📝 Release NotesAdd MASQUE client and server support 1Add HTTP/2, HTTP/3 and UDP support for HTTP proxy 2Add full certificate pinning for TLS 3Fixes and improvements1:The new MASQUE Client and MASQUE Server endpoints provide IP proxying over HTTP (CONNECT-IP), supporting HTTP/1.1, HTTP/2 and HTTP/3, address assignment and route advertisement. They can use the internal network stack or a system TUN interface.2:The HTTP proxy implementation has been rewritten, adding HTTP/2, HTTP/3 and UDP proxying through CONNECT-UDP to HTTP inbounds and outbounds.HTTP outbounds now use HTTP/2 by default with automatic fallback to HTTP/1.1. Configurations using path or the Host header continue to use HTTP/1.1. HTTP/3 can be enabled through the version option.The term "MASQUE VPN" usually refers to CONNECT-IP, rather than a combination of CONNECT and CONNECT-UDP, which is an enhancement to HTTP proxying. CONNECT-UDP and CONNECT-IP are collectively known as MASQUE in the IETF; the traditional CONNECT method for TCP proxying is not itself a MASQUE protocol.See HTTP Inbound and HTTP Outbound.3:The new certificate_sha256 and client_certificate_sha256 TLS options pin the SHA-256 hash of the whole certificate, complementing the existing public key pinning options.See TLS.