Mitmproxy has a completely new proxy core, fixing many longstanding issues:
Secure Web Proxy: Mitmproxy now supports TLS-over-TLS to already encrypt the connection to the proxy.
Server-Side Greetings: Mitmproxy now supports proxying raw TCP connections, including ones that start
with a server-side greeting (e.g. SMTP).
HTTP/1 – HTTP/2 Interoperability: mitmproxy can now accept an HTTP/2 connection from the client,
and forward it to an HTTP/1 server.
HTTP/2 Redirects: The request destination can now be changed on HTTP/2 flows.
Connection Strategy: Users can now specify if they want mitmproxy to eagerly connect upstream
or wait as long as possible. Eager connections are required to detect protocols with server-side
greetings, lazy connections enable the replay of responses without connecting to an upstream server.
Timeout Handling: Mitmproxy will now clean up idle connections and also abort requests if the client disconnects
in the meantime.
Host Header-based Proxying: If the request destination is unknown, mitmproxy now falls back to proxying
based on the Host header. This means that requests can often be redirected to mitmproxy using
DNS spoofing only.
Internals: All protocol logic is now separated from I/O ("sans-io").
This greatly improves testing capabilities, prevents a wide array of race conditions, and increases
proper isolation between layers.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dutzi/tamper/network/alerts).
dependabot[bot]
commented
2 years ago
Bumps mitmproxy from 0.11.1 to 7.0.3.
Release notes
Sourced from mitmproxy's releases.
... (truncated)
Changelog
Sourced from mitmproxy's changelog.
... (truncated)
Commits
c4f3597mitmproxy 7.0.39fed8aeMerge pull request from GHSA-22gh-3r9q-xf382323630[requires.io] dependency update on v7.0.x branch (#4802)2027d1ebump installbuilder (#4800)463bb90add python 3.10 trove classifierc99ff55tls: fix TLS1 constantb26e76efix Python 3.10 compatibility8b88e8fmitmproxy 7.0.253a916efix websocket regression introduced in 7.0.1 (#4733)88374e9reopen main for developmentDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dutzi/tamper/network/alerts).