{
  "summary": "QUIC/HTTP-3 inspection now works on Windows, not just Linux: the agent redirects outbound UDP/443 to a local relay via WinDivert (the Windows equivalent of Linux's nftables DNAT), which terminates QUIC with a per-hostname MITM certificate and forwards to the proxy's QUIC inspector with the same X-MyrSWG-* identity headers HTTP/2 traffic already gets - verified end-to-end on a real Windows 10 machine, including a real headless Edge browser actually negotiating HTTP/3 over the locally-installed CA. Security fix: quic_mode - which controls whether QUIC traffic is inspected, downgraded to inspectable TCP, or left alone - defaulted to fully uninspected (\"bypass\") on any fresh install that never explicitly touched the setting; now defaults to \"downgrade\", so an unconfigured or older agent never silently lets QUIC traffic through unread. Chrome/Chromium on Linux now also gets its CA trust written into its NSS certificate database (the store it actually reads on Linux, not the OS trust store) as a supplement to the existing managed-policy approach, which only newer Chrome versions honor. Screenshot and print-job OCR (used for DLP content matching against on-screen or printed text) now actually works: replaced a tesseract-CLI dependency that was never packaged or installed anywhere - meaning OCR had silently been a no-op on real fleets - with go-ocr, a new cgo-free library built for this that runs PP-OCRv5 via ONNX Runtime, published as an open-source Allod Solutions project."
}