What's Changed

• 828fd30d chore: support connection reuse for DoT by @H1JK
• 3c526ae0 feat: add query-server-name for ech-opts by @wwqgtxx
• dede56fe feat: add proxy-server-nameserver-policy to dns section by @wwqgtxx
• e45c8961 feat: support masque outbound by @wwqgtxx
• f94da9f2 chore: fingerprint verifier handle non-leaf certificate will check the SNI matches the certificate's DNS name by @wwqgtxx

BUG & Fix

• 2cfc4ba0 fix: CVE-2025-68121 for crypto/tls again and again by @wwqgtxx
• 32799662 fix: quic data race for crypto/tls by @wwqgtxx
• 3ac62152 fix: race condition of tcpConcurrent in dialer (#2556) by @Chenx Dust
• 75a0cd5a fix: file exists when tun start by @wwqgtxx
• 85c024a4 fix: snat key in sudoku packet listener by @wwqgtxx
• d18a14af fix: snat key in trojan packet listener by @wwqgtxx
• e3b8fc2b fix: hy2 listener panic with http/https masquerade by @wwqgtxx
• f52c9356 fix: CVE-2025-68121 for crypto/tls again by @wwqgtxx

Maintenance

• 022f6773 chore: cleanup hostValue code by @wwqgtxx
• 034f1d1e chore: disallow empty proxy-server-nameserver when proxy-server-nameserver-policy is set by @wwqgtxx
• 0c995a24 chore: move proxiesWithProviders to hub/route internal to disallow external usage of this poorly implemented function by @wwqgtxx
• 18d139a1 chore: rollback tls to restore the session resumption functionality in quic-go by @wwqgtxx
• 1e1434d1 chore: remove an unnecessary variable by @wwqgtxx
• 26052ba5 chore: remove confused varbin using in sing by @wwqgtxx
• 27a3ca6a chore: converter support fingerprint for vmess/vless/trojan by @wwqgtxx
• 3bca69c7 chore: add some comments for the fingerprint verifier by @wwqgtxx
• 46ee1649 chore: hy2 listener fellow hysteria2's code skip verify in https masquerade by @wwqgtxx
• 5516ca18 chore: code cleanup by @wwqgtxx
• 5e1b133e chore: more callback support for utls by @wwqgtxx
• 5fda87d5 chore: update sing-tun by @wwqgtxx
• 65c3d3e4 chore: remove unreachable code in sudoku by @wwqgtxx
• 6aaabc97 chore: decrease unneeded string convert in socks5 addr parsing by @wwqgtxx
• 707fe8b2 chore: remove auto IDNA conversion in domain rules by @wwqgtxx
• 710772f9 chore: add simple validation for static dialer-proxy config (#2551) by @sleshep
• 7573affd chore: better logging in masque outbound by @wwqgtxx
• 86257fc8 chore: remove reflect-based provider override code by @wwqgtxx
• 8b0bcb67 chore: better generator by @wwqgtxx
• 97f25250 chore: code cleanup by @wwqgtxx
• 98b30605 chore: optimize timeout control in DoH TLS probe by @wwqgtxx
• 993595df chore: switch to our own common/orderedmap package, remove two unneeded json dependence by @wwqgtxx
• b9010064 chore: using mihomo's global pool in DoQ by @wwqgtxx
• c33c90d7 chore: clean up duplicate code in sudoku by @wwqgtxx
• d36b024b chore: align sudoku with upstream v0.2.0 (#2549) by @saba-futai
• e03ba23f chore: update logrus by @wwqgtxx
• f2222b5e chore: code cleanup by @wwqgtxx

Full Changelog: https://github.com/MetaCubeX/mihomo/compare/v1.19.19...v1.19.20