DNS Proxy: all versions and old releases

### Added

• `config.dist.yaml` is now packed into release packages (#513).

### Changed

• Interface method [`upstream.Upstream.Exchange`] now accepts a context.
• Function [`upstream.ExchangeParallel`] now accepts a context.
• Function [`upstream.ExchangeAll`] now accepts a context.

[`upstream.Upstream.Exchange`]：https://pkg.go.dev/github.com/AdguardTeam/dnsproxy@v0.86.0/upstream#Upstream.Exchange
[`upstream.ExchangeParallel`]： https://pkg.go.dev/github.com/AdguardTeam/dnsproxy@v0.86.0/upstream#ExchangeParallel
[`upstream.ExchangeAll`]： https://pkg.go.dev/github.com/AdguardTeam/dnsproxy@v0.86.0/upstream#ExchangeAll

### Removed

• Package [`fastip`] is no longer exported.

[`fastip`]：https://pkg.go.dev/github.com/AdguardTeam/dnsproxy@v0.85.0/fastip

### Added

• Method [`proxy.Config.Validate`].
• Method [`proxy.UpstreamConfig.Validate`].
• Method [`proxy.Proto.Validate`].

### Changed

• The version of Go updated to 1.27.1.

### Fixed

• Reading partially received TCP prefix (#523).

[`proxy.Config.Validate`]： https://pkg.go.dev/github.com/AdguardTeam/dnsproxy@v0.85.0/proxy#Config.Validate
[`proxy.UpstreamConfig.Validate`]：https://pkg.go.dev/github.com/AdguardTeam/dnsproxy@v0.85.0/proxy#UpstreamConfig.Validate
[`proxy.Proto.Validate`]： https://pkg.go.dev/github.com/AdguardTeam/dnsproxy@v0.85.0/proxy#Proto.Validate

Fixed
• Docker image versioning.
• AA flag processing.

Fixed
- Docker image versioning.
- AA flag processing.

Changed
- The version of Go updated to 1.26.4.
- proxy.Config.DNSCryptResolverCert.
- upstream.Options.VerifyDNSCryptCertificate .
Fixed
- DoH ID handling and response validation.
- DoH uncontrolled bytes reading.

Security
- The timeouts used with the QUIC protocol have been improved, making the proxy less vulnerable to DoS attacks.
Fixed
- Broken DNS cache with disabled DNSSEC.

Security
- Non-zero IDs are now set when using plain-DNS upstreams.

Added
- proxy.Config.DNSSECEnabled.

Fixed
- Requests for root domain (.) incorrectly forwarded to unqualified-names-specific upstream, if configured in proxy.UpstreamConfig.

Added
- proxy.Config.RequestContext.
Changed
- Added context for proxy.Handler, proxy.Proxy.Resolve.

Added
- The command-line flags --doh-routes, --doh-insecure-enabled.
- proxy.HTTPConfig and proxy.Config.HTTPConfig.
Removed
- proxy.BeforeRequestHandler, proxy.BeforeRequestError, and proxy.Config.BeforeRequestHandler. Use proxy.Middleware interface instead.
- proxy.Config.HTTPSServerName, proxy.Config.HTTPSListenAddr, proxy.Config.HTTP3, and proxy.Config.UserInfo.

Fixed
- Issue with QUIC buffers (#484).
Changed
- package handler renamed to middleware.
- proxy.RequestHandler renamed to proxy.Handler.
Added
- ratelimit package.
- proxy.Middleware interface.
- proxy.ErrDrop.
Removed
- proxy.ResponseHandler, proxy.Config.ResponseHandler, and ratelimit configuration fields in proxy.Config.

Changed
- The version of Go updated to 1.25.5.
Fixed
- proxy.Config.CacheOptimisticAnswerTTL and proxy.Config.CacheOptimisticMaxAge were not set to default values again.

Fixed
- proxy.Config.CacheOptimisticAnswerTTL and proxy.Config.CacheOptimisticMaxAge were not set to default values, as documented.

Added
- proxy.Config.CacheOptimisticAnswerTTL and proxy.Config.CacheOptimisticMaxAge fields to control the behavior of the optimistic cache.
Changed
- upstream.QUICTraceFunc is now upstream.QUICTracer.

Changed
- The function upstream.NewDefaultHostsResolver now expects context.Context.
- The version of Go updated to 1.25.2.

Changed
- The version of Go updated to 1.25.1.

Fixed
- TTL override calculation.

Changed
- quic-go update: fields QUICConnection and QUICStream of proxy.DNSContext type are now pointer to structs.
Removed
- The previously deprecated function fastip.NewFastestAddr.

Fixed
- Opened listeners are now closed on failed start.

Changed
- Improved logging.
- Updated gonum dependency.

Fixed
- The custom cache provided through DNSContext is now utilized even when the global cache is disabled.

Acknowledgements
Special thanks to Xiang Li for reporting the vulnerability.
Security
- New configuration object PendingRequestsConfig for configuring the cache poisoning attack mitigation. By default, proxy.Proxy will now track all simultaneous duplicate requests, and only perform a single lookup for them.

Added
- New type BindRetryConfig for configuring listen addresses binding retry mechanism.

Changed
- The minimum required version of Go has been increased to 1.24.

Added
- The DNSContext.QueryStatistics method that returns the DNS query statistics for both the upstream and fallback DNS servers.
Changed
- Positional (non-flag) arguments now cause an error instead of being ignored.
Fixed
- The upstream.ExchangeParallel function now consistently returns a nil upstream in case of a DNS lookup error.
Removed
- The DNSContext.CachedUpstreamAddr and DNSContext.QueryDuration properties.

Fixed
- Issue with locating the system hosts file (#430).
- Reverse DNS lookups for records from the hosts file.

[!WARNING]
The release contains a bug related to resolving the system hosts file (#430).
[!IMPORTANT]
On Unix systems, add the initial separator / when specifying the path for the hosts file. For example, if you previously had --hosts-files=home/user/hosts.txt, use --hosts-files=/home/user/hosts.txt.
Changed
- The command-line flag --hosts-files, which previously required a relative file path location from the root, now supports both absolute path and paths relative to the current directory. --hosts-files=path/to/file is now interpreted relative to the current working directory as opposed to relative to the root (#418).

Fixed
- Race conditions when using fastest_addr and parallel upstream modes.

Changed
- Improved resource consumption (AdguardTeam/AdGuardHome#7357).

Changed
- Updated golibs dependency.
Fixed
- Cache related log messages (#424).

Fixed
- The hosts-file-enabled field of the YAML configuration could not be parsed (#413).

Changed
- Updated golibs dependency.

Fixed
- General memory performance improvements.

Fixed
- Race conditions on message ID in DNS-over-HTTPS and DNS-over-QUIC upstream implementations (#402).

Added
- proxy.Config struct now contains the new slog.Logger field which is used as the base logger for proxy service. If nil, slog.Default is used.
- upstream.Options with those you can configure the upstream properties now contain a new slog.Logger field which is used as the base logger during configuration and parsing processes. If nil, slog.Default is used.
Changed
- proxy.Config.UpstreamMode which determines the logic for upstreams has been changed, it is now of type proxy.UpstreamMode. If not specified the proxy.UpstreamModeLoadBalance is used.
- proxy.CheckDisabledAAAARequest has been deprecated, use proxy.RequestHandler instead.
- fastip.NewFastestAddr which initializes a new instance of fastip.FastestAddr is deprecated, use fastip.New instead.
- upstream.NewDefaultHostsResolver has been changed. Now it requires a non-nil slog.Logger as an additional argument.
Removed
- proxy.UModeLoadBalance, proxy.UModeParallel and proxy.UModeFastestAddr have been removed. Use the new corresponding type proxy.UpstreamMode.
- Deprecated proxy.Init has been removed.
- Deprecated upstream.LookupParallel has been removed.

Changed
- The quic-go dependency has been updated to v0.44.0.

Fixed
- Ignored wildcard specifications for top-level domains.

Fixed
- The quic-go dependency has been updated due to issues with QUIC and HTTP/3 upstreams on older Linux kernel versions.
- Domain specifications for top-level domains now considered when routing the requests for unqualified names.

Changed
- SOA and NS requests containing ARPA domains implying private IP addresses are now treated as private requests, as was previously the case only for PTR requests.
- proxy.DNSContext.RequestedPrivateRDNS is now set for SOA and NS requests, as was previously the case only for PTR requests.

Fixed
- Error-prone proxy.BeforeRequestError API. See documentation.
[!TIP]
Consider wrapping each returned error with proxy.BeforeRequestError with a SERVFAIL response.

Fixed
- Validations in proxy.New performed with the default values, not the ones from configuration.

Added
- New proxy.BeforeRequestError type for the errors containing a custom DNS response. See proxy.BeforeRequestHandler for usage.
Changed
- The quic-go dependency has been updated to v0.42.0.
- proxy.BeforeRequestHandler is now an interface instead of a callback, and its the only method also differs in signature.
Fixed
- Unspecified IP addresses no more checked when using proxy.UModeFastestAddr.

Added
- The field proxy.Config.PrivateSubnets used to determine if the address of a client or the address requested via PTR is considered private. The netutil.IsLocallyServed is used by default.
- The field proxy.Config.UsePrivateRDNS controls if the requests considered private should be resolved via proxy.Config.PrivateRDNSUpstreamConfig. Such requests answered with NXDOMAIN otherwise.
- The field proxy.DNSContext.IsPrivateClient which determines if the client's address is considered private.
- The field proxy.DNSContext.RequestedPrivateRDNS containing the prefix parsed from a requested ARPA domain, if the request itself is PTR for a private address and came from a private client.
- The proxy.ValidatePrivateConfig function to validate if an proxy.UpstreamConfig may be used for private RDNS.
Changed
- PTR requests for domains containing DNS64 prefixes are now answered with NXDOMAIN if proxy.Config.UseDNS64 is set to true, but proxy.Config.UsePrivateRDNS is not.
- Fallback servers aren't used for the aforementioned requests, as well as for all private RDNS requests.
- All the private RDNS requests coming from external (non-private) client are now answered with NXDOMAIN before proxy.RequestHandler.
- proxy.New now requires proxy.Config.PrivateRDNSUpstreamConfig to be valid as per proxy.ValidatePrivateConfig if proxy.Config.UsePrivateRDNS is set to true.

Added
- The new proxy.New constructor for proxy.Proxy structure.
Changed
- The proxy.Proxy.Start method now accepts a context.
- The proxy.Proxy.Stop method has been renamed to proxy.Proxy.Shutdown and now accepts a context.
Deprecated
- The proxy.Proxy.Init method. Use proxy.New instead.

Fixed
- The upstream.CachingResolver caching algorithm, which removed certain resource records within an RR set (AdguardTeam/AdGuardHome#6723).
[!IMPORTANT]
Release v0.65.1 hasn't been released. This release only differs from v0.65.1 in testing code.

Changed
- The minimal Go version has been changed to Go 1.21.7.
- The quic-go library has been updated.

Fixed
- Parsing of the IPv6 upstreams without a port number (#379).

Added
- The new [proxy.
ParseError] error which contains an index of the line of the upstream list.
Changed
- [proxy.ParseUpstreamsConfig] is now returns wrapped error containing [proxy.
ParseError]. It also skips empty lines and comments.

Changed
- Improved DNS-over-QUIC concurrent work (#373).
- Improved logging.

Changed
- [proxy.Config.
TrustedProxies] field's type is now [netutil.
SubnetSet] instead of []string.

Added
- The new [upstream.
CachingResolver] implementation of the [upstream.
Resolver] interface. It's used to account the TTL of resolved addresses and resolve those on demand.
- The new [upstream.
NewCachingResolver] function to wrap the [upstream.
UpstreamResolver]s.
Changed
- [Upstream]s are now bootstrapped on each call of [Exchange], meaning that caching the lookup results is now the [Options.
Bootstrap] resolver's responsibility.