v0.3.0

0.3.0 (2026-10-13)

⚠ BREAKING CHANGES

• launcher: java -jar microproxy.jar serves HTTP/2 to clients that offer h2 and speaks it to servers that pick h2, where it used to need --http2 and --http2-upstream (with the http2-codec jar, which the -all jar bundles). Pass --no-http2 --no-http2-upstream to keep HTTP/1.1.
• core: HTTP/2 is on by default to clients and to servers. Clients that offer h2 on intercepted TLS or the proxy's TLS listener now get HTTP/2, and servers that pick h2 when the proxy reaches them over TLS are spoken to in HTTP/2, where both used to get HTTP/1.1. Filters see such requests with version HTTP/2.0, and the streams of one client connection run concurrently. To keep HTTP/1.1, call withHttp2(false) and withHttp2Upstream(false) (properties http2=false and http2_upstream=false). Without the http2-codec module nothing changes.

Features

• a switch for TLS origination of clients' https:// requests, and fix their scheme in later script hooks (fdad513)
• core: add an h2c-only listener (921c47a)
• core: coalesce HTTP/2 connections to servers across names (dc8e7b2)
• core: make TLS origination for clients' https:// requests a switch (9a466ee)
• core: per-request upstream TLS handshake timeout (d558eef)
• core: speak HTTP/2 to chained proxies (5d95e13)
• core: turn HTTP/2 to clients and servers on by default (302ee02)
• HTTP/2 connection coalescing to servers (a7c25a6)
• HTTP/2 to chained proxies (69a33f5)
• http1: opt-in acceptance of Transfer-Encoding with Content-Length (fcb5a6d)
• http2-codec: read and write the ORIGIN frame (RFC 8336) (8be1a6f)
• http: decode Brotli with jaybrotli, and keep br when rewriting bodies (c60bffe)
• launcher: add --http2-coalesce (b761042)
• launcher: add --no-http2 and --no-http2-upstream (48d7e71)
• launcher: add --no-originate-tls (1184080)
• launcher: describe h2:// and h2c:// upstream proxies in --help (1719beb)
• loadtest: Envoy, goproxy, g3proxy and Squid as comparison proxies (ffac523)
• loadtest: guard the cross-proxy runs against other work on the machine (10f0f99)
• loadtest: keep verdicts apart from self-checks, and gate on MicroProxy (ece760b)
• loadtest: let a lone noisy step pass the rate sweep (f846796)
• loadtest: match the benchmarks' equal-settings choices (475268b)
• loadtest: system-level load and capacity harness (72ade9a)
• loadtest: system-level load and capacity harness, MicroProxy vs LittleProxy (8cc5928)
• loadtest: test external proxies, and record what else used the CPU (175448d)
• masque: CONNECT-UDP over HTTP/2 and HTTP/1.1 (34bf2d1)
• masque: serve CONNECT-UDP over HTTP/2 and HTTP/1.1 (2183d96)
• optional PROXY protocol, LittleProxy-faithful CONNECT 200, opt-in chunked+Content-Length (8a193c3)
• otel: add microproxy.upstream_protocol to spans and log records (ad9dab0)
• per-request TLS handshake timeout and RetryBackoff policies (0a03ff1)
• proxy-protocol: optional PROXY protocol, trusted sources, bounded header reads (cc91e95)
• quic: tell whether the peer is done with a stream, read or not (fc70132)
• tls: choose the server name and verification host per request (94b658f)
• tls: classify server TLS failures by their cause chain (92cb50e)
• tls: retry a server's handshake without SNI after unrecognized_name (0b3e7cc)
• tls: TLS failure reasons, per-request SNI/verification host, retry without SNI (ddb1744)

Bug Fixes

• admin graceful drain race, stats double-read, QUIC relay test idle timeout (4729e21)
• admin: begin a graceful drain before answering /drain_listeners (4e66595)
• compat: write the CONNECT 200 without response filters in LittleProxy mode (42e95d2)
• loadtest: correct OOM detection, port allocation and client memory (123aeec)
• loadtest: publish perf results with repository-relative paths (7e253c1)
• loadtest: record an external proxy's config under a relative results directory (acf503e)
• masque: give a CONNECT-UDP flow's places back before the client learns it ended (2698998)
• masque: give a CONNECT-UDP flow's places back before the client learns it ended (cfa529b)
• masque: give a flow's places back as the proxy reads the client's end of it (15ad370)
• masque: give a flow's places back as the proxy reads the client's end of it (0a4ecb2)
• masque: read a datagram's context ID in whichever length it is encoded (0f6413c)
• quic: time the key discard by the current PTO (c404880)
• quic: time the key discard by the current PTO (2342732)
• starlark: keep an absolute request's scheme for later hooks (6538727)
• stats: read each metric once when dumping the stats (965b3ba)

Performance Improvements

• http: encode br with jaybrotli's default strategies (f744200)

Documentation

• add the load-testing page and link it with the benchmarks page (caae6ae)
• animate how the architecture differs from LittleProxy's (f82b005)
• Brotli stream bounds, and its measured speed and size (b0f4a78)
• describe HTTP/2 on by default (0ca2013)
• describe load-test verdicts, the gate, and LittleProxy's slow readers (b524af5)
• describe the benchmarks against LittleProxy (1781512)
• describe the jaybrotli Brotli codec and br rewriting (d39cef4)
• document HTTP/2 connection coalescing to servers (6a6f829)
• document HTTP/2 to chained proxies (74091ca)
• document TLS origination for https:// proxy requests (1dede4e)
• drop the in-flight list from the docs contribution guide (aa7e58f)
• link the README's gRPC claim to the grpcio interop tests (f77acb6)
• list the retry without SNI among the compatibility-mode differences (7ac7470)
• masque: document CONNECT-UDP over HTTP/2 and HTTP/1.1 (02a8046)
• measured comparison with Envoy, Go, Rust and Squid proxies; animated architecture page (478d93e)
• per-request TLS handshake timeout and retry backoff policies (11abde1)
• publish a measured comparison with Envoy, Go, Rust and Squid proxies (460d5db)
• split the README into a documentation site (48ca28a)