Traefik 2.11.57 → 2.11.60

Vulnerabilities fixed by this upgrade

• 7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
• 6.3 GHSA-mhjw-hmjv-p99x Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
• 6.9 GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
• 7.0 GHSA-cw35-4q88-3rmp Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
• 7.0 GHSA-qm9f-w54v-q2qh Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
• 7.0 GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)

Breaking changes

None in the release notes.

Security changes

• security Advisory GHSA-hrpp-p4fc-wwf8 in 2.11.60
• security Advisory GHSA-cw35-4q88-3rmp in 2.11.58
• security Advisory GHSA-fh26-gfpp-7xxx in 2.11.58
• security Advisory GHSA-qm9f-w54v-q2qh in 2.11.58
• security Advisory GHSA-2272-4vv8-65ww in 2.11.58
• security Advisory GHSA-mhjw-hmjv-p99x in 2.11.58

Every release in between