@push.rocks/smartproxy 30.0.0 → 30.0.1

package/changelog.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2026-10-13 - 30.0.1
+
+### Fixes
+
+- Apply a route's IP, ingress and VPN security to a QUIC connection only when the connection is for that route (rust)
+  - The QUIC listener matched routes before the handshake, without the client's SNI, and applied the first route on the port's security to every connection. With an `ipAllowList` route and an open route for another hostname on one HTTP/3 port, every HTTP/3 connection from a source outside the list was refused, including those for the open hostname.
+  - A route that matches every hostname still has its security applied before the handshake. When only domain-restricted routes match, the listener now waits for the handshake's SNI, selects the route for that hostname as the TCP listener does, and applies that route's security with the SNI as the domain; an outsider is still refused for the restricted hostname, and HTTP/3 requests are still checked per request against the route their `:authority` selects. A QUIC connection without SNI, or with an SNI no route lists, no longer matches a domain-restricted route, as on TCP.
+
 ## 2026-10-13 - 30.0.0
 
 ### Breaking Changes

package/dist_rust/rustproxy_linux_amd64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "017ed17723abdd2fc561983ec355b94c1052a53442b89aa29ec3852ad1c8a02a",
+  "binarySha256": "6a329b3cfb0dfab45d91cdea6290021ee8b4586a38b69719ca8580f93f713e0c",
   "buildInfo": {
     "projectName": "@push.rocks/smartproxy",
-    "projectVersion": "30.0.0",
-    "gitCommit": "bf2e2db567e4ffaa451ce0e38aeb228c1c96da54",
+    "projectVersion": "30.0.1",
+    "gitCommit": "9b7161fdf800b77284a4589f491ab4de149cd0b7",
     "gitDirty": false,
-    "builtAt": "2026-10-13T19:54:25.100Z",
+    "builtAt": "2026-10-13T21:05:18.286Z",
     "tsrustVersion": "4.5.1",
     "binary": "rustproxy",
     "target": "linux_amd64_musl"

package/dist_rust/rustproxy_linux_arm64_musl.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "8b8b9b0b5707bdc5777d7ba5959d7284f2013e898dbd846ebcd1e0c30c82359d",
+  "binarySha256": "21db1d1ac89025fbded33251113db7f9ba5340ac32adfb5cf667e079258970ca",
   "buildInfo": {
     "projectName": "@push.rocks/smartproxy",
-    "projectVersion": "30.0.0",
-    "gitCommit": "bf2e2db567e4ffaa451ce0e38aeb228c1c96da54",
+    "projectVersion": "30.0.1",
+    "gitCommit": "9b7161fdf800b77284a4589f491ab4de149cd0b7",
     "gitDirty": false,
-    "builtAt": "2026-10-13T19:57:37.833Z",
+    "builtAt": "2026-10-13T21:08:30.672Z",
     "tsrustVersion": "4.5.1",
     "binary": "rustproxy",
     "target": "linux_arm64_musl"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartproxy',
-    version: '30.0.0',
+    version: '30.0.1',
     description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHFQQUFxUDtDQUNuUSxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "30.0.0",
+  "version": "30.0.1",
   "private": false,
   "description": "A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -1366,6 +1366,7 @@ SmartProxy searches for the Rust binary in this order:
 
 ### QUIC / HTTP3 Caveats
 - **GREASE frames are disabled.** The underlying h3 crate sends [GREASE frames](https://www.rfc-editor.org/rfc/rfc9114.html#frame-reserved) by default to test protocol extensibility. However, some HTTP/3 clients and servers don't properly ignore unknown frame types, causing 400/500 errors or stream hangs ([h3#206](https://github.com/hyperium/h3/issues/206)). SmartProxy disables GREASE on both the server side (for incoming H3 requests) and the client side (for H3 backend connections) to maximize compatibility.
+- **Route security follows the SNI.** Before the QUIC handshake the client's hostname is unknown, so only a route that matches every hostname has its `security` applied there. Otherwise the route is chosen from the handshake's SNI, as on TCP, and that route's `security` applies; a connection without SNI matches no domain-restricted route. HTTP/3 requests are then routed and checked by their `:authority`.
 - **HTTP/3 is pre-release.** The h3 ecosystem (h3 0.0.8, h3-quinn 0.0.10, quinn 0.11) is still pre-1.0. Expect rough edges.
 
 ### Performance Tuning

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '30.0.0',
+  version: '30.0.1',
   description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 }