dnscrypt-proxy: all versions and old releases

- Added support for PQDNSCrypt (DNSCrypt 2026), using post-quantum cryptography with compatible DNSCrypt servers to protect query confidentiality against future quantum computers. It is enabled by default and can be disabled with the new pqdnscrypt setting.
- Key material is now rotated when the local network changes, reducing linkability across network changes.
- Fixed a cache issue that could corrupt cached responses or cause data races under concurrent use.
- The netprobe_timeout configuration setting is now honored instead of being silently overridden by its command-line default.
- Forwarded queries now correctly fall back to TCP after a truncated UDP response, and SOCKS-proxied anonymized DNS exchanges are sent to the relay.
- HTTP/3 connections now retry after transient failures, and bootstrap resolution succeeds when at least one address was obtained.
- Cloaking rules that resolve through a rule ending in an IP address are no longer incorrectly rejected as recursive. Actual loops are still rejected.
- The monitoring dashboard now resolves API paths against the page origin, allowing it to work correctly when hosted under a path.

New public DNS monitoring website: https://status.dnscrypt.info -- Check it out!
Version 2.1.15
- The proxy now dynamically reduces timeouts as the connection limit is approached, improving performance and preventing connection exhaustion under heavy load.
- Fixed crashes in the configuration file watcher when fsnotify creation fails.
- DHCP resolver errors ($DHCP forwarding) are now properly logged and visible to system administrators.
- Fixed double-bracketing of IPv6 addresses in DoH stamps that could prevent proper connection to IPv6 DoH servers.
- Cache statistics are now more accurate by only counting queries that actually participate in caching.
- The monitoring UI has been enhanced with server health indicators and improved display of resolver performance metrics.
- Proxy hostnames (when using SOCKS/HTTP proxies) are now pre-resolved using bootstrap resolvers if they are domain names.
- Multiple IP addresses per hostname are now cached instead of randomly selecting one, improving connection reliability for multi-homed servers.

Version 2.1.14
- Added support for client IP address encryption in logs using IPCrypt. Three algorithms are supported: deterministic, non-deterministic with 8-byte tweak, and extended non-deterministic with 16-byte tweak.
- Enhanced pattern rule documentation with better examples.
- Fixed an issue where nil client addresses could cause crashes.

Version 2.1.13
- Fixed race conditions in WebSocket handling for the monitoring dashboard, improving stability and preventing potential crashes.
- Manual configuration reload via SIGHUP is now supported regardless of the hot-reload setting, providing more flexibility for system administrators.
- Fixed a regression in IP prefix matching for allow/block lists that could cause incorrect filtering behavior.
- The monitoring dashboard now properly displays blocked queries counter and tracks blocked queries in the UI.
- Improved error handling in the cache plugin initialization.
- Enhanced the forward plugin to return the last valid response when encountering only errors, improving resilience.
- Fixed various UI issues including scrolling behavior, WebSocket reconnection handling, and response time calculations.
- Updated the example configuration with current Quad9 source URLs.
- The generate-domains-blocklist script now handles poor network conditions more gracefully.
- Improved handling of DNS64 trampoline queries to prevent potential issues.
MacOS binaries are going to be built later.

- A new Weighted Power of Two (wp2) load balancing strategy has been implemented as the default, providing improved distribution across resolvers.
- An optional Prometheus metrics endpoint has been added for monitoring and observability.
- Memory usage for the cache has been reduced.
- The monitoring dashboard has received significant improvements including better security, performance optimizations, WebSocket rate limiting, and HTTP caching headers.
- The monitoring UI has been refined with stable sorting to prevent flickering, query type limitations, and improved scrolling behavior.
- Additional records in queries are now properly removed before forwarding.
- The simple view UI has been removed as it provided limited utility.

Version 2.1.8
- Dependencies have been updated, notably the QUIC implementation, which could be vulnerable to denial-of-service attacks.
- In forwarding rules, the target can now optionally include a non-standard DNS port number. The port number is also now optional when using IPv6.
- An annoying log message related to permissions on Windows has been suppressed.
- Resolver IP addresses can now be refreshed more frequently. Additionally, jitter has been introduced to prevent all resolvers from being refreshed simultaneously. Further changes have been implemented to mitigate issues arising from multiple concurrent attempts to resolve a resolver's IP address.
- An empty value for "tls_cipher_suite" is now equivalent to leaving the property undefined. Previously, it disabled all TLS cipher suites, which had little practical justification.
- In forwarding rules, an optional *. prefix is now accepted.

- dnscrypt-proxy can be compiled with Go 1.21.0+
- Responses to blocked queries now include extended error codes
- Reliability of connections using HTTP/3 has been improved
- New configuration directive: tls_key_log_file.
When defined, this is the path to a file where TLS secret keys will be written to, so that DoH traffic can be locally inspected.