@push.rocks/smartproxy 27.16.2 → 27.17.0

package/changelog.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2026-06-12 - 27.17.0
+
+### Features
+
+- WebSocket over HTTP/3 per RFC 9220, front and backend side (rustproxy-http)
+  - The h3 listener now advertises SETTINGS_ENABLE_CONNECT_PROTOCOL and accepts Extended CONNECT WebSocket bootstraps, bridging them through the shared route/security pipeline.
+  - Backends are reached via Extended CONNECT multiplexed onto pooled QUIC connections when backendProtocol is http3 (hard-fail), or automatically under auto once Alt-Svc discovery has cached h3 for the upstream (with h1 fallback and cache invalidation).
+  - All front × backend combinations work; an h1 front meeting an h3 backend receives a synthesized 101 with a derived Sec-WebSocket-Accept, since RFC 9220 has no key/accept exchange.
+  - The tunnel byte pump, inactivity watchdog, lifetime cap, metrics, and connection accounting are now shared by every WebSocket protocol combination.
+  - h3/h3-quinn are pinned to the upstream commit introducing ext::Protocol::WEBSOCKET (crates.io 0.0.8 rejects ":protocol: websocket" at header parse); drop the patch when h3 releases past 0.0.8.
+
+### Fixes
+
+- align the unknown-SNI passthrough test with the 27.16.2 alert behavior (tests)
+  - The test still asserted the pre-27.16.2 silent drop; it now validates the fatal unrecognized_name alert bytes.
+
 ## 2026-06-11 - 27.16.2
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartproxy',
-    version: '27.16.2',
+    version: '27.17.0',
     description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHFQQUFxUDtDQUNuUSxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "27.16.2",
+  "version": "27.17.0",
   "private": false,
   "description": "A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -413,7 +413,14 @@ const route: IRouteConfig = {
 | `'http2'` | Always HTTP/2 (hard-fail if unsupported) |
 | `'http3'` | Always HTTP/3 via QUIC (hard-fail if unsupported) |
 
-> **Note:** WebSocket upgrades always use HTTP/1.1 to the backend regardless of `backendProtocol`, since there's no performance benefit from H2/H3 Extended CONNECT for tunneled connections, and backend support is rare.
+### 🧦 WebSockets on Every Protocol (RFC 6455 / RFC 8441 / RFC 9220)
+
+WebSockets work across all front/backend protocol combinations:
+
+- **Fronts:** HTTP/1.1 `Upgrade`, HTTP/2 Extended CONNECT (RFC 8441), and HTTP/3 Extended CONNECT (RFC 9220). HTTP/3-enabled routes advertise `SETTINGS_ENABLE_CONNECT_PROTOCOL`, so h3 clients can bootstrap WebSockets directly over QUIC.
+- **Backends:** HTTP/1.1 `Upgrade` by default. With `backendProtocol: 'http3'` — or `'auto'` once Alt-Svc discovery has established the upstream speaks h3 — WebSocket tunnels ride an RFC 9220 Extended CONNECT stream multiplexed onto the pooled QUIC connection (no extra TCP connection per socket). `'auto'` falls back to HTTP/1.1 if the h3 attempt fails; `'http2'` backends use HTTP/1.1 for WebSockets.
+
+The proxy translates handshakes between generations transparently — e.g. an HTTP/1.1 client meeting an h3 backend still receives a correct `101` with a derived `Sec-WebSocket-Accept`, since Extended CONNECT has no key/accept exchange.
 
 ### 🔁 Dual-Stack TCP + UDP Route
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '27.16.2',
+  version: '27.17.0',
   description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 }