mihomo v1.19.30：新增 ZeroTier/AmneziaWG，修复 CVE

What's Changed

• e889b68 feat: support H2C and QUICv2 sniffing (#3036) by @kosta
• 05b5334 feat: add handshake-timeout for hysteria2 by @wwqgtxx
• 1265cb9 feat: add ip-stack option for masque outbound by @wwqgtxx
• 4ad27d8 feat: add ip-stack option for ZeroTier by @wwqgtxx
• 8453e58 feat: support AmneziaWG v3.0 by @wwqgtxx
• 8b76447 feat: add ip-stack option for wireguard outbound by @wwqgtxx
• 8c56780 feat: support AmneziaWG v3.1 by @wwqgtxx
• b082515 feat: add Zerotier outbound support by @wwqgtxx
• b27c659 feat: add client-metadata configuration to anytls and DON'T sent by default by @wwqgtxx
• bb80689 feat: support bbr3 for mipstack by @wwqgtxx
• d46944f feat: add ip-stack option for openvpn outbound by @wwqgtxx
• e40b596 feat: add rate-limit for restls listener by @wwqgtxx

BUG & Fix

• 25ccc4d fix: handle zerotier network lifecycle events correctly by @wwqgtxx
• 2e8a04c fix: tailscale failed to recover after the network was restored by @wwqgtxx
• 3315457 fix: CVE-2026-56862 for crypto/tls by @wwqgtxx
• 3a779dd fix: typo in uplinkHTTPMethod (#3029) by @kosta
• 4fcf9ae fix: track QUIC crypto stream coverage without repeated range sorting by @wwqgtxx
• 5e3cb10 fix: avoid reserved TLS suffixes in JLS FakeRandom by @wwqgtxx
• 63f15f2 fix: keep connections open after initial sniffing failures by @wwqgtxx
• 69a3142 fix: apply default uplink chunk size for xhttp (#3061) by @vanbujhm
• 7ac597b fix: domain resolve logic in zerotier outbound by @wwqgtxx
• 8d1b661 fix: avoid unnecessary waits in HTTP/2 sniffing by @wwqgtxx
• 8d71008 fix: typo in error string (#3090) by @rye Sears
• 9574a46 fix: truncate udp dns replies to the client's advertised buffer size (#3043) by @TWO666
• 95f7a0c fix: remove incorrect quic error wrapping by @wwqgtxx
• 978d25a fix: enforce ShadowQUIC JLS authentication in QUIC layer by @wwqgtxx
• 98f1200 fix: panic when UDP is not supported in dns_dialer by @wwqgtxx
• 9b9dc8a fix: survive server-initiated soft reset and rekey for openvpn (#3109) by @ayanami-desu
• 9d901dc fix: prevent CUBIC ACKs from reducing cwnd for gvisor by @wwqgtxx
• a2c9556 fix: HTTP/2 read loop spinning on underlying StreamError by @wwqgtxx
• a939fc1 fix: compilation errors under specific circumstances by @wwqgtxx
• ac017cd fix: initialize DNS before NTP (#3103) by @xyx
• ace2037 fix: echo edns0 opt in dns replies when the request carries one (#3041) by @TWO666
• afeb072 fix: trim trailing newline from Tailscale VersionDotTxt in IPNVersion (#3079) by @胡威
• b989445 fix: reduce PROTOCOL_VIOLATION errors on masque dialing by setting ConnectionIDLength by @wwqgtxx
• c1603f4 fix: coordinate TCP sniffers on overlapping ports by @wwqgtxx
• c7089c0 fix: include the upstream tailscale version for standardization (#3074) by @Feng.YJ
• cd05b74 fix: harden zerotier runtime synchronization by @wwqgtxx
• e18ef3a fix: harden ShadowQUIC JLS camouflage forwarding by @wwqgtxx
• ea9c544 fix: avoid unnecessary waits in TLS and QUIC sniffing by @wwqgtxx
• f298cd2 fix: normalize HTTP hosts and avoid unnecessary sniffing delays by @wwqgtxx
• f5fddd3 fix: preserve WebSocket 0-RTT data order by @wwqgtxx
• f83a072 fix: let QUIC sniffer handle Retry key changes by @wwqgtxx
• fb00221 fix: tun dns hijack sending zero-filled or stale packets when PackBuffer reallocates (#3037) by @TWO666

Maintenance

• 09b0ff3 chore: reduce interface differences between gVisor and mipstack by @wwqgtxx
• 0ba9f2f chore: remove dohMaxConnsPerHost & dohMaxIdleConns (#3048) by @ayanamist
• 1af24e9 chore: update tailscale to v1.102.2 by @wwqgtxx
• 1ef16c7 chore: harden TCP pacing and handshake state handling by @wwqgtxx
• 26c635f chore: avoid string reversal allocation in DomainSet.Has (#3049) by @ember Moth
• 2bade29 chore: allow the sniffer to read more data if possible by @wwqgtxx
• 2ea5461 chore: adjust internal dialQuic api by @wwqgtxx
• 3c16aaf chore: update quic-go to 0.61.0 by @wwqgtxx
• 3cac869 chore: reduce ZeroTier wire data-path overhead by @wwqgtxx
• 4859d14 chore: let quic sniffer handle coalesced packets and larger client hello by @wwqgtxx
• 49a5419 chore: update tailscale to v1.102.0 by @wwqgtxx
• 63024e3 chore: remove unused imports in test by @wwqgtxx
• 669db1b chore: harden QUIC Initial packet processing by @wwqgtxx
• 6bb8b98 chore: strictly verify the syntax for Clash-style domain wildcards by @wwqgtxx
• 7259bbb chore: update mipstack for api adjustment by @wwqgtxx
• 73b061a chore: split internal dns server handler by @wwqgtxx
• 770800e chore: reduce packet-path and TCP allocation overhead by @wwqgtxx
• 7ee0b05 chore: allow override IV_VER by peer-info for OpenVPN by @wwqgtxx
• 7ff6544 chore: improve ZeroTier reliability and throughput under load by @wwqgtxx
• 8df9462 chore: update mipstack for api adjustment by @wwqgtxx
• 944e8e1 chore: align MIPS TCP keepalive defaults with sing-wireguard behavior by @wwqgtxx
• 94a89fb chore: reject oversized sniff reads before filling the buffer by @wwqgtxx
• 97cbdc5 chore: update gvisor by @wwqgtxx
• 99ce79c chore: reduce packet queue contention and socket allocation churn by @wwqgtxx
• 9a9c4c6 chore: improve zerotier event diagnostics by @wwqgtxx
• a52c00b chore: expand datagram and raw IP socket support for mipstack by @wwqgtxx
• b9faf97 chore: improve internal sharing mechanism for dnsClient by @wwqgtxx
• c235dc1 chore: let the sniffer assemble client hello across TLS records by @wwqgtxx
• c807c9a chore: let the HTTP/2 sniffer assemble header blocks across continuation frames by @wwqgtxx
• cb8e990 chore: let sniffer support multi-round reading by @wwqgtxx
• cf98d2d chore: align ZeroTier link configuration and multicast state by @wwqgtxx
• d8fbf85 chore: update bart by @wwqgtxx
• dd7bc4c chore: reduce ZeroTier packet processing overhead by @wwqgtxx
• dfd7e89 chore: align congestion control with Linux by @wwqgtxx
• e183c58 chore: stabilize equal-quality peer path selection for ZeroTier by @wwqgtxx
• e9f6297 chore: improve ZeroTier packet bridge throughput by @wwqgtxx
• ee2db89 chore: let gVisor allow HandleLocal working with PromiscuousMode by @wwqgtxx
• efd63d8 chore: extract bitmap handling from QUIC crypto reassembly by @wwqgtxx
• f5fbe0c chore: update mieru version (#3046) by @enfein

Full Changelog: v1.19.29...v1.19.30