This release collects the maintenance and diagnostic changes since v2.2.8.
Connection acceptance now recovers from temporary errors and skips unusable
accepted sockets. A fatal listener failure reaches the supervisor instead of
leaving an apparently live process. Media DC identifiers retain their sign
through routing and fallback. Other changes improve SOCKS endpoint resolution,
OpenBSD keepalive handling, and fronting and Telegram connectivity diagnostics.
Before upgrading
Replace legacy domain-fronting-ip and [domain-fronting].ip with
[domain-fronting].host. Replace --domain-fronting-ip with
--domain-fronting-host for simple-run. The old IP options are now ignored with
a warning. If your setup pins a fronting destination, leaving an old option
unchanged can send traffic to a different destination, including back to your
own proxy when the secret hostname resolves to it. Keep the fronting port and
proxy-protocol settings as needed; host can be either a DNS name or an IP.
The FakeTLS secret and its SNI hostname do not need to change.
Media connections now use negative DC identifiers in metrics and events.
Update dashboards that filter exclusively on positive DC numbers.
Startup checks DNS/SNI and public-IP consistency before opening the listener.
These warnings do not stop startup, but checks can add startup latency.
mtg doctor now also verifies fronting TLS certificate validity and a Telegram
RPC exchange. It can expose connectivity or certificate problems that the old
doctor did not report. --skip-native-check is available when direct Telegram
egress is intentionally blocked and a configured proxy provides connectivity.
For Go library users
Replace ProxyOpts.DomainFrontingIP with ProxyOpts.DomainFrontingHost.
This release restores the exact v2.2.8 network/v2.New signature. Existing
callers keep the default TCP_NOTSENT_LOWAT setting and compile unchanged.
New code that needs an explicit setting can use NewWithTCPNotSentLowat.
CLI and doctor continue passing the configured socket value; defaults are
unchanged. In the Go API, zero uses the default and a negative value disables
the socket option. The compatibility repair is included in #583.
Unchanged defaults
The Go floor was already 1.26 in v2.2.8. Time-skew tolerance remains 3 seconds,
IP preference remains prefer-ipv6, auto-update remains disabled, and
TCP_NOTSENT_LOWAT remains 128 KiB. Pending-handshake limits, client MSS, and
configurable log-time formatting from the open feature PRs are not included.
Maintenance PRs
#582
#577
#578
#583
Full comparison:
v2.2.8...v2.3.0