## stamparm/maltrail — 3.2…3.3

_61 commits._

### Fixes
- **Drop the drawer's backdrop blur, and fix its height under text zoom** (312ff8b)
- **Fix five commit references the history rewrite broke, and gate them** (973d817)

### Backend
- **Register test_version_sync, and keep it running on the 3.6 floor** (4541290)
- **Version 3.3** (3099966)
- **Bump the version in one command, and check all five places it lives** (872e45d)
- **Upgrading links for being in stampar/trails repo** (d7d74ee)
- **Compute each row's sort key once instead of inside the comparator** (4fe8c91)
- **Give /events a validator so a repeat visit does not re-send the day** (51592d7)
- **Pick the grid's sort comparator once, and split the severity filter out** (069f5d6)
- **Compress /events, and stop repainting the grid a dozen times while it loads** (7152bf7)
- **Make the drawer open promptly, and stop re-deriving IP sort keys** (0387093)
- **Speed up the dashboard UI** (65ab38f)
- **Select more than one day of events (#4)** (26b64d3)
- **LOCAL_LOG_FORMAT text|json (#19130)** (ea0bd5a)
- **Teach every server-side log reader both formats** (5b76fa7)
- **Pin the JSON event rendering across the sensor and the server** (526d34a)
- **Ignore list: accept networks, ranges and port ranges (#19142)** (f9fc88f)
- **Decapsulate VXLAN, GENEVE, GRE, ERSPAN and IP-in-IP** (a1c6099)
- **Use div_ceil in the extension-header test builder** (7a515b2)
- **Default to source-affine fanout whenever more than one worker is used** (1f19ed1)
- **Source-affine fanout: stop multi-worker capture losing scan alerts** (bb565db)
- **IPv6: walk the extension-header chain instead of stopping at Next Header** (a0bb583)
- **/trails: answer an unchanged trail set with 304 instead of 84 MB** (2a966f1)
- **Clear the clippy backlog that only CI was catching** (3c3d830)
- **Update worst_asns.txt** (6c13f89)
- **quic: drop the dead test shim left by the key-schedule change** (40557ac)
- **Prebuild the ".intranet." finder instead of rebuilding it per DNS query** (2eb74b8)
- **tls: assemble the JA3 string in one buffer** (5c0379f)
- **quic: decrypt into a sized buffer instead of pushing bytes** (d55204a)
- **quic: derive the initial keys without allocating** (7e28fcc)
- **Prefilter the blocklist regex before running it per DNS query** (39fb305)
- **allowed_zone: keep the label-entry pass off the common path** (206d6d5)
- **dns_tunneling: gate it properly, and stop scanning the zone list per query** (5d6fea3)
- **tls: stop allocating a String per byte to render a fingerprint** (a8da481)
- **Whitelist the three reputation zones that were only covered by the heuristic** (a800b09)
- **DNS tunnelling detection, built to be hard to trigger** (96c96a4)
- **A reference network, so detection and noise are numbers** (f1fd55f)
- **Parse stacked VLAN tags instead of dropping the frame** (052df35)
- **fail2ban: stop the shipped regex banning our own hosts** (137db82)
- **Constant-time auth compare, and tests for three auth surfaces that had none** (ed1950d)
- **Stop the shipped config describing a sensor that no longer exists** (dd9a39b)
- **Fail the build on a trail that names a registry instead of a host** (164b09d)
- **Stop whitelisting two of the platforms the suspicious piles exist to name** (e94ffe5)
- **Say which of the two ways a whitelisted name kills a trail** (c4debfe)
- **Reconcile the whitelist report with what the sensor actually does** (dc35ab0)
- **Close the event-log handle on every path a session leaves by** (a2c92c8)
- **test_refs: assert the invariant, not the environment** (dbbe9a2)
- **check_refs: survive an environment with no git** (ec04c1b)
- **check_refs: work the same on shallow and full checkouts** (93f9f34)
- **check_refs: do not trip over its own fixtures** (c03c34c)
- **Take the canary list to 100k, at two depths** (0829cc4)
- **Stop ci.yml gating on a directory that is not there** (bea0f08)
- **Canary the trails against the top 10k domains, not 47 names** (622fda1)
- **Point the trail tests at the trails checkout** (eb51ea7)
- **Keep GLOBALACCELERATOR in the shared-infrastructure check** (91ee260)
- **Range lookup by sorted disjoint intervals, not bucketed scan** (bd3578f)
- **Warn us when what we publish would hurt somebody who redistributes it** (d46d859)
- **Drop 15 CloudFront addresses from the engine's own scanner lists** (0fe7849)
- **Gate address trails, not just names (#19607)** (9670fc0)
- **Move the systemd units to packaging/systemd/** (75e5669)
- **Retire the Python sensor, and the harness that only existed to drive it** (fe2965e)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/stamparm/maltrail?utm_source=github-action)._