sing-box 1.14.0 (released 2026-08-31) added OpenVPN client and server, OpenConnect, and Snell protocol support alongside L3 forwarding, network namespaces, a REST API, Dashboard UI, and desktop client. The release also adjusted DNS rule semantics, TUN, TLS, Hysteria2 fingerprint behavior, and rule-set processing.

China's CAC Phase 2 'Clearance·Rectify AI Application Chaos' campaign (reported 2026-09-02) removed 5.61 million pieces of content, processed 49,000+ accounts, and actioned 2,400+ websites and apps. Enforcement extended beyond post-publication removal to include AI-generated content labeling mandates, corpus auditing in generative AI products, and app-store developer vetting with retrospective re-testing of live apps.

§China CAC enforcement policy

sing-box 1.14 enables Chrome QUIC fingerprint simulation for Hysteria2 by default, but the release notes explicitly warn that servers using Ed25519 certificates will experience handshake failure when this option is active, requiring operators to disable the fingerprint option or switch certificate algorithms.

§sing-box 1.14 defense

sing-box 1.14 breaks Apple platform continuity: users of the legacy App Store app 'sing-box VT' must manually migrate to the new 'sing-box MT' under a new developer account, while the macOS 'SFM' client is no longer distributed through the App Store at all. Profiles and settings from the old sandboxed app are not automatically inherited by the replacement.

§sing-box 1.14 Apple migration deployment

sing-box 1.14 deprecates several DNS configuration fields — including old address-filter fields, the old `strategy` action, and `rule_set_ip_cidr_accept_empty` — with removal planned for version 1.16. Configurations using these fields will continue running until 1.16 but accumulate silent technical debt.

§sing-box 1.14 deployment