v0.2.0

0.2.0 (2026-10-12)

⚠ BREAKING CHANGES

• extras: ActivityLogger no longer takes a Clock nor exposes formatLogEntry and getFullUrl; lines are written when the exchange ends rather than when the response head is sent.

Features

• add HTTP/3 options to the bootstrap and properties (762408b)
• admin listener, readiness and drain (fe6a9c6)
• ClientHello inspection, SNI host rules, transparent HTTPS, ALPN mirroring and reverse mode (e6fbb1a)
• content views with schema-less protobuf and gRPC decoding (ba65b61)
• contentviews: show DNS messages as dig does (190274f)
• core: add ScriptCallObserver, which sees every call into a script (b6a91e5)
• core: add server states, drain with Envoy's strategies, a drain time and a health check (1b908ac)
• core: count bytes to and from clusters, and HTTP/3 clients' bytes (4213928)
• core: count chained proxies' failovers and backoffs, and those backing off (6aca5d2)
• core: count CONNECT-UDP flows, their datagrams, capsules and refusals, and the UDP hooks (71416b4)
• core: count HTTP/2 codec events both ways under Envoy's http2 names (89f3147)
• core: count HTTP/3 codec events, early data, Alt-Svc origins and TCP fallbacks (205f6c9)
• core: count QUIC connections by scope as they close, and write their qlog (11634a5)
• core: count requests, connections and clusters under Envoy's stat names (30a52ae)
• core: count SOCKS clients by version, refused authentication and replies by code (b0c2e7e)
• core: count SOCKS clients' tunnels as a kind of their own (f7bb3e9)
• core: count the hooks' calls, errors, drops, rewrites and latency per family (fe92c48)
• core: count transparent QUIC flows, their drops by reason and relayed bytes (2a9c8d2)
• core: count tunnels by kind and WebSocket sessions, frames, messages and close codes (05b9f9d)
• core: describe an UpstreamProxyManager's proxies with their credentials masked (29c06ad)
• core: give each exchange a failure, Envoy-style response flags and details (a628b6a)
• core: let an exchange's trace start spans of the proxy's own work (fbb179b)
• core: record each exchange, tunnel and flow when it ends (6dbae5e)
• core: resolve per-protocol, hook and chained-proxy stats once per proxy (18eadb2)
• core: serve Envoy's admin API on a listener of its own (49ecbb5)
• core: total each exchange's script calls, and log them with %MP_SCRIPT_*% (fdfd36c)
• dns: encode DNS messages and read them through a public view (1b2e81d)
• extras: add Envoy-style access-log filters with a compact syntax (9acaac7)
• extras: compute JA3 and JA4 fingerprints of a ClientHello (5029b30)
• extras: flag requests the concurrency limiter refuses as rate limited (0257b39)
• extras: parse Envoy-compatible access-log format strings once (40241ed)
• extras: register the concurrency limiter's state as stats (5ff1921)
• extras: show response flags and details in HttpLogger lines (7b84f54)
• extras: write access logs per finished exchange through the new formatter (1b4d37b)
• forward a client's absolute-form requests inside a session to the session's server (d00811a)
• forward a CONNECT inside a plain HTTP session to the HTTP proxy (0bb2528)
• forward a CONNECT inside an intercepted session to the intercepted server (4785380)
• forward CONNECT inside an intercepted session to the intercepted HTTPS proxy (df917ee)
• forward proxy requests inside sessions to the proxy the client chose (0a672c5)
• HTTP/2 and HTTP/3 frame interception, with Starlark on_frame and an http3-codec module (ff6de8d)
• HTTP/3 forward-proxy listener, CONNECT, WebSockets and MASQUE CONNECT-UDP over HTTP/3 (4467192)
• http3: answer 421 for other hosts on intercepted HTTP/3 connections (a9edf4b)
• http3: choose the congestion controller of the proxy's QUIC connections (3e73d48)
• http3: resume clients' QUIC sessions, and take 0-RTT with --http3-0rtt (c60292a)
• http3: resume sessions with servers and send safe requests as 0-RTT data (f296349)
• http3: serve HTTP/3 next to a forward proxy's TLS listener (a8a24d4)
• http3: serve HTTP/3 to clients of a reverse proxy (103cb9c)
• http3: speak HTTP/3 to servers known to support it (7a46b25)
• http3: tunnel CONNECT over HTTP/3 request streams (c06565d)
• http3: WebSockets over HTTP/3 with extended CONNECT (RFC 9220) (d96dee2)
• http3: WebSockets to HTTP/3 servers that enable extended CONNECT (d992165)
• intercept TLS that does not carry HTTP and relay it through the TCP hooks (a5846cb)
• join WebSocket messages and read through permessage-deflate (aaacf2a)
• launcher: add --access-log, --access-log-format, --access-log-json and --access-log-filter (2970289)
• launcher: add --admin-port, --admin-address, --admin-token, --drain-time, --drain-strategy and the health-check flags (de9b21d)
• launcher: add --log-http-view and --proto-descriptors (a89f890)
• launcher: add --masque-intercept-quic and --masque-quic-ports (ce4a921)
• launcher: add --metrics, --statsd, --dogstatsd, --stats-prefix and cluster bounds (dabe823)
• launcher: add --mode socks5 and --socks (cea1512)
• launcher: add --qlog-dir and --qlog-max-files for per-connection qlog files (95c0686)
• launcher: add --quic-congestion cubic|newreno|bbr (2fb5f71)
• launcher: add --quic-hosts (293a7ae)
• launcher: add --script-max-steps, --script-max-time, --script-max-alloc and --script-name (ee311d6)
• launcher: add --transparent-quic-port, its relay idle timeout and --http3-retry (dcc7175)
• launcher: add the CONNECT-UDP template, idle timeout and flow limits (79d2fa2)
• launcher: add the HTTP/3 flags and a TLS listener from a key store (b010126)
• live HTTP/3 in the proxy: reverse-mode h3, upstream h3 and live frame interception (0e7121f)
• masque: decide on QUIC inside CONNECT-UDP flows as on transparent QUIC (a8520d3)
• masque: proxy UDP with CONNECT-UDP over HTTP/3 (RFC 9298) (b03bf8c)
• message framing for QUIC stream hooks, with DNS and protobuf decoders (e5e06cc)
• metrics registry with Envoy-style stats, Prometheus and statsd (f4b51f6)
• mitmproxy-style addons, flow filters, HAR export and replay (efccd57)
• name HTTP/3 in HttpVersion and FlowContext (bfb4255)
• open CONNECT tunnels on HTTP/2 connections to servers (6d3b269)
• OpenTelemetry traces, metrics and logs over OTLP, with no dependencies (9e72395)
• otel: add a microproxy-otel module with W3C, B3 and Jaeger propagation and samplers (4394758)
• otel: encode OTLP traces, metrics and logs as protobuf and JSON (01369ea)
• otel: export the spans an exchange's trace starts as its INTERNAL children (0623fe2)
• otel: trace exchanges and export spans, metrics and access logs over OTLP/HTTP (9824ee7)
• otel: turn OpenTelemetry on from the launcher (28485a7)
• per-exchange failures, Envoy response flags and Envoy-compatible access logs (9cb1d71)
• per-protocol and hook stats, QUIC connection stats and qlog (9410b1d)
• permessage-deflate codec for WebSocket relays (b066198)
• proxy: keep QUIC flows going when their clients move (405b142)
• quic-tls: NewSessionTicket, PSK resumption and 0-RTT with an anti-replay policy (278a5c5)
• quic-tls: PSK binder, early traffic secret and resumption PSK in the key schedule (082df7b)
• quic-tls: stateless ticketer with rotating AES-GCM keys, and a client ticket cache (36ea414)
• quic: 0-RTT packets, remembered transport parameters and NEW_TOKEN (97081d0)
• quic: add a virtual-thread I/O runtime and blocking connection and stream API (d7375ea)
• quic: add ACK frequency state (b970171)
• quic: add connection ID generation, issuance and retirement (01e6278)
• quic: add connection timer table (a11f52e)
• quic: add DPLPMTUD path MTU discovery with black hole detection (e285b51)
• quic: add every RFC 9000 frame, DATAGRAM and ACK frequency, with budgeted encoders and a validating decoder (b75fdb3)
• quic: add packet and header protection keys, Initial keys per version, key updates and Retry integrity (b5b4c6d)
• quic: add packet headers, partial decoding, coalesced datagrams, packet numbers and packet protection (134bca5)
• quic: add packet number spaces, sent-packet tracking and ACK generation (df4f6c5)
• quic: add QuicInterceptor, hooks for the streams and datagrams of intercepted QUIC (a679839)
• quic: add range set, stream reassembly and send buffer (91c3f79)
• quic: add RFC 9002 loss detection, PTO and persistent congestion (d7ed16b)
• quic: add RTT estimator and NewReno and CUBIC congestion control (322e13e)
• quic: add sealed Retry and NEW_TOKEN address validation tokens (7ac891e)
• quic: add streams with state machines, flow control and priorities (c5709e9)
• quic: add the BBR congestion controller, ported from quinn (18aa3d6)
• quic: add the encryption levels, cipher suites, secrets and errors the handshake and packet protection share (de03391)
• quic: add the sans-I/O connection state machine (2063061)
• quic: add the sans-I/O endpoint with Retry, Version Negotiation and stateless resets (1934f90)
• quic: add the TLS 1.3 codec, handshake messages and extension payloads, ported from rustls (f9188fc)
• quic: add the TLS 1.3 key schedule, transcript, key exchange and signatures, checked against RFC 8448 (8c8b082)
• quic: add the TLS session for QUIC with its client and server handshakes (330965e)
• quic: add token-bucket pacer and injectable nanosecond clock (0b3807f)
• quic: add transport parameters with per-role validation, GREASE and version information (810cc44)
• quic: add transport, endpoint, server and client configuration (555e811)
• quic: add variable-length integers, connection IDs, versions 1 and 2, and stateless reset tokens (0c68ac3)
• quic: BBR congestion control (6ab0cc6)
• quic: carry a bandwidth estimate in ControllerMetrics (46fa687)
• quic: connection migration, path validation and preferred address (defede0)
• quic: connections, endpoints, a blocking stream API and aioquic interop (2d5278f)
• quic: cut stream bytes into messages with framers (cd5aaa0)
• quic: expose connection statistics, endpoint counts and a connection observer (09e635f)
• quic: expose the ClientHello random for key logging (e2ede1f)
• quic: follow migrating clients, probe new paths, preferred address (074e325)
• quic: leave the packet builder unchanged when a header does not fit (aef4669)
• quic: let a congestion controller set the pacing rate (5da50e6)
• quic: let a server filter the datagrams no connection claims (50bb7d9)
• quic: let an endpoint take its randomness from EndpointConfig (0f6a817)
• quic: migrate client connections to new sockets (88ec345)
• quic: packets, frames, transport parameters and packet protection (b7016f9)
• quic: port quinn's BBR max filter and bandwidth estimator (2c96c0e)
• quic: rebind a client connection without probing the new path (5ca6be4)
• quic: report the anti-amplification budget (b15aa78)
• quic: report the key exchange group of a connection (063bf85)
• quic: resumption and 0-RTT in the blocking API (cfe8529)
• quic: sample the delivery rate per packet (a49eecd)
• quic: session resumption, 0-RTT and NEW_TOKEN, in the QUIC module and the proxy (85b4296)
• quic: show intercepted QUIC streams to hooks as whole messages (989446b)
• quic: streams, flow control, loss recovery and congestion control (5dbd2f5)
• quic: TLS 1.3 handshake for QUIC, client and server (c88063c)
• quic: unbound servers, per-connection configurations and awaitStopped (3d5c70c)
• raw TCP hooks and TLS interception for non-HTTP protocols (a9dd6bb)
• relay tcp_hosts as raw TCP even when they look like HTTP (d822f6d)
• serve SOCKS5 and SOCKS4a clients (466055a)
• SOCKS5 and SOCKS4a server (f149dbe)
• starlark: add on_quic_start, on_quic_stream_data, on_quic_datagram and on_quic_end (ad80688)
• starlark: add on_udp_start, on_udp_message and on_udp_end (810b88c)
• starlark: count calls into scripts under hooks.starlark (cf8bf43)
• starlark: count the bytes of the values a call creates, against a budget (d9e2758)
• starlark: count what the re, base64, digest, codecs, url, protobuf, grpc and dns builtins make (76c6e2f)
• starlark: ctx.forwarded_via names the intercepted proxy a request goes through (d0ec163)
• starlark: ctx.socks_version tells SOCKS clients apart (bba5a7a)
• starlark: expose ctx.failure, ctx.response_flags and ctx.response_code_details (223e08e)
• starlark: give regular expressions and pbkdf2 the call's nanosecond deadline (db9eeea)
• starlark: give scripts a stats module of bounded script.<name> metrics (5c07b57)
• starlark: measure each hook call per script and hook, with a memory budget (a254140)
• starlark: on_quic_message, a dns module and framers in scripts (ade6b31)
• starlark: on_tcp_start, on_tcp_message and on_tcp_end (1084730)
• starlark: on_websocket_message and websocket_message() (4fe4da1)
• starlark: per-hook execution metrics, memory/time/step budgets and hook spans (db64329)
• starlark: protobuf and grpc modules (09978e9)
• starlark: show scripts the exchange's trace, and let them add to its span (b87609e)
• starlark: tell early data with ctx.early_data (1f57bf6)
• starlark: tell transparent QUIC flows with ctx.transparent_quic (e369968)
• starlark: trace each hook call as a span of its exchange (37edff5)
• stats: add a registry of Envoy-named metrics and their Prometheus exposition (7815e3e)
• stats: count framed QUIC messages, the message hook and framing errors (50ef2e0)
• stats: count QUIC migrations, NAT rebindings and failed path validations (d6c8aef)
• stats: extract the per-protocol stats' tags and add microsecond buckets (5dff377)
• stats: push metrics to statsd and DogStatsD from a virtual thread (01a8442)
• stats: render only the metrics a predicate accepts, and tell used ones (c5c7b34)
• stats: tag script hook stats with the script, the hook and the exhausted budget (c9a08b2)
• stream hooks for non-HTTP/3 QUIC, and interception of QUIC inside MASQUE flows (b7dad57)
• TCP stream hooks for raw tunnels (6a3d592)
• tls: hand key material and trust managers to TLS stacks other than the JDK's (c9e8f7d)
• trace: add a FlowTracer hook for distributed tracing of exchanges and flows (c9f93af)
• transparent QUIC/HTTP/3 interception on UDP 443 (57d2781)
• transparent: intercept or relay QUIC redirected to a transparent UDP port (79e7335)
• transparent: intercept QUIC that is not HTTP/3 stream by stream (6ee27e6)
• transparent: read a QUIC client's ClientHello from its Initial packets (2d3eb29)
• udp: add UdpInterceptor, hooks for the datagrams of UDP flows (a4612cc)
• WebSocket message hooks and permessage-deflate (c927b69)
• WebSocketMessage and the filterWebSocketMessage hooks (2c3089b)

Bug Fixes

• a TCP tunnel whose TLS closes whole after its client finished ends without an error (e203abc)
• core: close the listeners before the state says DRAINING (c374625)
• core: count a frame interceptor's added frames as a rewrite, and keep qlog times from going negative (70fa804)
• core: count SOCKS replies before sending them, and the RTT of every connection that completed its handshake (25b1555)
• core: end a request's active count only after the rest of it is counted (6f2098f)
• core: end QUIC connections', tunnels' and CONNECT-UDP flows' active counts only after the rest of them is counted (820801f)
• core: keep a + in admin query parameters a plus (f45e647)
• core: record misdirected HTTP/2 requests and client read timeouts (b481048)
• core: record refused clients, relayed QUIC upstreams and resets that fail the server side (1ff039b)
• core: say stream_idle_timeout in the details of idle tunnels and UDP flows (76d4140)
• core: wait for the acceptor when the listeners close (d0088bf)
• dns: show IPv6 addresses in the short form (45389f0)
• forwarded tunnels read the ClientHello, as CONNECT tunnels do (e823915)
• HTTP/2 WebSocket and CONNECT stream gaps, plus interception of CONNECT streams (7a87703)
• http3: advertise the reverse proxy's HTTP/3 when stripping left no Alt-Svc (6e77b5d)
• http3: close with the connection error's code, and tell a reset response from a finished one (67841ae)
• http3: count a client's reset before its stream's exchange learns of it (958fead)
• http3: count a client's reset before its stream's exchange learns of it (c61cf2d)
• http3: share one anti-replay record among the proxy's QUIC servers (2127782)
• launcher: show the default allocation budget, 256m (1f99c36)
• mirror an HTTP/1.1-only client's ALPN when forwarding CONNECT (1f38d8d)
• otel: end a SERVER span no earlier than its CLIENT spans (626fcbc)
• otel: extract as OpenTelemetry's composite propagator does (e964e7e)
• otel: take a CLIENT span's scheme and protocol from the real connection (95db55c)
• quic: close a connection relayed stream by stream with its client connection (1aa4200)
• quic: contain unexpected exceptions to the connection that raised them (e65b8dd)
• quic: document DeliveryRate's constructor, and give hasRetransmits its comment back (4402c80)
• quic: keep reporting a stream reset to later reads (fefbdec)
• quic: leave a connection application limited when a poll runs out of data (d57888f)
• quic: let each stream's relay threads go when the stream ends (91280f6)
• quic: let migrate wait for a probe already under way (e5fccc5)
• quic: make BBR follow the BBRv1 draft where quinn's port does not (7b644aa)
• quic: probe for 1-RTT data sent before the handshake is confirmed (7f3e19c)
• quic: queue a new connection's first datagram before others can reach it (6cfa7e4)
• quic: queue a new connection's first datagram before others can reach it (0525233)
• quic: run QUIC relayed stream by stream with the chosen congestion controller (99140e1)
• quic: send 0-RTT data again after a Retry (c85fb8f)
• quic: send one close datagram per occasion and tolerate runtimes without jdk.net (0874567)
• quic: update keys only once the handshake is confirmed, and never send empty datagrams (d2cfd31)
• quic: validate a path by a PATH_RESPONSE that comes back on any path (cebeeb1)
• read the ClientHello in tunnels that a session's proxy opens (1be193c)
• send a client's own CONNECT to a chained proxy only for its target (c781987)
• starlark: make the default allocation budget 256 MiB a call (ce1ceb6)
• starlark: put the stats module's method comments before their annotations (db0ba75)
• starlark: report excessive bytes repeats as before, and let a new allocation budget re-arm a thread (07fd522)
• stop waiting for HTTP/2 connections held up by a ClientHello (ae69752)
• TCP hooks name a tunnel's own server, never its session's (d6fb572)
• treat frames on a stream closed both ways as a connection error at once (1b07b54)
• treat frames on a stream closed both ways as a connection error at once (62aaa24)
• write logged trailers with the shared JSON writer (aefad89)

Documentation

• connection migration, the preferred address and relayed clients that move (a2b07f8)
• content views, gRPC and protobuf inspection, and script modules (1bc9cb6)
• core: describe where the stats live and how QUIC is counted (0257132)
• describe BBR, its departures from quinn, and --quic-congestion (fb06a31)
• describe large QUIC ClientHellos without naming a browser (e716617)
• describe OpenTelemetry tracing and OTLP export (d89dc57)
• describe QUIC resumption, 0-RTT, NEW_TOKEN and their replay safety (35f4418)
• describe transparent QUIC, its iptables rules and NAT, and who keeps Alt-Svc h3 (2ad02ce)
• document Envoy-compatible access logs, response flags and filters (a96a14d)
• document hook call spans, and where trace attributes go (322af83)
• document metrics, their Envoy names, Prometheus labels and cardinality bounds (6985719)
• document scripts' budgets, the allocation estimate, per-hook stats and %MP_SCRIPT_*% (8167e53)
• document the admin interface, readiness, draining and shutdown (502f38e)
• document the per-protocol, hook and chained-proxy stats, and qlog files (99f25f7)
• forwarded tunnels decide by the client's first bytes, as CONNECTs do (88e5694)
• give the raw-session decision's order in its Javadoc (dd1459f)
• how SOCKS tunnels and raw tunnels reach the TCP hooks (eb2ee8f)
• http3: an HTTP/3 forward-proxy listener, CONNECT, WebSockets and MASQUE over HTTP/3 (166a726)
• http3: describe a forward proxy's HTTP/3, and streams as sockets over HTTP/3 too (c4580a0)
• http3: describe HTTP/3 to clients and servers, and live HTTP/3 frames (5a7253b)
• impl: describe HTTP/3 roles, tunnels, WebSockets and CONNECT-UDP flows (256e78a)
• MicroProxy in front of an HTTP proxy, and who picks the server (65a0eed)
• MicroProxy in front of an HTTPS proxy (81480b2)
• QUIC message framing, on_quic_message and the dns module (02dd210)
• QUIC stream hooks, --quic-hosts, QUIC inside CONNECT-UDP flows and the transparent QUIC decision (0223eec)
• quic: describe connections, endpoints and the blocking API (003b0d7)
• quic: describe delivery rate sampling, BBR's departures from quinn, and seeded pairs (f086f31)
• quic: describe the connection internals (7b773c7)
• quic: describe the GREASE value bound by its source (7aa868e)
• quic: describe the packet layer, its versions and its limits (34d6d39)
• quic: describe the TLS 1.3 handshake API, what it supports and what is out of scope (c706364)
• quic: document QuicException's error code field (ccb2b12)
• quic: document serialized exception fields and stream write results (bb61711)
• quic: document the HTTP/3 interop and build its dependency in CI (c336ad2)
• quic: document the serialized error code so javadoc has no warnings (fecd9bd)
• quic: record loopback throughput and the connection fuzz test (a372c87)
• raw TCP streams, TLS that does not carry HTTP, TCP hosts and the script hooks (af24723)
• SOCKS5 mode, its replies and authentication (687a5dc)
• starlark: QuicContext serves on_quic_message too (eece9a6)
• WebSocket messages, permessage-deflate and the script examples (2fed6e5)