På tirsdag 30. juni 2026 kl. 21:04, skrev Igor Zornik
<mocheryl@mocheryl.org>:

> Hello, ports.
> 
> Been using this on my router for a couple of weeks without issues. Build
> and quick test done on today’s amd64 snap. QP-encoded diff below the
> changelog.
> 
> Changelog:
> - Dashboard HTML pages are no longer cached, preventing stale content from being
>   served after upgrades.
> - The IP allow/block plugins now support CIDR ranges in addition to single
>   addresses and prefix matching.
> - Forwarding rules now support '$RESOLVCONF:<file>' to pick up upstream
>   resolvers from a resolv.conf-style file, complementing the existing '$DHCP'
>   syntax.
> - Recursive cloaking rules are now rejected at load time instead of being
>   detected only when a matching query arrives.
> - Servers that hit a transient high RTT could previously stay penalized forever
>   and never come back into rotation; their RTT estimate now decays so they can
>   recover.
> - Servers are no longer penalized for slow responses when the response is
>   actually being served from the stale cache.
> - HTTP/3 probing now consults a negative cache before retrying, avoiding
>   repeated probes against servers known not to support it.
> - The HTTP transport now handles 'Alt-Svc: clear' properly and reuses HTTP
>   connections more aggressively.
> - The cache TTL is now an explicit, configurable parameter rather than being
>   derived implicitly.
> - Log entries now include the relay name when a query was sent through an
>   anonymized DNS or ODoH relay.
> - A new 'tls_prefer_rsa option' has been added to prefer RSA cipher suites
>   during the TLS handshake, useful on systems without hardware AES.
> - The 'tls_cipher_suite' option is now a no-op. Modern TLS stacks no longer
>   expose cipher suite selection in a meaningful way, and the option had become
>   misleading.
> - The '-resolve' command now reports incomplete DNSSEC support instead of
>   silently treating partial signatures as a success.
> - ODoH: the 401 key-refresh path has been hardened against panics, races and bad
>   server state, refreshes are now coalesced, and the blocking sleep on refresh
>   has been removed.
> - A log size of 0 no longer means "unlimited"; it now correctly disables
>   rotation by size.
> - 'jsdelivr' is now offered as an alternative source URL for resolver lists,
>   providing more redundancy when the primary mirrors are unreachable.
> 
> Detailed changelog is available at
> https://github.com/DNSCrypt/dnscrypt-proxy/releases/tag/2.1.16
> 

Built/tested on current/amd64 with privsep.
Build date: 1782827771 - Tue Jun 30 13:56:11 UTC 2026

Did:

// Applied patch
$ cd /usr/ports/net/dnscrypt-proxy/ && patch -l -p0 -E < /tmp/dnscrypt-proxy-2.1.16.patch

// Built and ran test/checks
$ cd /usr/ports/net/dnscrypt-proxy/ && make build package test ; make port-lib-depends-check check-shlib-syms

===>  Regression tests for dnscrypt-proxy-2.1.16
cd /usr/ports/pobj/dnscrypt-proxy-2.1.16/go/src/github.com/DNSCrypt/dnscrypt-proxy/dnscrypt-proxy && /usr/bin/env -i GO386=softfloat GOCACHE="/usr/ports/pobj/dnscrypt-proxy-2.1.16/go-cache" GOTOOLCHAIN=local TMPDIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/build-amd64" GOPROXY=invalid://ports.should.not.fetch.at.buildtime/ GO111MODULE=off GOPATH="/usr/ports/pobj/dnscrypt-proxy-2.1.16/go:/usr/local/go-pkg" PORTSDIR="/usr/ports" LIBTOOL="/usr/bin/libtool"  PATH='/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/X11R6/bin' PREFIX='/usr/local'  LOCALBASE='/usr/local' X11BASE='/usr/X11R6'  CFLAGS='-O2 -pipe'  TRUEPREFIX='/usr/local' DESTDIR=''  HOME='/dnscrypt-proxy-2.1.16_writes_to_HOME' PICFLAG="-fpic"  BINGRP=bin BINOWN=root BINMODE=755 NONBINMODE=644  DIRMODE=755  INSTALL_COPY=-c INSTALL_STRIP=  MANGRP=bin MANOWN=root MANMODE=644 BSD_INSTALL_PROGRAM="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -c  -m 755"  BSD_INSTALL_SCRIPT="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -c -m 755"  BSD_INSTALL_DATA="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -c -m 644"  BSD_INSTALL_MAN="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -c -m 644"  BSD_INSTALL_PROGRAM_DIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -d -m 755"  BSD_INSTALL_SCRIPT_DIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -d -m 755"  BSD_INSTALL_DATA_DIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -d -m 755"  BSD_INSTALL_MAN_DIR="/usr/ports/pobj/dnscrypt-proxy-2.1.16/bin/install -d -m 755" go test
PASS
  checks:  2009 passed  0 todo  0 failed	(total)
ok  	github.com/DNSCrypt/dnscrypt-proxy/dnscrypt-proxy	122.469s
--
// port-lib-depends-check check-shlib-syms had no problems

// Updated
# TRUSTED_PKG_PATH=/usr/ports/packages/amd64/all/ pkg_add -Dsnap -u
dnscrypt-proxy-2.1.15->2.1.16: ok
--

Looks fine and have been running this for a few hours. No regressions
so far.

Hope this helps! May you have a good one.
--
yaydn


> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/net/dnscrypt-proxy/Makefile,v
> retrieving revision 1.73
> diff -u -p -u -p -r1.73 Makefile
> --- Makefile	11 Mar 2026 21:11:33 -0000	1.73
> +++ Makefile	30 Jun 2026 17:32:19 -0000
> @@ -2,7 +2,7 @@ COMMENT =	flexible DNS proxy with suppor
> 
>  GH_ACCOUNT =	DNSCrypt
>  GH_PROJECT =	dnscrypt-proxy
> -GH_TAGNAME =	2.1.15
> +GH_TAGNAME =	2.1.16
> 
>  CATEGORIES =	net
> 
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/net/dnscrypt-proxy/distinfo,v
> retrieving revision 1.42
> diff -u -p -u -p -r1.42 distinfo
> --- distinfo	11 Mar 2026 21:11:33 -0000	1.42
> +++ distinfo	30 Jun 2026 17:32:19 -0000
> @@ -1,2 +1,2 @@
> -SHA256 (dnscrypt-proxy-2.1.15.tar.gz) = V9qR3So5kqFSjnZLz+m0gIjGPJM8DFcaLKw9J6yMdUY=
> -SIZE (dnscrypt-proxy-2.1.15.tar.gz) = 4058547
> +SHA256 (dnscrypt-proxy-2.1.16.tar.gz) = e6WqdtP9xvu2Z2iboT2Kw+Zr4nZVaVqdQS5a1K/jT40=
> +SIZE (dnscrypt-proxy-2.1.16.tar.gz) = 3595664
> 
>