The previous, outdated MacChanger has been replaced with native Network Manager config. It works great, there are a few cards that are known to not allow MAC spoofing, most of you won't be affected by this. And while at Network Manager, another config has been added to disable connectivity checks, although it's mostly just a nice touch, it was blocked by firewall anyways.
A few changes also happened to i2pd. Instead of creating a separate tunnel for wget, it now uses a "system" HTTP tunnel, which is used by applications utilizing the http_proxy, https_proxy, and ftp_proxy environment variables. One other application worth mentioning that uses this tunnel is Gajim, an XMPP client. Gajim doesn't have any other isolated tunnel, unlike HexChat.
Continuing, bandwidth share has been reduced a bit to 70% from previous 100%. Another thing, the set outproxy is now using exit.stormycloud.i2p's b32 address, although I've noticed StormyCloud has been having some issues for the past 2-3 weeks, and my attempts at reaching out have been useless, never got a response back, unfortunately. Talking about i2pd, I also stole i2pd's CSS stylesheet and edited it to use dark theme only, they are relying on system theme settings, which can't be used in private mode. You can find the theme in /var/lib/i2pd/webconsole/, or on Prestium's git server.
Prestium 1.3 comes with a few new applications, one such application is Feather wallet, replacing the official Monero wallet (+ extras), which made the resulting ISO smaller than the last 1.2.1 version, even after adding new applications, boot animation and other additional packages.
LibreWolf has been further hardened, for example, LibreWolf will now always start in private mode, cache memory has been disabled, and reverted default permissions for camera, VR, geo location, and desktop notifications, this is due to it being fingerprintable by permissions API. There is more that has changed for LibreWolf, everything is listed in the changelog below.

starting with the "boring," this update implements additional security, potentially privacy, features to Prestium, but since they are "low-level," I will name just a few of them, i.e. disabled kernel dumps, added protection against TCP Time-Wait assassination, and disabled kexec. For those further interested, you can see all security related changes in the changelog. These changes have been inspired by Whonix, Kicksecure, and /u/mark22k - thank you.

It's now possible to set the level of anonymity through the right-click menu (in "System" submenu). With this feature, you can easily change inbound and outbound tunnel length to 3, 5 and 8 hops. Changing between levels affects all tunnels, except for the SAM protocol. The implementation of this is rather hacky as there is no API for changing the tunnel length, and also forcibly restarts I2Pd after each change. This Openbox pipe menu is open source, you can read slightly more about how it works here.

A new, albeit experimental, bittorrent client has been added, qBittorrent 4.6.0, and replaced the previous "XD" client. This version had to be compiled from source, with a PR #18845 to fix the peer list (i2p peers not showing). To make qBittorrent work, latest libtorrent had to be compiled from source, too. Commits used to compile both qBittorrent and libtorrent are listed in the changelog. A dark theme (Dracula) is used by default, it wasn't looking nice in light theme, but you can always change between them in the settings.

I2Pd has been slightly reconfigured. The quantity for exploratory tunnels has been increased to 4, enabled IPv6, and I2PControl for restarting I2Pd, and in the next version of Prestium for an I2P monitoring widget (by /u/alreadyburnt, thank you). As per a request, tunnels for Postman's SMTP and POP3 services have been uncommented.

Last time, I made a poor decision to completely disable IPv6. While IPv6 has been re-enabled, it is still in a testing phase, and may misbehave. Network Manager's IPv6 privacy extension has been enabled, too. A thing to keep in mind, there are very few IPv6-enabled or IPv6-only routers, it may be stuck on "Testing" for a few hours before the Network status changes to "OK." If you do have IPv6 address assigned from your ISP, it would be very helpful if you, or someone else, could give me a feedback if it does, or doesn't, work.

HexChat no longer uses 3 separate tunnels (one for Ilita IRC, one for Irc2P, and a SOCKS proxy for any other IRC server), instead, it uses just single SOCKS proxy for all IRC servers. This was done to lower the total number of Client Tunnels. It does have a slight drawback, you are easily recognizable across different IRC servers, keep that in mind when connecting to multiple IRCs. Two new IRC servers have been added to the network list, and switched from memorable domains to b32 form, you will be able to connect faster, and also eliminates the need for jump-starting.

Last but not least, SpeedCrunch calculator has been recommended and added to Prestium for both simple and advanced maths. In previous Prestium version, GPG Frontend stopped working out of nowhere, updated client fixes it, and works again. This issue is unfortunately still present on the non-EE version.

A thank you goes to those who have helped with this Prestium version in any way, and in any capacity, even if the the change, feature or tool wasn't included in this version. That includes /u/NULLi2p, /u/mark22k, Vort, /u/huemob, /u/alreadyburnt, and others from private messages, and IRC.
Added

SpeedCrunch calculator
qBittorrent (built from source, commit 32a5555 + PR #18845)
Dracula dark theme for qBittorrent
Libtorrent (built from source, commit 272828e)
A script for changing inbound and outbound tunnel length (hops)
Right-click menu entry for SpeedCrunch and qBittorrent
Right-click submenu "Anonymity Level"
HexChat: two more IRC servers to the list, i.e. irc.nerds.i2p and irc.crustyirc.i2p (in b32 form)
sysctl: fs.suid_dumpable=0; prevent setuid processes from creating coredumps
sysctl: kernel.core_pattern=|/bin/false; disable core dumps
sysctl: net.ipv4.tcp_rfc1337=1; protect against time-wait assassination
sysctl: net.ipv4.tcp_timestamps=0; disable IPv4 timestamps
sysctl: net.ipv4.icmp_ignore_bogus_error_responses=1; ignore bogus ICMP error responses
sysctl: net.ipv6.conf.all.accept_ra=0; don't accept router advertisments
sysctl: net.ipv6.conf.default.accept_ra=0; -//-
sysctl: kernel.randomize_va_space=2; randomize mmap base, heap, stack and VDSO pages
sysctl: kernel.dmesg_restrict=1; Restrict kernel logs to root only
sysctl: kernel.kptr_restrict=2; hide kernel addresses in different files in /proc
sysctl: kernel.perf_event_paranoid=3; disallow kernel profiling
sysctl: kernel.kexec_load_disabled=1; kexec can be used to replace the running kernel
sysctl: kernel.printk=3 3 3 3; prevent kernel info leaks in console during boot
sysctl: vm.mmap_rnd_bits=32; improve ASLR effectiveness for mmap
sysctl: vm.mmap_rnd_compat_bits=16; -//-
sysctl: vm.swappiness=1; Only swap out of runtime memory if absolutely necessary
sysctl: vm.unprivilieged_userfaultfr=0; restrict userfaultfd() syscall to root
sysctl: dev.tty.ldisc_autoload=0; restrict loading TTY line disciplines to CAP_SYS_MODULE
Security limits (/etc/security/limits.conf): added * hard core 0
Security limits (/etc/security/limits.conf): added * soft core 0

Changed

i2pd: enabled I2PControl
i2pd: enabled IPv6
i2pd: uncommented Postman's SMTP and POP3 tunnels
i2pd: increased inbound and outbound tunnel quantity for exploratory tunnels from 3 to 4
Ferm: uncommented IPv6 rules
Network Manager: enabled IPv6 privacy extension
Boot partition's size reduced from 20MB to 10MB
HexChat: IRC servers now use their b32 addresses

Removed

XD & XD-Cli torrent client
ipv6.disable=1 boot option
i2pd: separate tunnels for irc.ilita.i2p and irc.postman.i2p

Updated

i2pd to 2.47.0
LibreWolf to 113.0-1
Feather wallet to 2.4.5-a
Audacity to 3.3.2
GPG Frontend to 2.1.0
Linux Kernel to 5.10.0-22
Other Debian packages

This release, I2P 2.4.0, continues our effort to improve the security and stability of the I2P network. It contains significant improvements to the Network Database, an essential structure within the I2P network used for disovering your peers. The congestion handling changes will improve network stability by giving routers the ability to relieve congested peers by avoiding them. This will help the network limit the effect of tunnel spam. It will also help the network heal during and after DDOS attacks. The NetDb changes also help secure individual routers and the applications that use them. Routers can now defend against attackers by separating the NetDB into multiple "Sub-DB's" which we use to prevent information leaks between applications and the router. This also improves the information available to Java routers about their NetDB activity and simplifies our support for multihoming applications. Also included are a number of bug-fixes and enhancements across the I2PSnark and SusiMail applications. As usual, we recommend that you update to this release. The best way to maintain security and help the network is to run the latest release.

RELEASE DETAILS

Changes

Router: Restructure netDb to isolate data recieved as a client from data recieved as a router
Router: Implement handling and penalties for congestion caps
Router: Temp. ban routers publishing in the future
NetDB: Lookup handler/throttler fixes
i2psnark: Uncomment and fix local torrent file picker

Bug Fixes

i2ptunnel: Exempt tunnel name from XSS filter (Gitlab #467)
i2ptunnel: Fix gzip footer check in GunzipOutputStream (Gitlab #458)
SAM: Fix accept after soft restart (Gitlab #399)
SAM: Reset incoming socket if no subsession is matched (Gitlab #456)

This release, I2P 2.5.0, provides more user-facing improvements than the 2.4.0 release, which was focused on implementing the NetDB isolation strategy.

New features have been added to I2PSnark like the ability to search through torrents. Bugs have been fixed to improve compatibility with other I2P torrent clients like BiglyBT and qBittorrent. We would like to thank all of the developers who have worked with libtorrent and qBittorrent to enable and improve their I2P support. New features have also been added to SusiMail including support for Markdown formatting in emails and the ability to drag-and-drop attachments into emails. Tunnels created with the Hidden Services manager now support "Keepalive" which improves performance and compatibility with web technologies, enabling more sophisticated I2P sites.

During this release we also made several tweaks to the NetDB to improve its resilience to spam and to improve the router's ability to reject suspicious messages. This was part of an effort to "audit" the implementation of "Sub-DB isolation" defenses from the 2.4.0 release. This investigation uncovered one minor isolation-piercing event which we repaired. This issue was discovered and fixed internally by the I2P team.

During this release several improvements were made to the process of releasing our downstream distributions for Android and Windows. This should result in improved delivery and availability for these downstream products.

As usual, we recommend that you update to this release. The best way to maintain security and help the network is to run the latest release.

RELEASE DETAILS

Changes

I2PTunnel: Implement support for Keepalive/Server-side Persistence
Susimail: Add markdown support for formatted plain-text content
Susimail: Add HTML Email support
I2PSnark: Add search capability
I2PSnark: Preserve private=0 in torrent files
Data: Store compressed RI and LS
Bug Fixes

Susimail: Fix handling of forwarded mail with attachments
Susimail: Fix handling of forwarded mail with unspecified encoding
Susimail: Fix forwarding of HTML-only email
Susimail: Bugfixes in presentation of encoded attachmments, mail body
I2PSnark: Handle data directory changes
SSU2: Cancel peer test if Charlie does not have B cap
SSU2: Treat peer test result as unknown if Charlie is unreachable
Router: Filter additional garlic-wrapped messages
I2CP: Prevent loopback messages to same session
NetDB: Resolve Exploratory/Router isolation-piercing event