v0.3.0

0.3.0 (2026-10-19)

Features

• acme: migrate instant-acme 0.7 -> 0.8 (2f5d1c8)
• admin: cache purge, and one cache instead of five (f2fb376)
• bot-detect: honeypot edge feed + bot_ip_tracking replay (526d962)
• config: make enable_signatures, worker_threads, enable_ipv6, (7751f1a)
• conformance: 27 live listeners, and four verdict bugs found by running them (fd99671)
• conformance: all 14 HTTP/3 anomalies, and three more of my own bugs (15fd66c)
• conformance: catalogue, verdicts and frame writer for the client suite (4c8044c)
• conformance: h3-conformance, a CI driver that drives your client (cff4104)
• conformance: reports, sessions that actually correlate, and a fifth verdict class (a5808fc)
• conformance: six QUIC-layer tests, and an honest outcome for tests that did not run (722a875)
• early-hints: exact-path matching for per-page 103 preloads (1551e11)
• fingerprints: distribute the GeoIP databases with the JA3 database (a8d0978)
• geoip: refresh the GeoLite2 masters, and sync to the path each node reads (a951324)
• limits: enforce connection rate, pool caps and connect timeout (0a57aa8)
• logging: make [logging] file real, with size-based rotation (1a3d239)
• quic: full multipath via noq, server-side ECH, configurable Retry (d75c6f4)
• quic: implement QUIC v2 (RFC 9369) in the noq fork, advertise v1+v2 (08aed32)
• quic: make the multipath path budget configurable (42cbe73)
• routes: apply remove_headers, and make the body-size override real (3e93012)
• security: fingerprint QUIC clients, expose ECH, share security state (5191ce9)
• security: resolve per-route policy before the security checks run (21a321a)
• startup: probe the bound listener, and emit the attestation as fields (eee6262)
• startup: probe WAF, rate limiting and mTLS enforcement (b0fa941)
• startup: verify the cryptographic runtime instead of describing it (2101c24)
• tls: real ML-KEM-1024 session tickets (dad03ba)
• tls: serve ML-DSA-87 (FIPS 204) server certificates per SNI (0a525f9)
• webtransport: advertise v1+v2 on the WebTransport endpoint (2a77339)

Bug Fixes

• cache: bypass response cache for Range requests on h1/h2 path (7af88f7)
• cache: never store a response carrying a CSP nonce (1ba6205)
• config: make every PQC and timeout flag do what it says (2f92ba5)
• conformance: verify every expected_code against the published RFC text (ac6f197)
• conformance: verify the seven unbuilt QUIC tests, and record how each was checked (f6f73d8)
• deny: restore itertools/redox_syscall skips (needed under CI --all-features) (496909c)
• deps: update crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204) (f154273)
• fingerprints: stop the weekly refresh from deleting curated JA3 entries (ebf95cb)
• fingerprint: the JA3 database now decides something (205f507)
• geoip: anchor the placeholder-credential check to the directives (fb3f50b)
• head: stop synthesizing content-length: 0 on HEAD responses (0392cee)
• logging,waf: stop benign h3 closes logging as errors; honour pentest bypass (370d500)
• logging: make [logging] level and format actually control logging (6cc1933)
• net: canonicalize IPv4-mapped peer addresses at accept boundary (ee72eb7)
• ocsp: stop warning hourly about certificates with no responder (3f085ce)
• security: enforce WAF on the HTTP/3 path (e75d469)
• security: reconcile the synced blocklist so unblocks actually take effect (4411b32)
• startup: share the live SecurityState, and probe both rate limiters (35ce06e)
• tls: gate ML-DSA certificate support out of fips builds (0fbee2d)
• waf: exempt public download endpoints from scanner-UA block; enforce backend request timeout (e4bfb3e)
• waf: stop truncating request bodies over 64KB during body scanning (a38752a)