Resumed PQDNSCrypt queries now use regular UDP padding, protecting their size and response budget. Oversized tickets are rejected, and oversized queries fall back to TCP.
Network changes are detected more reliably, ensuring PQDNSCrypt key material rotates when connections change.
Forwarded queries to local or DHCP resolvers now use UDP by default. Bootstrap resolvers still use TCP when force_tcp is enabled.
Suffix rules now match only at DNS label boundaries. IP allow/block rules now correctly handle IPv4-mapped IPv6 addresses.
The monitoring dashboard displays the running version. Its endpoints no longer allow cross-origin browser access.
