Serve HTTP, HTTPS, and SOCKS5 clients on the same listen address. SOCKS5 TLS streams use the MITM/uTLS path, while non-TLS streams are forwarded as plain TCP.
Select outbound uTLS fingerprints globally or by upstream host with the new fingerprint catalog, hot-reloadable configuration, and --tls-profile-file routes.
Monitor active and recent traffic with the optional --tui dashboard, structured log levels, and opt-in payload dumping.
Reorganize runtime code into focused internal packages and expand unit and end-to-end coverage.
Build Linux, Windows, and macOS archives for AMD64 and ARM64 with SHA-256 checksums. Stable releases also publish multi-platform GHCR images with SBOM and provenance attestations.
Breaking CLI changes
The runtime flags have been renamed:
-addr and -port → --listen
-cert and -key → --ca-cert and --ca-key
-client, -version, and -fingerprint → --tls-fingerprint
