v0.28.0

CHANGELOG.md

@@ -4,8 +4,26 @@
 > test-only changes and packaging implementation notes were moved to
 > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
 
+## 0.28.0
+
+- Add a manual GeoIP **Download now** action and replace the fragile release/checksum-base coupling with direct source URLs. CSV mode accepts separate IPv4/IPv6 files; MMDB mode accepts one native MaxMind DB for both families. Publisher SHA-256 URLs are optional per file; size/format validation, staging, the updater lock, atomic publication and hot reload remain mandatory.
+- Improve active-listener visibility in Settings by rendering HTTP/HTTPS binds as distinct endpoint cards and showing the active `H1`, `H2`, `H2C` and `H3/UDP` protocol badges per listener.
+- Remove the speculative Python/Certbot `checking/preparing` line from the startup banner; log the final detected ACME runtime state at INFO after the asynchronous check completes.
+- Add a configurable cache `Via` response header, enabled by default with value `RustProxy`, while preserving any upstream `Via` chain.
+- Avoid full cache invalidation when only cache bypass rules or response-only cache diagnostic/Via headers change; representation-affecting settings still invalidate incompatible cache entries.
+- Fix the vhost Security header-rule editor layout so Delete no longer collides with the first Operation selector.
+- Keep SQLite schema 8 and COLD format 3 unchanged; older configurations gain the default `cache.via_header` through serde defaults.
+
 ## 0.27.3
 
+- Preserve the existing data-directory UID/GID across backup restore, including restores executed as root.
+- Make `/var/lib/rustproxy` the production CLI data-directory default while retaining `./data` in `dev.sh`.
+- Add enabled-by-default automatic GeoIP updates with configurable HTTPS release/checksum sources, 256 MiB default file limit, 24-hour default interval, immediate first-start attempt, publisher SHA-256 verification, streaming staging, live reload and serialization with manual upgrades.
+- Fix explicit startup listener overrides so `--proxy-listen`/`--tls-listen` replace the canonical saved HTTP/HTTPS bind instead of retaining the old `:80`/`:443` listener alongside it.
+- Accept strict WebSocket `101` responses with absent `Content-Length` or `Content-Length: 0`; reject positive `Content-Length` and any `Transfer-Encoding` without requiring legacy mode.
+- Make release-version checking strictly best-effort and start it only after listener binding succeeds; DNS/update-server failures no longer interfere with startup diagnostics.
+- Keep the sidebar runtime/footer block at the viewport bottom when interface scale is reduced.
+
 - Fix managed Certbot validation and execution: Certbot 5.8.0 is a console-script application and does not provide `certbot.__main__`, so `python -m certbot` incorrectly failed validation. Managed ACME now executes the final `acme-python/bin/certbot` entry point directly; 0.27.3 creates/rebuilds the environment at its final path so the console-script shebang is valid.
 
 - Improve managed ACME bootstrap on systems with Python/pip but restricted `venv`/PEP 668 behavior: keep installation private, retry the application-local `virtualenv` bootstrap safely when required, and report whether failure happened during environment creation, pip preparation, Certbot installation or validation.