v3.2.0

Security & CI

🛡️ Semgrep CE Shell Security Scan

• Local Security Rules: Added a Semgrep CE workflow with Route10-specific shell security checks for risky script patterns, including remote pipe-to-shell execution, encoded payload execution, reverse-shell patterns, and unusual setuid permissions.
• Repository Badge: Added a Semgrep status badge to the README for quick GitHub Actions visibility.

🔎 FileScan.IO Upstream Binary Malware Scan

• DNSCrypt Artifact Scanning: Added a FileScan.IO workflow to scan the upstream DNSCrypt-Proxy and UPX release archives and extracted binaries.
• CI Verdict Enforcement: Fails the workflow on suspicious, likely_malicious, or malicious verdicts.

Full Changelog: v3.1.0...v3.2.0

v3.1.0

This release upgrades the core DNSCrypt-Proxy engine to 2.1.16 and introduces critical bug fixes for the auto-updater and boot-time NTP clock synchronization.

What's New & Enhancements

🚀 DNSCrypt-Proxy v2.1.16 Engine Upgrade

• Upgraded target version to 2.1.16 in configuration and scripts.
• Core improvements in DNSCrypt-Proxy v2.1.16 include:
  • Hot-reloading of configurations without restarting the daemon.
  • Interactive live monitoring web dashboard.
  • Bug fixes for ODoH key refresh and HTTP transport connection reuse.

🕒 NTP Boot-Time Lock Resolution

• Resolved the boot-time NTP/DNS deadlock in scripts/start.sh:
  • If the router clock is not sane on boot (e.g. 1970) and dnsmasq is configured for DNSCrypt only, the script temporarily disables the DNSCrypt-only block and restores standard WAN DNS upstreams.
  • This allows the NTP client to resolve NTP server domain names and sync the system clock.
  • Once the clock is synchronized and sane, the script starts DNSCrypt-Proxy, validates resolution, and performs the permanent cutover back to DNSCrypt.

🛠️ Active Binary Version Verification

• Updated setup.sh to parse and verify the version of any local dnscrypt-proxy executable using --version instead of blindly skipping downloads in non-interactive mode.

Full Changelog: v3.0.0...v3.1.0

v3.0.0

This release introduces a structural refactor for long-term maintainability, a new orchestrator wrapper, stronger boot/cron migration behavior, and safer update/version lifecycle management.

Compatibility Notes

• Existing installs are auto-migrated by running setup.sh once.
• Existing users should rerun setup.sh before rebooting so old boot hooks are migrated safely:
  • /cfg/dnscrypt-proxy/setup.sh --non-interactive --keep-binary
• The canonical boot command is now:
  • /cfg/dnscrypt-proxy/proxy.sh start >/var/log/dnscrypt-proxy-boot.log 2>&1 &
• The canonical cron commands are now:
  • 35 4 * * * /bin/ash /cfg/dnscrypt-proxy/proxy.sh updater check >/dev/null 2>&1
  • 0 4 * * * /bin/ash /cfg/dnscrypt-proxy/proxy.sh update-filters -f >/dev/null 2>&1

Full Changelog: v2.0.0...v3.0.0

v2.0.0

Release Notes - v2.0.0

Release Date: 2026-04-03

This release introduces a structural refactor for long-term maintainability, a new orchestrator wrapper, stronger boot/cron migration behavior, and safer update/version lifecycle management.

Highlights

• New Orchestrator (proxy.sh):

  • Added a single command wrapper for service operations:
    • proxy.sh start
    • proxy.sh updater [check|force]
    • proxy.sh update-filters [-f]
    • proxy.sh uninstall [--force]
  • Cron and boot hooks now target proxy.sh instead of direct script paths.

• Script Layout Migration (scripts/):

  • Moved operational scripts into scripts/:
    • scripts/start.sh
    • scripts/updater.sh
    • scripts/update-filters.sh
    • scripts/uninstall.sh
  • Updated all internal callers and path resolution to work from the new location.

• Configuration Layout Migration (conf/):

  • Moved TOML/TXT/logrotate assets into conf/:
    • conf/setup.toml
    • conf/setup-custom.toml
    • conf/dnscrypt-proxy.toml
    • conf/dnscrypt-proxy-custom.toml
    • conf/custom.toml
    • conf/whitelist.txt
    • conf/dnscrypt-proxy.logrotate
  • Updated setup, runtime merge logic, updater, and uninstall scripts to read from conf/.

• Boot/Cron Canonicalization in Setup:

  • setup.sh now actively removes legacy boot and cron entries and rewrites them to canonical proxy.sh entries every run.
  • This prevents stale historical paths from surviving upgrades.

• Updater Hardening:

  • Added robust version parity logic between local state and UCI.
  • Added installed-version tracking via .installed-version to prevent repeat updates when already current.
  • Added UCI registration updates during setup/update (dnscrypt-proxy.system.version, dnscrypt-proxy.system.dnscrypt).

• Filter Update Behavior Improvements:

  • update-filters.sh now treats missing blocked_names sources as a valid disabled mode instead of an error.
  • When sources are disabled, runtime config is rebuilt so stale [blocked_names] state is removed cleanly.

Compatibility Notes

• Existing installs are auto-migrated by running setup.sh once.
• The canonical boot command is now:
  • /cfg/dnscrypt-proxy/proxy.sh start >/var/log/dnscrypt-proxy-boot.log 2>&1 &
• The canonical cron commands are now:
  • 35 4 * * * /bin/ash /cfg/dnscrypt-proxy/proxy.sh updater check >/dev/null 2>&1
  • 0 4 * * * /bin/ash /cfg/dnscrypt-proxy/proxy.sh update-filters -f >/dev/null 2>&1

Full Changelog: v1.1.1...v2.0.0

v1.1.1

Fixed DNS blocklist generation issue after setup or boot.

Full Changelog: v1.1.0...v1.1.1

v1.1.0

This release focuses on configuration flexibility, system stability, and a new DNS filtering feature optimized for the Route10 environment.

Highlights

• TOML-Based Configuration: Migrated from legacy formats to TOML (setup.toml). This brings support for comments, structured data, and high maintainability without external dependencies.
• Script Robustness & Stability:
  • External Lua Helper: Eliminated silent shell-escaping bugs by moving configuration extraction to a dedicated Lua script.
• Native DNS Blocklist Integration:
  • Automatic Filtering: Direct integration for merging and loading multiple remote DNS blocklists.

Full Changelog: v1.0.0...v1.1.0

v1.0.0

See README for details.

Full Changelog: https://github.com/unflawed-code/route10-dnscrypt-proxy/commits/v1.0.0