Caddy 2.8.2 → 2.11.2
8 releases · 10 breaking changes · 14 security fixes · 4 advisories fixed
14security10breaking2deprecated102feature51fix
Vulnerabilities fixed by this upgrade
- high CVE-2026-45135 Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- medium CVE-2026-30852 vars_regexp double-expands user input, leaking env vars and files
- high CVE-2026-27590 Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport
- medium CVE-2026-27585 Improper sanitization of glob characters in file matcher may lead to bypassing security protections
Breaking changes
- breaking 89ed5f44de61fcb0c3b7ce93bfefbb8e775d1964 fix: Remove nil arg from zapslog.NewHandler call (#6984) in 2.10.1
- breaking Wildcards used by default: Previously, Caddy would obtain individual certificates for every domain in your config literally; now wildcards, if present, will be utilized for subdomains, rather than obtaining individual certificates. This change was motivated by the novel possibility for subdomain… in 2.10.0
- breaking 0d7c63920daecec510202c42816c883fd2dbe047 go.mod: remove glog dependency (#6838) in 2.10.0
- breaking 84364ffcd06e35a93c9bb08ed80617bde72d4f74 caddypki: Remove lifetime check at Caddyfile parse (fix #6878) in 2.10.0
- breaking f297bc0a04dcab6c2585b47f3672d045c4f6b54b admin: Remove host checking for UDS (close #6832) in 2.10.0
- breaking remove glog dependency in 2.10.0
- breaking eddbccd298f637c4785c891f5f96dbf103580fa8 fastcgi: remove dir redirection when useless in php_fastcgi (#6698) in 2.9.0
- breaking cmd: remove zealous check of Caddyfile auto-detection in 2.9.0
- breaking fileserver: Remove newline characters from precomputed etags in 2.9.0
- breaking doc: remove docs of deprecated directives in 2.9.0
Security changes
- security @NucleiAv reported a bug in the forward_auth directive that could permit identity injection and potential privilege escalation. in 2.11.2
- security @sammiee5311 reported that vars_regexp double-expanded placeholders, allowing some unusual configs to reveal secrets. in 2.11.2
- security Built on Go 1.26.1 (also released today) which patches several CVEs. in 2.11.2
- security Our documentation has been updated to note that file system case sensitivity may affect the behavior of the hide option of the file_server handler. in 2.11.2
- security 2dbcdefbbee68e7b4a31ac66361a0f4e3bcd2eea forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545) in 2.11.2
- security fastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport. in 2.11.1
- security admin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy… in 2.11.1
- security caddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass. in 2.11.1
- security caddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass. in 2.11.1
- security caddytls: CVE-2026-27586 by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed. in 2.11.1
- security caddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections. in 2.11.1
- security Security in 2.9.0
- security browse: add Content-Security-Policy w/ nonce in 2.9.0
- security browse: fix Content-Security-Policy warnings in Firefox in 2.9.0
Deprecations
- deprecated d7564d632fbed209e81978c5c2c529a7bf1836f7 caddytls: Drop rate_limit and burst, has been deprecated (#6611) in 2.9.0
- deprecated caddytls: Drop rate_limit and burst, has been deprecated in 2.9.0
Every release in between
featureReverse proxy got a lot of love with certain edge cases related to PROXY protocol, health check port, and closing body on retries. Dynamic upstreams are now tracked which enables passive health checking.
featurePerformance improvements for metrics.
featureNew tls_resolvers global option to control DNS resolvers for all sites when using the ACME DNS challenge.
featureLog rolling now supports zstd compression; deprecated roll_gzip, which will be removed in the future. Use roll_compression instead.
featureRefined logging and some error messages.
featureFixed a bug in rewrite handler that could cause some URIs to not be rewritten when URI path is an escaped form of target path. Thanks to @MaherAzzouzi for the report.
security@NucleiAv reported a bug in the forward_auth directive that could permit identity injection and potential privilege escalation.
security@sammiee5311 reported that vars_regexp double-expanded placeholders, allowing some unusual configs to reveal secrets.
securityBuilt on Go 1.26.1 (also released today) which patches several CVEs.
securityOur documentation has been updated to note that file system case sensitivity may affect the behavior of the hide option of the file_server handler.
feature88616e86e6e656738426bb86b4a42dcc20a59f77 api: Add all in-flight requests /reverse_proxy/upstreams (Fixes #7277) (#7517)
otherd935a6956c16902623b8e8f6d1aafec4f6124f46 autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)
other5d20adc7a97f70d6fe722099356cca2027908576 build(deps): bump github.com/smallstep/certificates (#7535)
other9371ee67c64d2d2c81f9530be0d9749ecdbd2b00 build(deps): bump the actions-deps group across 1 directory with 12 updates (#7536)
other9798f6964d58eb5703d1498804962faca2dae4ea caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)
otherdc360828598440beb1dfdb21c0ba14e09bcd565b caddyhttp: Collect metrics once per route instead of per handler (#7492)
other174fa2ddb93f830370b05058d1ea51ad1512597d caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)
othereac02ee98f9f61d79ae774aa49aa102ddf2076ba caddyhttp: Limit empty Host check to HTTP/1.1
otherf283062d37c50627d53ca682ebae2ce219b35515 cmd: Custom binary names through CustomBinaryName and CustomLongDescription (#7513)
othercd9e1660aa454e6536ad740c9d1aaecf3c3552ed cmd: Pass configFile, not configFlag, for reload command (#7532)
other7b34e3107eb6071fea3a3f94a5c913c32a55afd0 core: Check whether @id is unique (#7002)
other566e710991a6b752933178e2c6126181efc563aa fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)
feature2dd3852416e2b04bc90b98643673ec9e131c32e6 fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)
security2dbcdefbbee68e7b4a31ac66361a0f4e3bcd2eea forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)
otherce203aa9e1ff2686777019f45c36c283debb7986 go.mod: Upgrade x/net
other76b198f586e4e2482a0278ba52c176cff70af8cf http: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)
fix7ffb640a4da666203ab43396eaeb2b6b84bb983f httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) (#7507)
other45cf61b1276b2cf79ce0147df8fa48c96e8e5356 logging: Ensure slog error level logs don't print stack traces (#7512)
other987375297862d9cd0a3fa33cfb199c25e504ad1b logging: Support zstd roll compression (#7515)
feature294dfff4435c31b7c8d20d26067365b0a0016610 logging: add DirMode options and propagate FileMode to rotations (#7335)
othera6acb3902cb6453153db0738bd8210e093449ce1 proxyproto: Generated test coverage (#7540)
fix11b56c6cfc25f8c814fa66cb02060548d12c4040 reverseproxy: Fix health_port being ignored in health checks (#7533)
otherdb2986028fc573ae3add0a9a3381268dd7599267 reverseproxy: Track dynamic upstreams, enable passive healthchecking (#7539)
fixd7b21c610494e30e147de77a4783c18e5f206d99 reverseproxy: fix tls dialing w/ proxy protocol (#7508)
othera5e7c6e232573b8a8df2946914a84a36070d4b9f reverseproxy: prevent body close on dial-error retries (#7547)
other2ab043b8903db4574b2fc7a625619018a072f082 reverseproxy: query escape request urls when proxy protocol is enabled (#7537)
otherfbfb8fc517728f85890cd46559c01bec9495bf17 rewrite: Force recomputing path when escaped path matches rewrite target
featuref145bce553a306ca6890fea782ca4e3b06787bbb tls: Add tls_resolvers global option for DNS challenge configuration (#7297)
featureOur project now implements and requires Assistance Disclosures (for AI/LLMs) on issues, PRs, comments, replies, reviews, etc.
fixMany, many other minor improvements and bug fixes.
securityfastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
securityadmin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy…
securitycaddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.
securitycaddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.
securitycaddytls: CVE-2026-27586 by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.
securitycaddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.
featurecaddyhttp: add replacer placeholders for escaped values
fixcaddyfile: Prevent trailing space on line before env variable - Fixes #6881
featureadd: encode header Content-Type graphql-response
fixencode: fix response corruption when handle_errors is used
fixFix PKI creation when auto_https is disabled (#7211)
featurecaddyfile: Allow block to do nothing if nothing passed to import
featurehttpcaddyfile: Add missing DNS challenge check for acme_dns
featureArgon2id Support for Basic Auth
featurecaddyhttp: Add server options keepalive_idle and keepalive_count
featurelogging: Switch from lumberjack to timberjack, add time-rolling options
featurecaddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers
fixlogging: fix multiple regexp filters on same field (fixes #7049)
featurelisteners: Add support for named socket activation
featurefeat: switch to autoexport for OpenTelemetry span exporter
fixfix quote within quotes formatted incorrectly by fmt
fixfix golangci-lint error G602 in caddyhttp
featurefeat: allow customizing the Server header
featurefeat: custom slog handlers for modules (log contextual data)
fixFix retries for requests with bodies
featurecaddypki: Add support for multiple intermediates in signing chain
fixcaddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true
featuremultiplexing: Introduce packet conn wrappers
fixcaddytls: fix preferred chains options by appending values instead of replacing
featurefeat: mark Assert* functions as test helpers
featurenotify: implement windows service status and error notifications
featurecmd: add --json flag to list-modules
featureAdd span attributes to tracing module
fixreadme: fix fence
fixcaddyfile: Fix indentation of multiline strings in fmt (#7425)
featurecaddyfile: add observe_catchall_hosts option
featurecaddyfile: Add renewal_window_ratio global option
featurepki: add per-CA configurable maintenance_interval and renewal_window_ratio
+83 more items in the release notesotherhttp: Make logger first, before TLS provisioning
fixhttpcaddyfile: Fix acme_dns regression
fixcaddyfile: Fix importing nested tokens for {block}
fix551f793700fe1550845c824470b623fd1aa03d36 caddyfile: Fix importing nested tokens for {block} (#7189)
other16fe83c7afe2152b0bb53ae35078a28f87e6dcf2 http: Make logger first, before TLS provisioning (#7198)
fix4564261d8350f8010b7e001e646e260e9bba5746 httpcaddyfile: Fix acme_dns regression (#7199)
otherupdate quic-go to v0.51.0
otherforwardproxy: reference correct field name in LoadModule
fixfix: Remove nil arg from zapslog.NewHandler call
featurefileserver: Add support for .avif image format
otherreverseproxy: use DialTLSContext for TLS if servername has placeholder
otheradmin: Make sure that any admin routers are provisioned when local/re…
otherlog: default logger should respect {in,ex}clude
fixacme_server: fix policy parsing in caddyfile
featureimplement Unwrap for interceptedResponseHandler
fixcaddyhttp: fix route sort by comparing paths without wildcard if they don't shar…
fixfix: crash - null check on event origin
fixfix: prevent error handler from overriding sub handler matchers
fixcmd: fix Commands function not returning all registered commands
featurecore: clean up new config if it failed to run
feature[ADD] sort buttons in grid mode
fixFix: Support placeholders in header replacement search patterns
fixfix dead link
fixfix(provisioning): Context.App or Context.AppIfConfigured will return (val, nil) even if the app failed to provision or validate the first time
featurecmd: Allow caddy adapt to read from stdin
featurefeat: add bcrypt cost parameter to hash-password
fixfix typo in bcrypt cost flag name
fixcaddytls: fix regression in external certificate manager support
featurereverse_proxy: use the new KeepAliveConfig to set probe interval
featuredoc: Add a few lines about Etag file content
featurecaddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests
fix44d078b6705c7abcabb2a60f501568ff7f5a57a1 acme_server: fix policy parsing in caddyfile (#7006)
feature49dac61b078a704b3e98566134c108d6def19450 bcrypt: add cost parameter to hash-password (#7149)
feature14a63a26b9a673857fc37cba37aedc35a10ce634 caddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests (#6961)
fixb898873b90b5cb804400888ec2f2994f6a2dd270 caddytls: fix regression in external certificate manager support (#7179)
feature19ff47a63b9ff2ae424790b02548d9ba4afc56ba cmd: Allow caddy adapt to read from stdin (#7163)
fixe633d013f64d057f462786ccf4a430cd27817d4d cmd: fix Commands function not returning all registered commands (#7059)
feature3d0b4fac5a583d615fe411a4af9a24a7bcc3bee3 core: Clean up new config if it failed to run (#7068)
featureb9710c6af4f764b463a8e0c080783f2b7fb15ce0 fileserver: Add a few doc lines about Etag file content (#7173)
feature3b4d966fba069e9895980dbbf05f84bf818968ba fileserver: Add sort buttons in grid mode (#7089)
feature54d03ced48a8ed2264ae9248c81f00a1c2648d82 fileserver: Add support for .avif image format (#6988)
breaking89ed5f44de61fcb0c3b7ce93bfefbb8e775d1964 fix: Remove nil arg from zapslog.NewHandler call (#6984)
feature5b727bde2992e7cb9987208453db42ae6e1c6e1e httpcaddyfile: Allow naked acme_dns if dns is set (fix #7091)
fix0badb071efc38bb9cc055076f0a48d1725fe8cc8 httpcaddyfile: Fix generated config related to ACME global options
feature716d72e47538cc4f7bab43b1d973e0f8aa0a9fba intercept: implement Unwrap for interceptedResponseHandler (#7016)
feature1c596e3c5a1cd0b52febb1506ffe471918bd1128 reverse_proxy: use the new KeepAliveConfig to set probe interval (#7157)
+72 more items in the release notesfeatureEncrypted ClientHello (ECH): This new technology encrypts the last plaintext portion of a TLS connection: the ClientHello, which includes the domain name being connected to. The draft spec for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but…
featureACME profiles: ACME profiles are an experimental draft that allow you to choose properties of your certificates with more flexibility than traditional CSR methods. For example, Let's Encrypt will issue 6-day certificates under a certain profile. Caddy may eventually use that profile by default.
breakingWildcards used by default: Previously, Caddy would obtain individual certificates for every domain in your config literally; now wildcards, if present, will be utilized for subdomains, rather than obtaining individual certificates. This change was motivated by the novel possibility for subdomain…
featurelibdns 1.0 APIs: Many of you use DNS provider modules to solve ACME DNS challenges or to enable dynamic DNS. They implement interfaces defined by libdns to get, set, append, and delete DNS records. After 5 years of production experience, including lessons learned with ECH, libdns APIs have been…
featureGlobal dns config: Now that several components of Caddy configuration may affect DNS records (ACME challenges, ECH publication, etc.), there is a new dns global option that can be used to specify your DNS provider config in a single place. This prevents repetition of credentials for servers where…
fix96c5c554c1241430ac9ddea6f4b68948adcc961b admin: fix index validation for PUT requests (#6824)
fixbc3d497739444a5ce550696b7b0da36e6e3bc777 caddytls: Fix broken refactor
fix7b8f3505e33139de0d542566478e98b361bb84bf caddytls: Fix sni_regexp matcher to obtain layer4 contexts (#6804)
feature2c4295ee48f494bc8dda5fa09b37612d520c8b3b caddytls: Initial support for ACME profiles
breaking0d7c63920daecec510202c42816c883fd2dbe047 go.mod: remove glog dependency (#6838)
fix9e0e5a4b4c2babda81c58f28fe61adfa91d04524 logging: Fix crash if logging error is not HandlerError (#6777)
feature904a0fa368b7eacac3c7156ce4a1f6ced8f61f34 reverse_proxy: re-add healthy upstreams metric (#6806)
featuref4432a306ac59feee1fc45c8efefad3619e37629 caddyfile: add error handling for unrecognized subdirective/options in various modules (#6884)
breaking84364ffcd06e35a93c9bb08ed80617bde72d4f74 caddypki: Remove lifetime check at Caddyfile parse (fix #6878)
feature220cd1c2bcecc07bcf6a0141069538c1b1109907 reverseproxy: more comments about buffering and add new tests (#6778)
fixb3e692ed09f8ba15b741621c4b16d8bfee38f8a1 caddyfile: Fix formatting for backquote wrapped braces (#6903)
fix49f9af9a4ab2a28fa5c445630017f5284a5afa48 caddytls: Fix TrustedCACerts backwards compatibility (#6889)
fix39262f86632401ae4915600b042ef5a28141d3d5 caddytls: Minor fixes for ECH
feature173573035c7484bb4aad4498a90bf5a1cf1bb5be core: add modular network_proxy support (#6399)
featureaf2d33afbb52389cda139a6a0fd8a9d65f558676 headers: Allow nil HeaderOps (fix #6893)
featuredccf3d8982d1b428e840d43f71fa5c3becf6ea8f requestbody: Add set option to replace request body (#5795)
fix2ac09fdb2046957597e17096adf6335a6d589a2f requestbody: Fix ContentLength calculation after body replacement (#6896)
breakingf297bc0a04dcab6c2585b47f3672d045c4f6b54b admin: Remove host checking for UDS (close #6832)
feature35c8c2d92d26208642cea0d1549c77a00124e154 caddytls: Add remote_ip to HTTP cert manager (close #6952)
featurefb22a26b1a08a2fa3b2526d1852467904ee140f6 caddytls: Allow missing ECH meta file
feature6c38ae7381b3338b173c59706673d11783091dee reverseproxy: Add valid Upstream to DialInfo in active health checks (#6949)
fixFixes crash if logging error is not HandlerError
fixcaddytls: Fix sni_regexp matcher to obtain layer4 contexts
featurefeat: automatically set GOMEMLIMIT
featurereverse_proxy: re-add healthy upstreams metric
fixfix: update broken link to Ardan Labs
fixfix: fix index validation for PUT requests
breakingremove glog dependency
featureAdd error handling for unrecognized subdirective/options
fixFix TrustedCACerts backwards compatibility
featurerequestbody: Add replace for optional body replacement
fixrequestbody: Fix ContentLength calculation after body replacement
fixFix caddy fmt breaks backquote wrapped braces in template
featurecore: add modular network_proxy support
featureAdd a valid Upstream to the DialInfo when doing active health checks
+64 more items in the release notesother34cff4af7db1365bba6decc647ccfb6bf1b21afd core: Only initiate exit once (should fix #6707)
other50778b55425d378f709599c0d424b0138af592f4 fix: disable h3 for unix domain socket (#6769)
other0e570e0cc717f02cf3800ae741df70cd074c7275 go.mod: Upgrade CertMagic to 0.21.6 (fix ARI handshake maintenance)
othere48b75843b7eff2948b573391fb41535b5e333ef header: match subdirective for response matching (#6765)
other1f927d6b07d52d7cf46f1f3020c1ea5993a3e5e8 log: Only chmod if permission bits differ; make log dir (#6761)
other1bd567d7ad41d5509e2aa60cf36e749f195ad83c reverseproxy: buffer requests for fastcgi by default (#6759)
otherreverse proxy: fastcgi buffer requests for fastcgi by default
fixfix: disable h3 for unix domain socket
otherlog: Only chmod if permission bits differ
otherheader: match subdirective for response matching
securitySecurity
featureb116dcea3d022cd2b060a978c499ac17e5d0a2e1 caddyhttp: Add {?query} placeholder (#6714)
featurec216cf551dcbd2de1da1b9fe8a7e179b76827753 caddyhttp: Allow matching Transfer-Encoding, add to access logs (#6629)
feature09b2cbcf4d839adec91b189fea549d64a69e0595 caddyhttp: Add MatchWithError to replace SetVar hack (#6596)
feature5c8dc344181c49bc7feade4a293bb4eed882b838 caddytls: Allow disabling storage cleaning, avoids writing two files (#6593)
deprecatedd7564d632fbed209e81978c5c2c529a7bf1836f7 caddytls: Drop rate_limit and burst, has been deprecated (#6611)
featured398898b352a6a7e8ac5c24da01dd948fc334d77 cmd: Allow add-package to select version of package (#6665)
feature315715e90ffa25c4ad0d8a96e828dbdf6f638583 core: Implement FastAbs to avoid repeated os.Getwd calls (#6687)
breakingeddbccd298f637c4785c891f5f96dbf103580fa8 fastcgi: remove dir redirection when useless in php_fastcgi (#6698)
featureefd9251ad38a4fd9f7d900445400ac3c8e564c28 fileserver: Add first_exist_fallback strategy for try_files (#6699)
feature290cfea08f2486fb86dbc11eec96d79751180eda fileserver: add a test for precompressed defaults (#6743)
featurecc23ad6402e6dace30b04f0d9113530a4d9541a9 fileserver: Add file_limit option for browse (to be experimental) (#6648)
featureafa778ae05503f563af0d1015cdf7e5e78b1eeec httpcaddyfile: Implement experimental force_automate option (#6712)
featureb183aec83c2d467706583ad9ea0e4e9c56077c55 httpcaddyfile: Implement log sampling config (#6682)
feature1d106fa14d7bc150acb1107ea7d034d669f9f80d metrics: add go and process collectors (#6704)
feature825fe48e0654dc6e4e065df364a51ea79488e44b reverseproxy: Allow 0 as weights for weighted_round_robin (#6681)
feature5823eccf99d9fc6b4ffba8a78acfdb59c4ec0c97 rewrite: Don't add / in Caddyfile, do it after replacer (#6662)
feature669fc41e6321115df554d5f7d8eb55fdfbdaab18 tracing: Add spanID field to access logs and http.vars.span_id placeholder (#6646)
featurecaddyhttp: Add test case to corpus
breakingcmd: remove zealous check of Caddyfile auto-detection
featurelogging: Allow setting log file permissions
featurereverseproxy: add Max-Age option to sticky cookie
breakingfileserver: Remove newline characters from precomputed etags
featurereverseproxy: Add placeholder for host in active health check headers
securitybrowse: add Content-Security-Policy w/ nonce
securitybrowse: fix Content-Security-Policy warnings in Firefox
featurereverseproxy: Add placeholder for networkAddr in active health check headers
featureAdd option to set which HTTP method to use for active health checks
featurereverseproxy: Caddyfile support for health_method
featurereverseproxy: add health_upstream subdirective
featureCaddyfile support for TLS handshake matchers
featureCaddyfile support for TLS connection and certificate selection policies
featurefileserver: add sort options
featurereverseproxy: allow user to define source address
featurereverse_proxy: add placeholder http.reverse_proxy.retries
featurecaddytls: Add sni_regexp matcher
featureperf: use zap's Check() to prevent useless allocs
breakingdoc: remove docs of deprecated directives
featureImplement issue #6296 passing FDs / socket activation
deprecatedcaddytls: Drop rate_limit and burst, has been deprecated
+153 more items in the release notesfix7088605c cmd: fix regression in auto-detect of Caddyfile (#6362)