• Reject slicer toxics with average_size <= 0 or size_variation outside [0, average_size],
  and stop the slicer from recursing forever on degenerate sizes (#774, @iyaz-shaikh)
• Add optional bearer token auth for the HTTP API via TOXIPROXY_AUTH_TOKEN, supported by the Go
  client and toxiproxy-cli, and warn when the API is unauthenticated on a non-loopback address
  (#774, @iyaz-shaikh)
• Fix removing a toxic hanging forever, and freezing the whole HTTP API, when the downstream
  toxic or connection is already gone (#760, @matheusgb)
• Fix the bandwidth toxic hanging or panicking when rate <= 0 (#764, @jaideeppyne)
• Update go version to 1.27 (#777, @The-Black-Fox)
• Update various go packages

• Update go version to 1.23.0 (#628)
• Do not restart proxies when using hostnames to specify listen address when updating a proxy
  and populating a collection (#631, @robinbrandt)
• Update various go packages

• Do not pin minimum patch version in module (#595, @jaimem88)

• Update various go packages
• Update go version to 1.22.8 (#594, @abecevello)

• Updated go version to 1.22.1 to fix 3 CVEs (#559, @dianadevasia)
• Updated the version of golangci to 1.56.2 and disabled depguard rule in golangci (#559, @dianadevasia)

• toxiproxy-cli - sortedAttributes sort by attribute.key instead attribute.value (#543, @jesseward)

• Fix invalid JSON in /version endpoint response (#538, @whatyouhide)
• Update minimum supported Go version 1.19. (@abecevello)

• Gracefull shutdown of HTTP server. (#439, @miry)
• Support PATCH HTTP method for Proxy update(PATCH /proxies/{proxy}) and
  Toxic update(PATCH /proxies/{proxy}/toxics/{toxic}) endpoints.
  Deprecat POST HTTP method for those endpoints. (@miry)
• Client does not parse response body in case of errors for Populate.
  Requires to get current proxies with new command. (#441, @miry)
• Client specifies User-Agent HTTP header for all requests as
  "toxiproxy-cli/ /".
  Specifies client request content type as application/json. (#441, @miry)
• Replace Api.Listen parameters host and port with single addr. (#445, @miry)

Changes

• Update Release steps. (#369, @neufeldtech)
• Migrate off probot-CLA to new GitHub Action. (#405, @cursedcoder)
• Support go 1.18, 1.19. (#415, @miry)
• toxiproxy.NewProxy now accepts name, listen addr and upstream addr. (#418, @miry)
• Replace logrus with zerolog. (#413, @miry)
• Log HTTP requests to API server. (#413, #421, @miry)
• Add TimeoutHandler for the HTTP API server. (#420, @miry)
• Set Write and Read timeouts for HTTP API server connections. (#423, @miry)
• Show unique request id in API HTTP response. (#425, @miry)
• Add method to parse stream.Direction from a string.
  Allow converting stream.Direction to string. (#430, @miry)
• Add the possibility to write to Output with a deadline.
  On interrupting Bandwidth toxic, use non-blocking writes. (#436, @miry)
• Update minimum supported Go version 1.17. (#438, @miry)

New Contributors

• @waseem made their first contribution in #402
• @cursedcoder made their first contribution in #405

Full Changelog: v2.4.0...v2.5.0

Docker images

• docker pull ghcr.io/shopify/toxiproxy:2.5.0

Homebrew

• brew install shopify/shopify/toxiproxy

• Verify git tag on release (#347, @miry)
• Fix MacOS 12 tests for go17 with -race flag (#351, @Strech)
• Rename testing/ and bin/ folders (#354, @Strech)
• Added verbose error on proxy upstream dialing (#355, @f-dg)
• Improve server startup message (#358, @areveny)
• Introduce yaml linter. (#362, @miry)
• Handle slicer toxic with zero SizeVariation and fix slicing randomization (#359, @areveny)
• Added /metrics endpoint for exposing Prometheus-compatible internal metrics (#366, @neufeldtech)

Docker images

• docker pull ghcr.io/shopify/toxiproxy:2.4.0