Release 1.11.0

ShieldDNS 1.11.0

Note

Release Risk: Standard
This release introduces minor updates.

Affected areas: ⚙️ Go Backend (20 files · 32%) · 💻 Admin UI (29 files · 46%) · 🚀 CI/CD (5 files · 8%) · 📖 Docs (3 files · 5%)

📋 What's Changed

✨ New Features

• config: Dynamic multi-node failover and edge-case handling for Android and iOS profiles (5a4b3f1)
• worker: Render privacy-safe cluster status page in ShieldDNS dark theme (cabfc0f)
• cluster: Add cloudflare worker template, least-privilege proxy:worker token and UI generator (1b5ea44)
• privacy: Add Encrypted Client Hello (ECH) & HTTPS record configuration (a52d38f)
• doh3: Add configurable DoH3 toggle, cluster export sync and docs (208fb52)
• cluster: Add configurable query log replication and remote node badges (cb41578)
• tokens: Add dedicated cluster:sync permission scope with minimal privilege locking (4261f27)
• cluster: Add primary/replica federation and multi-environment profiles (804c256)
• doh3: Add HTTP/3 DoH server and DoQ CVE-2025-47950 hardening (216e760)
• privacy: Add dynamic GDPR transparency report to public landing page (f68ce40)
• mcp: Add security and client inspection MCP tools for autonomous management (da62eef)
• blocked-page: Add Unblock and Unblock & Reload buttons with login modal (0ea52a7)

🐛 Bug Fixes

• Coredns startup fix (0da7ef5)
• Small fix (e6a233e)
• dns: Remove unsupported ratelimit plugin from CorefileTemplate causing CoreDNS crash loop (0735cc1)
• deps: Downgrade quic-go and crypto to restore Go 1.25 compatibility for HA dev mode (bf4595d)
• Fix release workflow (1bfb248)
• deps: Update module github.com/quic-go/quic-go to v0.62.0 (9d2d27a)
• deps: Update go modules (#161) (a38e4bb)

🔒 Security

• security: Add CoreDNS query rate limiting and flood drop protection (be1799f)
• security: Enable Post-Quantum TLS 1.3 key exchange (X25519MLKEM768) (77c1052)
• auth: Offer passkey sign-in directly on primary login screen (c1960a5)

⚡ Performance

• github: Minimize GitHub API calls with ETag conditional requests and caching (056eaca)
• dns: Add failover and timeout parameters to CoreDNS forward blocks (4ee1b09)
• Optimize SQLite memory pragmas and cache pre-parsed templates (29b2339)
• dns: Optimize CoreDNS cache configuration for better hit rates (a5f7f9b)

♻️ Code Improvements

• admin: Split index.html into modular view and modal partials (97a77e0)

🎨 UI / UX

• dashboard: Add optional DoH proxy query filter to Live Query Log (44eea53)
• ui: Fix About page layout squeezing on mobile (cb4544e)
• ui: Add tap-to-reveal tooltips for mobile stat cards (26a9aac)

🔄 CI / CD

• deps: Upgrade dependencies and go to latest stable (732df52)

🔧 Maintenance

• deps: Update c-hive/gha-remove-artifacts action to v1.8.0 (#163) (39b3a64)
• deps: Update c-hive/gha-remove-artifacts action to v1.7.0 (#162) (ab83500)
• deps: Update golang:1.27-alpine docker digest to cf6fca6 (#160) (8eb981b)
• deps: Update golang:1.27-alpine docker digest to 26402d8 (#159) (3975e31)
• deps: Update docker/setup-qemu-action action to v4.3.0 (#158) (5282023)
• deps: Update softprops/action-gh-release action to v3.0.3 (#157) (497fd82)

📦 Other Changes

• Migrated outdated allowlist URL (e4328ca)

---

38 significant changes from 57 total commits since v1.10.5.

🐳 Docker Image

Official image available at: ghcr.io/faserf/shielddns:1.11.0