- Introduces Encrypted ClientHello (ECH) and post‑quantum X25519‑MLKEM768 key exchange for enhanced TLS privacy and security.
- Adds global DNS configuration, a Via header for reverse proxy, default wildcard certificate usage, and experimental ACME profiles.
- Updates libdns to 1.0 APIs and drops support for older Go minor versions, requiring provider code changes (breaking).