• Make TCP inactivity timeout configurable through a new tcp_timeout option (default: 600 seconds). Previously, the timeout was hardcoded to 10 minutes for all TCP connections. (#7909, @keshavkrishnadav)
• Flush flow file after each flow to allow further processing. (#7967, @caiquejjx)
• infer_content_encoding: Fallback to UTF-8 for more content types (#7961, @xu-cheng)
• Remove bless from hex editors to avoid issues with macOS (#7937, @caiquejjx)
• Improves is_mostly_bin check to support chinese characters (#7933, @caiquejjx, @mhils)
• Fix various issues in infer_content_encoding (#7928, @xu-cheng)
• Add example addon to spoof DNS responses. (#7973, @mhils)
• Gracefully handle decoding of raw binary payloads that previously caused "Raw cannot decode" or "failed to parse as JSON" errors (#7940, @AdityaPatadiya)
• Show query parameters for empty-body requests in the mitmproxy console. (#7923, @lups2000)
• mitmweb is now built with Vite, improving the development workflow. (#7971, @sleeyax, @mhils)
• Fix URL of mitmweb when --web-host is an IPv6 address. (#7963, @Julien00859)
• Fix event loop leak when running tests (#7982, @DNEGEL3125)
• Fix TypeScript build by adding React types and removing obsolete @ts-expect-error directives. (#7988, @DNEGEL3125)

• mitmproxy now supports Python 3.14. Binary releases ship with 3.14 by default. (#7918, @mhils)
• Replace htpasswd file parser with a custom implementation to migrate off unmaintained passlib dependency. The new parser only supports bcrypt and SHA-1 hashing. Contributions for additional formats are welcome as long as they don't introduce new dependencies. (#7906, @mhils)

• Docker images are now build with Debian Trixie. (#7851, @mhils)
• Fix mitmweb auth cookie always using the default web_port option. (#7827, @sujaldev)
• fix: missing content-length header in curl export (#7810, @mheguy)
• fix: update log message with correct header name (#7802, @kristof-mattei)
• Update deprecated windows-2019 runner to windows-2025. (#7801, @chedieck)
• Do not escape non-ascii characters in the JSON contentview. (#7740, @mhils)
• Fix crash in mitmweb when no explicit Server-Connection is logged. (#7734, @lups2000)
• Add syntax highlighting for CSS and JavaScript contentviews. (#7749, @mhils)
• Display local timezone in the Timing tab of mitmweb. (#7804, @lups2000)
• Prevent showing the quit message in the console when no flows are available under specific configurations. (#7833, @lups2000)

Security Fixes

• GHSA-847f-9342-265h: Upgrade hyper-h2 to fix a request smuggling vulnerability that affects mitmproxy's HTTP/2 -> HTTP/1 translation. (@mhils)

• Fix a race condition when updating the flow list in mitmweb. (#7729, @mhils)

• mitmweb now supports filtering by body contents (~b, ~bq, ~bs). (#7704, @lups2000, @mhils)
• Fix raw response export incorrectly zeroing non-zero Content-Length header for HEAD requests. (#7701, @sujaldev)
• Fix concurrent mitmweb instances overwrite each other's auth cookie. (#7690, @turboOrange)

• Fix a crash when editing raw messages bodies in mitmproxy. (#7697, @mhils)
• Added an option to pass the web token as Authentication: Bearer ... header (#7681, @gschaer)
• In DNS proxy mode, user-provided addons now trigger before DNS resolution has taken place. (#7685, @Florigolo)

New Contentview System (#7623, @mhils)

• Contentviews can now be interactive and re-encode prettified data. For example, the new Protobuf view pretty-prints to YAML, which the user can edit and then re-serialize into binary representation.
• Replace the existing gRPC and Protobuf contentviews with an interactive contentview that supports both existing proto definitions and completely unknown protos.
• The MsgPack contentview is now interactive, too.
• The contentview API has been drastically simplified. Contentviews now return a plain str with the prettified data. Syntax highlighting is now signaled off-band (and based on tree-sitter).
• Docs: Add new documentation page and API reference for contentviews.
• Contentviews can now be written in Rust for better performance and access to the crates ecosystem.

Other Changes

• Add a new feature to store streamed bodies for requests and responses. (#7637, @mkiami)
• Add support for TLS 1.3 Post Handshake Authentication. (#7576, @mhils, @cataggar)
• Add search functionality to the documentation. (#7603, @mhils)
• Introduce a new theme for docs.mitmproxy.org. (#7593, @mhils)
• Add CRL entries to dummy cert when the upstream certificate has some. (#7609, @Yepoleb, @JordanPlayz158)
• Fix a bug where mitmproxy would incorrectly send empty HTTP/2 data frames. (#7574, @mhils, @Dieken)
• Enhance homebrew installation command for Brewfile users. (#7566, @AntoineJT)
• Fix a bug where mitmdump would exit prematurely in server replay mode. (#7571, @mhils)
• Fix a bug where WebSocket Messages view jumps to top when a message is received (#7572, @DenizenB)
• Create content view for Socket.IO over WebSocket transport (#7570, @DenizenB)
• Correctly forward HTTP_1_1_REQUIRED errors in HTTP/2 streams. (#7575, @mhils)
• Fix a bug where HAR export would crash for malformed flows. (#7666, @mhils)
• Fix a bug where mitmweb would crash when viewing flows with undefined headers. (#7595, @emanuele-em)
• Fix a bug where mitmproxy does not listen on IPv4 and IPv6 by default in wireguard mode. (#7589, @errorxyz)
• Adjust popover placement for browsers that support anchor positioning (Chrome, Edge) (#7642, @lups2000)
• Fix mitmweb crash when searching or highlighting using ~h, ~hq, or ~hs. (#7652, @lups2000)
• mitmproxy.dns.Message has been renamed to mitmproxy.dns.DNSMessage (#7670, @mhils)
• Added support for selecting multiple flows in mitmweb using Ctrl+Click and Shift+Click. Multi-selection is now supported for deleting, duplicating, marking, reverting, replaying ,resuming, and aborting flows. (#7319, @lups2000, @mhils)

• Update mitmproxy_rs dependency to fix several bugs in local capture mode. (#7564, @mhils)
• Add documentation for local capture mode. (#7540, @mhils)
• Revise documentation on proxy modes. (#7545, @mhils)
• Add a log message to point Docker mitmweb users towards web_password. (#7554, @mhils)
• Fix a bug where UTF-8 surrogates would crash the export addon. (#7562, @mhils)
• Add help entries for all options in mitmweb that didn't have them. (#7563, @mhils)

• CVE-2025-23217: mitmweb's API now requires an authentication token by default. The mitmweb API is bound to localhost only, but @gronke found that an attacker can circumvent that restriction by tunneling requests through the proxy server itself in an SSRF-style attack. (fa89055, @mhils)
• Add (optional) password protection for mitmweb. The web_password option replaces the randomly-generated token authentication with a fixed secret that survives mitmproxy restarts. (0bd573a, @mhils)
• mitmweb can now be hosted under arbitrary domains, the previously-used DNS rebind protection is not required anymore. (62693af, @mhils)
• Security Hardening: mitmweb's xsrf_token cookie is now HttpOnly; SameSite=Strict. (#7491, @mhils)
• We now provide standalone binaries for Linux arm64. (#7484, @mhils)
• Standalone binaries are now compiled with Python 3.13. (#7485, @mhils)
• Fix console freezing due to DNS queries with an empty question section. (#7497, @sujaldev)
• Add mitmweb tutorial to docs. (#7509, @EstherRoeth)
• Fixed a bug that caused mitmproxy to crash when loading prior knowledge h2 flows. (#7514, @sujaldev)
• Fix a bug where mitmproxy would get stuck in secure web proxy mode when using ignore_hosts or allow_hosts. (#7519, @mhils)
• Copy request/response data to the clipboard in mitmweb (#7352, @lups2000)
• Fix a bug where exporting a curl or httpie command with escaped characters would lead to different data being sent. (#7520, @proteusvacuum)

• Local Capture Mode is now available on Linux as well. (#7440, @mhils)
• mitmproxy now requires Python 3.12 or above. (#7440, @mhils)
• Add cache-busting for mitmweb's front end code. (#7386, @mhils)
• Clicking the URL in mitmweb now places the cursor at the current position instead of selecting the entire URL. (#7385, @lups2000)
• Add missing status codes (#7455, @jwadolowski)
• All filter expressions are now case-insensitive by default. Users can opt into case-sensitive filters by setting MITMPROXY_CASE_SENSITIVE_FILTERS=1 as an environment variable. (#7458, @mhils, @AdityaPatadiya)
• Remove filter expression lowercasing in block_list addon (#7456, @jwadolowski)
• Remove check for status codes in the blocklist add-on. (#7453, @lups2000, @AdityaPatadiya)
• Prompt user before clearing screen (#7445, @errorxyz)

• Stop sorting keys in JSON contentview (#7346, @injust)
• Fix a bug where a custom CA would raise an error. (#7355, @nneonneo)
• Fix a bug where the mitmproxy UI would crash on negative durations. (#7358, @mhils)
• Allow technically invalid HTTP transfer encodings in requests if validate_inbound_headers is disabled. (#7361, #7373, @mhils)
• Fix a bug in windows management in mitmproxy TUI whereby the help window does not appear if "?" is pressed within the overlay (#6500, @emanuele-em)

• Tighten HTTP detection heuristic to better support custom TCP-based protocols. (#7228, @fatanugraha)
• Implement stricter validation of HTTP headers to harden against request smuggling attacks. (#7345, @mhils)
• Increase HTTP/2 default flow control window size, fixing performance issues. (#7317, @sujaldev)
• Fix a bug where mitmproxy would incorrectly report that TLS 1.0 and 1.1 are not supported with the current OpenSSL build. (#7241, @mhils)
• Docker: Update image to Python 3.13 on Debian Bookworm. (#7242, @mhils)
• Add a tun proxy mode that creates a virtual network device on Linux for transparent proxying. (#7278, @mhils)
• browser.start command now supports Firefox. (#7239, @sujaldev)
• Fix interaction of the modify_headers and stream_large_bodies options. This may break users of modify_headers that rely on filters referencing the message body. We expect this to be uncommon, but please make yourself heard if that's not the case. (#7286, @lukant)
• Fix a crash when handling corrupted compressed body in savehar addon and its tests. (#7320, @8192bytes)
• Remove dependency on protobuf library as it was no longer being used. (#7327, @matthew16550)

• mitmproxy now supports transparent HTTP/3 proxying. (#7202, @errorxyz, @meitinger, @mhils)
• Add HTTP3 support in HTTPS reverse-proxy mode. (#7114, @errorxyz)
• mitmproxy now officially supports Python 3.13. (#6934, @mhils)
• Tighten HTTP detection heuristic to better support custom TCP-based protocols. (#7087)
• Add show_ignored_hosts option to display ignored flows in the UI. This option is implemented as a temporary workaround and will be removed in the future. (#6720, @NicolaiSoeborg)
• Fix slow tnetstring parsing in case of very large tnetstring. (#7121, @mik1904)
• Add getaddrinfo-based fallback for DNS resolution if we are unable to determine the operating system's name servers. (#7122, @mhils)
• Improve the error message when users specify the certs option without a matching private key. (#7073, @mhils)
• Fix a bug where intermediate certificates would not be transmitted when using QUIC. (#7073, @mhils)
• Fix a bug where fragmented QUIC client hellos were not handled properly. (#7067, @errorxyz)
• Emit a warning when users configure a TLS version that is not supported by the current OpenSSL build. (#7139, @mhils)
• Fix a bug where mitmproxy would crash when receiving STOP_SENDING QUIC frames. (#7119, @mhils)
• Fix error when unmarking all flows. (#7192, @bburky)
• Add addon to update the alt-svc header in reverse mode. (#7093, @errorxyz)
• Do not send unnecessary empty data frames when streaming HTTP/2. (#7196, @rubu)
• Fix a bug where mitmproxy would ignore Ctrl+C/SIGTERM on OpenBSD. (#7130, @catap)
• Fix of measurement unit in HAR import, duration is in milliseconds. (#7179, @dstd)
• Connection.tls_version now is QUICv1 instead of QUIC for QUIC. (#7201, @mhils)
• Add support for full mTLS with client certs between client and mitmproxy. (#7175, @Kriechi)
• Update documentation adding a list of all possibile web_columns. (#7205, @lups2000, @Abhishek-Bohora)

• Fix a crash on startup when mitmproxy is unable to determine the OS' DNS servers (#7066, @errorxyz)

• Fix a bug where macOS local mode would not start up on macOS. (#7045, @mhils)
• Fix UDP error handling when we learn that the remote has disconnected. (#7045, @mhils)
• Container images are now published to both Docker Hub and GitHub Container Registry. (#7061, @mhils)

• Add support for DNS over TCP. (#6935, @errorxyz)
• Add first MVP new Capture Tab in mitmweb (#6999, @lups2000)
• Add HttpConnectedHook and HttpConnectErrorHook. (#6930, @errorxyz)
• Fix non-linear growth in processing time for large HTTP bodies. (#6952, @jackfromeast)
• Fix a bug where connections would be incorrectly ignored with allow_hosts. (#7002, @JarLob, @mhils)
• Fix zstd decompression to read across frames. (#6921, @zendai)
• Handle certificates we cannot parse more gracefully. (#6994, @mhils)
• Parse compressed domain names in ResourceRecord data. (#6954, @errorxyz)
• Fix a bug where mitmweb's flow list would not stay at the bottom. (#7008, @mhils)
• Fix a bug where SSH connections would be incorrectly handled as HTTP. (#7041, @mhils)
• Skip UTF-8 byte-order marks (BOM) when loading HAR files. (#6897, @dstd)
• Allow typing.Sequence[str] to be an editable option. (#7001, @errorxyz)
• Add Host header to CONNECT requests. (#7021, @petsneakers)
• Support all query types in DNS mode. (#6975, @errorxyz)
• Fix a bug where mitmproxy would crash for pipelined HTTP flows. (#7031, @gdiepen, @mhils)
• Add an optional "index" column for mitmweb. (#7039, @mhils)

• Release tags are now prefixed with v again. (#6810, @mhils)
• Fix a bug where mitmproxy would not exit when -n is passed. (#6819, @mhils)
• Set the unbuffered (stdout/stderr) flag for the mitmdump PyInstaller build. (#6821, @Prinzhorn)
• Fix a bug where client replay would not work with proxyauth. (#6866, @mhils)
• Fix slowdown when sending large amounts of data over HTTP/2. (#6875, @aib)
• Add an option to strip HTTPS records from DNS responses to block encrypted ClientHellos. (#6876, @errorxyz)
• Add an API to parse HTTPS records from DNS RDATA. (#6884, @errorxyz)
• Fix flow export in mitmweb for Safari (#6917, @mhils, @canyesilyurt)
• Releases now come with a Sigstore attestations file to demonstrate build provenance. (f05c050, @mhils)

• Add support for editing non text files in a hex editor (#6768, @wnyyyy)
• Add server_connect_error hook that is triggered when connection establishment fails. (#6806, @haanhvu, @spacewasp, @mhils)
• Add section in mitmweb for rendering, adding and removing a comment (#6709, @lups2000)
• Fix multipart form content view being unusable. (#6653, @DaniElectra)
• Documentation Improvements on CA Certificate Generation (#5370, @zioalex)
• Make it possible to read flows from stdin with mitmweb. (#6732, @jaywor1)
• Update aioquic dependency to >= 1.0.0, < 2.0.0. (#6747, @jlaine)
• Fix a bug where async client_connected handlers would crash mitmproxy. (#6749, @mhils)
• Add button to close flow details panel (#6734, @lups2000)
• Ignore SIGPIPE signals when there is lots of traffic. Socket errors are handled directly and do not require extra signals that generate noise. (#6764, @changsin)
• Add primitive websocket interception and modification (#6766, @errorxyz)
• Add support for exporting websocket messages when using "raw" export. (#6767, @txrp0x9)
• The "save body" feature now also includes WebSocket messages. (#6767, @txrp0x9)
• Fix compatibility with older cryptography versions and silence a DeprecationWarning on Python <3.11. (#6790, @mhils)
• Fix a bug when proxying unicode domains. (#6796, @mhils)

• Fix a bug where errors during startup would not be displayed when running mitmproxy. (#6719, @mhils)
• Use newer cryptography APIs to avoid CryptographyDeprecationWarnings. This bumps the minimum required version to cryptography 42.0. (#6718, @mhils)

• Fix a regression where allow_hosts/ignore_hosts would break with IPv6 connections. (#6614, @dqxpb)
• Fix bug where failed CONNECT request URLs are saved to HAR files incorrectly. (#6599, @basedBaba)
• Add an arm64 variant for the precompiled macOS app. (#6633, @mhils)
• Fix duplicate answers being returned in DNS queries. (#6648, @sujaldev)
• Fix bug where wireguard config is generated with incorrect endpoint when two or more NICs are active. (#6659, @basedBaba)
• Fix a regression when leaf cert creation would fail with intermediate CAs in ca_file. (#6666, @manselmi)
• Add content_view_lines_cutoff option to mitmdump (#6692, @errorxyz)
• Allow runtime modifications of HTTP flow filters for server replays (#6695, @errorxyz)
• Fix bug view options menu in case of overflow (#6697, @lups2000)
• Allow --allow-hosts and --ignore-hosts to work together (#6711, @dstd)

• Fix a regression where clientplayback would break due to eager task execution. (#6605, @mhils)
• Fix a regression where WebSocket connections would break due to eager task execution. (#6609, @mhils)
• Fix bug where insecure HTTP requests are saved incorrectly when exporting to HAR files. (#6578, @DaniElectra)
• allow_hosts/ignore_hosts option now matches against the full host:port string. (#6594, @LouisAsanaka)

• Fix a regression introduced in mitmproxy 10.2.0: WireGuard servers now bind to all interfaces again. (#6587, @mhils)
• Remove stale reference to ctx.log in addon documentation. (#6552, @brojonat)
• Fix a bug where a traceback is shown during shutdown. (#6581, @mhils)

• Local Redirect Mode is now officially available on macOS and Windows. See the linked blog posts for details. (@emanuele-em, @mhils)
• UDP streams are now backed by a new implementation in mitmproxy_rs. This represents a major API change as UDP traffic is now exposed as streams instead of a callback for each packet. (@mhils)
• Fix a regression from mitmproxy 10.1.6 where ignore_hosts would terminate requests instead of forwarding them. (#6559, @mhils)
• ignore_hosts now waits for the entire HTTP headers if it suspects the connection to be HTTP. (#6559, @mhils)

• Fix compatibility with Windows Schannel clients, which previously got confused by CA and leaf certificate sharing the same Subject Key Identifier. (#6549, @driuba and @mhils)
• Change keybinding for exporting flow from "e" to "x" to avoid conflict with "edit" keybinding. (#6225, @Llama1412)
• Fix bug where response flows from HAR files had incorrect content-length headers (#6548, @zanieb)
• Improved handling for allow_hosts/ignore_hosts options in WireGuard mode (#5930). (#6513, @dsphper)
• Fix a bug where TCP connections were not closed properly. (#6543, @mhils)
• DNS resolution is now exempted from ignore_hosts in WireGuard Mode. (#6513, @dsphper)
• Fix case sensitivity of URL added to blocklist (#6493, @emanuele-em)
• Fix a bug where logging was stopped prematurely during shutdown. (#6541, @mhils)
• For plaintext traffic, ignore_hosts now also takes HTTP/1 host headers into account. (#6513, @dsphper)
• Fix empty cookie attributes being set to Key= instead of Key (#5084, @Speedlulu)
• Scripts with relative paths are now loaded relative to the config file and not where the command is ran (#4860, @Speedlulu)
• Fix mitmweb splitter becoming drag and drop. (#6492, @xBZZZZ)
• Enhance documentation and add alert log messages when stream_large_bodies and modify_body are set (#6514, @rosydawn6)

Breaking Changes

• Subject Alternative Names are now represented as cryptography.x509.GeneralNames instead of list[str] across the codebase. This fixes a regression introduced in mitmproxy 10.1.1 related to punycode domain encoding. (#6537, @mhils)

• Remove stray replay-extra from CLI status bar. (37d62ce, @mhils)

• Fix a hang/freeze in the macOS distributions when doing TLS negotiation. (#6480, @mhils)
• Update savehar addon to fix creating corrupt har files caused by empty response content (#6459, @lain3d)
• Update savehar addon to handle scenarios where "path" key in cookie attrs dict is missing. (#6458, @pogzyb)
• Add server_replay_extra option to serverplayback to define behaviour when replayable response is missing. (#6465, @dkarandikar)

• Fix a bug introduced in mitmproxy 10.1.2 where mitmweb would fail to establish a WebSocket connection. Affected users may need to clear their browser cache or hard-reload mitmweb (Ctrl+Shift+R). (#6454, @mhils)

• Add a raw hex stream contentview. (#6389, @mhils)
• Add a contentview for DNS-over-HTTPS. (#6389, @mhils)
• Replaced standalone mitmproxy binaries on macOS with an app bundle that contains the mitmproxy/mitmweb/mitmdump CLI tools. This change was necessary to support macOS code signing requirements. Homebrew remains the recommended installation method. (#6447, @mhils)
• Fix certificate generation to work with strict mode OpenSSL 3.x clients (#6410, @mmaxim)
• Fix path() documentation that the return value might include the query string (#6412, @tddschn)
• mitmproxy now officially supports Python 3.12. (#6434, @mhils)
• Fix root-relative URLs so that mitmweb can run in subdirectories. (#6411, @davet2001)
• Add an optional parameter(ldap search filter key) to ProxyAuth-LDAP. (#6428, @outlaws-bai)
• Fix a regression when using the proxyauth addon with clients that (rightfully) reuse connections. (#6432, @mhils)

• Fix certificate generation for punycode domains. (#6382, @mhils)
• Fix a bug that would crash mitmweb when opening options. (#6386, @mhils)

• Add support for reading HAR files using the existing flow loading APIs, e.g. mitmproxy -r example.har. (#6335, @stanleygvi)

• Add support for writing HAR files using the save.har command and the hardump option for mitmdump. (#6368, @stanleygvi)

• Packaging changes:

  • mitmproxy-rs does not depend on a protobuf compiler being available anymore, we're now also providing a working source distribution for all platforms.
  • On macOS, mitmproxy-rs now depends on mitmproxy-macos. We only provide binary wheels for this package because it contains a code-signed system extension. Building from source requires a valid Apple Developer Id, see CI for details.
  • On Windows, mitmproxy-rs now depends on mitmproxy-windows. We only provide binary wheels for this package to simplify our deployment process, see CI for how to build from source.

  (#6303, @mhils)

• Increase maximum dump file size accepted by mitmweb (#6373, @t-wy)

• Add experimental support for HTTP/3 and QUIC. (#5435, @meitinger)
• ASGI/WSGI apps can now listen on all ports for a specific hostname. This makes it simpler to accept both HTTP and HTTPS. (#5725, @mhils)
• Add replay.server.add command for adding flows to server replay buffer (#5851, @italankin)
• Remove string escaping in raw view. (#5470, @stephenspol)
• Updating Request.port now also updates the Host header if present. This aligns with Request.host, which already does this. (#5908, @sujaldev)
• Fix editing of multipart HTTP requests from the CLI. (#5148, @mhils)
• Add documentation on using Magisk module for intercepting traffic in Android production builds. (#5924, @Jurrie)
• Fix a bug where the direction indicator in the message stream view would be in the wrong direction. (#5921, @konradh)
• Fix a bug where peername would be None in tls_passthrough script, which would make it not working. (#5904, @truebit)
• the esc key can now be used to exit the current view (#6087, @sujaldev)
• focus-follow shortcut will now work in flow view context too. (#6088, @sujaldev)
• Fix a bug where a server connection timeout would cause requests to be issued with a wrong SNI in reverse proxy mode. (#6148, @mhils)
• The server_replay_nopop option has been renamed to server_replay_reuse to avoid confusing double-negation. (#6084, @prady0t, @Semnodime)
• Add zstd to valid gRPC encoding schemes. (#6188, @tsaaristo)
• For reverse proxy directly accessed via IP address, the IP address is now included as a subject in the generated certificate. (#6202, @mhils)
• Enable legacy SSL connect when connecting to server if the ssl_insecure flag is set. (#6281, @DurandA)
• Change wording in the http-reply-from-proxy.py example. (#6117, @Semnodime)
• Added option to specify an elliptic curve for key exchange between mitmproxy <-> server (#6170, @Mike-Ki-ASD)
• Add "Prettier" code linting tool to mitmweb. (#5985, @alexgershberg)
• When logging exceptions, provide the entire exception object to log handlers (#6295, @mhils)
• mitmproxy now requires Python 3.10 or above. (#5954, @mhils)

Breaking Changes

• The onboarding_port option has been removed. The onboarding app now responds to all requests for the hostname specified in onboarding_host.
• connection.Client and connection.Server now accept keyword arguments only. This is a breaking change for custom addons that use these classes directly.

• The precompiled binaries now ship with OpenSSL 3.0.7, which resolves CVE-2022-3602 and CVE-2022-3786.
• Performance and stability improvements for WireGuard mode. (#5694, @mhils, @decathorpe)
• Fix a bug where the standalone Linux binaries would require libffi to be installed. (#5699, @mhils)
• Hard exit when mitmproxy cannot write logs, fixes endless loop when parent process exits. (#4669, @Prinzhorn)
• Fix a permission error affecting the Docker images. (#5700, @mhils)

Major Features

• Add Raw UDP support. (#5414, @meitinger)
• Add WireGuard mode to enable transparent proxying via WireGuard. (#5562, @decathorpe, @mhils)
• Add DTLS support. (#5397, @kckeiks).
• Add a quick help bar to mitmproxy. (#5381, #5652, @kckeiks, @mhils).

Deprecations

• Deprecate add_log event hook. Users should use the builtin logging module instead. See the docs for details and upgrade instructions. (#5590, @mhils)
• Deprecate mitmproxy.ctx.log in favor of Python's builtin logging module. See the docs for details and upgrade instructions. (#5590, @mhils)

Breaking Changes

• The mode option is now a list of server specs instead of a single spec. The CLI interface is unaffected, but users may need to update their config.yaml. (#5393, @mhils)

Full Changelog

• Mitmproxy binaries now ship with Python 3.11. (#5678, @mhils)
• One mitmproxy instance can now spawn multiple proxy servers. (#5393, @mhils)
• Add syntax highlighting to JSON and msgpack content view. (#5623, @SapiensAnatis)
• Add MQTT content view. (#5588, @nikitastupin, @abbbe)
• Setting connection_strategy to lazy now also disables early upstream connections to fetch TLS certificate details. (#5487, @mhils)
• Fix order of event hooks on startup. (#5376, @meitinger)
• Include server information in bind/listen errors. (#5495, @meitinger)
• Include information about lazy connection_strategy in related errors. (#5465, @meitinger, @mhils)
• Fix tls_version_server_min and tls_version_server_max options. (#5546, @mhils)
• Added Magisk module generation for Android onboarding. (#5547, @jorants)
• Update Linux binary builder to Ubuntu 20.04, bumping the minimum glibc version to 2.31. (#5547, @jorants)
• Add "Save filtered" button in mitmweb. (#5531, @rnbwdsh, @mhils)
• Render application/prpc content as gRPC/Protocol Buffers (#5568, @selfisekai)
• Mitmweb now supports content_view_lines_cutoff. (#5548, @sanlengjingvv)
• Fix a mitmweb crash when scrolling down the flow list. (#5507, @LIU-shuyi)
• Add HTTP/3 binary frame content view. (#5582, @mhils)
• Fix mitmweb not properly opening a browser and being stuck on some Linux. (#5522, @Prinzhorn)
• Fix race condition when updating mitmweb WebSocket connections that are closing. (#5405, #5686, @mhils)
• Fix mitmweb crash when using filters. (#5658, #5661, @LIU-shuyi, @mhils)
• Fix missing default port when starting a browser. (#5687, @rbdixon)
• Add docs for transparent mode on Windows. (#5402, @stephenspol)

• Support specifying the local address for outgoing connections (#5364, @meitinger)
• Fix a bug where an excess empty chunk has been sent for chunked HEAD request. (#5372, @jixunmoe)
• Drop pkg_resources dependency. (#5401, @PavelICS)
• Fix huge (>65kb) http2 responses corrupted. (#5428, @dhabensky)
• Remove overambitious assertions in the HTTP state machine, fix some error handling. (#5383, @mhils)
• Use default_factory for parser_options. (#5474, @rathann)

• DNS support (#5232, @meitinger)
• Mitmproxy now requires Python 3.9 or above. (#5233, @mhils)
• Fix a memory leak in mitmdump where flows were kept in memory. (#4786, @mhils)
• Replayed flows retain their current position in the flow list. (#5227, @mhils)
• Periodically send HTTP/2 ping frames to keep connections alive. (#5046, @EndUser509)
• Console Performance Improvements (#3427, @BkPHcgQL3V)
• Warn users if server side event responses are received without streaming. (#4469, @mhils)
• Add flatpak support to the browser addon (#5200, @pauloromeira)
• Add example addon to dump contents to files based on a filter expression (#5190, @redraw)
• Fix a bug where the wrong SNI is sent to an upstream HTTPS proxy (#5109, @mhils)
• Make sure that mitmproxy displays error messages on startup. (#5225, @mhils)
• Add example addon for domain fronting. (#5217, @randomstuff)
• Improve cut addon to better handle binary contents (#3965, @mhils)
• Fix text truncation for full-width characters (#4278, @kjy00302)
• Fix mitmweb export copy failed in non-secure domain. (#5264, @Pactortester)
• Add example script for manipulating cookies. (#5278, @WillahScott)
• When opening an external viewer for message contents, mailcap files are not considered anymore. This preempts the upcoming deprecation of Python's mailcap module. (#5297, @KORraNpl)
• Fix hostname encoding for IDNA domains in upstream mode. (#5316, @nneonneo)
• Fix hot reloading of contentviews. (#5319, @nneonneo)
• Ignore HTTP/2 information responses instead of raising an error. (#5332, @mhils)
• Improve performance and memory usage by reusing OpenSSL contexts. (#5339, @mhils)
• Fix handling of multiple Cookie headers when proxying HTTP/2 to HTTP/1 (#5337, @rinsuki)
• Improve http_manipulate_cookies.py example. (#5578, @insilications)

Major Changes

• Major improvements to the web interface (@gorogoroumaru)
• Event hooks can now be async (@nneonneo, #5106)
• New tls_{established,failed}_{client,server} event hooks to record negotiation success/failure (@mhils, #4790)

Security Fixes

• CVE-2022-24766: Fix request smuggling vulnerability reported by @zeyu2001 (@mhils)

Full Changelog

• Support proxy authentication for SOCKS v5 mode (@starplanet)
• Make it possible to ignore connections in the tls_clienthello event hook (@mhils)
• fix some responses not being decoded properly if the encoding was uppercase (#4735, @Mattwmaster58)
• Trigger event hooks for flows with semantically invalid requests, for example invalid content-length headers (@mhils)
• Improve error message on TLS version mismatch (@mhils)
• Windows: Switch to Python's default asyncio event loop, which increases the number of sockets that can be processed simultaneously (@mhils)
• Add client_replay_concurrency option, which allows more than one client replay request to be in-flight at a time. (@rbdixon)
• New content view which handles gRPC/protobuf. Allows to apply custom definitions to visualize different field decodings. Includes example addon which applies custom definitions for selected gRPC traffic (@mame82)
• Fix a crash caused when editing string option (#4852, @rbdixon)
• Base container image bumped to Debian 11 Bullseye (@Kriechi)
• Upstream replays don't do CONNECT on plaintext HTTP requests (#4876, @HoffmannP)
• Remove workarounds for old pyOpenSSL versions (#4831, @KarlParkinson)
• Add fonts to asset filter (~a) (#4928, @elespike)
• Fix bug that crashed when using view.flows.resolve (#4916, @rbdixon)
• Fix a bug where running() is invoked twice on startup (#3584, @mhils)
• Correct documentation example for User-Agent header modification (#4997, @jamesyale)
• Fix random connection stalls (#5040, @EndUser509)
• Add n new flow keybind to mitmweb (#5061, @ianklatzco)
• Fix compatibility with BoringSSL (@pmoulton)
• Added WebSocketMessage.injected flag (@Prinzhorn)
• Add example addon for saving streamed data to individual files (@EndUser509)
• Change connection event hooks to be blocking. Processing will only resume once the event hook has finished. (@Prinzhorn)
• Reintroduce Flow.live, which signals if a flow belongs to a currently active connection. (#4207, @mhils)
• Speculative fix for some rare HTTP/2 connection stalls (#5158, @EndUser509)
• Add ability to specify custom ports with LDAP authentication (#5068, @demonoidvk)
• Add support for rotating saved streams every hour or day (@EndUser509)
• Console Improvements on Windows (@mhils)
• Fix processing of --set options (#5067, @marwinxxii)
• Lowercase user-added header names and emit a log message to notify the user when using HTTP/2 (#4746, @mhils)
• Exit early if there are errors on startup (#4544, @mhils)
• Fixed encoding guessing: only search for meta tags in HTML bodies (##4566, @Prinzhorn)
• Binaries are now built with Python 3.10 (@mhils)

• Fix reading of saved flows in mitmweb.

• Fix flow serialization in mitmweb.

• Add Filter message to mitmdump (@sarthak212)
• Display TCP flows at flow list (@Jessonsotoventura, @nikitastupin, @mhils)
• Colorize JSON Contentview (@sarthak212)
• Fix console crash when entering regex escape character in half-open string (@sarthak212)
• Integrate contentviews to TCP flow details (@nikitastupin)
• Added add-ons that enhance the performance of web application scanners (@anneborcherding)
• Increase WebSocket message timestamp precision (@JustAnotherArchivist)
• Fix HTTP reason value on HTTP/2 reponses (@rbdixon)
• mitmweb: support wslview to open a web browser (@G-Rath)
• Fix dev version detection with parent git repo (@JustAnotherArchivist)
• Restructure examples and supported addons (@mhils)
• Certificate generation: mark SAN as critical if no CN is set (@mhils)
• Simplify Replacements with new ModifyBody addon (@mplattner)
• Rename SetHeaders addon to ModifyHeaders (@mplattner)
• mitmweb: "New -> File" menu option has been renamed to "Clear All" (@yogeshojha)
• Add new MapRemote addon to rewrite URLs of requests (@mplattner)
• Add support for HTTP Trailers to the HTTP/2 protocol (@sanlengjingvv and @Kriechi)
• Fix certificate runtime error during expire cleanup (@gorogoroumaru)
• Fixed the DNS Rebind Protection for secure support of IPv6 addresses (@tunnelpr0)
• WebSockets: match the HTTP-WebSocket flow for the ~websocket filter (@Kriechi)
• Fix deadlock caused by the "replay.client.stop" command (@gorogoroumaru)
• Add new MapLocal addon to serve local files instead of remote resources (@mplattner and @mhils)
• Add minimal TCP interception and modification (@nikitastupin)
• Add new CheckSSLPinning addon to check SSL-Pinning on client (@su-vikas)
• Add a JSON dump script: write data into a file or send to an endpoint as JSON (@emedvedev)
• Fix console output formatting (@sarthak212)
• Add example for proxy authentication using selenium (@anneborcherding and @weichweich)

• Fixed precompiled Linux binaries to not crash in table mode
• Display webp images in mitmweb (@cixtor)

• Fix an issue that caused mitmproxy to lose keyboard control after spawning an external editor.

• Fix a quote-related issue affecting the mitmproxy console command prompt.