<!--
 File        :  doc/source/changelog.sgml

 Purpose     :  Entity included in other project documents.

 Copyright (C) 2013-2023 Privoxy Developers https://www.privoxy.org/
 See LICENSE.

 ======================================================================
  This file used for inclusion with other documents only.
 ======================================================================

 If you make changes to this file, please verify the finished
 docs all display as intended.

 This file is included into:

  user-manual
-->


<!--
 The SGML ChangeLog can be generated with: utils/changelog2doc.pl ChangeLog
-->

<para>
  <application>Privoxy 4.0.0</application> fixes a few
  minor bugs and comes with a couple of general improvements
  and new features. HTTPS inspection is no
  longer considered experimental.
</para>
<para>
  Two new features have been funded by donations. If you can,
  please consider
  <ulink url="https://www.privoxy.org/donate">making a donation</ulink>
  to support future improvements.
</para>
<para>
  Changes in <application>Privoxy 4.0.0</application> stable:
</para>
<para>
 <itemizedlist>
  <listitem>
   <para>
    Bug fixes:
    <itemizedlist>
    <listitem>
     <para>
      Add missing client-body-tagger data to the action_type_info[] struct
      so lookups based on the action index work correctly again.
      Prevents assertion failures or segfaults when trying to edit
      an action file with the CGI editor.
      The type of failure depended on whether or not assertions
      were enabled and on whether or not Privoxy had been compiled
      with FEATURE_EXTERNAL_FILTERS.
      Regression introduced in Privoxy 3.0.34.
      Patch submitted by Aaron Li in #940.
     </para>
    </listitem>
    <listitem>
     <para>
      Bump MAX_FILTER_TYPES which should have been done in d128e6aa4
      when introducing the client-body-tagger{} action.
      Prevents an assertion in cgi_edit_actions_for_url() from triggering
      after e32d03e0 when using the CGI editor with assertions enabled.
     </para>
    </listitem>
    <listitem>
     <para>
      is_untrusted_url(): Search the encrypted headers for the Referer
      when the client is using https and https inspection is enabled.
      Fixes the trust mechanism for https requests.
      Reported by Laurent Caumont in #1767.
     </para>
    </listitem>
    <listitem>
     <para>
      GNUMakefile.in: Let the install target work if no group is specified.
     </para>
    </listitem>
    <listitem>
     <para>
      GNUMakefile.in: Set GROUP_T when installing configuration files as root
      and there is no privoxy user available so the install target doesn't
      fail. Patch by Fabrice Fontaine.
     </para>
    </listitem>
    <listitem>
     <para>
      GNUmakefile.in: Don't exit if configuration files are installed as root
      as this can be considered acceptable when cross-compiling
      Privoxy inside an autobuilder with only a root user.
      Patch by Fabrice Fontaine.
     </para>
    </listitem>
    <listitem>
     <para>
      configure.in: Fix argument types in gmtime_r() and localtime_r() probes.
      Otherwise these probes always fail with stricter compilers
      even if there is C library support for these functions.
      Patch submitted by Florian Weimer in SF#149.
     </para>
    </listitem>
    <listitem>
     <para>
      Fix socks4 and socks4a support under glibc's source fortification.
      With glibc's source fortification, gcc offers the compilation warning
      resulting in a runtime abort() when using a socks4 or socks4a upstream proxy.
      Despite the warning, the strlcpy() call in question is fine: gcc
      misidentifies the size of the destination buffer, estimating to hold
      only a single char while in fact the buffer stretches beyond the end of
      the struct socks_op.
      The issue was originally reported in the
      <ulink url="https://github.com/NixOS/nixpkgs/issues/265654">NixOS
      issue tracker</ulink> prompted by an upgrade of glibc from 2.37-39 to 2.38-0.
      Patch submitted by Ingo Blechschmid, joint work with
      @esclear and @richi235.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    General improvements:
    <itemizedlist>
    <listitem>
     <para>
      Allow to use wolfSSL for https inspection.
      wolfSSL supports TLS 1.3 and can be significantly faster than
      mbedTLS. Mainly tested on ElectroBSD amd64 where it can
      <ulink url="https://www.fabiankeil.de/gehacktes/privoxy-tls-benchmarks/">compete
      with OpenSSL and LibreSSL</ulink>
      To enable the support, install wolfSSL and run ./configure
      with the --with-wolfssl option.
      Sponsored by Privoxy project funds collected at SPI.
     </para>
    </listitem>
    <listitem>
     <para>
      Add an test framework that leverages the curl test suite.
      Sponsored by Privoxy project funds collected at SPI.
     </para>
    </listitem>
    <listitem>
     <para>
      Add pcre2 support. Closes bug #935.
      Initial patch submitted by Gagan Sidhu.
     </para>
    </listitem>
    <listitem>
     <para>
      Use SHA256 as hash algorithm for the certificate and key file names
      instead of MD5. The known MD5 vulnerabilities shouldn't matter for
      Privoxy's use case but it doesn't hurt to use a hash algorithm that
      isn't deprecated.
      Sponsored by: Robert Klemme
     </para>
    </listitem>
    <listitem>
     <para>
      Add support for mbedTLS 3.x. This removes a sanity check
      (whether issuer key and issuer certificate match) that seems
      overly cautious and fails to compile with mbedTLS 3.x as the
      struct members are private. We don't have an equivalent check
      in the OpenSSL or wolfSSL code either.
     </para>
    </listitem>
    <listitem>
     <para>
      Factor out newer_privoxy_version_required() and improve the logic
      Previously 3.0.11 was considered newer than 4.0.0.
     </para>
    </listitem>
    <listitem>
     <para>
      init_error_log(): Include the reason for failures to open the log file.
     </para>
    </listitem>
    <listitem>
     <para>
      create_client_ssl_connection(): Don't keep the certificate lock
      longer than necessary.
     </para>
    </listitem>
    <listitem>
     <para>
      Add periods to a bunch of log messages.
     </para>
    </listitem>
    <listitem>
     <para>
      normalize_lws(): Only log the 'Reducing whitespace ...' message
      once per header
     </para>
    </listitem>
    <listitem>
     <para>
      log_error() Win32: Only call LogShowActivity() for debug level
      LOG_LEVEL_REQUEST. As of b94bbe62a950, which was part of Privoxy 3.0.29,
      LOG_LEVEL_REQUEST is used for all requests including crunched ones.
      Previously LogShowActivity() was called twice for crunched
      requests, (presumably) resulting in an aborted animation.
     </para>
    </listitem>
    <listitem>
     <para>
      Remove ./ prefix from tarball-dist files.
     </para>
    </listitem>
    <listitem>
     <para>
      create_client_ssl_connection(): Make it more obvious from an
      error message that a function failed.
     </para>
    </listitem>
    <listitem>
     <para>
      Use stringify() instead of section_target() and remove section_target().
      Like the XXX comment suggested this could be done my moving the hash
      into the templates which seems preferable anyway.
     </para>
    </listitem>
    <listitem>
     <para>
      Prevent some compiler warnings.
     </para>
    </listitem>
    <listitem>
     <para>
      parse_numeric_value(): Expect a base-ten number.
     </para>
    </listitem>
    <listitem>
     <para>
      windows/MYconfigure: Have gcc diagnostics in color.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Action file improvements:
    <itemizedlist>
    <listitem>
     <para>
      Block requests to .amazon-adsystem.com/
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to 0.css-load.com/
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to html-load.com/ and 1.html-load.com/
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to b.6sc.co/
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to i.clean.gg/
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to s.cpx.to/
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to track.venatusmedia.com/
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to secure-eu.nmrodam.com/
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to o2.mouseflow.com/
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for services.akteneinsichtsportal.de/
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for /wp-content/plugins/pdf-viewer-for-elementor
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for syndication.twitter.com/
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for archive.softwareheritage.org/
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects to duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for .creator-spring.com/_next/image
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast redirects for accounts.bahn.de/
     </para>
    </listitem>
    <listitem>
     <para>
      Unblock .datenschmutz.de/
     </para>
    </listitem>
    <listitem>
     <para>
      Unblock requests for 'adventur*.'
     </para>
    </listitem>
    <listitem>
     <para>
      Unblock adl.windows.com/
      as it is apparently required to update from Windows 10 to 11.
      Reported by Sam Varshavchik.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Privoxy-Log-Parser:
    <itemizedlist>
    <listitem>
     <para>
      Highlight 'Couldn't deliver the error message for [...]'.
     </para>
    </listitem>
    <listitem>
     <para>
      Highlight 'Failed to accept() incoming connection: Software caused connection abort'.
     </para>
    </listitem>
    <listitem>
     <para>
      Highlight 'Keeping chunk offset at 0 despite flushing 31 bytes.'.
     </para>
    </listitem>
    <listitem>
     <para>
      Highlight 'Not shutting down client connection on socket 8. The socket is no longer alive.'.
     </para>
    </listitem>
    <listitem>
     <para>
      Bump version to 0.9.6.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Privoxy-Regression-Test.pl:
    <itemizedlist>
    <listitem>
     <para>
      Let the --min-level option increase the --max-level
      if the latter is smaller than the former.
     </para>
    </listitem>
    <listitem>
     <para>
      Add --curl option to use a non-default curl binary.
     </para>
    </listitem>
    <listitem>
     <para>
      Bump version to 0.7.5.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    uagen:
    <itemizedlist>
    <listitem>
     <para>
      Bump BROWSER_VERSION and BROWSER_REVISION to match Firefox ESR 128.
     </para>
    </listitem>
    <listitem>
     <para>
      Bump version to 1.2.6.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Documentation:
    <itemizedlist>
    <listitem>
     <para>
      Add HOWTOs for https inspection and client-tags to user-manual.
     </para>
    </listitem>
    <listitem>
     <para>
      Suggest to use the force-text-mode action when filtering binary content
      with external filters.
     </para>
    </listitem>
    <listitem>
     <para>
      Declare https-inspection non-experimental.
     </para>
    </listitem>
    <listitem>
     <para>
      FAQ: Mention that
      <ulink url="https://www.fabiankeil.de/gehacktes/privoxy-moral-license/">Privoxy
      Moral Licenses</ulink> are available as well.
     </para>
    </listitem>
    <listitem>
     <para>
      Fix LibreSSL URL.
     </para>
    </listitem>
    <listitem>
     <para>
      Update perlre perldoc URL.
     </para>
    </listitem>
    <listitem>
     <para>
      config: Add SOCKS 5 to the list of supported protocols.
     </para>
    </listitem>
    <listitem>
     <para>
      In the Windows build section, note that one only needs tidy
      to build the docs. If you're not building the docbook stuff you
      don't need tidy.
     </para>
    </listitem>
    <listitem>
     <para>
      trust: Use the words 'allowlists' and 'blocklists'
      instead of "whitelists" and "blacklists" which some
      people consider to be less inclusive.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
 </itemizedlist>
</para>
