Changelog

Notable MEHS changes and compatibility guidance. Package versions follow semantic versioning but do not imply a finalized or interoperable wire protocol. Historical notes describe their release, not today's platform status.

The live release archive may contain newer packages than the documented notes below. Download metadata does not include change descriptions; no undocumented release changes are inferred here.

Unreleased

Changed

• Connecting status is split into ResolvingControl, ControlTls, Authorizing, Finalizing, ResolvingData, DataConnecting, DataAuthenticating, and Probing.
• Verbose output reports detailed setup, transport, session, proxy, and recovery events with plain lifecycle tokens.

Fixed

• Flow closes are no longer dropped when the command queue is full; cancelled flow opens close the server flow.
• Links with unacknowledged data despite successful keepalives, or repeated new-flow rejection, are replaced with a fresh session instead of stalling.
• Server flows close on inbound-buffer overflow. UDP relays idle for 180 seconds close to prevent flow-limit exhaustion.
• Transient initial-connect failures such as Wi-Fi/cellular switching, DNS/route unavailability, timeouts, or ECONNABORTED retry with backoff.
• TUN packet I/O tolerates transient read/write failures.

Unreleased behavior is not a guarantee for currently downloaded packages. In particular, initial-connect retry behavior differs from the published CLI contract.

0.9.2 - 2026-10-22

Beta pre-release. Use the 0.9.2 client and server together; mixed patch releases are not certified.

Added

• iOS NEPacketTunnelProvider TUN runtime integration with bounded input, host packet-writer callbacks, host-owned settings, and device/simulator XCFramework packages.
• Optional ML-KEM-768 and AES-256-GCM end-to-end encryption.
• Configurable TLS client fingerprint presets and JSON profiles across release platforms.
• External HTTP(S) authorization with data-channel credential binding and no password persistence in local stores.
• Checksummed platform packages including Windows ARM64 MSVC and iOS device/universal simulator libraries.

Changed

• Client and server configuration surfaces are soft-frozen schema 1 contracts with strict parsing and evolution rules.
• Authorization reports the frame protocol version. Missing/mismatched values fail before finalization; this is a compatibility guard, not multi-version negotiation.
• Client status reports connecting immediately and flushes startup events after establishment.
• Host-driven platform lifecycle notifications and Android TUN integration are documented.

Fixed

• Local configured-store sessions authenticate correctly. External sessions remain memory-only and cannot be reloaded through a colliding local identity.
• External authorization HTTP framing was corrected.
• Both iOS simulator architectures are combined into a universal library; iOS deployment target is 13.0.
• Android packages include the required shared C++ runtime and NDK notices.

Compatibility and upgrade

• Frame version and ALPN/profile identifiers are unchanged, but matching numbers do not certify mixed releases.
• Upgrade clients and server together to 0.9.2, reconnect active sessions, and roll back both sides together.
• Missing/mismatched frame versions fail at authorization, before finalization.
• New configuration fields require the matching release. iOS packet I/O extends the C ABI without removing existing entry points.

Wire migration checklist

For incompatible releases, record old/new frame versions and ALPN/profile identifiers; exact supported and unsupported client/server pairs; failure stage (authorization, TLS/ALPN, or decode); upgrade order and rollback constraints; and effects on active sessions, flows, and reconnects.

0.9.1 - 2026-10-19

• Fixed TUN crashes on out-of-window peer TCP segments.
• TUN uploads with no upstream progress for 60 seconds reset instead of hanging.
• Dropping an unused transport pool in single-transport mode no longer emits a spurious server_policy correction.

0.9.0 - 2026-10-18

Added

• xhttp, trusttunnel, and notmehs HTTP carriers: HTTP/2 over TLS/TCP and HTTP/3 over QUIC, controlled by transport_profile, --transport-profile, transport_profiles, http_path, and --http-path. All profile/carrier pairs were manually verified with 20 MB transfers; no third-party interoperability.
• Per-application bypass/only routing on Linux and Windows, for proxy TCP and TUN TCP/UDP.
• Documented outbound_block_private; Windows TUN verified.
• Split routing with tun.exclude_routes and --tun-exclude, with route cleanup on exit or forced termination.
• New UDP flows prefer live QUIC links in auto mode to avoid TCP head-of-line blocking.
• Automatic authenticated measurements of RTT, jitter, loss, and throughput, cached for transport_cache_ttl_seconds.
• Live migration enabled by default via is_hot_change_available. Standby health checks and sustained selection_improvement_percent over selection_windows_required windows promote the candidate, subject to migration_cooldown_seconds. The old carrier drains for migration_drain_timeout_seconds.
• Independent multi-link pools balance new flows round-robin, replenish failed links, and fail over to standby carriers.
• Idle-link keepalive probes, unanswered-probe deadlines, bounded frame writes, and server probe echoes.
• Applied frame, negotiation TTL, cache, migration, selection, and health settings.
• TUN route state and a reaper clean routes after crashes or forced termination; verified on Linux.

Changed

Wire-incompatible with 0.8.x: probes require a 0.9.0 server; update clients and server together. Server max_connections (default 32) counts every link of every client.

0.8.1 - 2026-10-18

Added

• System-wide TUN using client-side TCP/UDP/ICMP flow mapping without server gateway changes or extra server privileges. Client root/administrator permissions still apply.
• client_mode, tun.name, mtu, routes, manage_routes, block_quic, fd, and corresponding CLI flags. Linux verified on TCP and QUIC; desktop/mobile availability at this historical release differed from current support.
• Server default max_flows_per_session raised to 1024.
• Shared CLI/FFI reconnect supervisor with 1-30 second backoff and in-process mehs_runtime_start/status/stop.
• Linux server/client, Windows x64/x86/arm64 with Wintun, and Android three-ABI packages.
• Configuration reference and integration/platform documentation.

Fixed

Closed-flow accounting, per-flow buffers, carrier keepalive, frame-size/unopened-flow crashes, and asynchronous task failure handling.

Changed

The package version became 0.8.1 after an earlier 1.0.0 label; the wire protocol remains evolving.

1.0.0 - 2026-10-16 (historical label)

Added

• Bounded v1 framing with 36-byte headers; stream data, datagram, ACK, probe, close, and error types; cumulative/selective ACK ranges; numeric error registry 1-8; validated payload encoding.
• TLS 1.3 TCP and QUIC with certificate verification, 0-32 independent connections per carrier, selection primitives, and make-before-break migration with a 60-second drain cap.
• In-memory authorization/policy, duplicate detection, per-flow sequencing/reordering, promotion/drain states, and scoring weights of 50% loss, 30% median RTT, 15% jitter, and 5% throughput.
• 24-hour configuration-keyed transport cache and 15-second consecutive-unreachability terminal detection.
• HTTPS authorization/finalization control API, TLS 1.3 only, and server policy enforcement.
• C ABI for session create/send/receive/poll, framing, migration begin/finalize/fallback, lifecycle hooks, and error reporting.
• SOCKS5 CONNECT/UDP ASSOCIATE, HTTP CONNECT, optional remote DNS, bounded-channel backpressure, reliable delivery/ACK/retransmission, authenticated flow-open/result messages, and destination forwarding.
• Legacy Linux raw-IP TUN device access using IFF_TUN | IFF_NO_PI, IPv4/IPv6 parsing, datagram flow mapping, and inbound injection; addressing, MTU, routes, and DNS were host-managed.
• Platform packet/lifecycle contracts, sleep/wake/interface notifications, and Android host-descriptor support. Historical iOS/Windows/macOS support limits do not describe later releases.
• Protocol, architecture, configuration, migration, server, and threat-model documentation.
• TLS certificate verification, session-bound replay protection, resource bounds, and an initial threat model. No independent production audit or published end-to-end performance study.

Fixed

• Cancellation-safe frame reads prevent payload-limit crashes under load; late closed-flow data no longer ends sessions.
• Clean shutdown and isolation of slow/stalled flows.
• Retransmission timer changed from 200 ms to 3 seconds, with backoff capped at 30 seconds.
• TCP_NODELAY on data, target, and local proxy sockets.
• Closed-flow accounting no longer blocks new flows after roughly 128 requests.
• TCP keepalive, QUIC keepalive every 10 seconds with a 90-second idle timeout, and automatic reconnect.

Security

Mandatory TLS 1.3 certificate validation; session-to-transport binding; resource bounds for connections, frames and buffers; no sensitive-data logging.

Roadmap and known limitations

Open gaps are not dated commitments: stable wire interoperability, full device/platform lifecycle validation, broader monitoring beyond status/metrics, durable multi-process credential/session storage, and independent security assurance. Default stores are in-memory; optional file stores are single-process and need deployment-specific protection.

Android hosts must configure VPN descriptors, addresses, routes, and DNS. Hosts must pause probing/new connections during sleep, validate health before resuming, and react to network changes. Later releases add iOS integration; consult the current support matrix, platform lifecycle guide, and security policy.