v0.6.0

Highlights

• Serve HTTP, HTTPS, and SOCKS5 clients on the same listen address. SOCKS5 TLS streams use the MITM/uTLS path, while non-TLS streams are forwarded as plain TCP.
• Select outbound uTLS fingerprints globally or by upstream host with the new fingerprint catalog, hot-reloadable configuration, and --tls-profile-file routes.
• Monitor active and recent traffic with the optional --tui dashboard, structured log levels, and opt-in payload dumping.
• Reorganize runtime code into focused internal packages and expand unit and end-to-end coverage.
• Build Linux, Windows, and macOS archives for AMD64 and ARM64 with SHA-256 checksums. Stable releases also publish multi-platform GHCR images with SBOM and provenance attestations.

Breaking CLI changes

The runtime flags have been renamed:

• -addr and -port → --listen
• -cert and -key → --ca-cert and --ca-key
• -client, -version, and -fingerprint → --tls-fingerprint
• -fingerprint-config → --tls-fingerprint-file
• -upstream-tls-config → --tls-profile-file
• -upstream → --upstream-proxy
• -list-fingerprints → --list-tls-fingerprints
• -debug → --log-level debug; use --dump-traffic to log payload data

Go 1.26.5 or newer is required when building from source.

Full Changelog: v0.5.1...v0.6.0