- Enhanced reverse proxy: fixed health‑check port handling, added passive health checking via dynamic upstream tracking, prevented body‑close on retries, and introduced query‑escaping when PROXY protocol is enabled
- Added global `tls.resolvers` option for ACME DNS challenges and log‑rolling support for zstd compression (gzip roll deprecated)
- Fixed multiple bugs and patched two CVEs (forward‑auth identity injection and vars regexp expansion); updated docs on file‑server hide case‑sensitivity