v1.8.4:

Bug Fixes
- Fixed Slipstream port stuck after disconnect — Rust native thread was
holding the port forever because SHOULD_SHUTDOWN was reset before the
abandoned thread could see it
- Added shutdown check before QUIC setup phase so the thread exits promptly
during reconnect cycles
- Capped idle sleep at 2s to ensure shutdown is detected within the 3s JNI
stop timeout
- Added port fallback (+10/+20/+30/+40/+50) if preferred port is still held by
a previous session
- Faster disconnect: reduced port wait from 5s to 1s (next connect has
fallback if needed)
- Synchronized stopClient() to prevent double-stop race from onDestroy +
coroutine cleanup
- Fixed database crash on first launch for users upgrading from very old
versions (v1–v4) by adding fallbackToDestructiveMigrationFrom
- Fixed MIGRATION_6_7 default value mismatch (forward_dns_through_ssh: 1 → 0)
that could cause schema validation failures on newer SQLite versions

New Features
- DNSTT standalone now uses DnsttSocksBridge (same architecture as Slipstream)
with persistent DNS worker pool, Dante auth, and multi-phase resilience
- DNS Scanner: scan random IPs from country CIDR ranges (geo-based resolver
discovery)
- Server reachability test simplified to SSH-only (DNS/tunnel pings were
misleading)

Improvements
- QUIC liveness monitoring: automatically reconnects after 30s of QUIC being
down (fixes background traffic dying on Samsung)
- Debug log sheet: batched updates (100ms flush timer) instead of per-line
ArrayList copy; removed scroll animation jank
- Add-menu popup animation smoothed out with faster durations and fixed shadow
lag
- Bridge link icons in Tor profile editor (Telegram, Web, Email)

v1.8.5:

New Features

- DNSTT authoritative mode — New toggle in profile editor for aggressive query rate on self-hosted DNS servers
- Sleep timer — Auto-disconnect after a configurable duration (0–120 min, 5 min steps); countdown shown on connection strip with cancel option
- DNS Scanner resume — Paused scans can now be resumed from where they left off instead of restarting
- DNS Scanner custom IP range — Scan a custom IP range for DNS resolvers

Improvements

- New profiles appear at top of the profile list instead of the bottom
- Max DNS resolvers per profile increased from 3 to 8

v1.8.6

New Features

- Global Remote DNS Setting — New setting in Settings to control which DNS servers are used on the remote side of all tunnels. Supports primary + fallback DNS with custom IP input.
- Default remote DNS changed to Google (8.8.8.8) primary, Cloudflare (1.1.1.1) fallback

Bug Fixes

- Fix DNSTT log spam after disconnect — DNSTT Go library no longer retries sending on closed connections for 10+ seconds after VPN is turned off. Transport is now closed immediately in Stop().
- Fix "Delete All Profiles" not deleting connected profile — Now properly disconnects first, then deletes all profiles including the active one.

Improvements

- Authoritative mode warning — Warning text is now red and bold for both DNSTT and Slipstream profiles
- DNS Scanner animation — Smoother panel switching between Country and Custom resolver list options (no more card height jump)
- Remote DNS preference is now passed through all tunnel bridges (SSH, Slipstream, DNSTT)

Bug Fixes

- Fixed crash on app update when upgrading caused by orphaned use_server_dns database column. The migration now properly removes the column via table recreation (compatible with Android 7+).

Improvements

- DoH DNS Scanner precision: Latency measurements are now significantly more stable and accurate. Uses a single reused socket,
pre-resolved addresses, nanosecond timing, and reports the median of 4 samples after a warm-up query.
- Config import forward-compatibility: Configs exported from future app versions are now imported gracefully instead of being rejected. A warning is shown if some settings may be missing.

New DoH Servers

Added 13 new DNS-over-HTTPS providers:
- AdGuard DNS & AdGuard Unfiltered
- Cloudflare Security & Cloudflare Family
- CleanBrowsing Family
- DNS4EU Protective
- Cisco Umbrella
- Mozilla DNS
- Mullvad (alternate URL)
- AliDNS
- Control D
- UncensoredDNS
- ComSS

New: SlipGate (NaiveProxy + SSH)

- New tunnel type: SlipGate — chains NaiveProxy (Chromium-based HTTPS tunnel) with SSH for a fully encrypted, censorship-resistant connection: https://github.com/anonvector/slipgate
- NaiveProxy mimics Chrome's TLS fingerprint, making tunnel traffic indistinguishable from normal HTTPS browsing
- NaiveBridge: manages NaiveProxy process lifecycle with SOCKS5 local proxy
- NaiveSocksProxy: bridges hev-socks5-tunnel to NaiveProxy with CONNECT and FWD_UDP support
- Pre-resolves server IP before connecting to prevent ISP DNS poisoning

Network Resilience

- SlipGate survives network changes (wifi ↔️ cellular) — full two-phase reconnection (NaiveProxy restart, then SSH re-establishment)
- Auto-tune SSH max channels per tunnel type for better performance

Reachability Test

- "Test Server Reachability" now works for all tunnel types (DNSTT, Slipstream, DoH, SlipGate) — only Snowflake/Tor is skipped
- Smart ping target selection per tunnel type (resolver host, DoH server, SSH host, etc.)

Deep Links

- Added slipnet:// URI deep link support — tap a link to import profiles directly