v2.1.0

https:// benchmarks now run on OpenSSL 3.5.7 instead of BoringSSL. Same
protocol, same code above it, a different implementation underneath — if you
compare TLS numbers across this release, compare them knowing that. Cleartext
benchmarks are untouched.

Why change it again

2.0.0 moved from std.crypto.tls to ztls over a Zig-built BoringSSL, because
HTTP/2 over TLS needs ALPN and std.crypto.tls has none. That worked. It also
left zrk and zoxy — which share a TLS stack,
a benchmark harness and a comparability rule — sitting on two different
libcryptos.

Only one of the two could move. BoringSSL has no CRYPTO_set_mem_functions,
and zoxy installs a fixed libcrypto heap through exactly that API; without it
the proxy refuses to start rather than run without its allocation budget. So
the shared libcrypto had to be OpenSSL, and zrk is the side that moves.

zrk gains nothing functionally from this — it installs no allocation hooks, and
BoringSSL served it perfectly well. What it gains is not being the odd one out:
one libcrypto, one set of CVEs to track, one thing to audit.

What it is

zoxy-io/openssl — OpenSSL 3.5.7, the
LTS line, supported to April 2030 — carrying
allyourcodebase/openssl#5
for the aarch64 assembly upstream ships only for x86_64.

Still one static binary per platform, still four platforms, still
cross-compiled from a single runner.

Also

• The release workflow builds the four targets in parallel (15 minutes down to
  about 5) and can be rehearsed without publishing anything.

Upgrading

Nothing to do. No flags, output or behaviour change. If you pin zrk beside
zoxy for comparable runs, move both.