pypi / mitmproxy
mitmproxy
What changed in mitmproxy 12, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.
1 breaking1 security3 new APIs and options1 performance5 behavior and defaults18 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initmitmproxy 1229 changes
Breaking changes 1
Removes bless from hex editors to avoid issues with macOS.
Security 1
mitmproxy has an LDAP Injection
New APIs and options 3
The mitmproxy console supports adding and editing comments on individual flows.
The mitmproxy console Quick Help UI can be hidden with the H key.
Adds a configurable TCP inactivity timeout, defaulting to 600 seconds; previously it was hardcoded to 10 minutes for all TCP connections.
Performance 1
Reduces mitmweb FlowTable Redux subscriptions from O(rows) to O(1).
Behavior and default changes 5
Reduces CERT_EXPIRY to 199 days.
Compression algorithms use fastest settings by default, improving addon runtime performance when assigning to message.content.
mitmweb shows the intercept filter tag at the bottom for default options.
mitmweb adds the number of selected flows to the footer.
Falls back to UTF-8 for more content types.
Fixes and other changes 18
Generated leaf certificates are valid for 197 days instead of 199, keeping the 2-day notBefore backdate below Chromium's 200-day limit.
Fixed an IndexError when exporting flows to HAR if payloads have a UTF-8 continuation byte at the 100-byte cutoff.
Fixed a bug where mitmweb did not pick up its XSRF cookie.
Fixed authority and subject key identifier mismatch errors with custom CAs whose SubjectKeyIdentifier was not derived as SHA-1 of the public key.
Incoming traffic, such as websocket messages, no longer causes the console command panel to lose focus.
Failed CONNECT requests are now displayed.
Editors now allow content to be cleared to an empty string.
Fixes a bug that caused mitmweb to show a blank page on Windows.
No longer crashes when replacement strings contain backslash sequences.
Includes addon options in its output.
Value parsing exceptions now include the option name.
HTTP requests with uppercase schemes no longer receive a 400 Bad Request.
Correctly uses the provided key parameter instead of a hardcoded key string.
Flow files are flushed after each flow, allowing further processing.
Improves the check to support Chinese characters.
The mitmproxy console shows query parameters for requests with empty bodies.
Gracefully handles decoding raw binary payloads that previously caused “Raw cannot decode” or “failed to parse as JSON” errors.
Fixes the mitmweb URL when --web-host is an IPv6 address.