v0.35.0

README.md

@@ -1,7 +1,13 @@
-# RustProxy 0.34.16
+# RustProxy 0.35.0
 
 RustProxy combines a reverse proxy, static/PHP web server, certificate management and traffic monitoring in one service with a browser administration panel. It supports several domains and backends without requiring a separate proxy configuration language.
 
+## Changes in 0.35.0
+
+- Accept encoded path separators `%2F` / `%2f` for reverse-proxy requests. Routing, ACLs and other security policy evaluate the normalized path with real `/` separators, while Preserve-mode forwarding keeps the client request target encoded for the upstream.
+- Keep path hardening fail-closed: encoded backslash, percent, query/fragment delimiters, semicolon, control bytes, malformed escapes, invalid UTF-8 and dot-segment traversal remain rejected.
+- Refresh release-gate compatibility with the supported Rust/Clippy toolchain and retain the complete test suite as a required release check.
+
 ## Changes in 0.34.16
 
 - Separated **identity provider** from **integration method** in Vhost Authentication: Tinyauth, Authelia or authentik can use Forward Auth or OIDC; Pocket ID and compatible custom providers use OIDC. HTTP Basic remains its own method. The `authentication` field stores the pair, with legacy Vhost JSON still supported.