- Add experimental CONNECT-IP (so-called "MASQUE") support.
- Fix CONNECT-UDP bugs.
- Update Go to 1.27.3, which has been hardcoded to blacklist 8 eMudhra intermediate certificates.
- Update the bundled Mozilla CA certificate store to the latest version, which has removed eMudhra root certificates.
- Rename root CA provider "system" to "Go" and rename root CA provider "system and user" to "Android" to avoid confusion.
This is a security update. The private keys for some of eMudhra’s intermediate certificates are too weak, causing them to be compromised through enumeration and exposing users to man-in-the-middle attacks. These private keys have since spread across the Internet and can be obtained by everyone.
You may want to know the impact of the compromise of eMudhra intermediate certificates for Exclave: #500.