(metadata.DstPort),
 		}
 	}
+	return spec
 }
 
 func buildMieruClientConfig(option MieruOption) (*mieruclient.ClientConfig, error) {
@@ -182,7 +196,13 @@ func buildMieruClientConfig(option MieruOption) (*mieruclient.ClientConfig, erro
 		return nil, fmt.Errorf("failed to validate mieru option: %w", err)
 	}
 
-	transportProtocol := mierupb.TransportProtocol_TCP.Enum()
+	var transportProtocol = mierupb.TransportProtocol_UNKNOWN_TRANSPORT_PROTOCOL.Enum()
+	switch option.Transport {
+	case "TCP":
+		transportProtocol = mierupb.TransportProtocol_TCP.Enum()
+	case "UDP":
+		transportProtocol = mierupb.TransportProtocol_UDP.Enum()
+	}
 	var server *mierupb.ServerEndpoint
 	if net.ParseIP(option.Server) != nil {
 		// server is an IP address
@@ -284,8 +304,8 @@ func validateMieruOption(option MieruOption) error {
 		}
 	}
 
-	if option.Transport != "TCP" {
-		return fmt.Errorf("transport must be TCP")
+	if option.Transport != "TCP" && option.Transport != "UDP" {
+		return fmt.Errorf("transport must be TCP or UDP")
 	}
 	if option.UserName == "" {
 		return fmt.Errorf("username is empty")
diff --git a/mihomo/adapter/outbound/mieru_test.go b/mihomo/adapter/outbound/mieru_test.go
index 086b791044..d80b27696c 100644
--- a/mihomo/adapter/outbound/mieru_test.go
+++ b/mihomo/adapter/outbound/mieru_test.go
@@ -34,7 +34,7 @@ func TestNewMieru(t *testing.T) {
 				Name:      "test",
 				Server:    "example.com",
 				Port:      10003,
-				Transport: "TCP",
+				Transport: "UDP",
 				UserName:  "test",
 				Password:  "test",
 			},
diff --git a/mihomo/docs/config.yaml b/mihomo/docs/config.yaml
index e71b06f482..8a5ec1f7d3 100644
--- a/mihomo/docs/config.yaml
+++ b/mihomo/docs/config.yaml
@@ -1027,7 +1027,7 @@ proxies: # socks5
     server: 1.2.3.4
     port: 2999
     # port-range: 2090-2099 #（不可同时填写 port 和 port-range）
-    transport: TCP # 只支持 TCP
+    transport: TCP # 支持 TCP 或者 UDP
     udp: true # 支持 UDP over TCP
     username: user
     password: password
diff --git a/mihomo/go.mod b/mihomo/go.mod
index 90362be0c6..2047d0eb11 100644
--- a/mihomo/go.mod
+++ b/mihomo/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/bahlo/generic-list-go v0.2.0
 	github.com/coreos/go-iptables v0.8.0
 	github.com/dlclark/regexp2 v1.11.5
-	github.com/enfein/mieru/v3 v3.22.1
+	github.com/enfein/mieru/v3 v3.23.0
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/render v1.0.3
 	github.com/gobwas/ws v1.4.0
diff --git a/mihomo/go.sum b/mihomo/go.sum
index 0bec36121a..bc29d7fef7 100644
--- a/mihomo/go.sum
+++ b/mihomo/go.sum
@@ -23,8 +23,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/enfein/mieru/v3 v3.22.1 h1:/XGYYXpEhEJlxosmtbpEJkhtRLHB8IToG7LB8kU2ZDY=
-github.com/enfein/mieru/v3 v3.22.1/go.mod h1:zJBUCsi5rxyvHM8fjFf+GLaEl4OEjjBXr1s5F6Qd3hM=
+github.com/enfein/mieru/v3 v3.23.0 h1:f/dd3UAoi36FD9DZ9x49t6Ps0oHeSjrVSgWzvEstn0E=
+github.com/enfein/mieru/v3 v3.23.0/go.mod h1:zJBUCsi5rxyvHM8fjFf+GLaEl4OEjjBXr1s5F6Qd3hM=
 github.com/ericlagergren/aegis v0.0.0-20250325060835-cd0defd64358 h1:kXYqH/sL8dS/FdoFjr12ePjnLPorPo2FsnrHNuXSDyo=
 github.com/ericlagergren/aegis v0.0.0-20250325060835-cd0defd64358/go.mod h1:hkIFzoiIPZYxdFOOLyDho59b7SrDfo+w3h+yWdlg45I=
 github.com/ericlagergren/polyval v0.0.0-20220411101811-e25bc10ba391 h1:8j2RH289RJplhA6WfdaPqzg1MjH2K8wX5e0uhAxrw2g=
diff --git a/mihomo/listener/inbound/common_test.go b/mihomo/listener/inbound/common_test.go
index 72874c7b54..4178035b27 100644
--- a/mihomo/listener/inbound/common_test.go
+++ b/mihomo/listener/inbound/common_test.go
@@ -59,11 +59,13 @@ func init() {
 }
 
 type TestTunnel struct {
-	HandleTCPConnFn   func(conn net.Conn, metadata *C.Metadata)
-	HandleUDPPacketFn func(packet C.UDPPacket, metadata *C.Metadata)
-	NatTableFn        func() C.NatTable
-	CloseFn           func() error
-	DoTestFn          func(t *testing.T, proxy C.ProxyAdapter)
+	HandleTCPConnFn    func(conn net.Conn, metadata *C.Metadata)
+	HandleUDPPacketFn  func(packet C.UDPPacket, metadata *C.Metadata)
+	NatTableFn         func() C.NatTable
+	CloseFn            func() error
+	DoTestFn           func(t *testing.T, proxy C.ProxyAdapter)
+	DoSequentialTestFn func(t *testing.T, proxy C.ProxyAdapter)
+	DoConcurrentTestFn func(t *testing.T, proxy C.ProxyAdapter)
 }
 
 func (tt *TestTunnel) HandleTCPConn(conn net.Conn, metadata *C.Metadata) {
@@ -86,6 +88,14 @@ func (tt *TestTunnel) DoTest(t *testing.T, proxy C.ProxyAdapter) {
 	tt.DoTestFn(t, proxy)
 }
 
+func (tt *TestTunnel) DoSequentialTest(t *testing.T, proxy C.ProxyAdapter) {
+	tt.DoSequentialTestFn(t, proxy)
+}
+
+func (tt *TestTunnel) DoConcurrentTest(t *testing.T, proxy C.ProxyAdapter) {
+	tt.DoConcurrentTestFn(t, proxy)
+}
+
 type TestTunnelListener struct {
 	ch     chan net.Conn
 	ctx    context.Context
@@ -213,6 +223,40 @@ func NewHttpTestTunnel() *TestTunnel {
 		}
 		assert.Equal(t, httpData[:size], data)
 	}
+
+	sequentialTestFn := func(t *testing.T, proxy C.ProxyAdapter) {
+		// Sequential testing for debugging
+		t.Run("Sequential", func(t *testing.T) {
+			testFn(t, proxy, "http", len(httpData))
+			testFn(t, proxy, "https", len(httpData))
+		})
+	}
+
+	concurrentTestFn := func(t *testing.T, proxy C.ProxyAdapter) {
+		// Concurrent testing to detect stress
+		t.Run("Concurrent", func(t *testing.T) {
+			wg := sync.WaitGroup{}
+			num := len(httpData) / 1024
+			for i := 1; i <= num; i++ {
+				i := i
+				wg.Add(1)
+				go func() {
+					testFn(t, proxy, "https", i*1024)
+					defer wg.Done()
+				}()
+			}
+			for i := 1; i <= num; i++ {
+				i := i
+				wg.Add(1)
+				go func() {
+					testFn(t, proxy, "http", i*1024)
+					defer wg.Done()
+				}()
+			}
+			wg.Wait()
+		})
+	}
+
 	tunnel := &TestTunnel{
 		HandleTCPConnFn: func(conn net.Conn, metadata *C.Metadata) {
 			defer conn.Close()
@@ -252,36 +296,11 @@ func NewHttpTestTunnel() *TestTunnel {
 		},
 		CloseFn: ln.Close,
 		DoTestFn: func(t *testing.T, proxy C.ProxyAdapter) {
-
-			// Sequential testing for debugging
-			t.Run("Sequential", func(t *testing.T) {
-				testFn(t, proxy, "http", len(httpData))
-				testFn(t, proxy, "https", len(httpData))
-			})
-
-			// Concurrent testing to detect stress
-			t.Run("Concurrent", func(t *testing.T) {
-				wg := sync.WaitGroup{}
-				num := len(httpData) / 1024
-				for i := 1; i <= num; i++ {
-					i := i
-					wg.Add(1)
-					go func() {
-						testFn(t, proxy, "https", i*1024)
-						defer wg.Done()
-					}()
-				}
-				for i := 1; i <= num; i++ {
-					i := i
-					wg.Add(1)
-					go func() {
-						testFn(t, proxy, "http", i*1024)
-						defer wg.Done()
-					}()
-				}
-				wg.Wait()
-			})
+			sequentialTestFn(t, proxy)
+			concurrentTestFn(t, proxy)
 		},
+		DoSequentialTestFn: sequentialTestFn,
+		DoConcurrentTestFn: concurrentTestFn,
 	}
 	return tunnel
 }
diff --git a/mihomo/listener/inbound/mieru_test.go b/mihomo/listener/inbound/mieru_test.go
index d163b49dcc..12aa680ccc 100644
--- a/mihomo/listener/inbound/mieru_test.go
+++ b/mihomo/listener/inbound/mieru_test.go
@@ -149,12 +149,18 @@ func TestNewMieru(t *testing.T) {
 }
 
 func TestInboundMieru(t *testing.T) {
-	t.Run("HANDSHAKE_STANDARD", func(t *testing.T) {
+	t.Run("TCP_HANDSHAKE_STANDARD", func(t *testing.T) {
 		testInboundMieruTCP(t, "HANDSHAKE_STANDARD")
 	})
-	t.Run("HANDSHAKE_NO_WAIT", func(t *testing.T) {
+	t.Run("TCP_HANDSHAKE_NO_WAIT", func(t *testing.T) {
 		testInboundMieruTCP(t, "HANDSHAKE_NO_WAIT")
 	})
+	t.Run("UDP_HANDSHAKE_STANDARD", func(t *testing.T) {
+		testInboundMieruUDP(t, "HANDSHAKE_STANDARD")
+	})
+	t.Run("UDP_HANDSHAKE_NO_WAIT", func(t *testing.T) {
+		testInboundMieruUDP(t, "HANDSHAKE_NO_WAIT")
+	})
 }
 
 func testInboundMieruTCP(t *testing.T, handshakeMode string) {
@@ -168,7 +174,7 @@ func testInboundMieruTCP(t *testing.T, handshakeMode string) {
 
 	inboundOptions := inbound.MieruOption{
 		BaseOption: inbound.BaseOption{
-			NameStr: "mieru_inbound",
+			NameStr: "mieru_inbound_tcp",
 			Listen:  "127.0.0.1",
 			Port:    strconv.Itoa(port),
 		},
@@ -194,7 +200,7 @@ func testInboundMieruTCP(t *testing.T, handshakeMode string) {
 		return
 	}
 	outboundOptions := outbound.MieruOption{
-		Name:          "mieru_outbound",
+		Name:          "mieru_outbound_tcp",
 		Server:        addrPort.Addr().String(),
 		Port:          int(addrPort.Port()),
 		Transport:     "TCP",
@@ -210,3 +216,57 @@ func testInboundMieruTCP(t *testing.T, handshakeMode string) {
 
 	tunnel.DoTest(t, out)
 }
+
+func testInboundMieruUDP(t *testing.T, handshakeMode string) {
+	t.Parallel()
+	l, err := net.ListenPacket("udp", "127.0.0.1:0")
+	if !assert.NoError(t, err) {
+		return
+	}
+	port := l.LocalAddr().(*net.UDPAddr).Port
+	l.Close()
+
+	inboundOptions := inbound.MieruOption{
+		BaseOption: inbound.BaseOption{
+			NameStr: "mieru_inbound_udp",
+			Listen:  "127.0.0.1",
+			Port:    strconv.Itoa(port),
+		},
+		Transport: "UDP",
+		Users:     map[string]string{"test": "password"},
+	}
+	in, err := inbound.NewMieru(&inboundOptions)
+	if !assert.NoError(t, err) {
+		return
+	}
+
+	tunnel := NewHttpTestTunnel()
+	defer tunnel.Close()
+
+	err = in.Listen(tunnel)
+	if !assert.NoError(t, err) {
+		return
+	}
+	defer in.Close()
+
+	addrPort, err := netip.ParseAddrPort(in.Address())
+	if !assert.NoError(t, err) {
+		return
+	}
+	outboundOptions := outbound.MieruOption{
+		Name:          "mieru_outbound_udp",
+		Server:        addrPort.Addr().String(),
+		Port:          int(addrPort.Port()),
+		Transport:     "UDP",
+		UserName:      "test",
+		Password:      "password",
+		HandshakeMode: handshakeMode,
+	}
+	out, err := outbound.NewMieru(outboundOptions)
+	if !assert.NoError(t, err) {
+		return
+	}
+	defer out.Close()
+
+	tunnel.DoSequentialTest(t, out)
+}
diff --git a/mihomo/tunnel/dns_dialer.go b/mihomo/tunnel/dns_dialer.go
index c141d96648..364cba699d 100644
--- a/mihomo/tunnel/dns_dialer.go
+++ b/mihomo/tunnel/dns_dialer.go
@@ -70,7 +70,9 @@ func (d *DNSDialer) DialContext(ctx context.Context, network, addr string) (net.
 		} else {
 			var ok bool
 			proxyAdapter, ok = Proxies()[proxyName]
-			if !ok {
+			if ok {
+				metadata.SpecialProxy = proxyName // just for log
+			} else {
 				opts = append(opts, dialer.WithInterface(proxyName))
 			}
 		}
@@ -158,7 +160,9 @@ func (d *DNSDialer) ListenPacket(ctx context.Context, network, addr string) (net
 		} else {
 			var ok bool
 			proxyAdapter, ok = Proxies()[proxyName]
-			if !ok {
+			if ok {
+				metadata.SpecialProxy = proxyName // just for log
+			} else {
 				opts = append(opts, dialer.WithInterface(proxyName))
 			}
 		}
diff --git a/mihomo/tunnel/tunnel.go b/mihomo/tunnel/tunnel.go
index fc901eb354..1b2f41365e 100644
--- a/mihomo/tunnel/tunnel.go
+++ b/mihomo/tunnel/tunnel.go
@@ -627,7 +627,7 @@ func logMetadataErr(metadata *C.Metadata, rule C.Rule, proxy C.ProxyAdapter, err
 func logMetadata(metadata *C.Metadata, rule C.Rule, remoteConn C.Connection) {
 	switch {
 	case metadata.SpecialProxy != "":
-		log.Infoln("[%s] %s --> %s using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), metadata.SpecialProxy)
+		log.Infoln("[%s] %s --> %s using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), remoteConn.Chains().String())
 	case rule != nil:
 		if rule.Payload() != "" {
 			log.Infoln("[%s] %s --> %s match %s using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), fmt.Sprintf("%s(%s)", rule.RuleType().String(), rule.Payload()), remoteConn.Chains().String())
@@ -639,7 +639,7 @@ func logMetadata(metadata *C.Metadata, rule C.Rule, remoteConn C.Connection) {
 	case mode == Direct:
 		log.Infoln("[%s] %s --> %s using DIRECT", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress())
 	default:
-		log.Infoln("[%s] %s --> %s doesn't match any rule using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), remoteConn.Chains().Last())
+		log.Infoln("[%s] %s --> %s doesn't match any rule using %s", strings.ToUpper(metadata.NetWork.String()), metadata.SourceDetail(), metadata.RemoteAddress(), remoteConn.Chains().String())
 	}
 }
 
diff --git a/openwrt-packages/gost/Makefile b/openwrt-packages/gost/Makefile
index 82f9e0b39d..3ef8e0738b 100644
--- a/openwrt-packages/gost/Makefile
+++ b/openwrt-packages/gost/Makefile
@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gost
-PKG_VERSION:=3.2.5
+PKG_VERSION:=3.2.6
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/go-gost/gost/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=fb9840530ded8067622f3c91365300f02b1feccdb7a873e6397eb12d6ed6e01f
+PKG_HASH:=79874354530b899576dd4866d3b1400651d0b17c1e7a90ad30c44686a0642600
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
diff --git a/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/rule.lua b/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/rule.lua
index 4d91ee4e74..3cc0ca8199 100644
--- a/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/rule.lua
+++ b/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/rule.lua
@@ -18,52 +18,52 @@ o.rmempty = false
 ---- gfwlist URL
 o = s:option(DynamicList, "gfwlist_url", translate("GFW domains(gfwlist) Update URL"))
 o:depends("geo2rule", false)
-o:value("https://fastly.jsdelivr.net/gh/YW5vbnltb3Vz/domain-list-community@release/gfwlist.txt", translate("v2fly/domain-list-community"))
-o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt", translate("Loyalsoldier/v2ray-rules-dat"))
-o:value("https://fastly.jsdelivr.net/gh/Loukky/gfwlist-by-loukky/gfwlist.txt", translate("Loukky/gfwlist-by-loukky"))
-o:value("https://fastly.jsdelivr.net/gh/gfwlist/gfwlist/gfwlist.txt", translate("gfwlist/gfwlist"))
-o.default = "https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt"
+o:value("https://cdn.jsdelivr.net/gh/YW5vbnltb3Vz/domain-list-community@release/gfwlist.txt", translate("v2fly/domain-list-community"))
+o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt", translate("Loyalsoldier/v2ray-rules-dat"))
+o:value("https://cdn.jsdelivr.net/gh/Loukky/gfwlist-by-loukky/gfwlist.txt", translate("Loukky/gfwlist-by-loukky"))
+o:value("https://cdn.jsdelivr.net/gh/gfwlist/gfwlist/gfwlist.txt", translate("gfwlist/gfwlist"))
+o.default = "https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt"
 
 ----chnroute  URL
 o = s:option(DynamicList, "chnroute_url", translate("China IPs(chnroute) Update URL"))
 o:depends("geo2rule", false)
-o:value("https://fastly.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china.txt", translate("gaoyifan/china-operator-ip/china"))
+o:value("https://cdn.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china.txt", translate("gaoyifan/china-operator-ip/china"))
 o:value("https://ispip.clang.cn/all_cn.txt", translate("Clang.CN"))
-o:value("https://fastly.jsdelivr.net/gh/soffchen/GeoIP2-CN@release/CN-ip-cidr.txt", translate("soffchen/GeoIP2-CN"))
-o:value("https://fastly.jsdelivr.net/gh/Hackl0us/GeoIP2-CN@release/CN-ip-cidr.txt", translate("Hackl0us/GeoIP2-CN"))
-o:value("https://fastly.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_IP_No_IPv6.txt", translate("ios_rule_script/ChinaMax_IP_No_IPv6"))
+o:value("https://cdn.jsdelivr.net/gh/soffchen/GeoIP2-CN@release/CN-ip-cidr.txt", translate("soffchen/GeoIP2-CN"))
+o:value("https://cdn.jsdelivr.net/gh/Hackl0us/GeoIP2-CN@release/CN-ip-cidr.txt", translate("Hackl0us/GeoIP2-CN"))
+o:value("https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_IP_No_IPv6.txt", translate("ios_rule_script/ChinaMax_IP_No_IPv6"))
 
 ----chnroute6 URL
 o = s:option(DynamicList, "chnroute6_url", translate("China IPv6s(chnroute6) Update URL"))
 o:depends("geo2rule", false)
-o:value("https://fastly.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china6.txt", translate("gaoyifan/china-operator-ip/china6"))
+o:value("https://cdn.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china6.txt", translate("gaoyifan/china-operator-ip/china6"))
 o:value("https://ispip.clang.cn/all_cn_ipv6.txt", translate("Clang.CN.IPv6"))
-o:value("https://fastly.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_IP.txt", translate("ios_rule_script/ChinaMax_IP"))
+o:value("https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_IP.txt", translate("ios_rule_script/ChinaMax_IP"))
 
 ----chnlist URL
 o = s:option(DynamicList, "chnlist_url", translate("China List(Chnlist) Update URL"))
 o:depends("geo2rule", false)
-o:value("https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/accelerated-domains.china.conf", translate("felixonmars/domains.china"))
-o:value("https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/apple.china.conf", translate("felixonmars/apple.china"))
-o:value("https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/google.china.conf", translate("felixonmars/google.china"))
-o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/china-list.txt", translate("Loyalsoldier/china-list"))
-o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/apple-cn.txt", translate("Loyalsoldier/apple-cn"))
-o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/google-cn.txt", translate("Loyalsoldier/google-cn"))
-o:value("https://fastly.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_Domain.txt", translate("ios_rule_script/ChinaMax_Domain"))
+o:value("https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/accelerated-domains.china.conf", translate("felixonmars/domains.china"))
+o:value("https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/apple.china.conf", translate("felixonmars/apple.china"))
+o:value("https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/google.china.conf", translate("felixonmars/google.china"))
+o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/china-list.txt", translate("Loyalsoldier/china-list"))
+o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/apple-cn.txt", translate("Loyalsoldier/apple-cn"))
+o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/google-cn.txt", translate("Loyalsoldier/google-cn"))
+o:value("https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_Domain.txt", translate("ios_rule_script/ChinaMax_Domain"))
 
 if has_xray or has_singbox then
 	o = s:option(ListValue, "geoip_url", translate("GeoIP Update URL"))
 	o:value("https://github.com/Loyalsoldier/geoip/releases/latest/download/geoip.dat", translate("Loyalsoldier/geoip"))
 	o:value("https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.dat", translate("MetaCubeX/geoip"))
-	o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/geoip@release/geoip.dat", translate("Loyalsoldier/geoip (CDN)"))
-	o:value("https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat", translate("MetaCubeX/geoip (CDN)"))
+	o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/geoip@release/geoip.dat", translate("Loyalsoldier/geoip (CDN)"))
+	o:value("https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat", translate("MetaCubeX/geoip (CDN)"))
 	o.default = "https://github.com/Loyalsoldier/geoip/releases/latest/download/geoip.dat"
 
 	o = s:option(ListValue, "geosite_url", translate("Geosite Update URL"))
 	o:value("https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geosite.dat", translate("Loyalsoldier/geosite"))
 	o:value("https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geosite.dat", translate("MetaCubeX/geosite"))
-	o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat", translate("Loyalsoldier/geosite (CDN)"))
-	o:value("https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat", translate("MetaCubeX/geosite (CDN)"))
+	o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat", translate("Loyalsoldier/geosite (CDN)"))
+	o:value("https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat", translate("MetaCubeX/geosite (CDN)"))
 	o.default = "https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geosite.dat"
 
 	o = s:option(Value, "v2ray_location_asset", translate("Location of Geo rule files"), translate("This variable specifies a directory where geoip.dat and geosite.dat files are."))
diff --git a/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/0_default_config b/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/0_default_config
index 6ca00d0e83..f7304428f1 100644
--- a/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/0_default_config
+++ b/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/0_default_config
@@ -64,13 +64,13 @@ config global_rules
 	option gfwlist_update '1'
 	option geosite_update '0'
 	option geoip_update '0'
-	list gfwlist_url 'https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt'
+	list gfwlist_url 'https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt'
 	list chnroute_url 'https://ispip.clang.cn/all_cn.txt'
-	list chnroute_url 'https://fastly.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china.txt'
+	list chnroute_url 'https://cdn.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china.txt'
 	list chnroute6_url 'https://ispip.clang.cn/all_cn_ipv6.txt'
-	list chnroute6_url 'https://fastly.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china6.txt'
-	list chnlist_url 'https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/accelerated-domains.china.conf'
-	list chnlist_url 'https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/apple.china.conf'
+	list chnroute6_url 'https://cdn.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china6.txt'
+	list chnlist_url 'https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/accelerated-domains.china.conf'
+	list chnlist_url 'https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/apple.china.conf'
 	option v2ray_location_asset '/usr/share/v2ray/'
 	option geoip_url 'https://github.com/Loyalsoldier/geoip/releases/latest/download/geoip.dat'
 	option geosite_url 'https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geosite.dat'
diff --git a/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua b/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua
index b41c6928f1..24a49313c9 100644
--- a/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua
+++ b/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua
@@ -121,7 +121,8 @@ else
 		{key = "response_mode", config_key = "response-mode", prefix = "-r ", default = "first-ping"},
 		{key = "rr_ttl", config_key = "rr-ttl", prefix = "-rr-ttl "},
 		{key = "rr_ttl_min", config_key = "rr-ttl-min", prefix = "-rr-ttl-min "},
-		{key = "rr_ttl_max", config_key = "rr-ttl-max", prefix = "-rr-ttl-max "}
+		{key = "rr_ttl_max", config_key = "rr-ttl-max", prefix = "-rr-ttl-max "},
+		{key = "rr_ttl_reply_max", config_key = "rr-ttl-reply-max", prefix = "-rr-ttl-reply-max "}
 	}
 	-- 从 custom.conf 中读取值，以最后出现的值为准
 	local custom_config = {}
diff --git a/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/rule_update.lua b/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/rule_update.lua
index 286b8aa1a5..923a5dbe95 100755
--- a/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/rule_update.lua
+++ b/openwrt-passwall/luci-app-passwall/root/usr/share/passwall/rule_update.lua
@@ -21,12 +21,6 @@ local chnlist_update = "0"
 local geoip_update = "0"
 local geosite_update = "0"
 
--- match comments/title/whitelist/ip address/excluded_domain
-local comment_pattern = "^[#!\\[@]+"
-local ip_pattern = "^%d+%.%d+%.%d+%.%d+"
-local ip4_ipset_pattern = "^%d+%.%d+%.%d+%.%d+[%/][%d]+$"
-local ip6_ipset_pattern = ":-[%x]+%:+[%x]-[%/][%d]+$"
-local domain_pattern = "([%w%-]+%.[%w%.%-]+)[%/%*]*"
 local excluded_domain = {"apple.com","sina.cn","sina.com.cn","baidu.com","byr.cn","jlike.com","weibo.com","zhongsou.com","youdao.com","sogou.com","so.com","soso.com","aliyun.com","taobao.com","jd.com","qq.com","bing.com"}
 
 local gfwlist_url = uci:get(name, "@global_rules[0]", "gfwlist_url") or {"https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt"}
@@ -87,7 +81,8 @@ end
 -- curl
 local function curl(url, file, valifile)
 	local args = {
-		"-skL", "-w %{http_code}", "--retry 3", "--connect-timeout 3", "--max-time 300", "--speed-limit 51200 --speed-time 15"
+		"-skL", "-w %{http_code}", "--retry 3", "--connect-timeout 3", "--max-time 300", "--speed-limit 51200 --speed-time 15",
+		'-A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"'
 	}
 	if file then
 		args[#args + 1] = "-o " .. file
@@ -100,14 +95,43 @@ local function curl(url, file, valifile)
 end
 
 --check excluded domain
+local excluded_map = {}
+for _, d in ipairs(excluded_domain) do
+	excluded_map[d] = true
+end
 local function check_excluded_domain(value)
-	value = value and value:lower() or ""
-	for _, domain in ipairs(excluded_domain) do
-		local pattern = "^[a-z0-9-]+%.(" .. domain .. ")$"
-		if value:match(pattern) then
-		    return true
-		end
+	if not value or value == "" then return false end
+	value = value:lower()
+	local eq_pos = value:find("=", 1, true)
+	if eq_pos then
+		value = value:sub(eq_pos + 1)
 	end
+	if value:sub(1,1) == "/" then
+		value = value:sub(2)
+	end
+	local slash_pos = value:find("/", 1, true)
+	local colon_pos = value:find(":", 1, true)
+	local cut_pos
+	if slash_pos and colon_pos then
+		cut_pos = (slash_pos < colon_pos) and slash_pos or colon_pos
+	else
+		cut_pos = slash_pos or colon_pos
+	end
+	if cut_pos then
+		value = value:sub(1, cut_pos - 1)
+	end
+	value = value:gsub("^%.*", ""):gsub("%.*$", "")
+	while value do
+		if excluded_map[value] then
+			return true
+		end
+		local dot_pos = value:find(".", 1, true)
+		if not dot_pos then
+			break
+		end
+		value = value:sub(dot_pos + 1)
+	end
+	return false
 end
 
 local function line_count(file_path)
@@ -118,6 +142,170 @@ local function line_count(file_path)
 	return num;
 end
 
+-- 替代 string.find 查找 "^[#!\\[@]+"
+local function is_comment_line(s)
+	if not s or s == "" then return false end
+	local b = s:byte(1)
+	-- '#' = 35, '!' = 33, '\' = 92, '[' = 91, '@' = 64
+	if b == 35 or b == 33 or b == 92 or b == 91 or b == 64 then
+		return true
+	end
+	return false
+end
+
+-- IPv4 检测，替代 string.find "^%d+%.%d+%.%d+%.%d+"
+local function is_ipv4(s)
+	local dot = 0
+	local last = 1
+	local len = #s
+	for i = 1, len do
+		local b = s:byte(i)
+		if b == 46 then  -- "."
+			dot = dot + 1
+			if dot > 3 then return false end
+			if i == last then return false end
+			local seg = tonumber(s:sub(last, i - 1))
+			if not seg or seg > 255 then return false end
+			last = i + 1
+		elseif b < 48 or b > 57 then
+			return dot == 3 and i > last and tonumber(s:sub(last)) and tonumber(s:sub(last)) <= 255
+		end
+	end
+	if dot ~= 3 or last > len then return false end
+	local seg = tonumber(s:sub(last))
+	return seg and seg <= 255
+end
+
+-- IPv4 cidr检测，替代 string.find "^%d+%.%d+%.%d+%.%d+[%/][%d]+$"
+local function is_ipv4_cidr(s)
+	local dot = 0
+	local seg_start = 1
+	local len = #s
+	local i = 1
+	local mask_start = nil
+	while i <= len do
+		local b = s:byte(i)
+		if b >= 48 and b <= 57 then
+			-- 数字，继续
+		elseif b == 46 then  -- "."
+			dot = dot + 1
+			if dot > 3 or i == seg_start then return false end
+			local seg = tonumber(s:sub(seg_start, i - 1))
+			if not seg or seg > 255 then return false end
+			seg_start = i + 1
+		elseif b == 47 then  -- "/"
+			if dot ~= 3 or i == seg_start then return false end
+			local seg = tonumber(s:sub(seg_start, i - 1))
+			if not seg or seg > 255 then return false end
+			mask_start = i + 1
+			break
+		else
+			return false
+		end
+		i = i + 1
+	end
+	if not mask_start or mask_start > len then return false end
+	-- 检查 CIDR 掩码
+	local mask = tonumber(s:sub(mask_start))
+	if not mask or mask < 0 or mask > 32 then return false end
+	return true
+end
+
+-- IPv6 cidr检测，替代 string.find ":-[%x]+%:+[%x]-[%/][%d]+$"
+local function is_ipv6_cidr(s)
+	local len = #s
+	local i = 1
+	local seg_len = 0
+	local segs = 0
+	local saw_dc = false
+	local b
+	while i <= len do
+		b = s:byte(i)
+		if b == 47 then
+			if seg_len > 0 then segs = segs + 1 end
+			if (not saw_dc and segs ~= 8) or (saw_dc and segs > 8) then return false end
+			i = i + 1
+			if i > len then return false end
+			local mask = 0
+			while i <= len do
+				b = s:byte(i)
+				if b < 48 or b > 57 then return false end
+				mask = mask * 10 + (b - 48)
+				if mask > 128 then return false end
+				i = i + 1
+			end
+			return true
+		elseif b == 58 then
+			if i + 1 <= len and s:byte(i + 1) == 58 then
+				if saw_dc then return false end
+				saw_dc = true
+				if seg_len > 0 then segs = segs + 1; seg_len = 0 end
+				i = i + 2
+			else
+				if seg_len == 0 then return false end
+				segs = segs + 1
+				seg_len = 0
+				i = i + 1
+			end
+		else
+			if not ((b >= 48 and b <= 57) or (b >= 65 and b <= 70) or (b >= 97 and b <= 102)) then
+				return false
+			end
+			seg_len = seg_len + 1
+			if seg_len > 4 then return false end
+			i = i + 1
+		end
+	end
+	return false
+end
+
+-- 检测是否含有冒号，替代 string.find(line, ":")
+local function has_colon(s)
+	for i = 1, #s do
+		if s:byte(i) == 58 then  -- ':'
+			return true
+		end
+	end
+	return false
+end
+
+-- 域名提取，替代 string.match "([%w%-]+%.[%w%.%-]+)[%/%*]*"
+local function extract_domain(s)
+	if not s or s == "" then return nil end
+	local len = #s
+	local start = nil
+	local last_dot = nil
+	for i = 1, len do
+		local b = s:byte(i)
+		-- 允许的域名字符：a-zA-Z0-9.- 
+		if (b >= 48 and b <= 57) or (b >= 65 and b <= 90) or (b >= 97 and b <= 122) or b == 45 or b == 46 then
+			if not start then start = i end
+			if b == 46 then last_dot = i end
+		else
+			if start then
+				if last_dot and last_dot > start then
+					local domain = s:sub(start, i - 1)
+					while domain:byte(1) == 46 do
+						domain = domain:sub(2)
+					end
+					return domain
+				else
+					start = nil
+					last_dot = nil
+				end
+			end
+		end
+	end
+	if start and last_dot and last_dot > start then
+		local domain = s:sub(start)
+		while domain:byte(1) == 46 do
+			domain = domain:sub(2)
+		end
+		return domain
+	end
+	return nil
+end
+
 local function non_file_check(file_path, vali_file)
 	if fs.readfile(file_path, 10) then
 		local size_str = sys.exec("grep -i 'Content-Length' " .. vali_file .. " | tail -n1 | sed 's/[^0-9]//g'")
@@ -201,7 +389,6 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 
 		if sret_tmp == 200 then
 			if rule_name == "gfwlist" and geo2rule == "0" then
-				local domains = {}
 				local gfwlist = io.open(download_file_tmp..k, "r")
 				local decode = api.base64Decode(gfwlist:read("*all"))
 				gfwlist:close()
@@ -214,8 +401,8 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 			if rule_type == "domain" and exclude_domain == true then
 				for line in io.lines(download_file_tmp..k) do
 					line = line:gsub("full:", "")
-					if not (string.find(line, comment_pattern) or string.find(line, ip_pattern) or check_excluded_domain(line) or string.find(line, ":")) then
-						local match = string.match(line, domain_pattern)
+					if not (is_comment_line(line) or is_ipv4(line) or check_excluded_domain(line) or has_colon(line)) then
+						local match = extract_domain(line)
 						if match then
 							domains[match] = true
 						end
@@ -225,8 +412,8 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 			elseif rule_type == "domain" then
 				for line in io.lines(download_file_tmp..k) do
 					line = line:gsub("full:", "")
-					if not (string.find(line, comment_pattern) or string.find(line, ip_pattern) or string.find(line, ":")) then
-						local match = string.match(line, domain_pattern)
+					if not (is_comment_line(line) or is_ipv4(line) or has_colon(line)) then
+						local match = extract_domain(line)
 						if match then
 							domains[match] = true
 						end
@@ -235,22 +422,35 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 
 			elseif rule_type == "ip4" then
 				local out = io.open(unsort_file_tmp, "a")
+				local function is_0dot(s) -- "^0%..*"
+					return s and s:byte(1)==48 and s:byte(2)==46
+				end
 				for line in io.lines(download_file_tmp..k) do
-					if string.match(line, ip4_ipset_pattern) and not string.match(line, "^0%..*") then
-						out:write(string.format("%s\n", line))
+					if is_ipv4_cidr(line) and not is_0dot(line) then
+						out:write(line .. "\n")
 					end
 				end
 				out:close()
 
 			elseif rule_type == "ip6" then
 				local out = io.open(unsort_file_tmp, "a")
+				local function is_double_colon_cidr(s) -- "^::(/%d+)?$"
+					if not s or s:byte(1)~=58 or s:byte(2)~=58 then return false end
+					local l = #s
+					if l==2 then return true end
+					if l==3 or s:byte(3)~=47 then return false end
+					for i=4,l do
+						local b=s:byte(i)
+						if b<48 or b>57 then return false end
+					end
+					return true
+				end
 				for line in io.lines(download_file_tmp..k) do
-					if string.match(line, ip6_ipset_pattern) and not string.match(line, "^::(/%d+)?$") then
-						out:write(string.format("%s\n", line))
+					if is_ipv6_cidr(line) and not is_double_colon_cidr(line) then
+						out:write(line .. "\n")
 					end
 				end
 				out:close()
-
 			end
 		else
 			sret = 0
@@ -268,7 +468,7 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 			end
 			out:close()
 		end
-		sys.call("LC_ALL=C sort -u " .. unsort_file_tmp .. " > " .. file_tmp)
+		os.execute("LC_ALL=C /bin/busybox sort -u " .. unsort_file_tmp .. " > " .. file_tmp)
 		os.remove(unsort_file_tmp)
 
 		local old_md5 = sys.exec("echo -n $(md5sum " .. rule_path .. "/" ..rule_name.. " | awk '{print $1}')"):gsub("\n", "")
@@ -290,10 +490,10 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 					end
 					gen_cache(set_name, "ipv6_addr", file_tmp, output_file)
 				end
-				sys.exec(string.format('mv -f %s %s', output_file, rule_path .. "/" ..rule_name.. ".nft"))
+				sys.call(string.format('mv -f %s %s', output_file, rule_path .. "/" ..rule_name.. ".nft"))
 				os.remove(output_file)
 			end
-			sys.exec("mv -f "..file_tmp .. " " ..rule_path .. "/" ..rule_name)
+			sys.call("mv -f "..file_tmp .. " " ..rule_path .. "/" ..rule_name)
 			reboot = 1
 			log(rule_name.. " 更新成功，总规则数 " ..count.. " 条。")
 		else
diff --git a/small/luci-app-passwall/luasrc/model/cbi/passwall/client/rule.lua b/small/luci-app-passwall/luasrc/model/cbi/passwall/client/rule.lua
index 4d91ee4e74..3cc0ca8199 100644
--- a/small/luci-app-passwall/luasrc/model/cbi/passwall/client/rule.lua
+++ b/small/luci-app-passwall/luasrc/model/cbi/passwall/client/rule.lua
@@ -18,52 +18,52 @@ o.rmempty = false
 ---- gfwlist URL
 o = s:option(DynamicList, "gfwlist_url", translate("GFW domains(gfwlist) Update URL"))
 o:depends("geo2rule", false)
-o:value("https://fastly.jsdelivr.net/gh/YW5vbnltb3Vz/domain-list-community@release/gfwlist.txt", translate("v2fly/domain-list-community"))
-o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt", translate("Loyalsoldier/v2ray-rules-dat"))
-o:value("https://fastly.jsdelivr.net/gh/Loukky/gfwlist-by-loukky/gfwlist.txt", translate("Loukky/gfwlist-by-loukky"))
-o:value("https://fastly.jsdelivr.net/gh/gfwlist/gfwlist/gfwlist.txt", translate("gfwlist/gfwlist"))
-o.default = "https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt"
+o:value("https://cdn.jsdelivr.net/gh/YW5vbnltb3Vz/domain-list-community@release/gfwlist.txt", translate("v2fly/domain-list-community"))
+o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt", translate("Loyalsoldier/v2ray-rules-dat"))
+o:value("https://cdn.jsdelivr.net/gh/Loukky/gfwlist-by-loukky/gfwlist.txt", translate("Loukky/gfwlist-by-loukky"))
+o:value("https://cdn.jsdelivr.net/gh/gfwlist/gfwlist/gfwlist.txt", translate("gfwlist/gfwlist"))
+o.default = "https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt"
 
 ----chnroute  URL
 o = s:option(DynamicList, "chnroute_url", translate("China IPs(chnroute) Update URL"))
 o:depends("geo2rule", false)
-o:value("https://fastly.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china.txt", translate("gaoyifan/china-operator-ip/china"))
+o:value("https://cdn.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china.txt", translate("gaoyifan/china-operator-ip/china"))
 o:value("https://ispip.clang.cn/all_cn.txt", translate("Clang.CN"))
-o:value("https://fastly.jsdelivr.net/gh/soffchen/GeoIP2-CN@release/CN-ip-cidr.txt", translate("soffchen/GeoIP2-CN"))
-o:value("https://fastly.jsdelivr.net/gh/Hackl0us/GeoIP2-CN@release/CN-ip-cidr.txt", translate("Hackl0us/GeoIP2-CN"))
-o:value("https://fastly.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_IP_No_IPv6.txt", translate("ios_rule_script/ChinaMax_IP_No_IPv6"))
+o:value("https://cdn.jsdelivr.net/gh/soffchen/GeoIP2-CN@release/CN-ip-cidr.txt", translate("soffchen/GeoIP2-CN"))
+o:value("https://cdn.jsdelivr.net/gh/Hackl0us/GeoIP2-CN@release/CN-ip-cidr.txt", translate("Hackl0us/GeoIP2-CN"))
+o:value("https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_IP_No_IPv6.txt", translate("ios_rule_script/ChinaMax_IP_No_IPv6"))
 
 ----chnroute6 URL
 o = s:option(DynamicList, "chnroute6_url", translate("China IPv6s(chnroute6) Update URL"))
 o:depends("geo2rule", false)
-o:value("https://fastly.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china6.txt", translate("gaoyifan/china-operator-ip/china6"))
+o:value("https://cdn.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china6.txt", translate("gaoyifan/china-operator-ip/china6"))
 o:value("https://ispip.clang.cn/all_cn_ipv6.txt", translate("Clang.CN.IPv6"))
-o:value("https://fastly.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_IP.txt", translate("ios_rule_script/ChinaMax_IP"))
+o:value("https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_IP.txt", translate("ios_rule_script/ChinaMax_IP"))
 
 ----chnlist URL
 o = s:option(DynamicList, "chnlist_url", translate("China List(Chnlist) Update URL"))
 o:depends("geo2rule", false)
-o:value("https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/accelerated-domains.china.conf", translate("felixonmars/domains.china"))
-o:value("https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/apple.china.conf", translate("felixonmars/apple.china"))
-o:value("https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/google.china.conf", translate("felixonmars/google.china"))
-o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/china-list.txt", translate("Loyalsoldier/china-list"))
-o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/apple-cn.txt", translate("Loyalsoldier/apple-cn"))
-o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/google-cn.txt", translate("Loyalsoldier/google-cn"))
-o:value("https://fastly.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_Domain.txt", translate("ios_rule_script/ChinaMax_Domain"))
+o:value("https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/accelerated-domains.china.conf", translate("felixonmars/domains.china"))
+o:value("https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/apple.china.conf", translate("felixonmars/apple.china"))
+o:value("https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/google.china.conf", translate("felixonmars/google.china"))
+o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/china-list.txt", translate("Loyalsoldier/china-list"))
+o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/apple-cn.txt", translate("Loyalsoldier/apple-cn"))
+o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/google-cn.txt", translate("Loyalsoldier/google-cn"))
+o:value("https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/ChinaMax/ChinaMax_Domain.txt", translate("ios_rule_script/ChinaMax_Domain"))
 
 if has_xray or has_singbox then
 	o = s:option(ListValue, "geoip_url", translate("GeoIP Update URL"))
 	o:value("https://github.com/Loyalsoldier/geoip/releases/latest/download/geoip.dat", translate("Loyalsoldier/geoip"))
 	o:value("https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.dat", translate("MetaCubeX/geoip"))
-	o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/geoip@release/geoip.dat", translate("Loyalsoldier/geoip (CDN)"))
-	o:value("https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat", translate("MetaCubeX/geoip (CDN)"))
+	o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/geoip@release/geoip.dat", translate("Loyalsoldier/geoip (CDN)"))
+	o:value("https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geoip.dat", translate("MetaCubeX/geoip (CDN)"))
 	o.default = "https://github.com/Loyalsoldier/geoip/releases/latest/download/geoip.dat"
 
 	o = s:option(ListValue, "geosite_url", translate("Geosite Update URL"))
 	o:value("https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geosite.dat", translate("Loyalsoldier/geosite"))
 	o:value("https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geosite.dat", translate("MetaCubeX/geosite"))
-	o:value("https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat", translate("Loyalsoldier/geosite (CDN)"))
-	o:value("https://fastly.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat", translate("MetaCubeX/geosite (CDN)"))
+	o:value("https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat", translate("Loyalsoldier/geosite (CDN)"))
+	o:value("https://cdn.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@release/geosite.dat", translate("MetaCubeX/geosite (CDN)"))
 	o.default = "https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geosite.dat"
 
 	o = s:option(Value, "v2ray_location_asset", translate("Location of Geo rule files"), translate("This variable specifies a directory where geoip.dat and geosite.dat files are."))
diff --git a/small/luci-app-passwall/root/usr/share/passwall/0_default_config b/small/luci-app-passwall/root/usr/share/passwall/0_default_config
index 6ca00d0e83..f7304428f1 100644
--- a/small/luci-app-passwall/root/usr/share/passwall/0_default_config
+++ b/small/luci-app-passwall/root/usr/share/passwall/0_default_config
@@ -64,13 +64,13 @@ config global_rules
 	option gfwlist_update '1'
 	option geosite_update '0'
 	option geoip_update '0'
-	list gfwlist_url 'https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt'
+	list gfwlist_url 'https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt'
 	list chnroute_url 'https://ispip.clang.cn/all_cn.txt'
-	list chnroute_url 'https://fastly.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china.txt'
+	list chnroute_url 'https://cdn.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china.txt'
 	list chnroute6_url 'https://ispip.clang.cn/all_cn_ipv6.txt'
-	list chnroute6_url 'https://fastly.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china6.txt'
-	list chnlist_url 'https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/accelerated-domains.china.conf'
-	list chnlist_url 'https://fastly.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/apple.china.conf'
+	list chnroute6_url 'https://cdn.jsdelivr.net/gh/gaoyifan/china-operator-ip@ip-lists/china6.txt'
+	list chnlist_url 'https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/accelerated-domains.china.conf'
+	list chnlist_url 'https://cdn.jsdelivr.net/gh/felixonmars/dnsmasq-china-list/apple.china.conf'
 	option v2ray_location_asset '/usr/share/v2ray/'
 	option geoip_url 'https://github.com/Loyalsoldier/geoip/releases/latest/download/geoip.dat'
 	option geosite_url 'https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geosite.dat'
diff --git a/small/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua b/small/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua
index b41c6928f1..24a49313c9 100644
--- a/small/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua
+++ b/small/luci-app-passwall/root/usr/share/passwall/helper_smartdns_add.lua
@@ -121,7 +121,8 @@ else
 		{key = "response_mode", config_key = "response-mode", prefix = "-r ", default = "first-ping"},
 		{key = "rr_ttl", config_key = "rr-ttl", prefix = "-rr-ttl "},
 		{key = "rr_ttl_min", config_key = "rr-ttl-min", prefix = "-rr-ttl-min "},
-		{key = "rr_ttl_max", config_key = "rr-ttl-max", prefix = "-rr-ttl-max "}
+		{key = "rr_ttl_max", config_key = "rr-ttl-max", prefix = "-rr-ttl-max "},
+		{key = "rr_ttl_reply_max", config_key = "rr-ttl-reply-max", prefix = "-rr-ttl-reply-max "}
 	}
 	-- 从 custom.conf 中读取值，以最后出现的值为准
 	local custom_config = {}
diff --git a/small/luci-app-passwall/root/usr/share/passwall/rule_update.lua b/small/luci-app-passwall/root/usr/share/passwall/rule_update.lua
index 286b8aa1a5..923a5dbe95 100755
--- a/small/luci-app-passwall/root/usr/share/passwall/rule_update.lua
+++ b/small/luci-app-passwall/root/usr/share/passwall/rule_update.lua
@@ -21,12 +21,6 @@ local chnlist_update = "0"
 local geoip_update = "0"
 local geosite_update = "0"
 
--- match comments/title/whitelist/ip address/excluded_domain
-local comment_pattern = "^[#!\\[@]+"
-local ip_pattern = "^%d+%.%d+%.%d+%.%d+"
-local ip4_ipset_pattern = "^%d+%.%d+%.%d+%.%d+[%/][%d]+$"
-local ip6_ipset_pattern = ":-[%x]+%:+[%x]-[%/][%d]+$"
-local domain_pattern = "([%w%-]+%.[%w%.%-]+)[%/%*]*"
 local excluded_domain = {"apple.com","sina.cn","sina.com.cn","baidu.com","byr.cn","jlike.com","weibo.com","zhongsou.com","youdao.com","sogou.com","so.com","soso.com","aliyun.com","taobao.com","jd.com","qq.com","bing.com"}
 
 local gfwlist_url = uci:get(name, "@global_rules[0]", "gfwlist_url") or {"https://fastly.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/gfw.txt"}
@@ -87,7 +81,8 @@ end
 -- curl
 local function curl(url, file, valifile)
 	local args = {
-		"-skL", "-w %{http_code}", "--retry 3", "--connect-timeout 3", "--max-time 300", "--speed-limit 51200 --speed-time 15"
+		"-skL", "-w %{http_code}", "--retry 3", "--connect-timeout 3", "--max-time 300", "--speed-limit 51200 --speed-time 15",
+		'-A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"'
 	}
 	if file then
 		args[#args + 1] = "-o " .. file
@@ -100,14 +95,43 @@ local function curl(url, file, valifile)
 end
 
 --check excluded domain
+local excluded_map = {}
+for _, d in ipairs(excluded_domain) do
+	excluded_map[d] = true
+end
 local function check_excluded_domain(value)
-	value = value and value:lower() or ""
-	for _, domain in ipairs(excluded_domain) do
-		local pattern = "^[a-z0-9-]+%.(" .. domain .. ")$"
-		if value:match(pattern) then
-		    return true
-		end
+	if not value or value == "" then return false end
+	value = value:lower()
+	local eq_pos = value:find("=", 1, true)
+	if eq_pos then
+		value = value:sub(eq_pos + 1)
 	end
+	if value:sub(1,1) == "/" then
+		value = value:sub(2)
+	end
+	local slash_pos = value:find("/", 1, true)
+	local colon_pos = value:find(":", 1, true)
+	local cut_pos
+	if slash_pos and colon_pos then
+		cut_pos = (slash_pos < colon_pos) and slash_pos or colon_pos
+	else
+		cut_pos = slash_pos or colon_pos
+	end
+	if cut_pos then
+		value = value:sub(1, cut_pos - 1)
+	end
+	value = value:gsub("^%.*", ""):gsub("%.*$", "")
+	while value do
+		if excluded_map[value] then
+			return true
+		end
+		local dot_pos = value:find(".", 1, true)
+		if not dot_pos then
+			break
+		end
+		value = value:sub(dot_pos + 1)
+	end
+	return false
 end
 
 local function line_count(file_path)
@@ -118,6 +142,170 @@ local function line_count(file_path)
 	return num;
 end
 
+-- 替代 string.find 查找 "^[#!\\[@]+"
+local function is_comment_line(s)
+	if not s or s == "" then return false end
+	local b = s:byte(1)
+	-- '#' = 35, '!' = 33, '\' = 92, '[' = 91, '@' = 64
+	if b == 35 or b == 33 or b == 92 or b == 91 or b == 64 then
+		return true
+	end
+	return false
+end
+
+-- IPv4 检测，替代 string.find "^%d+%.%d+%.%d+%.%d+"
+local function is_ipv4(s)
+	local dot = 0
+	local last = 1
+	local len = #s
+	for i = 1, len do
+		local b = s:byte(i)
+		if b == 46 then  -- "."
+			dot = dot + 1
+			if dot > 3 then return false end
+			if i == last then return false end
+			local seg = tonumber(s:sub(last, i - 1))
+			if not seg or seg > 255 then return false end
+			last = i + 1
+		elseif b < 48 or b > 57 then
+			return dot == 3 and i > last and tonumber(s:sub(last)) and tonumber(s:sub(last)) <= 255
+		end
+	end
+	if dot ~= 3 or last > len then return false end
+	local seg = tonumber(s:sub(last))
+	return seg and seg <= 255
+end
+
+-- IPv4 cidr检测，替代 string.find "^%d+%.%d+%.%d+%.%d+[%/][%d]+$"
+local function is_ipv4_cidr(s)
+	local dot = 0
+	local seg_start = 1
+	local len = #s
+	local i = 1
+	local mask_start = nil
+	while i <= len do
+		local b = s:byte(i)
+		if b >= 48 and b <= 57 then
+			-- 数字，继续
+		elseif b == 46 then  -- "."
+			dot = dot + 1
+			if dot > 3 or i == seg_start then return false end
+			local seg = tonumber(s:sub(seg_start, i - 1))
+			if not seg or seg > 255 then return false end
+			seg_start = i + 1
+		elseif b == 47 then  -- "/"
+			if dot ~= 3 or i == seg_start then return false end
+			local seg = tonumber(s:sub(seg_start, i - 1))
+			if not seg or seg > 255 then return false end
+			mask_start = i + 1
+			break
+		else
+			return false
+		end
+		i = i + 1
+	end
+	if not mask_start or mask_start > len then return false end
+	-- 检查 CIDR 掩码
+	local mask = tonumber(s:sub(mask_start))
+	if not mask or mask < 0 or mask > 32 then return false end
+	return true
+end
+
+-- IPv6 cidr检测，替代 string.find ":-[%x]+%:+[%x]-[%/][%d]+$"
+local function is_ipv6_cidr(s)
+	local len = #s
+	local i = 1
+	local seg_len = 0
+	local segs = 0
+	local saw_dc = false
+	local b
+	while i <= len do
+		b = s:byte(i)
+		if b == 47 then
+			if seg_len > 0 then segs = segs + 1 end
+			if (not saw_dc and segs ~= 8) or (saw_dc and segs > 8) then return false end
+			i = i + 1
+			if i > len then return false end
+			local mask = 0
+			while i <= len do
+				b = s:byte(i)
+				if b < 48 or b > 57 then return false end
+				mask = mask * 10 + (b - 48)
+				if mask > 128 then return false end
+				i = i + 1
+			end
+			return true
+		elseif b == 58 then
+			if i + 1 <= len and s:byte(i + 1) == 58 then
+				if saw_dc then return false end
+				saw_dc = true
+				if seg_len > 0 then segs = segs + 1; seg_len = 0 end
+				i = i + 2
+			else
+				if seg_len == 0 then return false end
+				segs = segs + 1
+				seg_len = 0
+				i = i + 1
+			end
+		else
+			if not ((b >= 48 and b <= 57) or (b >= 65 and b <= 70) or (b >= 97 and b <= 102)) then
+				return false
+			end
+			seg_len = seg_len + 1
+			if seg_len > 4 then return false end
+			i = i + 1
+		end
+	end
+	return false
+end
+
+-- 检测是否含有冒号，替代 string.find(line, ":")
+local function has_colon(s)
+	for i = 1, #s do
+		if s:byte(i) == 58 then  -- ':'
+			return true
+		end
+	end
+	return false
+end
+
+-- 域名提取，替代 string.match "([%w%-]+%.[%w%.%-]+)[%/%*]*"
+local function extract_domain(s)
+	if not s or s == "" then return nil end
+	local len = #s
+	local start = nil
+	local last_dot = nil
+	for i = 1, len do
+		local b = s:byte(i)
+		-- 允许的域名字符：a-zA-Z0-9.- 
+		if (b >= 48 and b <= 57) or (b >= 65 and b <= 90) or (b >= 97 and b <= 122) or b == 45 or b == 46 then
+			if not start then start = i end
+			if b == 46 then last_dot = i end
+		else
+			if start then
+				if last_dot and last_dot > start then
+					local domain = s:sub(start, i - 1)
+					while domain:byte(1) == 46 do
+						domain = domain:sub(2)
+					end
+					return domain
+				else
+					start = nil
+					last_dot = nil
+				end
+			end
+		end
+	end
+	if start and last_dot and last_dot > start then
+		local domain = s:sub(start)
+		while domain:byte(1) == 46 do
+			domain = domain:sub(2)
+		end
+		return domain
+	end
+	return nil
+end
+
 local function non_file_check(file_path, vali_file)
 	if fs.readfile(file_path, 10) then
 		local size_str = sys.exec("grep -i 'Content-Length' " .. vali_file .. " | tail -n1 | sed 's/[^0-9]//g'")
@@ -201,7 +389,6 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 
 		if sret_tmp == 200 then
 			if rule_name == "gfwlist" and geo2rule == "0" then
-				local domains = {}
 				local gfwlist = io.open(download_file_tmp..k, "r")
 				local decode = api.base64Decode(gfwlist:read("*all"))
 				gfwlist:close()
@@ -214,8 +401,8 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 			if rule_type == "domain" and exclude_domain == true then
 				for line in io.lines(download_file_tmp..k) do
 					line = line:gsub("full:", "")
-					if not (string.find(line, comment_pattern) or string.find(line, ip_pattern) or check_excluded_domain(line) or string.find(line, ":")) then
-						local match = string.match(line, domain_pattern)
+					if not (is_comment_line(line) or is_ipv4(line) or check_excluded_domain(line) or has_colon(line)) then
+						local match = extract_domain(line)
 						if match then
 							domains[match] = true
 						end
@@ -225,8 +412,8 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 			elseif rule_type == "domain" then
 				for line in io.lines(download_file_tmp..k) do
 					line = line:gsub("full:", "")
-					if not (string.find(line, comment_pattern) or string.find(line, ip_pattern) or string.find(line, ":")) then
-						local match = string.match(line, domain_pattern)
+					if not (is_comment_line(line) or is_ipv4(line) or has_colon(line)) then
+						local match = extract_domain(line)
 						if match then
 							domains[match] = true
 						end
@@ -235,22 +422,35 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 
 			elseif rule_type == "ip4" then
 				local out = io.open(unsort_file_tmp, "a")
+				local function is_0dot(s) -- "^0%..*"
+					return s and s:byte(1)==48 and s:byte(2)==46
+				end
 				for line in io.lines(download_file_tmp..k) do
-					if string.match(line, ip4_ipset_pattern) and not string.match(line, "^0%..*") then
-						out:write(string.format("%s\n", line))
+					if is_ipv4_cidr(line) and not is_0dot(line) then
+						out:write(line .. "\n")
 					end
 				end
 				out:close()
 
 			elseif rule_type == "ip6" then
 				local out = io.open(unsort_file_tmp, "a")
+				local function is_double_colon_cidr(s) -- "^::(/%d+)?$"
+					if not s or s:byte(1)~=58 or s:byte(2)~=58 then return false end
+					local l = #s
+					if l==2 then return true end
+					if l==3 or s:byte(3)~=47 then return false end
+					for i=4,l do
+						local b=s:byte(i)
+						if b<48 or b>57 then return false end
+					end
+					return true
+				end
 				for line in io.lines(download_file_tmp..k) do
-					if string.match(line, ip6_ipset_pattern) and not string.match(line, "^::(/%d+)?$") then
-						out:write(string.format("%s\n", line))
+					if is_ipv6_cidr(line) and not is_double_colon_cidr(line) then
+						out:write(line .. "\n")
 					end
 				end
 				out:close()
-
 			end
 		else
 			sret = 0
@@ -268,7 +468,7 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 			end
 			out:close()
 		end
-		sys.call("LC_ALL=C sort -u " .. unsort_file_tmp .. " > " .. file_tmp)
+		os.execute("LC_ALL=C /bin/busybox sort -u " .. unsort_file_tmp .. " > " .. file_tmp)
 		os.remove(unsort_file_tmp)
 
 		local old_md5 = sys.exec("echo -n $(md5sum " .. rule_path .. "/" ..rule_name.. " | awk '{print $1}')"):gsub("\n", "")
@@ -290,10 +490,10 @@ local function fetch_rule(rule_name,rule_type,url,exclude_domain)
 					end
 					gen_cache(set_name, "ipv6_addr", file_tmp, output_file)
 				end
-				sys.exec(string.format('mv -f %s %s', output_file, rule_path .. "/" ..rule_name.. ".nft"))
+				sys.call(string.format('mv -f %s %s', output_file, rule_path .. "/" ..rule_name.. ".nft"))
 				os.remove(output_file)
 			end
-			sys.exec("mv -f "..file_tmp .. " " ..rule_path .. "/" ..rule_name)
+			sys.call("mv -f "..file_tmp .. " " ..rule_path .. "/" ..rule_name)
 			reboot = 1
 			log(rule_name.. " 更新成功，总规则数 " ..count.. " 条。")
 		else
diff --git a/small/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client-config.lua b/small/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client-config.lua
index c0e625b1e3..54fd709598 100644
--- a/small/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client-config.lua
+++ b/small/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client-config.lua
@@ -1181,19 +1181,8 @@ if is_finded("xray") then
 	end
 	o.rmempty = true
 	o:depends({type = "v2ray", v2ray_protocol = "vless", transport = "raw", tls = true})
-	o:depends({type = "v2ray", v2ray_protocol = "vless", transport = "raw", reality = true})
-
-	o = s:option(ListValue, "xhttp_tls_flow", translate("Flow"))
-	for _, v in ipairs(tls_flows) do
-		if v == "none" then
-		   o.default = "none"
-		   o:value("none", translate("none"))
-		else
-		   o:value("xtls-rprx-vision", translate("xtls-rprx-vision"))
-		end
-	end
-	o.rmempty = true
 	o:depends({type = "v2ray", v2ray_protocol = "vless", transport = "xhttp", tls = true})
+	o:depends({type = "v2ray", v2ray_protocol = "vless", transport = "raw", reality = true})
 	o:depends({type = "v2ray", v2ray_protocol = "vless", transport = "xhttp", reality = true})
 
 	-- [[ uTLS ]]--
@@ -1305,6 +1294,7 @@ o.rmempty = false
 o:depends("tls", true)
 o:depends("type", "hysteria2")
 o:depends("type", "tuic")
+o:depends({type = "v2ray", v2ray_protocol = "vless", reality = true})
 o.description = translate("If true, allowss insecure connection at TLS client, e.g., TLS server uses unverifiable certificates.")
 
 -- [[ Hysteria2 TLS pinSHA256 ]] --
diff --git a/small/luci-app-ssr-plus/luasrc/view/shadowsocksr/ssrurl.htm b/small/luci-app-ssr-plus/luasrc/view/shadowsocksr/ssrurl.htm
index 8e0f80de9b..93b0e702a3 100644
--- a/small/luci-app-ssr-plus/luasrc/view/shadowsocksr/ssrurl.htm
+++ b/small/luci-app-ssr-plus/luasrc/view/shadowsocksr/ssrurl.htm
@@ -736,16 +736,17 @@ function import_ssr_url(btn, urlname, sid) {
 				setElementValue('cbid.shadowsocksr.' + sid + '.' + params.get("security"), true);
 				dispatchEventIfExists('cbid.shadowsocksr.' + sid + '.' + params.get("security"), event);
 
+				if (params.get("allowInsecure") === "1") {
+					setElementValue('cbid.shadowsocksr.' + sid + '.insecure', true); // 设置 insecure 为 true
+					dispatchEventIfExists('cbid.shadowsocksr.' + sid + '.insecure', event); // 触发事件
+				}
+
 				if (params.get("security") === "tls") {
 					if (params.get("ech") && params.get("ech").trim() !== "") {
 						setElementValue('cbid.shadowsocksr.' + sid + '.enable_ech', true); // 设置 enable_ech 为 true
 						dispatchEventIfExists('cbid.shadowsocksr.' + sid + '.enable_ech', event); // 触发事件
 						setElementValue('cbid.shadowsocksr.' + sid + '.ech_config', params.get("ech") || "");
 					}
-					if (params.get("allowInsecure") === "1") {
-						setElementValue('cbid.shadowsocksr.' + sid + '.insecure', true); // 设置 insecure 为 true
-						dispatchEventIfExists('cbid.shadowsocksr.' + sid + '.insecure', event); // 触发事件
-					}
 				}
 				if (params.get("security") === "reality") {
 					setElementValue('cbid.shadowsocksr.' + sid + '.reality_publickey', params.get("pbk") ? decodeURIComponent(params.get("pbk")) : "");
diff --git a/small/luci-app-ssr-plus/root/usr/share/shadowsocksr/subscribe.lua b/small/luci-app-ssr-plus/root/usr/share/shadowsocksr/subscribe.lua
index dfa58b9c7b..cf7c84d8af 100755
--- a/small/luci-app-ssr-plus/root/usr/share/shadowsocksr/subscribe.lua
+++ b/small/luci-app-ssr-plus/root/usr/share/shadowsocksr/subscribe.lua
@@ -276,12 +276,18 @@ local function processData(szType, content)
 		alias = alias .. remarks
 		result.alias = alias
 	elseif szType == "vmess" then
-		-- 去掉前后空白和#注释
+		-- 去掉前后空白和注释
 		local link = trim(content:gsub("#.*$", ""))
 
-		-- 解析正常节点
-		local success, info = pcall(jsonParse, link)
-		if not success or type(info) ~= "table" then
+		-- Base64 解码
+		local decoded = base64Decode(link)
+		if not decoded or decoded == "" then
+			return nil
+		end
+
+		-- 解析 JSON
+		local ok, info = pcall(jsonParse, decoded)
+		if not ok or type(info) ~= "table" then
 			return nil
 		end
 
@@ -318,9 +324,9 @@ local function processData(szType, content)
 			result.xhttp_host = info.host
 			result.xhttp_path = info.path
 			-- 检查 extra 参数是否存在且非空
-			if params.extra and params.extra ~= "" then
+			if info.extra and info.extra ~= "" then
 				result.enable_xhttp_extra = "1"
-				result.xhttp_extra = params.extra
+				result.xhttp_extra = info.extra
 			end
 			-- 尝试解析 JSON 数据
 			local success, Data = pcall(jsonParse, info.extra or "")
@@ -894,6 +900,11 @@ local function processData(szType, content)
 			result.tls_alpn = alpn
 		end
 
+		-- 处理 insecure 参数
+		if params.allowInsecure and params.allowInsecure ~= "" then
+			result.insecure = "1"
+		end
+
 		-- Reality 参数
 		if security == "reality" then
 			result.reality_publickey = params.pbk and UrlDecode(params.pbk) or nil
diff --git a/small/v2ray-geodata/Makefile b/small/v2ray-geodata/Makefile
index 83af933b24..bb1dc71ca8 100644
--- a/small/v2ray-geodata/Makefile
+++ b/small/v2ray-geodata/Makefile
@@ -21,13 +21,13 @@ define Download/geoip
   HASH:=2445b44d9ae3ab9a867c9d1e0e244646c4c378622e14b9afaf3658ecf46a40b9
 endef
 
-GEOSITE_VER:=20251121020256
+GEOSITE_VER:=20251122135507
 GEOSITE_FILE:=dlc.dat.$(GEOSITE_VER)
 define Download/geosite
   URL:=https://github.com/v2fly/domain-list-community/releases/download/$(GEOSITE_VER)/
   URL_FILE:=dlc.dat
   FILE:=$(GEOSITE_FILE)
-  HASH:=441358172fc8b142ca2470db5d903ab9934d7c4f00673683b9f64bbb27c1c201
+  HASH:=dd3e5c4708dc6b1ea6c45c8ed0e429c233f459e3f48153a2507a95103c69d9e8
 endef
 
 GEOSITE_IRAN_VER:=202511170041
diff --git a/v2ray-core/.github/workflows/codeql-analysis.yml b/v2ray-core/.github/workflows/codeql-analysis.yml
index 5cf6513e0c..1b928467f3 100644
--- a/v2ray-core/.github/workflows/codeql-analysis.yml
+++ b/v2ray-core/.github/workflows/codeql-analysis.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
diff --git a/v2ray-core/.github/workflows/linter.yml b/v2ray-core/.github/workflows/linter.yml
index 7a95ad43a2..50a38aef98 100644
--- a/v2ray-core/.github/workflows/linter.yml
+++ b/v2ray-core/.github/workflows/linter.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout codebase
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up Go
         uses: actions/setup-go@v6
diff --git a/v2ray-core/.github/workflows/release.yml b/v2ray-core/.github/workflows/release.yml
index dc42139aca..b1715786b7 100644
--- a/v2ray-core/.github/workflows/release.yml
+++ b/v2ray-core/.github/workflows/release.yml
@@ -121,7 +121,7 @@ jobs:
 
     steps:
       - name: Checkout codebase
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -215,7 +215,7 @@ jobs:
     needs: build
     steps:
       - name: Checkout codebase
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -319,7 +319,7 @@ jobs:
         arm64-v8a:arm64
         arm64-v8a:arm64/v8
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Log in to ghcr.io
         uses: redhat-actions/podman-login@v1
diff --git a/v2ray-core/.github/workflows/sign.yml b/v2ray-core/.github/workflows/sign.yml
index c1aa253343..9597643c68 100644
--- a/v2ray-core/.github/workflows/sign.yml
+++ b/v2ray-core/.github/workflows/sign.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout default branch
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Grant it execution permission
         run: |
diff --git a/v2ray-core/.github/workflows/test.yml b/v2ray-core/.github/workflows/test.yml
index 6736324a66..a29e3ef278 100644
--- a/v2ray-core/.github/workflows/test.yml
+++ b/v2ray-core/.github/workflows/test.yml
@@ -28,7 +28,7 @@ jobs:
         os: [windows-latest, ubuntu-latest, macos-latest]
     steps:
       - name: Checkout codebase
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/v2ray-core/core.go b/v2ray-core/core.go
index 3e09edaa1b..51c39d4bb4 100644
--- a/v2ray-core/core.go
+++ b/v2ray-core/core.go
@@ -18,7 +18,7 @@ import (
 )
 
 var (
-	version  = "5.41.0"
+	version  = "5.42.0"
 	build    = "Custom"
 	codename = "V2Fly, a community-driven edition of V2Ray."
 	intro    = "A unified platform for anti-censorship."
diff --git a/v2ray-core/go.mod b/v2ray-core/go.mod
index c503eaf49d..9e6007bae3 100644
--- a/v2ray-core/go.mod
+++ b/v2ray-core/go.mod
@@ -41,7 +41,7 @@ require (
 	golang.org/x/net v0.47.0
 	golang.org/x/sync v0.18.0
 	golang.org/x/sys v0.38.0
-	google.golang.org/grpc v1.76.0
+	google.golang.org/grpc v1.77.0
 	google.golang.org/protobuf v1.36.10
 	gopkg.in/yaml.v3 v3.0.1
 	gvisor.dev/gvisor v0.0.0-20231020174304-b8a429915ff1
@@ -91,6 +91,6 @@ require (
 	golang.org/x/text v0.31.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.38.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect
 	nhooyr.io/websocket v1.8.6 // indirect
 )
diff --git a/v2ray-core/go.sum b/v2ray-core/go.sum
index 1244011d87..c5c665f59b 100644
--- a/v2ray-core/go.sum
+++ b/v2ray-core/go.sum
@@ -548,18 +548,18 @@ go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
-go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
-go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
-go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
-go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
-go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
-go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
-go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
-go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
-go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
+go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
+go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
+go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
+go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
+go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
+go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
+go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
+go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
+go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
 go.starlark.net v0.0.0-20230612165344-9532f5667272 h1:2/wtqS591wZyD2OsClsVBKRPEvBsQt/Js+fsCiYhwu8=
 go.starlark.net v0.0.0-20230612165344-9532f5667272/go.mod h1:jxU+3+j+71eXOW14274+SmmuW82qJzl6iZSeqEtTGds=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
@@ -807,8 +807,8 @@ google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvx
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20210126160654-44e461bb6506/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b h1:zPKJod4w6F1+nRGDI9ubnXYhU9NSWoFAijkHkUXeTK8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 h1:M1rk8KBnUsBDg1oPGHNCxG4vc1f49epmTO7xscSajMk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.0/go.mod h1:chYK+tFQF0nDUGJgXMSgLCQk3phJEuONr2DCgLDdAQM=
@@ -823,8 +823,8 @@ google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.32.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
-google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
+google.golang.org/grpc v1.77.0 h1:wVVY6/8cGA6vvffn+wWK5ToddbgdU3d8MNENr4evgXM=
+google.golang.org/grpc v1.77.0/go.mod h1:z0BY1iVj0q8E1uSQCjL9cppRj+gnZjzDnzV0dHhrNig=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
diff --git a/v2rayn/v2rayN/ServiceLib/Models/SingboxConfig.cs b/v2rayn/v2rayN/ServiceLib/Models/SingboxConfig.cs
index 6dde5e7c07..cbf674fa14 100644
--- a/v2rayn/v2rayN/ServiceLib/Models/SingboxConfig.cs
+++ b/v2rayn/v2rayN/ServiceLib/Models/SingboxConfig.cs
@@ -216,6 +216,8 @@ public class Transport4Sbox
     public string? idle_timeout { get; set; }
     public string? ping_timeout { get; set; }
     public bool? permit_without_stream { get; set; }
+    public int? max_early_data { get; set; }
+    public string? early_data_header_name { get; set; }
 }
 
 public class Headers4Sbox
diff --git a/v2rayn/v2rayN/ServiceLib/Models/V2rayConfig.cs b/v2rayn/v2rayN/ServiceLib/Models/V2rayConfig.cs
index e10cd0d9dd..b84a6a66ba 100644
--- a/v2rayn/v2rayN/ServiceLib/Models/V2rayConfig.cs
+++ b/v2rayn/v2rayN/ServiceLib/Models/V2rayConfig.cs
@@ -411,8 +411,6 @@ public class WsSettings4Ray
 
 public class Headers4Ray
 {
-    public string Host { get; set; }
-
     [JsonPropertyName("User-Agent")]
     public string UserAgent { get; set; }
 }
diff --git a/v2rayn/v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxOutboundService.cs b/v2rayn/v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxOutboundService.cs
index 5188d1774c..b04c6e9ffd 100644
--- a/v2rayn/v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxOutboundService.cs
+++ b/v2rayn/v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxOutboundService.cs
@@ -364,7 +364,35 @@ public partial class CoreConfigSingboxService
 
                 case nameof(ETransport.ws):
                     transport.type = nameof(ETransport.ws);
-                    transport.path = node.Path.IsNullOrEmpty() ? null : node.Path;
+                    var wsPath = node.Path;
+                    
+                    // Parse eh and ed parameters from path using regex
+                    if (!wsPath.IsNullOrEmpty())
+                    {
+                        var edRegex = new Regex(@"[?&]ed=(\d+)");
+                        var edMatch = edRegex.Match(wsPath);
+                        if (edMatch.Success && int.TryParse(edMatch.Groups[1].Value, out var edValue))
+                        {
+                            transport.max_early_data = edValue;
+                            transport.early_data_header_name = "Sec-WebSocket-Protocol";
+
+                            wsPath = edRegex.Replace(wsPath, "");
+                            wsPath = wsPath.Replace("?&", "?");
+                            if (wsPath.EndsWith('?'))
+                            {
+                                wsPath = wsPath.TrimEnd('?');
+                            }
+                        }
+
+                        var ehRegex = new Regex(@"[?&]eh=([^&]+)");
+                        var ehMatch = ehRegex.Match(wsPath);
+                        if (ehMatch.Success)
+                        {
+                            transport.early_data_header_name = Uri.UnescapeDataString(ehMatch.Groups[1].Value);
+                        }
+                    }
+
+                    transport.path = wsPath.IsNullOrEmpty() ? null : wsPath;
                     if (node.RequestHost.IsNotEmpty())
                     {
                         transport.headers = new()
diff --git a/v2rayn/v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayOutboundService.cs b/v2rayn/v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayOutboundService.cs
index 351c7bf0fc..53a04a5fd4 100644
--- a/v2rayn/v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayOutboundService.cs
+++ b/v2rayn/v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayOutboundService.cs
@@ -351,7 +351,6 @@ public partial class CoreConfigV2rayService
                     if (host.IsNotEmpty())
                     {
                         wsSettings.host = host;
-                        wsSettings.headers.Host = host;
                     }
                     if (path.IsNotEmpty())
                     {
diff --git a/v2rayn/v2rayN/ServiceLib/ViewModels/ProfilesViewModel.cs b/v2rayn/v2rayN/ServiceLib/ViewModels/ProfilesViewModel.cs
index a6bb2567ef..80461288fa 100644
--- a/v2rayn/v2rayN/ServiceLib/ViewModels/ProfilesViewModel.cs
+++ b/v2rayn/v2rayN/ServiceLib/ViewModels/ProfilesViewModel.cs
@@ -553,6 +553,11 @@ public class ProfilesViewModel : MyReactiveObject
 
     private async Task RemoveDuplicateServer()
     {
+        if (await _updateView?.Invoke(EViewAction.ShowYesNo, null) == false)
+        {
+            return;
+        }
+
         var tuple = await ConfigHandler.DedupServerList(_config, _config.SubIndexId);
         if (tuple.Item1 > 0 || tuple.Item2 > 0)
         {
diff --git a/v2rayn/v2rayN/v2rayN.Desktop/Views/MainWindow.axaml b/v2rayn/v2rayN/v2rayN.Desktop/Views/MainWindow.axaml
index 52cf5c4fb3..8496761914 100644
--- a/v2rayn/v2rayN/v2rayN.Desktop/Views/MainWindow.axaml
+++ b/v2rayn/v2rayN/v2rayN.Desktop/Views/MainWindow.axaml
@@ -9,8 +9,8 @@
     xmlns:view="using:v2rayN.Desktop.Views"
     xmlns:vms="clr-namespace:ServiceLib.ViewModels;assembly=ServiceLib"
     Title="v2rayN"
-    Width="1000"
-    Height="600"
+    Width="1200"
+    Height="800"
     MinWidth="900"
     x:DataType="vms:MainWindowViewModel"
     Icon="/Assets/NotifyIcon1.ico"
diff --git a/v2rayn/v2rayN/v2rayN/Views/MainWindow.xaml b/v2rayn/v2rayN/v2rayN/Views/MainWindow.xaml
index 25de8f7fd4..18dd7281e3 100644
--- a/v2rayn/v2rayN/v2rayN/Views/MainWindow.xaml
+++ b/v2rayn/v2rayN/v2rayN/Views/MainWindow.xaml
@@ -11,8 +11,8 @@
     xmlns:view="clr-namespace:v2rayN.Views"
     xmlns:vms="clr-namespace:ServiceLib.ViewModels;assembly=ServiceLib"
     Title="v2rayN"
-    Width="900"
-    Height="700"
+    Width="1200"
+    Height="800"
     MinWidth="900"
     x:TypeArguments="vms:MainWindowViewModel"
     Icon="/Resources/v2rayN.ico"
diff --git a/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/dto/SubscriptionItem.kt b/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/dto/SubscriptionItem.kt
index 8a38e6dbfd..beac5147e8 100644
--- a/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/dto/SubscriptionItem.kt
+++ b/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/dto/SubscriptionItem.kt
@@ -13,5 +13,6 @@ data class SubscriptionItem(
     var filter: String? = null,
     var intelligentSelectionFilter: String? = null,
     var allowInsecureUrl: Boolean = false,
+    var userAgent: String? = null,
 )
 
diff --git a/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/handler/AngConfigManager.kt b/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/handler/AngConfigManager.kt
index 320f369333..4e3619e668 100644
--- a/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/handler/AngConfigManager.kt
+++ b/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/handler/AngConfigManager.kt
@@ -425,17 +425,18 @@ object AngConfigManager {
                 }
             }
             Log.i(AppConfig.TAG, url)
+            val userAgent = it.second.userAgent
 
             var configText = try {
                 val httpPort = SettingsManager.getHttpPort()
-                HttpUtil.getUrlContentWithUserAgent(url, 15000, httpPort)
+                HttpUtil.getUrlContentWithUserAgent(url, userAgent, 15000, httpPort)
             } catch (e: Exception) {
                 Log.e(AppConfig.ANG_PACKAGE, "Update subscription: proxy not ready or other error", e)
                 ""
             }
             if (configText.isEmpty()) {
                 configText = try {
-                    HttpUtil.getUrlContentWithUserAgent(url)
+                    HttpUtil.getUrlContentWithUserAgent(url, userAgent)
                 } catch (e: Exception) {
                     Log.e(AppConfig.TAG, "Update subscription: Failed to get URL content with user agent", e)
                     ""
diff --git a/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/ui/SubEditActivity.kt b/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/ui/SubEditActivity.kt
index 46f2afc09c..22fec0a5af 100644
--- a/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/ui/SubEditActivity.kt
+++ b/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/ui/SubEditActivity.kt
@@ -44,6 +44,7 @@ class SubEditActivity : BaseActivity() {
     private fun bindingServer(subItem: SubscriptionItem): Boolean {
         binding.etRemarks.text = Utils.getEditable(subItem.remarks)
         binding.etUrl.text = Utils.getEditable(subItem.url)
+        binding.etUserAgent.text = Utils.getEditable(subItem.userAgent)
         binding.etFilter.text = Utils.getEditable(subItem.filter)
         binding.etIntelligentSelectionFilter.text = Utils.getEditable(subItem.intelligentSelectionFilter)
         binding.chkEnable.isChecked = subItem.enabled
@@ -76,6 +77,7 @@ class SubEditActivity : BaseActivity() {
 
         subItem.remarks = binding.etRemarks.text.toString()
         subItem.url = binding.etUrl.text.toString()
+        subItem.userAgent = binding.etUserAgent.text.toString()
         subItem.filter = binding.etFilter.text.toString()
         subItem.intelligentSelectionFilter = binding.etIntelligentSelectionFilter.text.toString()
         subItem.enabled = binding.chkEnable.isChecked
diff --git a/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/util/HttpUtil.kt b/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/util/HttpUtil.kt
index f06c0426ac..6baf1d76de 100644
--- a/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/util/HttpUtil.kt
+++ b/v2rayng/V2rayNG/app/src/main/java/com/v2ray/ang/util/HttpUtil.kt
@@ -128,7 +128,7 @@ object HttpUtil {
      * @throws IOException If an I/O error occurs.
      */
     @Throws(IOException::class)
-    fun getUrlContentWithUserAgent(url: String?, timeout: Int = 15000, httpPort: Int = 0): String {
+    fun getUrlContentWithUserAgent(url: String?, userAgent: String?,  timeout: Int = 15000, httpPort: Int = 0): String {
         var currentUrl = url
         var redirects = 0
         val maxRedirects = 3
@@ -136,7 +136,12 @@ object HttpUtil {
         while (redirects++ < maxRedirects) {
             if (currentUrl == null) continue
             val conn = createProxyConnection(currentUrl, httpPort, timeout, timeout) ?: continue
-            conn.setRequestProperty("User-agent", "v2rayNG/${BuildConfig.VERSION_NAME}")
+            val finalUserAgent = if (userAgent.isNullOrBlank()) {
+                "v2rayNG/${BuildConfig.VERSION_NAME}"
+            } else {
+                userAgent
+            }
+            conn.setRequestProperty("User-agent", finalUserAgent)
             conn.connect()
 
             val responseCode = conn.responseCode
diff --git a/v2rayng/V2rayNG/app/src/main/res/layout/activity_sub_edit.xml b/v2rayng/V2rayNG/app/src/main/res/layout/activity_sub_edit.xml
index baf3edb1a5..c3db6a96df 100644
--- a/v2rayng/V2rayNG/app/src/main/res/layout/activity_sub_edit.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/layout/activity_sub_edit.xml
@@ -74,6 +74,25 @@
 
             </LinearLayout>
 
+            <LinearLayout
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:layout_marginTop="@dimen/padding_spacing_dp16"
+                android:orientation="vertical">
+
+                <TextView
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content"
+                    android:text="@string/sub_setting_user_agent" />
+
+                <EditText
+                    android:id="@+id/et_user_agent"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:inputType="text" />
+
+            </LinearLayout>
+
             <LinearLayout
                 android:layout_width="match_parent"
                 android:layout_height="wrap_content"
diff --git a/v2rayng/V2rayNG/app/src/main/res/values-ar/strings.xml b/v2rayng/V2rayNG/app/src/main/res/values-ar/strings.xml
index 04c7e80897..d013a76d35 100644
--- a/v2rayng/V2rayNG/app/src/main/res/values-ar/strings.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/values-ar/strings.xml
@@ -265,6 +265,7 @@
     <string name="title_sub_setting">إعداد مجموعة الاشتراك</string>
     <string name="sub_setting_remarks">ملاحظات</string>
     <string name="sub_setting_url">عنوان URL اختياري</string>
+    <string name="sub_setting_user_agent">User Agent</string>
     <string name="sub_setting_filter">Remarks regular filter</string>
     <string name="sub_setting_enable">تفعيل التحديث</string>
     <string name="sub_auto_update">تفعيل التحديث التلقائي</string>
diff --git a/v2rayng/V2rayNG/app/src/main/res/values-bn/strings.xml b/v2rayng/V2rayNG/app/src/main/res/values-bn/strings.xml
index 43aea6963b..4361dda047 100644
--- a/v2rayng/V2rayNG/app/src/main/res/values-bn/strings.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/values-bn/strings.xml
@@ -265,6 +265,7 @@
     <string name="title_sub_setting">সাবস্ক্রিপশন গ্রুপ সেটিং</string>
     <string name="sub_setting_remarks">মন্তব্য</string>
     <string name="sub_setting_url">ঐচ্ছিক URL</string>
+    <string name="sub_setting_user_agent">User Agent</string>
     <string name="sub_setting_filter">Remarks regular filter</string>
     <string name="sub_setting_enable">আপডেট সক্রিয় করুন</string>
     <string name="sub_auto_update">স্বয়ংক্রিয় আপডেট সক্রিয় করুন</string>
diff --git a/v2rayng/V2rayNG/app/src/main/res/values-bqi-rIR/strings.xml b/v2rayng/V2rayNG/app/src/main/res/values-bqi-rIR/strings.xml
index 0537ca6672..3f8d186896 100644
--- a/v2rayng/V2rayNG/app/src/main/res/values-bqi-rIR/strings.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/values-bqi-rIR/strings.xml
@@ -265,6 +265,7 @@
     <string name="title_sub_setting">سامووا بونکۊ اشتراک</string>
     <string name="sub_setting_remarks">نیشتنا</string>
     <string name="sub_setting_url">نشۊوی اینترنتی اختیاری</string>
+    <string name="sub_setting_user_agent">User Agent</string>
     <string name="sub_setting_filter">نوم موستعار فیلتر</string>
     <string name="sub_setting_enable">فعال بیڌن ورۊ کردن</string>
     <string name="sub_auto_update">فعال بیڌن ورۊ کردن خوتکار</string>
diff --git a/v2rayng/V2rayNG/app/src/main/res/values-fa/strings.xml b/v2rayng/V2rayNG/app/src/main/res/values-fa/strings.xml
index 7d58e1aee5..734784b670 100644
--- a/v2rayng/V2rayNG/app/src/main/res/values-fa/strings.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/values-fa/strings.xml
@@ -262,6 +262,7 @@
     <string name="title_sub_setting">تنظیمات گروه‌ اشتراک</string>
     <string name="sub_setting_remarks">ملاحظات</string>
     <string name="sub_setting_url">نشانی اینترنتی اختیاری</string>
+    <string name="sub_setting_user_agent">User Agent</string>
     <string name="sub_setting_filter">نام مستعار فیلتر</string>
     <string name="sub_setting_enable">فعال کردن به‌روزرسانی</string>
     <string name="sub_auto_update">فعال سازی به‌روزرسانی خودکار</string>
diff --git a/v2rayng/V2rayNG/app/src/main/res/values-ru/strings.xml b/v2rayng/V2rayNG/app/src/main/res/values-ru/strings.xml
index 4022154cfa..befc2421e5 100644
--- a/v2rayng/V2rayNG/app/src/main/res/values-ru/strings.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/values-ru/strings.xml
@@ -264,6 +264,7 @@
     <string name="title_sub_setting">Группы</string>
     <string name="sub_setting_remarks">Название</string>
     <string name="sub_setting_url">URL (необязательно)</string>
+    <string name="sub_setting_user_agent">User Agent</string>
     <string name="sub_setting_filter">Название фильтра</string>
     <string name="sub_setting_enable">Использовать обновление</string>
     <string name="sub_auto_update">Использовать автообновление</string>
diff --git a/v2rayng/V2rayNG/app/src/main/res/values-vi/strings.xml b/v2rayng/V2rayNG/app/src/main/res/values-vi/strings.xml
index 117de03683..161f078fb7 100644
--- a/v2rayng/V2rayNG/app/src/main/res/values-vi/strings.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/values-vi/strings.xml
@@ -265,6 +265,7 @@
     <string name="title_sub_setting">Các gói đăng ký</string>
     <string name="sub_setting_remarks">Tên gói đăng ký</string>
     <string name="sub_setting_url">URL gói đăng ký</string>
+    <string name="sub_setting_user_agent">User Agent</string>
     <string name="sub_setting_filter">Remarks regular filter</string>
     <string name="sub_setting_enable">Sử dụng gói đăng ký này</string>
     <string name="sub_auto_update">Bật tự động cập nhật</string>
diff --git a/v2rayng/V2rayNG/app/src/main/res/values-zh-rCN/strings.xml b/v2rayng/V2rayNG/app/src/main/res/values-zh-rCN/strings.xml
index 7eabc42ce3..716094148e 100644
--- a/v2rayng/V2rayNG/app/src/main/res/values-zh-rCN/strings.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/values-zh-rCN/strings.xml
@@ -262,6 +262,7 @@
     <string name="title_sub_setting">订阅分组设置</string>
     <string name="sub_setting_remarks">备注</string>
     <string name="sub_setting_url">可选地址 (url)</string>
+    <string name="sub_setting_user_agent">User Agent</string>
     <string name="sub_setting_filter">别名正则过滤</string>
     <string name="sub_setting_enable">启用更新</string>
     <string name="sub_auto_update">启用自动更新</string>
diff --git a/v2rayng/V2rayNG/app/src/main/res/values-zh-rTW/strings.xml b/v2rayng/V2rayNG/app/src/main/res/values-zh-rTW/strings.xml
index e85dd489b3..77b85d7c8d 100644
--- a/v2rayng/V2rayNG/app/src/main/res/values-zh-rTW/strings.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/values-zh-rTW/strings.xml
@@ -263,6 +263,7 @@
     <string name="title_sub_setting">訂閱分組設定</string>
     <string name="sub_setting_remarks">備註</string>
     <string name="sub_setting_url">可選位址(url)</string>
+    <string name="sub_setting_user_agent">User Agent</string>
     <string name="sub_setting_filter">別名正規過濾</string>
     <string name="sub_setting_enable">啟用更新</string>
     <string name="sub_auto_update">啟用自動更新</string>
diff --git a/v2rayng/V2rayNG/app/src/main/res/values/strings.xml b/v2rayng/V2rayNG/app/src/main/res/values/strings.xml
index 90bbc067eb..39d0083897 100644
--- a/v2rayng/V2rayNG/app/src/main/res/values/strings.xml
+++ b/v2rayng/V2rayNG/app/src/main/res/values/strings.xml
@@ -268,6 +268,7 @@
     <string name="title_sub_setting">Subscription group setting</string>
     <string name="sub_setting_remarks">remarks</string>
     <string name="sub_setting_url">Optional URL</string>
+    <string name="sub_setting_user_agent">User Agent</string>
     <string name="sub_setting_filter">Remarks regular filter</string>
     <string name="sub_setting_enable">Enable update</string>
     <string name="sub_auto_update">Enable automatic update</string>
diff --git a/yt-dlp/yt_dlp/extractor/_extractors.py b/yt-dlp/yt_dlp/extractor/_extractors.py
index 5f82ad54e9..5a71096c96 100644
--- a/yt-dlp/yt_dlp/extractor/_extractors.py
+++ b/yt-dlp/yt_dlp/extractor/_extractors.py
@@ -75,6 +75,7 @@ from .afreecatv import (
     AfreecaTVLiveIE,
     AfreecaTVUserIE,
 )
+from .agalega import AGalegaIE
 from .agora import (
     TokFMAuditionIE,
     TokFMPodcastIE,
diff --git a/yt-dlp/yt_dlp/extractor/agalega.py b/yt-dlp/yt_dlp/extractor/agalega.py
new file mode 100644
index 0000000000..c02d4ae3a4
--- /dev/null
+++ b/yt-dlp/yt_dlp/extractor/agalega.py
@@ -0,0 +1,91 @@
+import json
+import time
+
+from .common import InfoExtractor
+from ..utils import jwt_decode_hs256, url_or_none
+from ..utils.traversal import traverse_obj
+
+
+class AGalegaBaseIE(InfoExtractor):
+    _access_token = None
+
+    @staticmethod
+    def _jwt_is_expired(token):
+        return jwt_decode_hs256(token)['exp'] - time.time() < 120
+
+    def _refresh_access_token(self, video_id):
+        AGalegaBaseIE._access_token = self._download_json(
+            'https://www.agalega.gal/api/fetch-api/jwt/token', video_id,
+            note='Downloading access token',
+            data=json.dumps({
+                'username': None,
+                'password': None,
+                'client': 'crtvg',
+                'checkExistsCookies': False,
+            }).encode())['access']
+
+    def _call_api(self, endpoint, display_id, note, fatal=True, query=None):
+        if not AGalegaBaseIE._access_token or self._jwt_is_expired(AGalegaBaseIE._access_token):
+            self._refresh_access_token(endpoint)
+        return self._download_json(
+            f'https://api-agalega.interactvty.com/api/2.0/contents/{endpoint}', display_id,
+            note=note, fatal=fatal, query=query,
+            headers={'Authorization': f'jwtok {AGalegaBaseIE._access_token}'})
+
+
+class AGalegaIE(AGalegaBaseIE):
+    IE_NAME = 'agalega:videos'
+    _VALID_URL = r'https?://(?:www\.)?agalega\.gal/videos/(?:detail/)?(?P<id>[0-9]+)'
+    _TESTS = [{
+        'url': 'https://www.agalega.gal/videos/288664-lr-ninguencheconta',
+        'md5': '04533a66c5f863d08dd9724b11d1c223',
+        'info_dict': {
+            'id': '288664',
+            'title': 'Roberto e Ángel Martín atenden consultas dos espectadores',
+            'description': 'O cómico ademais fai un repaso dalgúns momentos da súa traxectoria profesional',
+            'thumbnail': 'https://crtvg-bucket.flumotion.cloud/content_cards/2ef32c3b9f6249d9868fd8f11d389d3d.png',
+            'ext': 'mp4',
+        },
+    }, {
+        'url': 'https://www.agalega.gal/videos/detail/296152-pulso-activo-7',
+        'md5': '26df7fdcf859f38ad92d837279d6b56d',
+        'info_dict': {
+            'id': '296152',
+            'title': 'Pulso activo | 18-11-2025',
+            'description': 'Anxo, Noemí, Silvia e Estrella  comparten as sensacións da clase de Eddy.',
+            'thumbnail': 'https://crtvg-bucket.flumotion.cloud/content_cards/a6bb7da6c8994b82bf961ac6cad1707b.png',
+            'ext': 'mp4',
+        },
+    }]
+
+    def _real_extract(self, url):
+        video_id = self._match_id(url)
+        content_data = self._call_api(
+            f'content/{video_id}/', video_id, note='Downloading content data', fatal=False,
+            query={
+                'optional_fields': 'image,is_premium,short_description,has_subtitle',
+            })
+        resource_data = self._call_api(
+            f'content_resources/{video_id}/', video_id, note='Downloading resource data',
+            query={
+                'optional_fields': 'media_url',
+            })
+
+        formats = []
+        subtitles = {}
+        for m3u8_url in traverse_obj(resource_data, ('results', ..., 'media_url', {url_or_none})):
+            fmts, subs = self._extract_m3u8_formats_and_subtitles(
+                m3u8_url, video_id, ext='mp4', m3u8_id='hls')
+            formats.extend(fmts)
+            self._merge_subtitles(subs, target=subtitles)
+
+        return {
+            'id': video_id,
+            'formats': formats,
+            'subtitles': subtitles,
+            **traverse_obj(content_data, {
+                'title': ('name', {str}),
+                'description': (('description', 'short_description'), {str}, any),
+                'thumbnail': ('image', {url_or_none}),
+            }),
+        }
diff --git a/yt-dlp/yt_dlp/extractor/wistia.py b/yt-dlp/yt_dlp/extractor/wistia.py
index 53ffb5529a..d12e9e4c4a 100644
--- a/yt-dlp/yt_dlp/extractor/wistia.py
+++ b/yt-dlp/yt_dlp/extractor/wistia.py
@@ -339,11 +339,20 @@ class WistiaChannelIE(WistiaBaseIE):
             'title': 'The Roof S2: The Modern CRO',
             'thumbnail': r're:https?://embed(?:-ssl)?\.wistia\.com/.+\.(?:jpg|png)',
             'duration': 86.487,
-            'description': 'A sales leader on The Roof? Man, they really must be letting anyone up here this season.\n',
+            'description': 'A sales leader on The Roof? Man, they really must be letting anyone up here this season. ',
             'timestamp': 1619790290,
             'upload_date': '20210430',
         },
         'params': {'noplaylist': True, 'skip_download': True},
+    }, {
+        # Channel with episodes structure instead of videos
+        'url': 'https://fast.wistia.net/embed/channel/sapab9p6qd',
+        'info_dict': {
+            'id': 'sapab9p6qd',
+            'title': 'Credo: An RCIA Program',
+            'description': '\n',
+        },
+        'playlist_mincount': 80,
     }]
     _WEBPAGE_TESTS = [{
         'url': 'https://www.profitwell.com/recur/boxed-out',
@@ -399,8 +408,7 @@ class WistiaChannelIE(WistiaBaseIE):
 
         entries = [
             self.url_result(f'wistia:{video["hashedId"]}', WistiaIE, title=video.get('name'))
-            for video in traverse_obj(series, ('sections', ..., 'videos', ...)) or []
-            if video.get('hashedId')
+            for video in traverse_obj(series, ('sections', ..., ('videos', 'episodes'), lambda _, v: v['hashedId']))
         ]
 
         return self.playlist_result(