clash-verge-rev/clash-verge-rev
A modern GUI client based on Tauri, designed to run in Windows, macOS and Linux for tailored proxy experience
How clash-verge-rev is put together
Clash Verge Rev is a cross-platform desktop GUI (Windows/macOS/Linux) for the Clash Meta (mihomo) proxy kernel, built as a Tauri 2 application. The frontend is React 19 + TypeScript served inside the system webview, communicating with a Rust backend exclusively through Tauri IPC commands and events; the Rust side manages the embedded mihomo core lifecycle, generates/enhances YAML configs (Merge and Script via an embedded JS engine), controls system proxy and TUN mode, and supports an optional privileged Windows service plus WebDAV config backup. The repo is a Cargo workspace (root app crate src-tauri plus seven helper crates) alongside a pnpm-managed Vite frontend. No server-side datastore exists; state lives in local YAML/JSON config files, with secrets such as WebDAV credentials and subscription URLs persisted locally.
Languages
Frameworks
Infrastructure
Major components
Rust core (src-tauri)
Tauri application library (app_lib) implementing IPC commands, config generation/enhancement, system proxy guard, TUN mode, tray, and mihomo process/service management.
Frontend UI (src/pages)
React router pages for home, proxies, profiles, connections, rules, logs, unlock testing, and settings rendered in the webview.
Frontend hooks (src/hooks)
Reusable React hooks binding UI state to mihomo WebSocket streams (traffic, connections, memory, logs), profile management, and system/service state.
Services layer (src/services)
Bridge between UI and backend: typed command wrappers (cmds.ts), event subscriptions, SWR query client, i18n init, updater, and WebDAV status.
Workspace crates
Modular Rust libraries: clash-verge-draft (config drafting), clash-verge-i18n (YAML locale catalogs), clash-verge-media-unlock (streaming/AI region-unlock checks), clash-verge-logging, clash-verge-signal, clash-verge-limiter, and a custom Tauri sysinfo plugin.
Media unlock module (crates/clash-verge-media-unlock)
Per-provider detectors (Netflix, Disney+, YouTube, ChatGPT, Claude, Gemini, TikTok, Spotify, Bahamut, Bilibili, Prime Video) that test node accessibility.
Service/sidecar integration
Installs or reuses a privileged helper service for core management via clash_verge_service_ipc, with dev modes preserving or forcing sidecar operation.
Build/release tooling (scripts/, Makefile.toml)
Node scripts for dev orchestration, updater artifact generation, portable builds, version fixing, and i18n key hygiene.
A quieter week focused on small but meaningful fixes to Tun Mode defaults, subscription errors, system proxy resilience, and a fresh macOS app icon.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week focused on small but meaningful fixes to Tun Mode defaults, subscription errors, system proxy resilience, and a fresh macOS app icon.
Week of 2026-08-17
The busiest week of the month delivered version 2.5.4 with dozens of stability fixes, including safer core upgrades, smoother proxy node management, and better port handling.
Week of 2026-08-10
A major rewrite of the system proxy logic landed this week, plus rules can now be moved between top or bottom of the list and Traditional Chinese translations were completed.
Week of 2026-08-03
This week added a 'liquid glass' icon option for macOS, made profile deletion safe to roll back, and included heavy dependency upkeep with improved Russian localization.
Week of 2026-07-27
A large infrastructure-focused week fixed app freezes and node selection persistence, overhauled the core run-state handling and IPC layer, and updated many dependencies.
Over the past month the team shipped a steady stream of reliability fixes around system proxy handling, core upgrades, and profile updates, alongside a version 2.5.4 release. A recurring theme was making the app more resilient: retrying transient failures, avoiding false conflicts on restart, and cleaning up after failed upgrades. There were also polish efforts, including a new macOS 'liquid glass' icon, improved Linux theming and proxy hints, and a wave of dependency maintenance.
Week by week
2026-08-24A quieter week focused on small but meaningful fixes to Tun Mode defaults, subscription errors, system proxy resilience, and a fresh macOS app icon.latest6 changes
Fix
Reset IPv6 fake-IP range default
Tun Mode now uses a standard default IPv6 address range so it works correctly out of the box.
Fix
Surface subscription update failures
When a subscription fails to update, that failure now properly reaches the user interface instead of being silently swallowed.
Fix
Restrict external URL opening
A security tightening limits which external links the app is allowed to open.
Fix
More reliable Windows system proxy
The app retries transient system proxy write failures and stays usable even when the proxy core isn't ready yet.
Refactor
Reduced idle background work
The app does less unnecessary processing when sitting idle, saving resources.
Feature
New macOS app icon via Icon Composer 2
Mac users get an updated, modernized application icon.
2026-08-17The busiest week of the month delivered version 2.5.4 with dozens of stability fixes, including safer core upgrades, smoother proxy node management, and better port handling.6 changes
Chore
Version 2.5.4 release
A new release was cut bundling the week's many fixes and service updates.
Fix
Atomic mihomo core upgrades
Core updates are now installed safely in one step instead of letting the core self-update mid-run, preventing broken states.
Fix
Stop mixed port climbing on every restart
Restarting the app no longer causes the network port number to keep increasing each time.
Feature
Manually unfix proxy nodes
Users can now release a pinned ('fixed') proxy node by hand when they want automatic selection back.
Fix
Platform-specific proxy bypass separators
Proxy bypass lists now use the correct separator character for each operating system, fixing broken bypass entries.
Feature
Faster auto-update intervals for profiles
Subscriptions can now be set to auto-update more often than once per day.
2026-08-10A major rewrite of the system proxy logic landed this week, plus rules can now be moved between top or bottom of the list and Traditional Chinese translations were completed.6 changes
Refactor
System proxy logic rewritten
The code that sets your computer's system proxy was rebuilt from scratch, making it far more robust across platforms.
Feature
Move rules between prepend and append
Users can now reposition traffic rules between the top and bottom of their rule lists.
Fix
Clearer Linux proxy error hints
Linux users now see an explicit message naming any missing command needed to set the system proxy, and the dconf command is no longer mandatory.
Fix
Avoid false port conflicts after quick relaunch
Quickly restarting Clash no longer triggers a mistaken 'port already in use' fallback.
Fix
Traditional Chinese strings completed
The backend's Traditional Chinese translations were filled in for full language coverage.
Chore
Supply-chain attack protection enabled
Automated dependency updates got extra security protections against tampered packages.
2026-08-03This week added a 'liquid glass' icon option for macOS, made profile deletion safe to roll back, and included heavy dependency upkeep with improved Russian localization.6 changes
Feature
Liquid glass icon support
Users on modern macOS versions can choose a new translucent 'liquid glass' style app icon.
Fix
Rollback-safe profile deletion
Deleting a configuration profile now rolls back cleanly if something goes wrong, instead of leaving broken state.
Refactor
Media unlock checker extracted into its own crate
The code that checks whether streaming services are accessible was split into a separate reusable component.
Chore
Improved Russian localization
Russian translations were reviewed and polished.
Fix
Safe YAML parsing utility added
A shared helper now parses YAML config files safely, reducing crash risk from malformed content.
Fix
Profile card switching overlay
Switching profiles now shows a visual overlay on the card so the state change is clear.
2026-07-27A large infrastructure-focused week fixed app freezes and node selection persistence, overhauled the core run-state handling and IPC layer, and updated many dependencies.6 changes
Fix
Fixed app freeze on proxy refresh event
The app no longer freezes when a proxy configuration refresh event fires.
Fix
Node selection persistence
Your chosen proxy node now sticks reliably across sessions.
Refactor
Core run-state overhaul
How the app tracks whether the proxy core is running was redesigned for consistency and easier maintenance.
Refactor
Mihomo IPC refactor
Communication between the app and the proxy core was restructured, improving reliability.
Fix
Consistent health probes and sidecar fallback
Service health checks and the fallback to running without the service now behave predictably, including after failed actions.
Fix
Keep current proxy menus interactive
Tray and menu controls for the active proxy stay clickable during updates.
Dependencies and code review
Dependency advisories
Security Watch
5 vulnerable packages (7 advisories) across 82 scanned dependencies.
tar 7.5.15
3 advisories. Fixed in 7.5.19.
How it can be abusedIf a user restores or opens a maliciously crafted archive file, for example a tampered WebDAV backup or a core package from a hijacked download source, the app can freeze or crash because the tar parser loops forever or blows the stack on bad entry sizes and deep paths. Only users who deliberately feed the app an attacker-controlled tar archive are affected.
- criticalGHSA-23hp-3jrh-7fpwnode-tar: Decompression/parse DoS via unlimited input
- highGHSA-8x88-c5mf-7j5wnode-tar: Negative tar entry size causes infinite loop in archive replace
- highGHSA-r292-9mhp-454mnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
axios 1.16.1
1 advisory. Fixed in 0.33.0.
How it can be abusedThis flaw lives in the Node.js HTTP adapter, letting an attacker who already controls request config redirect traffic through a proxy they choose. In this repo, axios only runs in the browser-style webview for the React frontend, so the affected code path is never exercised and users of Clash Verge Rev are not realistically impacted.
- highGHSA-gcfj-64vw-6mp9Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
js-yaml 5.0.0
1 advisory. Fixed in 5.2.2.
How it can be abusedA malicious or hijacked proxy subscription feed can contain a specially crafted YAML file that makes the parser take exponentially longer as it grows, freezing the app's interface when the config is loaded or edited. Anyone who adds a subscription URL they do not fully trust, which is the normal use of this app, is exposed.
- highGHSA-pm4m-ph32-ghv5js-yaml: Exponential parsing time in flow collections leads to denial of service
react-router 8.0.0
1 advisory. Fixed in 7.18.2.
How it can be abusedThis flaw only matters when React Router runs on a server handling form actions over HTTP, letting a malicious website trick a victim's browser into running those actions. Clash Verge Rev uses React Router only inside the desktop webview with no exposed server endpoint, so an outside attacker has nothing to target and users are not affected.
- highGHSA-qwww-vcr4-c8h2React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
vite 8.0.14
1 advisory. Fixed in 8.0.16.
How it can be abusedThis flaw only exists in Vite's development server, which lets someone on the network read files from a Windows developer's machine that should have been blocked. It affects only developers running the app's dev server locally, not users of the built Clash Verge Rev application.
- highGHSA-fx2h-pf6j-xcffvite: `server.fs.deny` bypass on Windows alternate paths
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required