Colitu VPN for Windows 2.8.5

Colitu VPN for Windows 2.8.5

• API certificate pinning: the Colitu API, its mirrors and the endpoint list are reached only over certificates whose validated chain ends at the ISRG (Let's Encrypt) or Google Trust Services roots, so a root certificate installed on the device cannot read sign-in or session traffic. The check ends on 31 December 2027, so an old app never locks itself out.
• Update manifest freshness: latest.json keeps the old signature for older versions and adds signature_v2 over issued_at/expires_at; 2.8.5+ refuse a manifest older than 30 days or past its expiry.
• Independent security review fixes: the kill switch service never deletes an untrusted data folder as SYSTEM and locks down the install folder; support downloads go to an admin-only folder; the elevated app loads no native DLLs from %TEMP% and no startup hooks; the local proxy never listens on the LAN; bounded Shadowsocks link parsing; import accepts share links only; unused legacy code (AmazTool, old main window, unsigned old updater) removed.
• "Only selected apps" mode: DNS of those apps goes through the tunnel.
• Adaptive Connect: a transport that already worked on the current network gets a 90 s penalty after a mid-session stall instead of 10 minutes, so the tunnel returns to it soon after a short UDP block; a dead warm spare is replaced after at most 2 minutes of light traffic; a new network no longer reuses the previous network's memory.
• Adaptive Connect 3.0 parts (start order from anonymous network hints, recovery set for when the API is unreachable) are in the code but switched off in this release.

Download: https://colitu.com/download · Release notes: https://docs.colitu.com/changelog/windows