Reality handshake fallback

Fixed an edge case where Reality TLS would refuse to fall back to plain TLS on networks that strip ALPN. Affected Hiddify users on certain ISPs in IR/CN.

WireGuard kernel module on Linux

Linux builds now use the in-kernel WireGuard implementation when available, falling back to wireguard-go. ~15% throughput gain on bare metal.

Pinned TLS roots refresh

Rotated pinned CA bundle. No action required — apps refresh on next launch.

Apple TV beta

Native tvOS app with 10-foot UI, focus engine, and Siri Remote support. Joins the existing iOS, macOS, Windows, and Linux clients.

Multi-hop on EU regions

Premium plans can now chain two EU POPs: FRA → AMS, AMS → STO, STO → HEL. Adds ~30ms latency for a second-jurisdiction hop.

Token rotation race condition

Fixed a race in our self-pop installer that could leave a node with mismatched keys after a forced rotation. Impacted ~2% of self-hosted users.