v0.7.35

What's Changed

• fix(deps): bump rustls to 0.23.45 (RUSTSEC-2026-0285, DEC-0034) by @scimbe in #222
• fix(setup): curl | bash one-liner aborts on unbound BASH_SOURCE (#218) by @scimbe in #223
• fix(setup.ps1): -Docker gets the resolved config; build from release tag by @scimbe in #226
• fix(ssh-owner): create the owner key's temp file exclusively by @scimbe in #227
• fix(setup): --docker gets the resolved config; CT_BOOTSTRAP out of argv by @scimbe in #225
• feat(setup): --client-only installs the CLI without the .env gate (#219) by @scimbe in #224
• fix(channel): harden handler subprocesses (secret env, bounded output, process group, redaction) by @scimbe in #232
• fix(transport): bound every QUIC control-stream ack by @scimbe in #229
• fix: bound the MASQUE dial; IPv6-safe peer sockets; super-peer survives ConnectionReset by @scimbe in #230
• fix(fallback): fixed reprobe schedule, UDP origins, no abort of consumed slots by @scimbe in #231
• fix(supervisor): never stop draining child stderr; forward SIGTERM/SIGINT by @scimbe in #233
• fix(storage): replace state and secret files atomically and durably by @scimbe in #234
• fix(acme): renew by certificate lifetime; DNS-01 checks that can pass by @scimbe in #235
• fix(http,login): keep credentials on their host; keep a non-rotated refresh token by @scimbe in #236
• chore: remove dead code; keep test-only code out of the release build by @scimbe in #238
• refactor: one copy of the hex/base64url/constant-time/clock/jitter helpers by @scimbe in #239
• refactor(fallback): FallbackCtx instead of 9-arg chains; fallback tunnels reach /metrics by @scimbe in #242
• fix(channel): serve members survive dial failures; no leaked ticker; bounded relay streams by @scimbe in #243
• fix(config): one reading of boolean env flags; blank CT_AGENT_STATE_DIR is unset by @scimbe in #237
• fix(serve): bound the unauthenticated direct listener and the TLS terminator by @scimbe in #240
• fix(events): budget the log lines a peer can trigger before authenticating by @scimbe in #241
• fix(config): re-resolve a hostname CT_AGENT_EDGE on every reconnect by @scimbe in #245
• chore(deps): pin CADS-Tunnel to v0.4.20 (#217, #45) by @scimbe in #228
• fix(p2p): tie DCUtR swarm drivers to their session; bound setup waits by @scimbe in #244
• fix(channel): bounded backoff + give-up cap for DCUtR serve dial failures by @scimbe in #246
• fix(security): SSH owner auth fails closed on streams that skip TLS by @scimbe in #247
• fix(security): share-link sessions are not the URL token; separate link lockout; same-origin redirect by @scimbe in #248
• fix(security): bound the observability listener; refuse DNS-rebound hosts on loopback by @scimbe in #249
• fix(security): hygiene from the security audit (log injection, token in logs, dir modes, symlinks, UDP injection, quoting, chown) by @scimbe in #250
• fix(self-update): download the checked tag, not latest; only plain version tags are newer by @scimbe in #251
• fix(install): verify what the installers download; fix the Docker build context by @scimbe in #252
• ci(release): least-privilege tokens; no credentials left in build checkouts by @scimbe in #253
• fix(fallback): an 'A' registration that dies parked is not a failed tunnel; e2e scrape test by @scimbe in #254
• fix(config): keep a resolved edge among replicas; share the learned address; pin re-resolution in the loop by @scimbe in #256
• Accept-Seite - Allowlist, Default aus, Abweisung mit Event by @scimbe in #257
• fix(security): channel/grant is callable only by configured grant issuers by @scimbe in #259
• feat(security): opt-in end-to-end check of the channel peer's grant by @scimbe in #260
• Channel: TCP-Weiterleitung, Initiate-Seite (Listener, Stream, Grenzen) – #255, Stand aus AUF-20260929-029 by @scimbe in #262
• Release 0.7.35 (TCP-Weiterleitung über Channels, #255) by @scimbe in #263

Full Changelog: v0.7.34...v0.7.35