0.3.0

A security and correctness release: it clears most of the open Dependabot alerts and fixes a series of defects in the proxy lifecycle, several of which meant a suite could run green against a proxy that was not working.

Breaking changes

• listen_host now defaults to 127.0.0.1 instead of 0.0.0.0. The old default exposed an intercepting proxy on every network interface of the machine. Pass 0.0.0.0 explicitly if the proxy really must be reachable from elsewhere.
• A custom response that sets only headers, or only a status code, now keeps the rest of the original response instead of discarding it.

Fixed

• Stop Mitm Proxy did not release its port. Master.shutdown() only signals the event loop and the proxyserver addon has no teardown hook, so the socket stayed bound and restarting the proxy failed with EADDRINUSE.
• Start Mitm Proxy with no certificates directory raised TypeError, because mitmproxy rejects confdir=None — so the default call, as documented in the README, could never work.
• Startup failures were swallowed. mitmproxy logs bind errors rather than raising them, so a suite ran green against a proxy that never came up.
• The response hook grew three lists on every response, leaking memory and slowing every later lookup.
• The blocklist matched on pretty_host while documenting pretty_url, so entries containing a path silently blocked nothing.
• A blocking time.sleep in the response hook stalled every concurrent flow, not just the delayed one.
• Add Response Delay accepted an invalid time string and only failed later, inside the proxy, far from the keyword that caused it.
• Reusing an alias silently created a second entry that could not be removed.
• Removing an unknown alias raised TypeError instead of warning.
• logger.error() was called with an also_console argument it does not accept, so reporting a failed custom response failed itself.

Dependencies and security

• Dropped wheel from the runtime dependencies. It is a build tool that nothing in MitmLibrary imports, and its constraint is what pinned a vulnerable version for every consumer.
• Requires mitmproxy ^12.2.2; setuptools and pytest bumped and the lock file regenerated.
• Added dependabot.yml so the backlog does not rebuild.
• SECURITY.md documents the advisories that cannot be resolved while mitmproxy declares upper bounds on cryptography, tornado, msgpack and h2.

Tooling

Unit tests run on Python 3.12–3.14 across Linux, Windows and macOS; the acceptance suite runs on Linux. Linting moved to ruff, mypy and robocop.

---

This release is published retroactively: the v0.3.0 tag and the PyPI release already existed, but no GitHub release was created at the time.