Ghostunnel Files

Feature and maintenance release.

New Features

• ALPN support. The new --alpn flag sets the protocols to negotiate via ALPN, comma-separated, in order of preference (e.g. --alpn h2,http/1.1). It works in both client and server mode; when unset (the default), ALPN stays disabled. In server mode the preference order is authoritative: the server picks the first entry from its own list that the client also offers, and a client that offers ALPN with no protocol in common is rejected with a no_application_protocol alert (clients that don't use ALPN at all still connect, so this is not an access control mechanism). Malformed lists are rejected at startup, the status port deliberately ignores --alpn so monitoring clients can't be locked out, and when ACME is in use acme-tls/1 is still advertised automatically for the TLS-ALPN-01 challenge (the name is reserved and can't appear in --alpn). See the security docs for negotiation behavior and caveats. Comes with new integration tests covering client and server negotiation and ACME challenge interaction (#812 by @mjm, [#813]).

Other

• Go 1.27. The required Go version is now 1.27, and release builds are made with it. Among other things, this inherits support for ML-DSA (FIPS 204) post-quantum certificates from the Go standard library, now documented in the post-quantum section of the security docs (#814).
• Dependency upgrades. All Go dependencies updated to their latest versions, including OPA v1.19.1, grpc v1.83.1, and prometheus/client_golang v1.24.1. The mholt/acmez module was migrated from v1 to v3, dropping the duplicate older module version from the build (#814).

New Flags