# What changed in mitmproxy

> 29 changes in mitmproxy 12 from its official release notes, upgrade guides and advisories: 1 breaking, 1 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/pypi/mitmproxy/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## mitmproxy 12

### Breaking changes

- Removes bless from hex editors to avoid issues with macOS. (12.2.1) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.1)

### Security

- mitmproxy has an LDAP Injection (12.2.2) — [security advisory](https://github.com/advisories/GHSA-527G-3W9M-29HV), [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)

### New APIs and options

- The mitmproxy console supports adding and editing comments on individual flows. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- The mitmproxy console Quick Help UI can be hidden with the H key. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Adds a configurable TCP inactivity timeout, defaulting to 600 seconds; previously it was hardcoded to 10 minutes for all TCP connections. (12.2.1) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.1)

### Performance

- Reduces mitmweb FlowTable Redux subscriptions from O(rows) to O(1). (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)

### Behavior and default changes

- Reduces CERT_EXPIRY to 199 days. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Compression algorithms use fastest settings by default, improving addon runtime performance when assigning to message.content. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- mitmweb shows the intercept filter tag at the bottom for default options. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- mitmweb adds the number of selected flows to the footer. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Falls back to UTF-8 for more content types. (12.2.1) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.1)

### Fixes and other changes

- Generated leaf certificates are valid for 197 days instead of 199, keeping the 2-day notBefore backdate below Chromium's 200-day limit. (12.2.3) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.3)
- Fixed an IndexError when exporting flows to HAR if payloads have a UTF-8 continuation byte at the 100-byte cutoff. (12.2.3) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.3)
- Fixed a bug where mitmweb did not pick up its XSRF cookie. (12.2.3) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.3)
- Fixed authority and subject key identifier mismatch errors with custom CAs whose SubjectKeyIdentifier was not derived as SHA-1 of the public key. (12.2.3) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.3)
- Incoming traffic, such as websocket messages, no longer causes the console command panel to lose focus. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Failed CONNECT requests are now displayed. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Editors now allow content to be cleared to an empty string. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Fixes a bug that caused mitmweb to show a blank page on Windows. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- No longer crashes when replacement strings contain backslash sequences. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Includes addon options in its output. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Value parsing exceptions now include the option name. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- HTTP requests with uppercase schemes no longer receive a 400 Bad Request. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Correctly uses the provided key parameter instead of a hardcoded key string. (12.2.2) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2)
- Flow files are flushed after each flow, allowing further processing. (12.2.1) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.1)
- Improves the check to support Chinese characters. (12.2.1) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.1)
- The mitmproxy console shows query parameters for requests with empty bodies. (12.2.1) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.1)
- Gracefully handles decoding raw binary payloads that previously caused “Raw cannot decode” or “failed to parse as JSON” errors. (12.2.1) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.1)
- Fixes the mitmweb URL when --web-host is an IPv6 address. (12.2.1) — [release notes](https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.1)