v0.4.0

0.4.0 (2026-10-16)

Features

• api: expose the local address and the PROXY header destination on FlowContext (eccedff)
• chained-proxy: make the backoff budget part of RetryBackoff (193b2e5)
• loadtest: bootstrap a dedicated machine for the cross-proxy comparison (664be11)
• loadtest: count the Windows host's load against runs on WSL2 (9d8d13d)
• loadtest: proxy-java setting to run the JVM proxies on another JDK (194d6c2)
• loadtest: refine the sweep's knee and record proxy CPU per request (d649211)
• loadtest: take the page's memory figures from a separate run (f53ab01)
• mitm: mitm_server_handshake (deferred or eager), with failover either way (d8c03d5)
• per-protocol policies with LittleProxy compatibility as a preset; MITM handshake timing, generated responses, backoff budget, flow addresses (4733482)
• policy: generated_responses, and FlowContext.responseSource() (0c282c9)
• policy: protocol policies per client protocol; LittleProxy compatibility as a preset (6f037ab)

Bug Fixes

• core: an immediate drain no longer closes connections accepted after it began (e1bf0f3)
• http3: send an HTTP/3 request's body as its HTTP/1 head is framed (f2ed3fa)
• loadtest: give the g3proxy build the Rust toolchain setup.sh installed (76fcd96)
• loadtest: keep the kernel's socket buffers out of the memory scenario's limit (e9fd612)
• loadtest: keep the kernel's socket buffers out of the memory scenario's limit (39aa8c5)
• loadtest: pick measurement cores by topology, and install any distribution's Squid (990ae65)
• loadtest: reject WSL2 runs without the Windows log, and leave the port range alone there (9f71c4a)
• mitm: deferred TLS failover keeps pool accounting and the request's retry budget (6975e71)
• tls: a retry without SNI is part of the attempt the server rejected (3f20681)

Performance Improvements

• core: ask a server connection's local address once (86c2c23)
• core: keep the idle timeout of keep-alive waits without a timer per wait (20307ea)
• cut virtual-thread hand-offs per request (one write per small response, shared idle deadlines, direct poller registration on JDK 21) (588d406)
• http1: send a small response's head and body in one write (48478bb)
• launcher: register socket waits directly on JDK 21 (c35d1da)

Documentation

• loadtest: state WSL2's core-placement limitation for the methodology (30efd83)
• perf: dedicated-machine benchmark campaign, page redesign and harness hardening (724c99b)
• perf: drop the WSL2 campaign from the caveats (54fc25c)
• perf: memory results with socket buffers beside the cap (8260e0b)
• perf: publish the dedicated-machine campaign (a8f467c)
• perf: publish the memory runs with socket buffers beside the cap (681acc7)
• perf: redesign the performance page's charts and tables (fb95260)
• say how the one-core cost table was measured, and why its p99 is not the sweep's (114e33f)
• what a request costs on one core, and which JDK to run (fc23f3e)

v0.3.0

0.3.0 (2026-10-13)

⚠ BREAKING CHANGES

• launcher: java -jar microproxy.jar serves HTTP/2 to clients that offer h2 and speaks it to servers that pick h2, where it used to need --http2 and --http2-upstream (with the http2-codec jar, which the -all jar bundles). Pass --no-http2 --no-http2-upstream to keep HTTP/1.1.
• core: HTTP/2 is on by default to clients and to servers. Clients that offer h2 on intercepted TLS or the proxy's TLS listener now get HTTP/2, and servers that pick h2 when the proxy reaches them over TLS are spoken to in HTTP/2, where both used to get HTTP/1.1. Filters see such requests with version HTTP/2.0, and the streams of one client connection run concurrently. To keep HTTP/1.1, call withHttp2(false) and withHttp2Upstream(false) (properties http2=false and http2_upstream=false). Without the http2-codec module nothing changes.

Features

• a switch for TLS origination of clients' https:// requests, and fix their scheme in later script hooks (fdad513)
• core: add an h2c-only listener (921c47a)
• core: coalesce HTTP/2 connections to servers across names (dc8e7b2)
• core: make TLS origination for clients' https:// requests a switch (9a466ee)
• core: per-request upstream TLS handshake timeout (d558eef)
• core: speak HTTP/2 to chained proxies (5d95e13)
• core: turn HTTP/2 to clients and servers on by default (302ee02)
• HTTP/2 connection coalescing to servers (a7c25a6)
• HTTP/2 to chained proxies (69a33f5)
• http1: opt-in acceptance of Transfer-Encoding with Content-Length (fcb5a6d)
• http2-codec: read and write the ORIGIN frame (RFC 8336) (8be1a6f)
• http: decode Brotli with jaybrotli, and keep br when rewriting bodies (c60bffe)
• launcher: add --http2-coalesce (b761042)
• launcher: add --no-http2 and --no-http2-upstream (48d7e71)
• launcher: add --no-originate-tls (1184080)
• launcher: describe h2:// and h2c:// upstream proxies in --help (1719beb)
• loadtest: Envoy, goproxy, g3proxy and Squid as comparison proxies (ffac523)
• loadtest: guard the cross-proxy runs against other work on the machine (10f0f99)
• loadtest: keep verdicts apart from self-checks, and gate on MicroProxy (ece760b)
• loadtest: let a lone noisy step pass the rate sweep (f846796)
• loadtest: match the benchmarks' equal-settings choices (475268b)
• loadtest: system-level load and capacity harness (72ade9a)
• loadtest: system-level load and capacity harness, MicroProxy vs LittleProxy (8cc5928)
• loadtest: test external proxies, and record what else used the CPU (175448d)
• masque: CONNECT-UDP over HTTP/2 and HTTP/1.1 (34bf2d1)
• masque: serve CONNECT-UDP over HTTP/2 and HTTP/1.1 (2183d96)
• optional PROXY protocol, LittleProxy-faithful CONNECT 200, opt-in chunked+Content-Length (8a193c3)
• otel: add microproxy.upstream_protocol to spans and log records (ad9dab0)
• per-request TLS handshake timeout and RetryBackoff policies (0a03ff1)
• proxy-protocol: optional PROXY protocol, trusted sources, bounded header reads (cc91e95)
• quic: tell whether the peer is done with a stream, read or not (fc70132)
• tls: choose the server name and verification host per request (94b658f)
• tls: classify server TLS failures by their cause chain (92cb50e)
• tls: retry a server's handshake without SNI after unrecognized_name (0b3e7cc)
• tls: TLS failure reasons, per-request SNI/verification host, retry without SNI (ddb1744)

Bug Fixes

• admin graceful drain race, stats double-read, QUIC relay test idle timeout (4729e21)
• admin: begin a graceful drain before answering /drain_listeners (4e66595)
• compat: write the CONNECT 200 without response filters in LittleProxy mode (42e95d2)
• loadtest: correct OOM detection, port allocation and client memory (123aeec)
• loadtest: publish perf results with repository-relative paths (7e253c1)
• loadtest: record an external proxy's config under a relative results directory (acf503e)
• masque: give a CONNECT-UDP flow's places back before the client learns it ended (2698998)
• masque: give a CONNECT-UDP flow's places back before the client learns it ended (cfa529b)
• masque: give a flow's places back as the proxy reads the client's end of it (15ad370)
• masque: give a flow's places back as the proxy reads the client's end of it (0a4ecb2)
• masque: read a datagram's context ID in whichever length it is encoded (0f6413c)
• quic: time the key discard by the current PTO (c404880)
• quic: time the key discard by the current PTO (2342732)
• starlark: keep an absolute request's scheme for later hooks (6538727)
• stats: read each metric once when dumping the stats (965b3ba)

Performance Improvements

• http: encode br with jaybrotli's default strategies (f744200)

Documentation

• add the load-testing page and link it with the benchmarks page (caae6ae)
• animate how the architecture differs from LittleProxy's ([f82b005](f82b005...

v0.2.0

0.2.0 (2026-10-12)

⚠ BREAKING CHANGES

• extras: ActivityLogger no longer takes a Clock nor exposes formatLogEntry and getFullUrl; lines are written when the exchange ends rather than when the response head is sent.

Features

• add HTTP/3 options to the bootstrap and properties (762408b)
• admin listener, readiness and drain (fe6a9c6)
• ClientHello inspection, SNI host rules, transparent HTTPS, ALPN mirroring and reverse mode (e6fbb1a)
• content views with schema-less protobuf and gRPC decoding (ba65b61)
• contentviews: show DNS messages as dig does (190274f)
• core: add ScriptCallObserver, which sees every call into a script (b6a91e5)
• core: add server states, drain with Envoy's strategies, a drain time and a health check (1b908ac)
• core: count bytes to and from clusters, and HTTP/3 clients' bytes (4213928)
• core: count chained proxies' failovers and backoffs, and those backing off (6aca5d2)
• core: count CONNECT-UDP flows, their datagrams, capsules and refusals, and the UDP hooks (71416b4)
• core: count HTTP/2 codec events both ways under Envoy's http2 names (89f3147)
• core: count HTTP/3 codec events, early data, Alt-Svc origins and TCP fallbacks (205f6c9)
• core: count QUIC connections by scope as they close, and write their qlog (11634a5)
• core: count requests, connections and clusters under Envoy's stat names (30a52ae)
• core: count SOCKS clients by version, refused authentication and replies by code (b0c2e7e)
• core: count SOCKS clients' tunnels as a kind of their own (f7bb3e9)
• core: count the hooks' calls, errors, drops, rewrites and latency per family (fe92c48)
• core: count transparent QUIC flows, their drops by reason and relayed bytes (2a9c8d2)
• core: count tunnels by kind and WebSocket sessions, frames, messages and close codes (05b9f9d)
• core: describe an UpstreamProxyManager's proxies with their credentials masked (29c06ad)
• core: give each exchange a failure, Envoy-style response flags and details (a628b6a)
• core: let an exchange's trace start spans of the proxy's own work (fbb179b)
• core: record each exchange, tunnel and flow when it ends (6dbae5e)
• core: resolve per-protocol, hook and chained-proxy stats once per proxy (18eadb2)
• core: serve Envoy's admin API on a listener of its own (49ecbb5)
• core: total each exchange's script calls, and log them with %MP_SCRIPT_*% (fdfd36c)
• dns: encode DNS messages and read them through a public view (1b2e81d)
• extras: add Envoy-style access-log filters with a compact syntax (9acaac7)
• extras: compute JA3 and JA4 fingerprints of a ClientHello (5029b30)
• extras: flag requests the concurrency limiter refuses as rate limited (0257b39)
• extras: parse Envoy-compatible access-log format strings once (40241ed)
• extras: register the concurrency limiter's state as stats (5ff1921)
• extras: show response flags and details in HttpLogger lines (7b84f54)
• extras: write access logs per finished exchange through the new formatter (1b4d37b)
• forward a client's absolute-form requests inside a session to the session's server (d00811a)
• forward a CONNECT inside a plain HTTP session to the HTTP proxy (0bb2528)
• forward a CONNECT inside an intercepted session to the intercepted server (4785380)
• forward CONNECT inside an intercepted session to the intercepted HTTPS proxy (df917ee)
• forward proxy requests inside sessions to the proxy the client chose (0a672c5)
• HTTP/2 and HTTP/3 frame interception, with Starlark on_frame and an http3-codec module (ff6de8d)
• HTTP/3 forward-proxy listener, CONNECT, WebSockets and MASQUE CONNECT-UDP over HTTP/3 (4467192)
• http3: answer 421 for other hosts on intercepted HTTP/3 connections (a9edf4b)
• http3: choose the congestion controller of the proxy's QUIC connections (3e73d48)
• http3: resume clients' QUIC sessions, and take 0-RTT with --http3-0rtt (c60292a)
• http3: resume sessions with servers and send safe requests as 0-RTT data (f296349)
• http3: serve HTTP/3 next to a forward proxy's TLS listener (a8a24d4)
• http3: serve HTTP/3 to clients of a reverse proxy (103cb9c)
• http3: speak HTTP/3 to servers known to support it (7a46b25)
• http3: tunnel CONNECT over HTTP/3 request streams (c06565d)
• http3: WebSockets over HTTP/3 with extended CONNECT (RFC 9220) (d96dee2)
• http3: WebSockets to HTTP/3 servers that enable extended CONNECT (d992165)
• intercept TLS that does not carry HTTP and relay it through the TCP hooks (a5846cb)
• join WebSocket messages and read through permessage-deflate (aaacf2a)
• launcher: add --access-log, --access-log-format, --access-log-json and --access-log-filter (2970289)
• launcher: add --admin-port, --admin-address, --admin-token, --drain-time, --drain-strategy and the health-check flags ([de9b21d](https://...

v0.1.1

0.1.1 (2026-10-09)

Bug Fixes

• build: prepare signed artifacts for Maven Central (634bac0)
• build: preserve project URLs in published child POMs (cc5bf5a)

v0.1.0

0.1.0 (2026-10-09)

Features

• --chained-proxy-backoff flag for retry backoff between chained proxies (a41c3e5)
• --log-http / --log-http-json and log_http properties (2f790cf)
• authenticate hook lets a Starlark script be the proxy authenticator (581fdbe)
• build HttpFilters from lambdas (8fe1e28)
• carry the connection id in log lines and record when connections are accepted (df0dac6)
• digest.equal compares secrets in constant time (1fbc9a1)
• extras: ConcurrencyLimiter caps exchanges in progress per key (7752ce8)
• extras: HttpLogger logs whole requests and responses (8360483)
• hardening, observability, scripting and LittleProxy test parity (91af61a)
• hardening, observability, scripting and LittleProxy test parity (#3) (91af61a)
• HTTP/2 version and per-stream flow contexts (303a0fb)
• HTTP/2 WebSockets, CONNECT streams and TLS listener (phase 3b) (6a80673)
• http2-codec: add field validation and flow-control accounting (ef41b14)
• http2-codec: add HPACK encoder and decoder (17baf5d)
• http2-codec: add HTTP/2 frame reader and writer (7b50bd7)
• http2-codec: support RFC 8441 extended CONNECT (4eacef7)
• JSON_EXTENDED access log with response source and timings (d203991)
• let filters and a FailureResponder answer the proxy's own failures (301671f)
• let MITM managers decide per client connection (7c6532f)
• log TLS handshakes with their outcome and certificates (02abb53)
• negotiate HTTP/2 on the proxy TLS listener (03c991b)
• on_failure hook for Starlark scripts with Failure values (5746211)
• optional backoff between chained proxy attempts (3348651)
• per-request connect timeout from filters (1ab97bb)
• pin TLS protocol versions on every TLS socket (30d64a6)
• proxyToClientResponseSent hook, SelectiveFilters and HttpBodies.decodedPrefix (0407a16)
• read-only script constants from Java and --script-var / --script-var-file (c098bad)
• record per-exchange timings and report completed responses (98a48c3)
• relay request and response bodies at once between HTTP/2 streams (146635e)
• request-aware proxy authentication (41e7287)
• res.source, res.upstream_status and ctx.timings for Starlark scripts (29598b5)
• rewrite and drop WebSocket frames from filters and scripts (1b3b8f5)
• serve h2c with prior knowledge on the plain listener (b1faed7)
• serve HTTP/2 to clients on intercepted TLS (42299ac)
• speak HTTP/2 to origin servers that negotiate h2 (386ee6d)
• starlark: load() standard library modules in scripts (2b8fce8)
• starlark: port starlarky's Python-compatible standard library (3f3ef23)
• starlark: req.http_version (98f1c23)
• starlark: typed scripts (8133dcb)
• starlark: vendor starlarky's Larky runtime on the JDK (e4fc255)
• strip h3 alternatives from Alt-Svc when intercepting or transparent (b5a09c9)
• strip tracing headers from requests sent upstream (7117c1a)
• tell trackers where each response came from and what the server sent (9ed0a90)
• tunnel CONNECT and WebSockets through HTTP/2 streams (e36748b)
• warn when HTTP/2 is enabled without interception (03bdc92)
• withLittleProxyCompatibility() for filters that depend on LittleProxy's behaviour (a1f63be)

Bug Fixes

• a chained proxy whose name does not resolve is a ConnectFailed (e6e5f62)
• accept port 0 in the address property (38ec195)
• answer frames on HTTP/2 streams the client closed with STREAM_CLOSED (1ddffd6)
• bound TLS handshakes with an overall deadline (ebe82e7)
• call proxyToServerConnectionSSLHandshakeStarted for encrypted chained proxies (5f0b1d8)
• credit the connection window for a malformed stream's DATA (c3e4ed9)
• discard the server's body when proxyToClientResponse replaces a streamed response (543de40)
• do not report proxyToServerConnectionFailed when the server name did not resolve (85533e0)
• end an HTTP/2 stream with the head of an empty response (414490f)
• end bodiless requests with a LastHttpContent for request filters (fa93583)
• frame filter-made full responses by the response, not the client stream (e97b3f1)
• keep PROXY-header connections out of the shared pool (7993ab2)
• log from built filters returned by a lambda filters source (d68774c)
• name the option when a launcher value is invalid (4c7ef6f)
• plain-text error bodies that do not echo the request ([4212e7d](4212e7dd8d35fe213db...