zoraxy

v3.3.3 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 1mo Reverse Proxies & Load Balancers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

cluster-gateway go self-hosted http-proxy port-forward proxy

+9 more

redirect server stream-proxy subdomain tcp-proxy virtual-directory web-server websocket-proxy zoraxy

Affected surfaces

crypto_tls breaking_upgrade

ReleasePort's take

Light signal

editorial:auto 1mo

SMTP support is removed in this release; a WebDAV server access plugin is added as its replacement.

Why it matters: Deprecation of SMTP removes that transport option entirely, requiring migration to alternatives such as the new WebDAV plugin for file‑manager use cases.

Summary

AI summary

ACME certificate request regression fixed, SMTP feature removed, and ACME now supports url.URL for dnsCredentials.

Changes in this release

Type	Severity	Summary	CVE
Feature	Medium	Adds WebDAV server access plugin as replacement for deprecated web file manager. Adds WebDAV server access plugin as replacement for deprecated web file manager. Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Medium	Allows Uptime Monitor to use a custom URI for health checks. Allows Uptime Monitor to use a custom URI for health checks. Source: llm_adapter@2026-06-09 Confidence: high	—
Dependency	Low	Migrates internal database dependency to a maintained fork of boltDB. Migrates internal database dependency to a maintained fork of boltDB. Source: llm_adapter@2026-06-09 Confidence: high	—
Deprecation	High	Removes the long-deprecated SMTP feature. Removes the long-deprecated SMTP feature. Source: llm_adapter@2026-06-09 Confidence: high	—
Bugfix	Medium	Resolves ACME certificate request regression introduced in rc2. Resolves ACME certificate request regression introduced in rc2. Source: llm_adapter@2026-06-09 Confidence: high	—
Bugfix	Medium	Enforces ReadHeaderTimeout and IdleTimeout on main listeners to prevent stuck connections. Enforces ReadHeaderTimeout and IdleTimeout on main listeners to prevent stuck connections. Source: llm_adapter@2026-06-09 Confidence: high	—

Full changelog

v3.3.3

This version of Zoraxy brings a mix of new features, housekeeping changes, and stability improvements. The long-deprecated SMTP feature has been removed in this release, and trusted proxy gating has been extended to cover more internal services. IP scanning received a few minor improvements, and the internal database dependency has been migrated to a maintained fork of boltDB.

Since the web file manager interface has been deprecated from previous release, a new WebDAV server access plugin is now available for those who need it, and the Uptime Monitor now supports setting a custom URI for health checks. On the stability side, the ACME certificate request regression that was inadvertently introduced in rc2 has been resolved. Main listeners now correctly enforce ReadHeaderTimeout and IdleTimeout to prevent connections from getting stuck indefinitely. A supporter list has also been quietly added to the webmin UI.

As always, thanks for all your contributions and pull requests to make this project better for everyone :)

What's Changed

Update CHANGELOG.md by @Morethanevil in https://github.com/tobychui/zoraxy/pull/1082
feat(acme): url.URL support for dnsCredentials by @t510599 in https://github.com/tobychui/zoraxy/pull/1078
feat: add a basic CI script by @AnthonyMichaelTDM in https://github.com/tobychui/zoraxy/pull/752
Bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in https://github.com/tobychui/zoraxy/pull/1104
Features: Turnstile for directory by @Klarulor in https://github.com/tobychui/zoraxy/pull/1112
Bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in https://github.com/tobychui/zoraxy/pull/1113
Bump actions/setup-go from 4 to 6 by @dependabot[bot] in https://github.com/tobychui/zoraxy/pull/1103
Bump actions/checkout from 4 to 6 by @dependabot[bot] in https://github.com/tobychui/zoraxy/pull/1105
fix: Allow Location header rewrite when target matches OriginalHost by @TuxLux40 in https://github.com/tobychui/zoraxy/pull/1120
Fix certificate file permissions by @devilmonastery in https://github.com/tobychui/zoraxy/pull/1116
Update lego to v4.35.2 by @zen8841 in https://github.com/tobychui/zoraxy/pull/1130
Update golang version in ci by @zen8841 in https://github.com/tobychui/zoraxy/pull/1131
V3.3.3 by @tobychui in https://github.com/tobychui/zoraxy/pull/1129
Fix typo in customHeaders.html by @jeremyy294 in https://github.com/tobychui/zoraxy/pull/1167
V3.3.3-rc2 by @tobychui in https://github.com/tobychui/zoraxy/pull/1166
fix #1169 by @zen8841 in https://github.com/tobychui/zoraxy/pull/1171
chore: clean up Docker related files by @PassiveLemon in https://github.com/tobychui/zoraxy/pull/1175
Sync docker change to dev branch by @tobychui in https://github.com/tobychui/zoraxy/pull/1177
Add custom URI for Uptime Monitor health check by @barto95100 in https://github.com/tobychui/zoraxy/pull/1172
V3.3.3-rc3 by @tobychui in https://github.com/tobychui/zoraxy/pull/1178
Bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in https://github.com/tobychui/zoraxy/pull/1190
fix(dynamicproxy): set ReadHeaderTimeout and IdleTimeout on main listeners by @ElmoViggiani in https://github.com/tobychui/zoraxy/pull/1187
Bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/tobychui/zoraxy/pull/1189
Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in https://github.com/tobychui/zoraxy/pull/1188
V3.3.3-rc4 by @tobychui in https://github.com/tobychui/zoraxy/pull/1192

New Contributors

@t510599 made their first contribution in https://github.com/tobychui/zoraxy/pull/1078
@Klarulor made their first contribution in https://github.com/tobychui/zoraxy/pull/1112
@TuxLux40 made their first contribution in https://github.com/tobychui/zoraxy/pull/1120
@devilmonastery made their first contribution in https://github.com/tobychui/zoraxy/pull/1116
@jeremyy294 made their first contribution in https://github.com/tobychui/zoraxy/pull/1167
@barto95100 made their first contribution in https://github.com/tobychui/zoraxy/pull/1172

Full Changelog: https://github.com/tobychui/zoraxy/compare/v3.3.2...v3.3.3

Breaking Changes

Removed the long-deprecated SMTP feature.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track zoraxy

Get notified when new releases ship.

About zoraxy

A general purpose HTTP reverse proxy and forwarding tool. Now written in Go!

All releases →