Traefik 2.11.0 → 2.11.54
51 releases · 3 breaking changes · 43 security fixes · 10 advisories fixed
43security3breaking0deprecated14feature182fix
Vulnerabilities fixed by this upgrade
- 6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
- 4.8 CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
- 7.0 CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
- 7.8 GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
- high CVE-2026-54763 Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
- 6.9 CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
- 7.8 CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
- 7.8 CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
- 6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
- 6.9 CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
Breaking changes
- breaking Remove extra dots in migration guide ( by rtribotte) in 2.11.36
- breaking Remove awesome.traefik.io reference in documentation section ( by kevinpollet) in 2.11.19
- breaking Remove helm default repo warning as repo has been long deprecated ( by corneliusroemer) in 2.11.4
Security changes
- security Advisory GHSA-62fc-8686-hfmq in 2.11.54
- security Advisory GHSA-3ccp-42pg-hgv6 in 2.11.53
- security Advisory GHSA-cxjq-mrr5-89rv in 2.11.52
- security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 2.11.51
- security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 2.11.51
- security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 2.11.51
- security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 2.11.48
- security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 2.11.46
- security Advisory GHSA-rh7m-2m44-x32f in 2.11.46
- security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 2.11.44
- security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 2.11.43
- security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 2.11.43
- security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 2.11.43
- security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 2.11.43
- security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 2.11.43
- security CVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c) in 2.11.42
- security CVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx) in 2.11.42
- security CVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr) in 2.11.41
- security CVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48) in 2.11.41
- security CVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j) in 2.11.40
- security CVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x) in 2.11.38
- security CVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94) in 2.11.38
- security CVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52) in 2.11.38
- security CVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697) in 2.11.37
- security warning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v2.11.32, but it restores by default the behavior that existed… in 2.11.35
- security CVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj) in 2.11.35
- security CVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide. in 2.11.32
- security Update SECURITY.md to streamline information ( by emilevauge) in 2.11.32
- security Update SECURITY.md ( by cwayne18) in 2.11.32
- security CVE-2025-47952 (Advisory GHSA-vrch-868g-9jx5) in 2.11.25
- security CVE-2025-32431 (Advisory GHSA-6p68-w45g-48j7) in 2.11.24
- security CVE-2025-22868 (Advisory GHSA-3wqc-mwfx-672p) in 2.11.24
- security CVE-2025-22871 (Advisory GHSA-5423-jcjm-2gpv) in 2.11.24
- security Add Security Support ( by nmengin) in 2.11.22
- security CVE: CVE-2024-53259 (Advisory GHSA-hxr6-2p24-hf98) in 2.11.15
- security CVE: CVE-2024-45410 (Advisory GHSA-h924-8g65-j9wg) in 2.11.14
- security CVE: CVE-2024-45410 (Advisory GHSA-62c8-mh53-4cqv) in 2.11.9
- security CVE: CVE-2024-39321 (Advisory GHSA-gxrv-wf35-62w9) in 2.11.6
- security GHSA-rvj4-q8q5-8grf (Related to CVE-2024-35255) in 2.11.5
- security GHSA-7jmw-8259-q9jx (Related to CVE-2024-24790) in 2.11.4
- security GHSA-f7cq-5v43-8pwp (Related to CVE-2024-24788) in 2.11.3
- security GHSA-7f4j-64p6-5h5v (related to CVE-2023-45288) in 2.11.2
- security CVE-2024-28869 in 2.11.2
Every release in between
securityAdvisory GHSA-62fc-8686-hfmq
fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)
fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)
fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)
fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)
securityAdvisory GHSA-3ccp-42pg-hgv6
fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)
fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)
fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)
fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)
featureAdd a migration note for CONNECT requests ( @kevinpollet)
securityAdvisory GHSA-cxjq-mrr5-89rv
fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)
fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)
fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)
fixFix changelog v2.11.51 ( @mmatur)
securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)
fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)
fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)
fix[middleware, authentication] Add an option to remove request headers with underscores ( @youkoulayley)
fix[webui] Bump axios to v1.18.0 ( @gndz07)
fixConfigurable max request header size ( @juliens)
security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)
featureAdds documentations on maxHeaderBytes ( @juliens)
fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)
fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)
fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)
fix[webui] Bump axios to v1.17.0 ( @gndz07)
fix[tls] Fix snicheck with keepalive ( @juliens)
securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)
fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)
fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)
fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)
fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)
fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)
fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)
securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
securityAdvisory GHSA-rh7m-2m44-x32f
fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)
fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)
fix[k8s/crd] Remove cross-provider sanitization for Kubernetes service loading ( @rtribotte)
fix[docker, ecs] Migrate to github.com/moby/moby modules ( @mmatur)
securityCVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r)
fix[middleware] Add errorRequestHeaders option to Errors middleware ( @gndz07)
fix[acme] Bump github.com/go-acme/lego to v4.35.2 ( @mmatur)
otherMake FLAGS Make variable usable ( @twz123)
securityCVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847)
securityCVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm)
securityCVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54)
securityCVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h)
securityCVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq)
fix[middleware, authentication] Remove map lookup making the basic auth notFoundSecret empty ( @rtribotte)
fix[middleware, authentication] Fix trustForwardHeader on forward auth middleware ( @juliens)
fix[middleware, authentication] Cleanup and make ForwardAuth logs consistent ( @kevinpollet)
fix[middleware] Remove untrusted X headers with underscores ( @rtribotte)
fix[middleware] Sanitize the request URL after stripping the prefix ( @kevinpollet)
fix[k8s/crd, k8s] Honor allowCrossNamespace with chain middleware CRD ( @rtribotte)
securityCVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c)
securityCVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx)
fix[grpc] Bump google.golang.org/grpc to v1.79.3 ( @mmatur)
fix[middleware, authentication] Prevent duplicate user headers in basic and digest auth middleware ( @juliens)
fix[middleware] Fix StripPrefix and StripPrefixRegex to slice the prefix using encoded prefix length ( @gndz07)
securityCVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr)
securityCVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48)
fix[http] Add maxResponseBodySize configuration on HTTP provider ( @gndz07)
fix[tls] Support fragmented TLS client hello ( @rtribotte)
fix[middleware, authentication] Make basic auth check timing constant ( @rtribotte)
otherBump mkdocs-traefiklabs to use consent mode ( @darkweaver87)
securityCVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j)
fix[docker] Bump Docker and OpenTelemetry dependencies ( by mmatur)
fix[server] Bump golang.org/x/net to v0.51.0 ( by kevinpollet)
securityCVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x)
securityCVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94)
securityCVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52)
fix[middleware] Fix case sensitivity on x-forwarded headers for Connection ( by LBF38)
fix[middleware, authentication] Add maxResponseBodySize configuration to forwardAuth middleware ( by gndz07)
fix[server] Fix TLS handshake error handling ( by juliens)
securityCVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697)
fix[healthcheck] Validate healthcheck path configuration ( by rtribotte)
fix[tls,server] Cap TLS record length to RFC 8446 limit in ClientHello peeking ( by mmatur)
fix[service] Avoid recursion with services ( by juliens)
fix[webui] Bump dependencies of documentation and webui ( by gndz07)
breakingRemove extra dots in migration guide ( by rtribotte)
securitywarning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v2.11.32, but it restores by default the behavior that existed…
securityCVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj)
fix[acme] Add timeout to ACME-TLS/1 challenge handshake ( by LBF38)
fix[server] Make encoded character options opt-in ( by gndz07)
fix[server] Fix deny encoded characters ( by rtribotte)
fix[server] Print access logs for rejected requests and warn about new behavior ( by rtribotte)
otherClarify doc about encoded characters rejection ( by rtribotte)
fixFix encoded characters entryPoint option documentation ( by rtribotte)
fixFix encoded characters option documentation ( by kevinpollet)
securityCVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide.
fix[server] Reject suspicious encoded characters ( by rtribotte)
fix[plugins] Validate plugin module name ( by kevinpollet)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.1 ( by GreyXor)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.0 ( by GreyXor)
fix[server] Bump golang.org/x/crypto to v0.45.0 ( by kevinpollet)
securityUpdate SECURITY.md to streamline information ( by emilevauge)
securityUpdate SECURITY.md ( by cwayne18)
fix[docker,docker/swarm] Auto-negotiate Docker API version ( by kevinpollet)
fix[http3] Bump github.com/quic-go/quic-go to v0.55.0 ( by kevinpollet)
fix[kv] Fix KV key name used to check if connection is alive ( by kevinpollet)
fix[server] Bump golang.org/x/net to v0.46.0 ( by kevinpollet)
fix[tracing] Bump gopkg.in/DataDog/dd-trace-go.v1 to v1.74.6 ( by hannahkm)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.25.2 ( by ldez)
fix[docker] Bump github.com/docker/docker to v28.3.3 ( by kevinpollet)
fixFix invalid links in documentation ( by mloiseleur)
otherUpdate releases docs for v3.5 ( by jnoordsij)
fix[logs] Redact logged install configuration ( by jspdown)
fix[plugins] Fix client arbitrary file access during archive extraction zipslip ( by odaysec)
fix[server] Disable MPTCP by default ( by rtribotte)
other[k8s/crd,k8s] Remove all mentions of ordering for TLSOption CurvePreferences field ( by jnoordsij)
fixBump github.com/go-viper/mapstructure/v2 to v2.3.0 ( by kevinpollet)
fix[middleware] Do not log redis sentinel username and password ( by kevinpollet)
other[kv] Fix KV reference rendering ( by rtribotte)
other[middleware,k8s/crd] Fix typo in redirect middleware documentation ( by rtribotte)
otherUpdate supported versions ( by jnoordsij)
securityCVE-2025-47952 (Advisory GHSA-vrch-868g-9jx5)
fix[k8s/ingress] Fix panic for ingress with backend resource ( by rtribotte)
fix[server] Normalize request path ( by kevinpollet)
feature[middleware,k8s] Add multi-tenant TLS guidance to the docs ( by sheddy-traefik)
feature[service] Add a note about how to disable connection reuse with backends ( by rtribotte)
fixFix broken link in documentation ( by sheddy-traefik)
otherChange version for path sanitization migration guide ( by rtribotte)
securityCVE-2025-32431 (Advisory GHSA-6p68-w45g-48j7)
securityCVE-2025-22868 (Advisory GHSA-3wqc-mwfx-672p)
securityCVE-2025-22871 (Advisory GHSA-5423-jcjm-2gpv)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.23.1 ( by ldez)
fix[metrics] Bump gopkg.in/DataDog/dd-trace-go.v1 to v1.72.2 ( by kevinpollet)
fix[middleware] Add Content-Length header to preflight response ( by lbenguigui)
fix[server] Sanitize request path ( by rtribotte)
fixBump github.com/redis/go-redis/v9 to v9.7.3 ( by kevinpollet)
fixBump golang.org/x/net to v0.38.0 ( by kevinpollet)
fixBump golang.org/x/oauth2 to v0.28.0 ( by rtribotte)
feature[middleware] Add content-length best practice documentation ( by sheddy-traefik)
otherTypo fix on the Explanation Section for User Guide HTTP Challenge. ( by YapWC)
fix[ecs,logs] Bump AWS SDK to v2 ( by Juneezee)
fix[logs,tls] Error level log for configuration-related TLS errors with backends ( by rtribotte)
fix[rules] Allow underscore character in HostSNI matcher ( by rohitlohar45)
fix[server] Bump github.com/vulcand/oxy/v2 to v2.0.3 ( by adamvduke)
fix[server] Bump golang.org/x/net to v0.37.0 ( by kevinpollet)
fix[webui] Change boolean module properties default value to undefined ( by rtribotte)
fixBump github.com/golang-jwt/jwt to v4.5.2 and v5.2.2 ( by kevinpollet)
fixBump github.com/redis/go-redis/v9 to v9.6.3 ( by kevinpollet)
fixBump golang.org/x/net to v0.36.0 ( by kevinpollet)
fixBump github.com/go-jose/go-jose/v4 to v4.0.5 ( by kevinpollet)
other[accesslogs] Remove documentation for OriginStatusLine and DownstreamStatusLine accessLogs fields ( by rtribotte)
other[middleware] Clarifies that retry middleware uses TCP, not HTTP status codes ( by geraldcroes)
feature[redis] Add tip for dynamic configuration updates of Redis ( by Alanxtl)
securityAdd Security Support ( by nmengin)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.22.2 ( by ldez)
fix[cli] Bump github.com/traefik/paerser to v0.2.2 ( by kevinpollet)
fix[middleware] Enable the retry middleware in the proxy ( by kevinpollet)
fix[middleware] Retry should send headers on Write ( by kevinpollet)
fix[acme] Graceful shutdown for ACME JSON write operation ( by juliens)
otherChange docker-compose to docker compose ( by khai-pi)
fix[middleware] Changing log message when client cert is not available to debug ( by Nelwhix)
fix[service] Do not create a logger instance for each proxy ( by kevinpollet)
fix[webui] Fix auto refresh not clearing on component unmount ( by DoubleREW)
breakingRemove awesome.traefik.io reference in documentation section ( by kevinpollet)
fix[websocket,server] Disable http2 connect setting for websocket by default ( by rtribotte)
fix[acme] Update go-acme/lego to v4.21.0 ( by ldez)
fix[middleware] Fix typo in basicauth note ( by tieje)
fix[service] Configure ErrorLog in httputil.ReverseProxy ( by peacewalker122)
fixBump golang.org/x/net to v0.33.0 ( by kevinpollet)
other[acme] Fix allowACMEByPass TOML example ( by hannesbraun)
other[k8s/crd] Update copyright for 2025 ( by kevinpollet)
fix[server] Update golang.org/x dependencies ( by rtribotte)
securityCVE: CVE-2024-53259 (Advisory GHSA-hxr6-2p24-hf98)
fix[acme] Update go-acme/lego to v4.20.4 ( by ldez)
fix[http3] Update github.com/quic-go/quic-go to v0.48.2 ( by kevinpollet)
securityCVE: CVE-2024-45410 (Advisory GHSA-h924-8g65-j9wg)
fix[acme] Update go-acme/lego to v4.20.2 ( by ldez)
fix[logs,server] Change level of peeking first byte error log to DEBUG ( by rtribotte)
fix[middleware,server] Drop untrusted X-Forwarded-Prefix header ( by rtribotte)
fix[server] Apply keepalive config to h2c entrypoints ( by davefu113)
fix[service] Fix internal handlers ServiceBuilder composition ( by juliens)
feature[accesslogs] Update access-logs.md, add examples for accesslog.format ( by bluepuma77)
fixFix the defaultRule CLI examples ( by kevinpollet)
fixFix spelling, grammar, and rephrase sections for clarity in some documentation pages ( by AntoineDeveloper)
fixFix absolute link in the migration guide ( by kevinpollet)
featureAdd X-Forwarded-Prefix to the migration guide ( by kevinpollet)
fixFix a small typo in entrypoints documentation ( by quiode)
featureAdd a warning about environment variables casing for static configuration ( by anchal00)
otherImprove documentation on dashboard ( by mloiseleur)
fix[middleware,service] Panic on aborted requests to properly close the connection ( by tonybart1337)
otherUpdate business callouts ( by tomatokoolaid)
fix[middleware] Bump github.com/klauspost/compress to dbd6c381492a ( by kevinpollet)
fix[webui] Upgrade to node 22.9 and yarn lock to fix vulnerabilities ( by kevinpollet)
fix[webui] Adopt a layout for the large amount of entrypoint port numbers ( by framebassman)
other[accesslogs] Clarify that only header fields may be redacted in access-logs ( by mattbnz)
otherUpdate business callout ( by tomatokoolaid)
fix[acme] Ensure defaultGeneratedCert.main as Subject's CN ( by Lamatte)
fix[middleware,authentication] Clean connection headers for forward auth request only ( by rtribotte)
fix[middleware] Bump github.com/klauspost/compress to 8e14b1b5a913 ( by kevinpollet)
fix[server] Rework condition to not log on timeout ( by rtribotte)
fix[webui] Remove unused boot files from webui ( by michelheusschen)
other[accesslogs] Specify default format value for access log ( by darkweaver87)
other[api] Update API documentation to mention pagination ( by lyrandy)
fix[http3] Bump github.com/quic-go/quic-go to v0.47.0 ( by rtribotte)
fix[server] Check if ACME certificate resolver is not nil ( by kevinpollet)
securityCVE: CVE-2024-45410 (Advisory GHSA-62c8-mh53-4cqv)
fix[acme] Update go-acme/lego to v4.18.0 ( by ldez)
fix[acme] Allow handling ACME challenges with custom routers ( by rtribotte)
fix[logs,middleware] Make the keys of the accessLog.fields.names map case-insensitive ( by SpecLad)
fix[logs,middleware] Ensure proper logs for aborted streaming responses ( by hood)
fix[middleware,server] Cleanup Connection headers before passing the middleware chain ( by kevinpollet)
fix[plugins] Upgrade paerser to v0.2.1 ( by mmatur)
fix[server,tcp] Prevent error logging when TCP WRR pool is empty ( by kevinpollet)
fix[webui] Upgrade webui dependencies ( by mloiseleur)
other[acme] Fix typo in multiple DNS challenge provider warning ( by tired-engineer)
other[k8s] Update k8s quickstart permissions ( by mmatur)
other[metrics] Remove documentation for unimplemented service retries metric ( by rtribotte)
other[middleware] Unify tab titles ( by jsoref)
otherGive valid examples for exposing dashboard with default Helm values ( by holysoles)
fix[docker] Update to github.com/docker/docker v27.1.1 ( by rtribotte)
fix[webui] Upgrade webui dependencies ( by mmatur)
fixFix embedded youtube video ( by mmatur)
otherUpdated index.md to include video ( by tomatokoolaid)
fix[logs] Make the log about new version more accurate ( by jmcbri)
fix[tls,k8s/crd,k8s] Enforce default cipher suites list ( by rtribotte)
other[acme] Modify certificatesDuration documentation ( by peacewalker122)
other[api] Improve explanation on API exposition ( by mloiseleur)
other[docker,consul,rancher,ecs] Improve doc on sensitive data stored into labels/tags ( by emilevauge)
other[docker,logs] Improve error and documentation on the needed link between router and service ( by mloiseleur)
other[docker] Document Docker port selection on multiple exposed ports ( by mbrodala)
otherUpdate the supported versions table for v3.1 release ( by jnoordsij)
otherUpdate PR approval process ( by emilevauge)
securityCVE: CVE-2024-39321 (Advisory GHSA-gxrv-wf35-62w9)
fix[ecs] Fix ECS config for OIDC + IRSA ( by mmatur)
fix[http3] Disable QUIC 0-RTT ( by mmatur)
fix[middleware,server] Remove interface names from IPv6 ( by JeroenED)
fix[docker,acme] Fix a typo in the ACME docker-compose docs ( by ciacon)
otherUpdate Advanced Capabilities Callout ( by tomatokoolaid)
otherUpdate maintainers ( by emilevauge)
fixFix readme badge for Semaphore CI ( by mmatur)
fixFix typo in keepAliveMaxTime docs ( by shochdoerfer)
securityGHSA-rvj4-q8q5-8grf (Related to CVE-2024-35255)
fix[acme] Update go-acme/lego to v4.17.4 ( by ldez)
otherUpdate the supported versions table ( by nmengin)
securityGHSA-7jmw-8259-q9jx (Related to CVE-2024-24790)
fix[acme] Update go-acme/lego to v4.17.3 ( by ldez)
other[acme] Fix .com and .org domain examples ( by rptaylor)
feature[middleware] Add a note about the Ratelimit middleware's behavior when the sourceCriterion header is missing ( by dgutzmann)
featureAdd user guides link to getting started ( by norlinhenrik)
breakingRemove helm default repo warning as repo has been long deprecated ( by corneliusroemer)
securityGHSA-f7cq-5v43-8pwp (Related to CVE-2024-24788)
fix[server] Remove deadlines for non-TLS connections ( by rtribotte)
fix[webui] Display of Content Security Policy values getting out of screen ( by brandonfl)
fix[webui] Fix provider icon size ( by framebassman)
other[k8s/crd] Fix migration/v2.md ( by stemar94)
other[k8s/gatewayapi] Fix HTTPRoute use of backendRefs ( by sakaru)
other[k8s/gatewayapi] Fix HTTPRoute path type ( by sakaru)
other[k8s] Improve mirroring example on Kubernetes ( by mloiseleur)
otherConsistent entryPoints capitalization in CLI flag usage ( by jnoordsij)
fixFix unfinished migration sentence for v2.11.2 ( by kevinpollet)
securityGHSA-7f4j-64p6-5h5v (related to CVE-2023-45288)
securityCVE-2024-28869
fix[server] Revert LingeringTimeout and change default value for ReadTimeout ( by kevinpollet)
fix[server] Set default ReadTimeout value to 60s ( by rtribotte)
fix[acme,tls] Enforce handling of ACME-TLS/1 challenges ( by rtribotte)
fix[acme] Update go-acme/lego to v4.16.1 ( by ldez)
fix[acme] Close created file in ACME local store CheckFile func ( by testwill)
fix[docker,http3] Update to quic-go v0.42.0 and docker/cli v24.0.9 ( by mloiseleur)
fix[docker,marathon,rancher,ecs,tls,nomad] Allow to configure TLSStore default generated certificate with labels ( by kevinpollet)
fix[ecs] Adjust ECS network interface detection logic ( by amaxine)
fix[logs,tls] Fix log when default TLSStore and TLSOptions are defined multiple times ( by rtribotte)
fix[middleware] Allow empty replacement with ReplacePathRegex middleware ( by rtribotte)
fix[plugins] Update Yaegi to v0.16.1 ( by ldez)
fix[provider,rules] Don't allow routers higher than internal ones ( by ldez)
fix[rules] Reserve priority range for internal routers ( by youkoulayley)
fix[server,tcp] Introduce Lingering Timeout ( by rtribotte)
fix[tcp] Enforce failure for TCP HostSNI with hostname ( by youkoulayley)
fix[tracing] Bump Elastic APM to v2.4.8 ( by rtribotte)
fix[webui] Fix dashboard exposition through a router ( by mmatur)
fix[webui] Display IPAllowlist middleware configuration in dashboard ( by youkoulayley)
fix[webui] Make text more readable in dark mode ( by hood)
fix[webui] Migrate to Quasar 2.x and Vue.js 3.x ( by andsarr)
fix[webui] Add a horizontal scroll for the mobile view ( by framebassman)
other[acme] Update gandiv5 env variable in providers table ( by dominiwe)
other[acme] Fix multiple dns provider documentation ( by mmatur)
other[docker] Fix paragraph in entrypoints and Docker docs ( by luigir-it)
other[k8s] Improve middleware example ( by mloiseleur)
other[metrics] Fix host header mention in prometheus metrics doc ( by MorphBonehunter)
other[metrics] Fix typo in statsd metrics docs ( by xpac1985)
other[middleware] Improve excludedIPs example with IPWhiteList and IPAllowList middleware ( by mloiseleur)
other[nomad] Improve documentation about Nomad ACL minimum rights ( by Thadir)
feature[server] Add specification for TCP TLS routers in documentation ( by shivanipawar00)
other[tls] Fix default value for peerCertURI option ( by marcmognol)
otherUpdate releases page ( by ldez)
featureAdd youkoulayley to maintainers ( by emilevauge)
featureAdd sdelicata to maintainers ( by emilevauge)
other[webui] Modify the Hub Button ( by mdeliatf)