This release syncs everything from upstream s-ui v1.5.0 through v1.5.2 into 2s-ui, on top of our own fixes. Full parity with upstream v1.5.2, plus a few corrections upstream doesn't have yet.

Security

• Panel passwords are now stored as bcrypt hashes instead of plaintext (upstream #1159). Existing databases are migrated automatically; passwords keep working unchanged. s-ui admin -show no longer prints the password — use s-ui admin -username <user> -password <pass> to set a new one.
• SQL injection fix in the changes-log query (upstream #1131).
• Unknown-SNI TLS handshakes are rejected when a panel/sub domain is configured with manual certificates. If you connect by raw IP over HTTPS, either use the domain or leave the domain setting empty.
• Dependency security updates: sing-box v1.13.14, golang.org/x/crypto and friends.

Features (from upstream v1.5.0–v1.5.2)

• External JSON subscriptions with connection timeout and optional default routing rules.
• Client enhancements: creation time and remark fields, improved bulk add.
• Reset all clients' traffic — manual API and scheduled (globalReset cron setting); re-enables depleted clients and restarts the core.
• TLS certificate hot reload for panel and subscription servers — renewed certificates are picked up without a restart.
• Automatic SHA256 pinning for self-signed certificates, applied to configs and share links (with back-fill migration).
• CLI backup command: s-ui backup -output <file|-> [-exclude changes,stats].
• Configurable traffic sampling (statsBucketSeconds) with deduplicated storage.
• getCertPing API returns the leaf certificate SPKI hash of a remote TLS endpoint.
• Subscription improvements: Content-Disposition filename, Clash default groups only injected when referenced, TUIC udp_relay_mode on links.

Fixes

• VLESS over plain TCP+TLS keeps flow: xtls-rprx-vision in generated Clash/JSON configs (upstream #1156).
• Share links carry the correct certificate pin: hex fingerprint under the standard pinSHA256 key. (Upstream v1.5.2 emits this under a pcs key that clients don't recognize — we kept the standard name.)
• getCertPing hardening over upstream: no crash on CN-only certificates (no SANs), and the probe connection is closed properly.
• External subscriptions with no outbounds now return a real error instead of silently succeeding with empty data.
• Traffic chart adapts its resolution to the stored bucket size, so raising the sampling interval can't blank the dashboard charts (upstream #1150).
• h3 ALPN in Clash subs, Clash sub headers, WARP connection timeout, stricter VLESS flow validation (upstream v1.5.0).

Upgrade notes

• Docker: migrations run automatically via the entrypoint. Nothing to do.
• Bare-metal (systemd): run s-ui migrate once after upgrading. Without it, plaintext passwords are still upgraded lazily on each successful login, but the self-signed-certificate pin back-fill only runs through the migration.
• The stats table is deduplicated and gains a unique index on first start after the upgrade; on very large databases the first start may take a little longer.