Update module github.com/caddyserver/caddy/v2 to v2.11.2#9
Merged
Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
Bot
force-pushed
the
renovate/github.com-caddyserver-caddy-v2-2.x
branch
from
2e33388 to
60d9366
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.10.2→v2.11.2Release Notes
caddyserver/caddy (github.com/caddyserver/caddy/v2)
v2.11.2Compare Source
Caddy 2.11.2 contains numerous bug fixes and enhancements! I know that's a lame summary but it's really all over the place.
Highlights
tls_resolversglobal option to control DNS resolvers for all sites when using the ACME DNS challenge.zstdcompression; deprecatedroll_gzip, which will be removed in the future. Useroll_compressioninstead.Security fixes
This release fixes two CVEs.
forward_authdirective that could permit identity injection and potential privilege escalation.vars_regexpdouble-expanded placeholders, allowing some unusual configs to reveal secrets.In addition:
hideoption of thefile_serverhandler.Thank you to everyone who contributed, and for our ongoing sponsorships that make this development possible!
Changelog
88616e8api: Add all in-flight requests /reverse_proxy/upstreams (Fixes #7277) (#7517)d935a69autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)5d20adcbuild(deps): bump github.com/smallstep/certificates (#7535)9371ee6build(deps): bump the actions-deps group across 1 directory with 12 updates (#7536)9798f69caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)dc36082caddyhttp: Collect metrics once per route instead of per handler (#7492)174fa2dcaddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)eac02eecaddyhttp: Limit empty Host check to HTTP/1.1f283062cmd: Custom binary names throughCustomBinaryNameandCustomLongDescription(#7513)cd9e166cmd: Pass configFile, not configFlag, for reload command (#7532)7b34e31core: Check whether @id is unique (#7002)566e710fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)2dd3852fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)2dbcdefforward_auth:copy_headersdoes not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)ce203aago.mod: Upgrade x/net76b198fhttp: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)7ffb640httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) (#7507)45cf61blogging: Ensureslogerror level logs don't print stack traces (#7512)9873752logging: Supportzstdroll compression (#7515)294dffflogging: add DirMode options and propagate FileMode to rotations (#7335)a6acb39proxyproto: Generated test coverage (#7540)11b56c6reverseproxy: Fixhealth_portbeing ignored in health checks (#7533)db29860reverseproxy: Track dynamic upstreams, enable passive healthchecking (#7539)d7b21c6reverseproxy: fix tls dialing w/ proxy protocol (#7508)a5e7c6ereverseproxy: prevent body close on dial-error retries (#7547)2ab043breverseproxy: query escape request urls when proxy protocol is enabled (#7537)fbfb8fcrewrite: Force recomputing path when escaped path matches rewrite targetf145bcetls: Addtls_resolversglobal option for DNS challenge configuration (#7297)v2.11.1Compare Source
Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.
There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.
Special Sponsor Shoutout
Extra big thanks to our major sponsors:
They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!
Notable changes
SIGUSR1can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.log_appendcan now log request and response bodies, useful for debugging.Thank you to everyone who was involved this release!
CVE-2026-27590by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.CVE-2026-27589by @1seal - Cross-origin requests attempted withno-corsmode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)CVE-2026-27588by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.CVE-2026-27587by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.CVE-2026-27586by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.CVE-2026-27585by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.🚨 Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your
go.modfile. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses. (Then, turn Dependabot off.)What's Changed
blockto do nothing if nothing passed toimportby @BeeJay28 in #7206SIGUSR1if config never changed via admin by @francislavoie in #7258acme_dnsby @rightaditya in #7270keepalive_idleandkeepalive_countby @joshuamcbeth in #7298lumberjacktotimberjack, add time-rolling options by @aeris in #7244trusted_proxies_unixfor trusting unix socketX-Forwarded-*headers by @cseufert in #7265LeafFolderLoaderby @mohammed90 in #7327{http.request.body_base64}placeholder by @francislavoie in #7367aea342f) by @willnorris in #7397log_appendEarly option, Supports{http.response.body}by @francislavoie in #7368prealloclint fix by @francislavoie in #7430time/tzdataby @francislavoie in #7432observe_catchall_hostsoption by @mohammed90 in #7434Hostto{upstream_hostport}automatically if TLS by @francislavoie in #7454dnswithacme_dns(fix #7294) by @rightaditya in #7458maintenance_intervalandrenewal_window_ratioby @Amirhf1 in #7479ech.goby @francislavoie in #7487New Contributors
Full Changelog: caddyserver/caddy@v2.10.2...v2.11.1
v2.11.0Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.