@push.rocks/smartproxy 30.0.0 → 30.1.0

package/changelog.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 2026-10-18 - 30.1.0
+
+### Features
+
+- `maxConnectionsPerIP` and `connectionRateLimitPerMinute` accept `null` for no per-IP limit (smart-proxy)
+  - The engine already reads an absent limit as none; `null` now reaches it as such. A listener behind a reverse proxy that pools its backend connections sees every client from the proxy's address, so the per-IP limits there throttle all clients together; such a listener can now turn them off and leave per-client limits to the edge. Omitting a limit keeps its default of 100 simultaneous connections or 300 new connections per minute.
+
+### Fixes
+
+- Refuse a per-IP limit that is not a positive integer (smart-proxy)
+  - The constructor defaulted both limits with `||`, so `0` and `NaN` silently became 100 or 300, negative and fractional values reached the engine, and `Infinity` reached it as no limit. Each of them now throws `SettingsValidationError` naming the field; `RouteValidator.validateSettings()` answers the same reason. A consumer that passed `0` or `Infinity` must pass `null` for no limit, or omit the option for the default.
+
+### Maintenance
+
+- Drop Deno from the test surface: the route utility unit test `test/test.deno.ts` runs on Node as `test/test.node.ts`, and `deno.lock` is removed; the public API is unchanged.
+- release tooling: @git.zone/tsrust 5.0.0, @git.zone/tstest 8.0.0, @types/node 26.6.5, pnpm 12.12.0
+  - `native-notices/` is regenerated with `tsrust notices`: the static musl binaries' LLVM libunwind is now listed with its own license text (`runtime/libunwind-22.1.2/`), and each binary in `dist_rust/` ships tsrust's third-party notices sidecar beside it.
+
+## 2026-10-13 - 30.0.1
+
+### Fixes
+
+- Apply a route's IP, ingress and VPN security to a QUIC connection only when the connection is for that route (rust)
+  - The QUIC listener matched routes before the handshake, without the client's SNI, and applied the first route on the port's security to every connection. With an `ipAllowList` route and an open route for another hostname on one HTTP/3 port, every HTTP/3 connection from a source outside the list was refused, including those for the open hostname.
+  - A route that matches every hostname still has its security applied before the handshake. When only domain-restricted routes match, the listener now waits for the handshake's SNI, selects the route for that hostname as the TCP listener does, and applies that route's security with the SNI as the domain; an outsider is still refused for the restricted hostname, and HTTP/3 requests are still checked per request against the route their `:authority` selects. A QUIC connection without SNI, or with an SNI no route lists, no longer matches a domain-restricted route, as on TCP.
+
 ## 2026-10-13 - 30.0.0
 
 ### Breaking Changes