Hello, ports. Been using this on my router for a couple of weeks without issues. Build and quick test done on today’s amd64 snap. QP-encoded diff below the changelog.
Changelog: - Dashboard HTML pages are no longer cached, preventing stale content from being served after upgrades. - The IP allow/block plugins now support CIDR ranges in addition to single addresses and prefix matching. - Forwarding rules now support '$RESOLVCONF:<file>' to pick up upstream resolvers from a resolv.conf-style file, complementing the existing '$DHCP' syntax. - Recursive cloaking rules are now rejected at load time instead of being detected only when a matching query arrives. - Servers that hit a transient high RTT could previously stay penalized forever and never come back into rotation; their RTT estimate now decays so they can recover. - Servers are no longer penalized for slow responses when the response is actually being served from the stale cache. - HTTP/3 probing now consults a negative cache before retrying, avoiding repeated probes against servers known not to support it. - The HTTP transport now handles 'Alt-Svc: clear' properly and reuses HTTP connections more aggressively. - The cache TTL is now an explicit, configurable parameter rather than being derived implicitly. - Log entries now include the relay name when a query was sent through an anonymized DNS or ODoH relay. - A new 'tls_prefer_rsa option' has been added to prefer RSA cipher suites during the TLS handshake, useful on systems without hardware AES. - The 'tls_cipher_suite' option is now a no-op. Modern TLS stacks no longer expose cipher suite selection in a meaningful way, and the option had become misleading. - The '-resolve' command now reports incomplete DNSSEC support instead of silently treating partial signatures as a success. - ODoH: the 401 key-refresh path has been hardened against panics, races and bad server state, refreshes are now coalesced, and the blocking sleep on refresh has been removed. - A log size of 0 no longer means "unlimited"; it now correctly disables rotation by size. - 'jsdelivr' is now offered as an alternative source URL for resolver lists, providing more redundancy when the primary mirrors are unreachable. Detailed changelog is available at https://github.com/DNSCrypt/dnscrypt-proxy/releases/tag/2.1.16 Index: Makefile =================================================================== RCS file: /cvs/ports/net/dnscrypt-proxy/Makefile,v retrieving revision 1.73 diff -u -p -u -p -r1.73 Makefile --- Makefile 11 Mar 2026 21:11:33 -0000 1.73 +++ Makefile 30 Jun 2026 17:32:19 -0000 @@ -2,7 +2,7 @@ COMMENT = flexible DNS proxy with suppor GH_ACCOUNT = DNSCrypt GH_PROJECT = dnscrypt-proxy -GH_TAGNAME = 2.1.15 +GH_TAGNAME = 2.1.16 CATEGORIES = net Index: distinfo =================================================================== RCS file: /cvs/ports/net/dnscrypt-proxy/distinfo,v retrieving revision 1.42 diff -u -p -u -p -r1.42 distinfo --- distinfo 11 Mar 2026 21:11:33 -0000 1.42 +++ distinfo 30 Jun 2026 17:32:19 -0000 @@ -1,2 +1,2 @@ -SHA256 (dnscrypt-proxy-2.1.15.tar.gz) = V9qR3So5kqFSjnZLz+m0gIjGPJM8DFcaLKw9J6yMdUY= -SIZE (dnscrypt-proxy-2.1.15.tar.gz) = 4058547 +SHA256 (dnscrypt-proxy-2.1.16.tar.gz) = e6WqdtP9xvu2Z2iboT2Kw+Zr4nZVaVqdQS5a1K/jT40= +SIZE (dnscrypt-proxy-2.1.16.tar.gz) = 3595664
