Traefik 2.7.3 → 3.7.16
161 releases · 15 breaking changes · 152 security fixes · 54 advisories fixed
152security15breaking7deprecated326feature839fix
Vulnerabilities fixed by this upgrade
- 7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
- 6.9 GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
- 7.0 GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
- 6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
- 8.8 CVE-2026-88009 Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
- 5.3 CVE-2026-88011 ForwardAuth identity spoofing via dot-form header alias
- 8.2 GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts
- 9.3 GHSA-5w68-77r2-r64c Complete authentication bypass in the `digestAuth` middleware
- 4.8 CVE-2026-71325 `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
- 7.0 CVE-2026-71324 Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
- 7.8 GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware
- high CVE-2026-54763 Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
- 6.9 CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false
- 7.8 CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
- 7.8 CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
- 6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
- 6.9 CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
- 7.8 CVE-2026-40912 StripPrefixRegex auth bypass via Path/RawPath desync
- 7.8 CVE-2026-35051 ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
- 7.8 CVE-2026-39858 Forwarded alias spoofing top pre-auth decision bypass
- 6.3 CVE-2026-41263 BasicAuth middleware: timing side-channel vulnerability
- 4.8 CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
- 7.8 CVE-2026-33186 Fix CVE-2026-33186
- 5.1 CVE-2026-33433 BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
- 6.3 CVE-2026-32695 Ingress Rule Injection Allows Host Restriction Bypass in Traefik
- 7.8 CVE-2026-32305 Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config
- 6.3 CVE-2026-32595 BasicAuth Middleware Timing Attack Allows Username Enumeration
- 7.7 CVE-2026-27141 HTTP/2 frames can cause a running server to panic
- 6.1 CVE-2026-29777 Kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values
- 7.5 CVE-2026-26999 TLS Handshake Error Handling Allows Stalled Connections on TCP Routers
- 4.4 CVE-2026-26998 ForwardAuth Middleware Allows Unbounded Response Body, Causing Potential Denial of Service
- 7.8 CVE-2025-68121 TLS ClientAuth Bypass on HTTP/3
- 5.9 CVE-2026-22045 ACME TLS-ALPN fast path lacks timeouts and close on handshake stall
- 7.8 CVE-2025-66490 Path Normalization Bypass in Traefik Router + Middleware Rules
- 7.3 CVE-2025-54386 Path Traversal in WASM Client Plugin
- low CVE-2025-47952 Path traversal still possible using url encoding
- high CVE-2025-32431 Path Matchers Vulnerability
- medium CVE-2024-53259 Fix CVE-2024-53259
- low CVE-2024-52003 X-Forwarded-Prefix Header allows for Open Redirect
- 9.8 CVE-2024-45410 HTTP client can remove the X-Forwarded headers
- 7.5 CVE-2024-39321 Bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes
- medium CVE-2024-35255 ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability
- medium CVE-2024-24790 Unexpected behavior with IPv4-mapped IPv6 addresses
- medium CVE-2024-24787 Malformed DNS message can cause infinite loop
- medium CVE-2023-45288 Fix CVE-2023-45288 - HTTP/2 CONTINUATION flood in net/http
- high CVE-2024-28869 Possible DoS vulnerability with Content-length header
- medium CVE-2023-47124 Potential DDoS whith ACME HTTPChallenge
- medium CVE-2023-47633 Uses 100% CPU after request to with host `traefik-service`
- low CVE-2023-47106 Incorrect processing of fragment in the URL leads to Authorization Bypass
- medium GHSA-7v4p-328v-8v5g HTTP/2 request could cause a deny of service
- high CVE-2023-29013 HTTP header parsing could cause a deny of service
- medium CVE-2022-23469 Authorization header displayed in the debug logs
- high CVE-2022-46153 Routes exposed with an empty TLSOption
- high CVE-2022-39271 HTTP/2 connections management could cause a deny of service
Breaking changes
- breaking Remove redundant period in README ( @mxmrnn) in 3.7.15
- breaking Remove retired Go Report Card badge ( @yardenshoham) in 3.7.11
- breaking Remove unsupported servers[n].address from TCP label examples ( @sheddy-traefik) in 3.7.0
- breaking Add a Breaking change note to the changelog ( @nmengin) in 3.7.0
- breaking Remove extra dots in migration guide ( @rtribotte) in 3.7.0
- breaking Remove extraneous dots in migration guide ( @dathbe) in 3.7.0
- breaking Remove unsupported servers[n].address from TCP label examples ( @sheddy-traefik) in 3.6.11
- breaking Remove extraneous dots in migration guide ( by dathbe) in 3.6.8
- breaking Remove extra dots in migration guide ( by rtribotte) in 3.6.8
- breaking Add a Breaking change note to the changelog ( by nmengin) in 3.6.5
- breaking Remove dead link to Peka blog ( by kevinpollet) in 3.5.0
- breaking Remove extra dots in migration guide ( by rtribotte) in 2.11.36
- breaking Remove awesome.traefik.io reference in documentation section ( by kevinpollet) in 2.11.19
- breaking Remove helm default repo warning as repo has been long deprecated ( by corneliusroemer) in 2.11.4
- breaking Removes the experimental tag on the Traefik Hub header ( by tfny) in 2.9.5
Security changes
- security [security] Fix typo in the Request Path page ( @SethFalco) in 3.7.15
- security [security] Document the coordinated disclosure embargo for security reports ( @emilevauge) in 3.7.14
- security Advisory GHSA-qqjf-53cj-pwvv in 3.7.13
- security Advisory GHSA-f52w-8j3h-j724 in 3.7.13
- security Advisory GHSA-v67p-phpq-fc8x in 3.7.13
- security Advisory GHSA-w4v4-9rw7-5326 in 3.7.13
- security Advisory GHSA-8fcf-v89g-xpg6 in 3.7.13
- security Tell scanning agents to read the security policy and decisions pages ( @emilevauge) in 3.7.13
- security Advisory GHSA-cjr6-pf59-jq29 in 3.7.12
- security Advisory GHSA-7ghq-v6jf-g56c in 3.7.12
- security Advisory GHSA-rf44-j88r-hh8c in 3.7.12
- security [security] Document the security threat model and settled security decisions ( @emilevauge) in 3.7.12
- security Reduce SECURITY.md to a pointer to the security documentation ( @emilevauge) in 3.7.12
- security Advisory GHSA-5w68-77r2-r64c in 3.7.11
- security Advisory GHSA-g55h-rg46-x9c5 in 3.7.11
- security Advisory GHSA-j994-9gqj-9hwq in 3.7.11
- security Advisory GHSA-m6wx-622r-48r9 in 3.7.11
- security Advisory GHSA-fgjj-px3w-67xx in 3.7.10
- security Advisory GHSA-62fc-8686-hfmq in 3.7.10
- security Advisory GHSA-6765-c87h-8mrf in 3.7.10
- security Advisory GHSA-3ccp-42pg-hgv6 in 3.7.9
- security Advisory GHSA-8rxv-jg7p-wvg3 in 3.7.8
- security Advisory GHSA-cxjq-mrr5-89rv in 3.7.7
- security Advisory GHSA-42cj-m3vj-89wv in 3.7.7
- security Advisory GHSA-qq9q-x9w4-chhj in 3.7.7
- security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 3.7.6
- security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 3.7.6
- security CVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv) in 3.7.6
- security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 3.7.6
- security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.7.5
- security CVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c) in 3.7.5
- security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.7.3
- security CVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66) in 3.7.3
- security CVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7) in 3.7.3
- security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.7.1
- security Update vulnerability submission guidelines ( @emilevauge) in 3.7.0
- security [k8s] Improve the multi tenant security note ( @nmengin) in 3.7.0
- security Add vulnerability submission quality guidelines ( @emilevauge) in 3.7.0
- security [k8s] Improve the K8S multi-tenancy security note ( @nmengin) in 3.7.0
- security Bring back security section on API & Dashboard documentation page ( @gndz07) in 3.7.0
- security Update SECURITY.md ( @cwayne18) in 3.7.0
- security Update SECURITY.md to streamline information ( @emilevauge) in 3.7.0
- security Advisory GHSA-fgjj-px3w-67xx in 3.6.25
- security Advisory GHSA-62fc-8686-hfmq in 3.6.25
- security Advisory GHSA-6765-c87h-8mrf in 3.6.25
- security Advisory GHSA-3ccp-42pg-hgv6 in 3.6.24
- security Advisory GHSA-cxjq-mrr5-89rv in 3.6.23
- security Advisory GHSA-42cj-m3vj-89wv in 3.6.23
- security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 3.6.22
- security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 3.6.22
- security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 3.6.22
- security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.6.21
- security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.6.19
- security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.6.17
- security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 3.6.15
- security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 3.6.14
- security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 3.6.14
- security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 3.6.14
- security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 3.6.14
- security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 3.6.14
- security Update vulnerability submission guidelines ( @emilevauge) in 3.6.14
- security CVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c) in 3.6.12
- security CVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx) in 3.6.12
- security CVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr) in 3.6.11
- security CVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48) in 3.6.11
- security CVE-2026-32695 (Advisory GHSA-67jx-r9pv-98rj) in 3.6.11
- security [k8s] Improve the multi tenant security note ( @nmengin) in 3.6.11
- security Add vulnerability submission quality guidelines ( @emilevauge) in 3.6.11
- security CVE-2026-29777 (Advisory GHSA-8q2w-wr49-whqj) in 3.6.10
- security CVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j) in 3.6.10
- security CVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x) in 3.6.9
- security CVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94) in 3.6.9
- security CVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52) in 3.6.9
- security CVE-2026-25949 (Advisory GHSA-89p3-4642-cr2w) in 3.6.8
- security CVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697) in 3.6.8
- security warning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v3.6.4, but it restores by default the behavior that existed before… in 3.6.7
- security CVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj) in 3.6.7
- security Bring back security section on API & Dashboard documentation page ( by gndz07) in 3.6.7
- security [k8s] Improve the K8S multi-tenancy security note ( by nmengin) in 3.6.6
- security CVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide. in 3.6.4
- security CVE-2025-66491 (Advisory GHSA-7vww-mvcr-x6vj) in 3.6.4
- security CVE-2025-47952 (Advisory GHSA-vrch-868g-9jx5) in 3.4.1
- security CVE-2025-32431 (Advisory GHSA-6p68-w45g-48j7) in 3.3.6
- security CVE-2025-22868 (Advisory GHSA-3wqc-mwfx-672p) in 3.3.6
- security CVE-2025-22871 (Advisory GHSA-5423-jcjm-2gpv) in 3.3.6
- security CVE: CVE-2024-53259 (Advisory GHSA-hxr6-2p24-hf98) in 3.2.2
- security CVE: CVE-2024-45410 (Advisory GHSA-h924-8g65-j9wg) in 3.2.1
- security CVE: CVE-2024-45410 (Advisory GHSA-62c8-mh53-4cqv) in 3.1.3
- security CVE: CVE-2024-39321 (Advisory GHSA-gxrv-wf35-62w9) in 3.0.4
- security GHSA-rvj4-q8q5-8grf (Related to CVE-2024-35255) in 3.0.3
- security GHSA-7jmw-8259-q9jx (Related to CVE-2024-24790) in 3.0.2
- security GHSA-f7cq-5v43-8pwp (Related to CVE-2024-24788) in 3.0.1
- security Advisory GHSA-qqjf-53cj-pwvv in 2.11.57
- security Advisory GHSA-f52w-8j3h-j724 in 2.11.57
- security Advisory GHSA-w4v4-9rw7-5326 in 2.11.57
- security Advisory GHSA-7ghq-v6jf-g56c in 2.11.56
- security Advisory GHSA-rf44-j88r-hh8c in 2.11.56
- security Advisory GHSA-5w68-77r2-r64c in 2.11.55
- security Advisory GHSA-g55h-rg46-x9c5 in 2.11.55
- security Advisory GHSA-62fc-8686-hfmq in 2.11.54
- security Advisory GHSA-3ccp-42pg-hgv6 in 2.11.53
- security Advisory GHSA-cxjq-mrr5-89rv in 2.11.52
- security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 2.11.51
- security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 2.11.51
- security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 2.11.51
- security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 2.11.48
- security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 2.11.46
- security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 2.11.44
- security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 2.11.43
- security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 2.11.43
- security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 2.11.43
- security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 2.11.43
- security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 2.11.43
- security CVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c) in 2.11.42
- security CVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx) in 2.11.42
- security CVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr) in 2.11.41
- security CVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48) in 2.11.41
- security CVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j) in 2.11.40
- security CVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x) in 2.11.38
- security CVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94) in 2.11.38
- security CVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52) in 2.11.38
- security CVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697) in 2.11.37
- security warning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v2.11.32, but it restores by default the behavior that existed… in 2.11.35
- security CVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj) in 2.11.35
- security CVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide. in 2.11.32
- security Update SECURITY.md to streamline information ( by emilevauge) in 2.11.32
- security Update SECURITY.md ( by cwayne18) in 2.11.32
- security CVE-2025-47952 (Advisory GHSA-vrch-868g-9jx5) in 2.11.25
- security CVE-2025-32431 (Advisory GHSA-6p68-w45g-48j7) in 2.11.24
- security CVE-2025-22868 (Advisory GHSA-3wqc-mwfx-672p) in 2.11.24
- security CVE-2025-22871 (Advisory GHSA-5423-jcjm-2gpv) in 2.11.24
- security Add Security Support ( by nmengin) in 2.11.22
- security CVE: CVE-2024-53259 (Advisory GHSA-hxr6-2p24-hf98) in 2.11.15
- security CVE: CVE-2024-45410 (Advisory GHSA-h924-8g65-j9wg) in 2.11.14
- security CVE: CVE-2024-45410 (Advisory GHSA-62c8-mh53-4cqv) in 2.11.9
- security CVE: CVE-2024-39321 (Advisory GHSA-gxrv-wf35-62w9) in 2.11.6
- security GHSA-rvj4-q8q5-8grf (Related to CVE-2024-35255) in 2.11.5
- security GHSA-7jmw-8259-q9jx (Related to CVE-2024-24790) in 2.11.4
- security GHSA-f7cq-5v43-8pwp (Related to CVE-2024-24788) in 2.11.3
- security GHSA-7f4j-64p6-5h5v (related to CVE-2023-45288) in 2.11.2
- security CVE-2024-28869 in 2.11.2
- security CVE-2023-45283 in 2.10.6
- security CVE-2023-45284 in 2.10.6
- security [acme] Remove backoff for http challenge (CVE-2023-47124) ( by youkoulayley) in 2.10.6
- security [provider] Refuse recursive requests (CVE-2023-47633) ( by rtribotte) in 2.10.6
- security [server] Deny request with fragment in URL path (CVE-2023-47106) ( by lbenguigui) in 2.10.6
- security Github Advisory GHSA-7v4p-328v-8v5g Related to CVE-2023-39325 in 2.10.5
- security CVE-2023-29013 Related to CVE-2023-24534 in 2.9.10
- security fix CVE-2022-41724 in 2.9.8
- security Fixes CVE-2022-23469: Authorization header displayed in the debug logs in 2.9.6
- security Fixes CVE-2022-46153: Routes exposed with an empty TLSOption in 2.9.6
- security Fixes CVE-2022-39271: HTTP/2 connections management could cause a deny of service in 2.8.8
Deprecations
- deprecated Fix migration guide URLs in deprecation notice ( @alexmar07) in 3.7.0
- deprecated Deprecate defaultRuleSyntax and ruleSyntax options ( by rtribotte) in 3.4.0
- deprecated [acme] Fix deprecated dnsChallenge propagation logging and documentation ( by thomscode) in 3.3.2
- deprecated [k8s/crd] Adjust deprecation notice for Kubernetes CRD provider ( by rtribotte) in 2.11.0
- deprecated Update deprecation notes about Pilot ( by nmengin) in 2.8.5
- deprecated Update deprecation notes about Pilot ( by nmengin) in 2.8.4
- deprecated Update deprecation notices ( by ddtmachado) in 2.8.1
Every release in between
fix[authentication, service, k8s/ingress-nginx] Support NTLM and Kerberos in ForwardAuth and ingress-nginx auth-url ( @juliens)
fix[authentication, service] Support NTLM and Kerberos authentication in ForwardAuth ( @juliens)
fix[k8s/gatewayapi] Fix Gateway API conformance suite setup with the containerd image store ( @Neffi42)
other[k8s/ingress-nginx] Document that rewrite is supported in configuration-snippet ( @bingtang9)
fix[server] Reject CONNECT requests regardless of HTTP version ( @juliens)
fix[server] Reject CONNECT method before reaching the muxer ( @juliens)
fix[k8s/crd] Allow observability metadata on child routers ( @bunnysayzz)
fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.3 ( @rtribotte)
fix[k8s/gatewayapi] Default HTTPRoute backend scheme to HTTP when no appProtocol ( @Tyagiquamar)
fix[k8s/ingress-nginx] Apply auth-tls client authentication to the whole host ( @juliens)
fix[k8s/ingress-nginx] Fix cross-namespace check on shared auth-tls-secret TLS options ( @juliens)
fix[fastproxy] Add a non-regression test for CR/LF in FastProxy request headers ( @mturac)
fix[fastproxy] Fix concurrent buffer reads on upgraded connections ( @juliens)
fixBump golang.org/x/net to v0.60.0 ( @kevinpollet)
security[security] Fix typo in the Request Path page ( @SethFalco)
other[k8s/crd] Fix broken Kubernetes CRD definitions links in CRD reference pages ( @SatvikMishra08)
other[k8s] Document the safeNaming impact on cross-provider references ( @lazerg)
other[k8s/gatewayapi] Fix broken links in the Gateway API routing page ( @Neffi42)
fixFix broken anchor links to Restrict the Scope of Service Discovery ( @SatvikMishra08)
featureAdd the documentation style guide to the Contributing section ( @rachana5)
breakingRemove redundant period in README ( @mxmrnn)
fix[acme] Bump github.com/go-acme/lego/v5 to v5.5.1 ( @ldez)
fix[acme] Bump github.com/go-acme/lego/v5 to v5.5.2 ( @ldez)
fix[acme] Close the newly created ACME storage file on Windows ( @datrixlab)
fix[docker] Bump github.com/docker/cli to v29.8.1 ( @kevinpollet)
fix[fastproxy] Isolate NTLM and Negotiate backend connections in FastProxy ( @kevinpollet)
fix[k8s/gatewayapi] Allow configuring gateways ( @kevinpollet)
fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.2 ( @kevinpollet)
fix[k8s/gatewayapi] Do not create the Gateway API routers a previous one shadows ( @rtribotte)
fix[k8s/gatewayapi] Do not let TLSRoute routers shadow TCPRoute routers ( @rtribotte)
fix[k8s/gatewayapi] Fix HTTP/GRPC routes conflict ( @AnatoleLucet)
fix[k8s/gatewayapi] Fix TLSRoute router name collision across listeners sharing an entry point ( @rtribotte)
fix[k8s/gatewayapi] Report the BackendTLSPolicy ancestor in the namespace of its Gateway ( @rtribotte)
fix[k8s/gatewayapi] Stable sort Gateways to keep the TLS certificate order stable ( @rl-io)
fix[k8s/ingress-nginx] Build the ssl-passthrough HTTP route like any other ingress ( @rtribotte)
fix[k8s/ingress-nginx] Do not normalize resource names in the ingress-nginx provider ( @kevinpollet)
fix[k8s/ingress-nginx] Fix the ingress-nginx cross-links between the routing and provider docs ( @simpleqt)
fix[k8s/ingress-nginx] Make trailing capture group optional in ImplementationSpecific paths ( @mmatur)
fix[k8s/ingress-nginx] Remove Authorization header for basic and digest auth ( @josmo)
fix[k8s/ingress-nginx] Set the Ssl-Client-* request headers on the Ingress-NGINX HTTP router ( @rtribotte)
fix[k8s/ingress-nginx] Support wildcard origins in cors-allow-origin for the ingress-nginx provider ( @kimsehyoung)
fix[logs, middleware, k8s/crd] Expose IngressRoute metadata in access logs ( @mmatur)
fix[middleware] Avoid deprecated table.maxn in the rate limiter Lua script ( @lazerg)
fix[otel] Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric to v1.46.0 ( @kevinpollet)
fix[otel] Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.46.0 ( @kevinpollet)
fix[otel] Bump otlploggrpc and otlploghttp to v0.22.0 ( @kevinpollet)
fix[rules] Ignore negated matchers when parsing rule domains ( @rtribotte)
fix[server] Bump golang.org/x/crypto to v0.57.0 ( @kevinpollet)
fix[server] Silence encoded characters warning when some are disallowed ( @Adel-Ayoub)
fix[service] Dedicate a sticky transport per ServersTransport ( @sdelicata)
fix[service] Fix the second server selection bias in the P2C load balancer ( @lazerg)
fix[service] Isolate preauthenticated NTLM and Kerberos backend connections ( @kevinpollet)
fix[udp] Copy UDP datagrams into right-sized buffers before queuing ( @rtribotte)
fix[webui] Bump react-router to v7 and vite to v8 ( @gndz07)
fixFix build with GOPROXY=direct ( @mehrdadbn9)
other[accesslogs] Clarify access log buffering behavior ( @amazon7737)
security[security] Document the coordinated disclosure embargo for security reports ( @emilevauge)
feature[tcp] Fix 'allows to configure' grammar in TCP ServersTransport ( @fng713)
fixFix 'allow to match' grammar in TCP HostSNI rules ( @fng713)
fixFix case-sensitive option anchors ( @simpleqt)
fixFix the end anchor in the single-test example ( @amazon7737)
+3 more items in the release notessecurityAdvisory GHSA-qqjf-53cj-pwvv
securityAdvisory GHSA-f52w-8j3h-j724
securityAdvisory GHSA-v67p-phpq-fc8x
securityAdvisory GHSA-w4v4-9rw7-5326
securityAdvisory GHSA-8fcf-v89g-xpg6
fix[acme] Bump github.com/go-acme/lego/v5 to v5.4.1 ( @ldez)
fix[acme] Disable recursive nss propagation by default for DNS challenge ( @rtribotte)
fix[acme] Do not require recursive nameservers propagation by default for the DNS-01 challenge ( @amazon7737)
fix[acme, tls] Ignore negated matchers when parsing rule domains ( @rtribotte)
fix[consulcatalog, nomad] Build a collision-free item key in the Consul Catalog and Nomad providers ( @rtribotte)
fix[http3] Dedicate a transport per HTTP/3 client connection ( @sdelicata)
fix[k8s/ingress-nginx] Fix sticky cookie expiration per request ( @makaiver)
fix[k8s/ingress-nginx] Create HTTP redirect router for ssl-passthrough with force-ssl-redirect ( @mmatur)
fix[k8s/ingress-nginx] Preserve leading dot in sticky session cookie Domain attribute ( @mmatur)
fix[logs, middleware] Set access log entry level and time before formatting the OTLP body ( @emilevauge)
fix[logs, tls, k8s/crd] Downgrade default TLS resources namespace mismatch log to warning ( @lazerg)
fix[middleware] Fix {url} placeholder in customErrors middleware now includes correct scheme ( @AnouarMohamed)
fix[middleware, authentication] Prevent user enumeration through the basic auth singleflight key ( @sdelicata)
fix[server] Build the configuration copy once per change ( @jspdown)
fix[server] Do not forward h2c upgrade headers to the backend ( @sdelicata)
fix[server] Deny request with an opaque request target ( @sdelicata)
fix[server] Do not forward request trailer values to the backend ( @rtribotte)
fix[server] Bump github.com/quic-go/quic-go to v0.62.0 ( @Nelwhix)
fix[tls] Redact duplicate TLS certificates in provider merge logs ( @xsergos)
fix[webui] Fix displayed number on details pages ( @gndz07)
feature[k8s] Add warning about Ingress API frozen state ( @jnoordsij)
other[k8s] Remove namespace reference for providers.kubernetesGateway.labelSelector ( @jnoordsij)
other[k8s/crd] Fix broken redirect for the Kubernetes CRD reference docs ( @thev1ndu)
securityTell scanning agents to read the security policy and decisions pages ( @emilevauge)
securityAdvisory GHSA-cjr6-pf59-jq29
securityAdvisory GHSA-7ghq-v6jf-g56c
securityAdvisory GHSA-rf44-j88r-hh8c
fix[fastproxy] Bump github.com/valyala/fasthttp to v1.73.0 ( @mmatur)
fix[file] Include the filename in file provider configuration errors ( @lazerg)
fix[http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 ( @gndz07)
fix[k8s] Fix typos in docs and an OCSP log message ( @MsfPablo)
fix[k8s, k8s/ingress-nginx] Fix redirect www host with a non-numeric port ( @mmatur)
fix[k8s/ingress-nginx] Fix TLS option name collision across namespaces in the ingress-nginx provider ( @gndz07)
fix[server] Add an entry point option to handle request headers with aliasing names ( @rtribotte)
fix[tcp, udp] Reject negative weights in TCP and UDP weighted services ( @rtribotte)
fixBump etcd client modules to v3.5.33 ( @mmatur)
other[k8s] Update redirections block reference in basic.md ( @Larzenegger)
other[k8s] Fix formatting in Kubernetes setup guide ( @stefkiourk)
security[security] Document the security threat model and settled security decisions ( @emilevauge)
other[service] Clarify ServersTransport behavior for the errors middleware in Kubernetes ( @lazerg)
fixFix v3.7.11 migration guide ( @gndz07)
otherMove Jean-Baptiste Doumenjou and Mathieu Lonjaret to past maintainers ( @emilevauge)
securityReduce SECURITY.md to a pointer to the security documentation ( @emilevauge)
otherUpdate end of support dates ( @nmengin)
securityAdvisory GHSA-5w68-77r2-r64c
securityAdvisory GHSA-g55h-rg46-x9c5
securityAdvisory GHSA-j994-9gqj-9hwq
securityAdvisory GHSA-m6wx-622r-48r9
fix[fastproxy] Reject out-of-range status codes from backends when using FastProxy ( @gndz07)
fix[http3] Bump github.com/quic-go/quic-go to v0.61.0 ( @jnoordsij)
fix[k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider ( @rtribotte)
fix[k8s/crd] Add an option to restrict the namespace of the default TLS resources ( @rtribotte)
fix[k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider ( @rtribotte)
fix[k8s/crd] Name failover generated services after the referenced Kubernetes Service ( @rtribotte)
fix[k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider ( @gndz07)
fix[k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect ( @gndz07)
fix[k8s/gatewayapi] Fix Gateway API router rules ( @rtribotte)
fix[k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider ( @gndz07)
fix[k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend ( @rtribotte)
fix[k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider ( @gndz07)
fix[k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware ( @gndz07)
fix[middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 ( @kevinpollet)
fix[tls] Add an option to disable the fallback to the default TLS options ( @rtribotte)
fixBump golang.org/x dependencies ( @mmatur)
other[accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation ( @rtribotte)
other[api] Fix doubled word in API/dashboard reference docs ( @latent-9)
other[docker] Remove :ro from docker.sock ( @bluepuma77)
other[k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 ( @rtribotte)
other[k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider ( @rtribotte)
other[k8s/ingress-nginx] Docs: Update supported server snippet directives ( @rtsui-harmonicinc)
feature[middleware] Add rejectStatusCode to the ipAllowList middleware configuration example ( @amazon7737)
other[middleware] Mark the errors middleware service option as required ( @lazerg)
other[tls] Document the TLS options conflict resolution ( @rtribotte)
other[tls] Clarify router TLS replaces entrypoint TLS ( @sornapudisuresh)
otherDocument Redis keyspace notifications requirement ( @omkar619-dev)
breakingRemove retired Go Report Card badge ( @yardenshoham)
otherRestore the systemd socket activation documentation ( @lazerg)
otherUpdate version support policy starting with v3.6 ( @nmengin)
securityAdvisory GHSA-fgjj-px3w-67xx
securityAdvisory GHSA-62fc-8686-hfmq
securityAdvisory GHSA-6765-c87h-8mrf
fix[acme] Bump github.com/go-acme/lego/v5 to v5.3.1 ( @ldez)
fix[middleware, authentication] Fix auth singleflight key collision ( @mmatur)
fix[k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider ( @gndz07)
fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)
fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)
fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)
fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)
fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.1 ( @rtribotte)
other[k8s/ingress-nginx] Clarify auth-url/rewrite-target interaction on ingress-nginx provider ( @gndz07)
securityAdvisory GHSA-3ccp-42pg-hgv6
fix[k8s/ingress-nginx] Fix redirect with use-regex in IngressNGINX provider ( @AmariahAK)
fix[middleware] Disable Zstd support in the gzhttp wrapper ( @kevinpollet)
fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)
fix[server] Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ( @sdelicata)
fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)
fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)
other[k8s/gatewayapi] Document Gateway API generated service names change in the migration guide ( @rtribotte)
other[k8s/ingress-nginx] Fix typo in nginx annotation proxy-buffer-numbers ( @fischerman)
featureAdd a migration note for CONNECT requests ( @kevinpollet)
securityAdvisory GHSA-8rxv-jg7p-wvg3
fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)
fix[k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider ( @gndz07)
fix[logs] Remove unrelated error from nonexistent cert resolver log ( @ArthurHlt)
fix[middleware] Fix panic in retry middleware with Websockets ( @juliens)
other[k8s] Align certificateRef and indicate ports ( @veenoise)
other[rules] Fix syntax notes in routing rule documentation ( @stevenlele)
other[k8s/crd] Fix duplicated options table in ServersTransport CRD reference ( @rachana5)
securityAdvisory GHSA-cxjq-mrr5-89rv
securityAdvisory GHSA-42cj-m3vj-89wv
securityAdvisory GHSA-qq9q-x9w4-chhj
fix[middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation ( @dfeinblatt)
fix[rules] Fix consistency between HostSNI() and Host() ( @juliens)
fix[k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace ( @gndz07)
fix[middleware] Fix handle empty unknown-length bodies in mirroring ( @amazon7737)
fix[k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider ( @gndz07)
fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)
fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)
fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)
fix[k8s] Fix panic when endpointslice port value or name is nil ( @kevinpollet)
fixFix version in migration guide ( @kevinpollet)
fixFix changelog v2.11.51 ( @mmatur)
featureAdd v3.7 to supported version docs ( @jnoordsij)
fixFix some function names in comments ( @blackflytech)
featureAdd @nandorKollar as a current maintainer ( @emilevauge)
featureAdd @amazon7737 as a current maintainer ( @emilevauge)
other[middleware] Clarify buffering middleware defaults ( @amazon7737)
fixFix grammar in TLS, TCP service, and routing reference docs ( @almightymoon)
fixFix X-Forwarded-Prefix documentation for dashboard redirection ( @kevinpollet)
securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)
securityCVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv)
fix[acme, logs] Bump github.com/go-acme/lego/v5 ( @ldez)
fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)
fix[k8s, k8s/ingress-nginx] Fix ingress-nginx ssl passthrough status updates ( @nickmnt)
fix[k8s/gatewayapi] Add missing Gateway API features in conformance tests ( @AnatoleLucet)
fix[k8s/gatewayapi] Avoid collisions for Gateway API services names ( @rtribotte)
fix[k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways ( @rtribotte)
fix[k8s/ingress-nginx] Configure retry according to buffering configuration ( @rtribotte)
fix[k8s/ingress-nginx] Fix force-ssl-redirect routing 418 when TLS is terminated upstream ( @carloslima)
fix[k8s] Detect EndpointSlice condition changes ( @kevinpollet)
fix[k8s] Index Kubernetes EndpointSlice by service name ( @kevinpollet)
fix[k8s] Sort endpointslices to keep backend IPs consistent across rebuilds ( @kevinpollet)
fix[kv] Bump kvtools/redis to v1.2.1 ( @ldez)
fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)
fix[middleware, k8s/gatewayapi] Fix Gateway API redirect missing statuses ( @AnatoleLucet)
fix[middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier ( @mihuross)
fix[middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme ( @gndz07)
fix[middleware] Fix CORS Max-Age set to 0 by default ( @AnatoleLucet)
fix[middleware] Fix CORS wildcard when allow-credentials is true ( @AnatoleLucet)
fix[server] Add an option to remove request headers with underscores ( @youkoulayley)
fix[server] Configurable max request header size ( @juliens)
fix[tls] Fix nondeterministic TLS certificate selection on shared SAN ( @rtribotte)
fix[webui] Bump axios to v1.18.0 ( @gndz07)
fix[websocket] Fix connection upgrades when backend server is using h2c scheme ( @stffabi)
other[k8s/crd] Fix broken CRD reference links in IngressRoute page ( @s3onghyun)
other[k8s/gatewayapi] Remove experimental note for Gateway API/TLSRoute documentation ( @jnoordsij)
feature[k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list ( @nmengin)
other[k8s] Align Helm chart documented values with chart v41 ( @mloiseleur)
other[middleware, authentication, k8s/ingress-nginx] Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-* headers ( @rtribotte)
other[middleware] Clarify entryPoint middleware reference format ( @mloiseleur)
security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)
featureAdds documentations on maxHeaderBytes ( @juliens)
fixFix inaccuracies in reference documentation ( @sheddy-traefik)
securityCVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)
securityCVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c)
fix[k8s/ingress-nginx] Skip ingress when auth-secret resolution fails ( @gndz07)
fix[k8s/ingress-nginx] Pass endpointslice fencing on ingress-nginx provider ( @Learloj)
fix[k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace ( @youkoulayley)
fix[server] Bump to github.com/pires/go-proxyproto v0.12.0 ( @timschumi)
fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)
fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)
fix[middleware] Fix redis write timeout option configuration ( @bzyy1024)
fix[webui] Bump react-router and jsdom ( @gndz07)
fix[k8s/gatewayapi] Fix BackendTLSPolicy status update ( @AnatoleLucet)
fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)
fix[webui] Bump axios to v1.17.0 ( @gndz07)
fix[tls] Fix snicheck with keepalive ( @juliens)
securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
securityCVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66)
securityCVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7)
fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)
fix[webui, tcp] Fix TCP router service resolution in dashboard flow diagram ( @aliamerj)
fix[k8s/ingress-nginx] Trim quotes from proxy_set_header header name ( @crisbal)
fix[accesslogs] Escape double quotes in quoted log fields ( @KaanSimsek)
fix[k8s/gatewayapi] Escape exact gRPC method matches ( @nickmnt)
fix[logs, middleware] Allow query parameters to be dropped from RequestPath in access log ( @calinelson)
fix[k8s/ingress-nginx] Clear Ssl-Client-* headers when no client certificate is present ( @gndz07)
fix[k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 ( @kevinpollet)
fix[file] Improve file provider behavior regarding dangling symlinks ( @fh-yuxiao-zeng)
fix[server] Bump github.com/bytedance/sonic to v1.15.1 ( @kevinpollet)
fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)
fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)
fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)
fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)
fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)
fix[k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst ( @kevinpollet)
fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)
feature[k8s] Document new chart behavior on Gateway API ( @mloiseleur)
other[file] Replace generated File routing reference page ( @sheddy-traefik)
other[k8s/crd] Fix typo in accesslogs field name ( @PlayMTL)
other[k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence ( @emilevauge)
otherPolish grammar in migration guides ( @quyentonndbs)
other[middleware] Remove whitespace in HTML tag ( @marbon87)
featureAdd @LBF38 as a current maintainer ( @emilevauge)
featureAdd ingressClassName to Kubernetes CRD provider migration guide ( @kevinpollet)
feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/enable-global-auth to the list of supported annotations ( @filip2mac)
other[k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX ( @smellems)
securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)
fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)
feature[k8s/ingress-nginx] Use a metamodel to generate dynamic configuration in ingress-nginx ( @juliens)
feature[k8s/ingress-nginx] Add limit-connections support ( @amazon7737)
feature[webui] Display server weight in service detail view ( @murataslan1)
feature[webui, tls] Add certificates menu and overview ( @holomekc)
feature[provider] Add providers routing precedence configuration ( @juliens)
feature[k8s/ingress-nginx] Support NGINX global auth annotation ( @foxcool)
feature[k8s/ingress-nginx] Add limit-burst-multiplier annotation support ( @amazon7737)
feature[k8s/ingress-nginx, k8s/ingress, rules] Add wildcard host in Host and HostSNI matchers ( @juliens)
feature[k8s/gatewayapi] Support multiple certificateRefs on gateway listeners ( @mortennordbye)
feature[k8s/gatewayapi] Add secret support for BackendTLSPolicy caCertificateRefs ( @kevinpollet)
feature[accesslogs, k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/enable-access-log annotation ( @ris-tlp)
feature[accesslogs, k8s/ingress-nginx, k8s/ingress] Add Kubernetes Ingress logs fields ( @rtribotte)
feature[k8s/knative] Support knative v1.20.0 ( @idurgakalyan)
feature[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.5.1 ( @mmatur)
feature[k8s/ingress-nginx, middleware, authentication] Add support for auth-snippet ( @juliens)
feature[accesslogs, otel] Allow Stdio access logs alongsige OTLP logging ( @Mulgish)
feature[acme] Add CertificateTimeout ACME configuration option ( @ceko)
feature[k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/allowlist-source-range ( @ris-tlp)
feature[k8s/crd] Add ingressClassName field to the CRDs spec ( @kkrypt0nn)
feature[k8s/crd] Service failover support in TraefikService CRD ( @jspdown)
feature[k8s/crd, service] Support cipher suites configuration with ServersTransport ( @NEwa-05)
feature[k8s/ingress, middleware, k8s/crd, service, k8s/gatewayapi] Services middleware and Gateway API filters on HTTP backends ( @juliens)
feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/proxy-connect-timeout annotation ( @gndz07)
feature[k8s/ingress-nginx] Add rewrite-target nginx annotations support ( @LBF38)
feature[k8s/ingress-nginx] Add support for app-root nginx annotation ( @LBF38)
feature[k8s/ingress-nginx] Add support for auth-signin annotation ( @DesalLama)
feature[k8s/ingress-nginx] Add support for from-to-www-redirect NGINX annotation ( @LBF38)
feature[k8s/ingress-nginx] Add support for proxy-read-timeout and proxy-send-timeout NGINX annotations ( @LBF38)
securityUpdate vulnerability submission guidelines ( @emilevauge)
security[k8s] Improve the multi tenant security note ( @nmengin)
securityAdd vulnerability submission quality guidelines ( @emilevauge)
breakingRemove unsupported servers[n].address from TCP label examples ( @sheddy-traefik)
security[k8s] Improve the K8S multi-tenancy security note ( @nmengin)
breakingAdd a Breaking change note to the changelog ( @nmengin)
securityBring back security section on API & Dashboard documentation page ( @gndz07)
deprecatedFix migration guide URLs in deprecation notice ( @alexmar07)
breakingRemove extra dots in migration guide ( @rtribotte)
breakingRemove extraneous dots in migration guide ( @dathbe)
securityUpdate SECURITY.md ( @cwayne18)
securityUpdate SECURITY.md to streamline information ( @emilevauge)
+242 more items in the release notessecurityAdvisory GHSA-fgjj-px3w-67xx
securityAdvisory GHSA-62fc-8686-hfmq
securityAdvisory GHSA-6765-c87h-8mrf
fix[acme] Bump github.com/go-acme/lego/v5 to v5.3.1 ( @ldez)
fix[middleware, authentication] Fix auth singleflight key collision ( @mmatur)
fix[k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider ( @gndz07)
fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)
fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)
fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)
fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)
securityAdvisory GHSA-3ccp-42pg-hgv6
fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)
fix[logs] Remove unrelated error from nonexistent cert resolver log ( @ArthurHlt)
fix[middleware] Disable Zstd support in the gzhttp wrapper ( @kevinpollet)
fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)
fix[server] Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ( @sdelicata)
fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)
fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)
other[k8s] Align certificateRef and indicate ports ( @veenoise)
other[rules] Fix syntax notes in routing rule documentation ( @stevenlele)
featureAdd a migration note for CONNECT requests ( @kevinpollet)
securityAdvisory GHSA-cxjq-mrr5-89rv
securityAdvisory GHSA-42cj-m3vj-89wv
fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)
fix[k8s] Fix panic when endpointslice port value or name is nil ( @kevinpollet)
fix[k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider ( @gndz07)
fix[middleware] Fix handle empty unknown-length bodies in mirroring ( @amazon7737)
fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)
fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)
other[middleware] Clarify buffering middleware defaults ( @amazon7737)
featureAdd @amazon7737 as a current maintainer ( @emilevauge)
featureAdd @nandorKollar as a current maintainer ( @emilevauge)
fixFix changelog v2.11.51 ( @mmatur)
fixFix grammar in TLS, TCP service, and routing reference docs ( @almightymoon)
fixFix some function names in comments ( @blackflytech)
fixFix version in migration guide ( @kevinpollet)
fixFix X-Forwarded-Prefix documentation for dashboard redirection ( @kevinpollet)
securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)
fix[acme, logs] Bump github.com/go-acme/lego/v5 ( @ldez)
fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)
fix[k8s/gatewayapi] Add missing Gateway API features in conformance tests ( @AnatoleLucet)
fix[k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways ( @rtribotte)
fix[k8s] Detect EndpointSlice condition changes ( @kevinpollet)
fix[k8s] Index Kubernetes EndpointSlice by service name ( @kevinpollet)
fix[k8s] Sort endpointslices to keep backend IPs consistent across rebuilds ( @kevinpollet)
fix[kv] Bump kvtools/redis to v1.2.1 ( @ldez)
fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)
fix[middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier ( @mihuross)
fix[middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme ( @gndz07)
fix[middleware] Fix CORS Max-Age set to 0 by default ( @AnatoleLucet)
fix[middleware] Fix CORS wildcard when allow-credentials is true ( @AnatoleLucet)
fix[tls] Fix nondeterministic TLS certificate selection on shared SAN ( @rtribotte)
fix[server] Add an option to remove request headers with underscores ( @youkoulayley)
fix[server] Configurable max request header size ( @juliens)
fix[webui] Bump axios to v1.18.0 ( @gndz07)
fix[websocket] Fix connection upgrades when backend server is using h2c scheme ( @stffabi)
other[k8s] Align Helm chart documented values with chart v41 ( @mloiseleur)
other[k8s/crd] Fix broken CRD reference links in IngressRoute page ( @s3onghyun)
feature[k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list ( @nmengin)
other[middleware] Clarify entryPoint middleware reference format ( @mloiseleur)
security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)
feature[server] Adds documentations on maxHeaderBytes ( @juliens)
fixFix inaccuracies in reference documentation ( @sheddy-traefik)
securityCVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)
fix[k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace ( @youkoulayley)
fix[server] Bump to github.com/pires/go-proxyproto v0.12.0 ( @timschumi)
fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)
fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)
fix[middleware] Fix redis write timeout option configuration ( @bzyy1024)
fix[webui] Bump react-router and jsdom ( @gndz07)
fix[k8s/gatewayapi] Fix BackendTLSPolicy status update ( @AnatoleLucet)
fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)
fix[webui] Bump axios to v1.17.0 ( @gndz07)
fix[tls] Fix snicheck with keepalive ( @juliens)
securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)
fix[accesslogs] Escape double quotes in quoted log fields ( @KaanSimsek)
fix[k8s/gatewayapi] Escape exact gRPC method matches ( @nickmnt)
fix[logs, middleware] Allow query parameters to be dropped from RequestPath in access log ( @calinelson)
fix[k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 ( @kevinpollet)
fix[file] Improve file provider behavior regarding dangling symlinks ( @fh-yuxiao-zeng)
fix[server] Bump github.com/bytedance/sonic to v1.15.1 ( @kevinpollet)
fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)
fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)
fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)
fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)
fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)
fix[k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst ( @kevinpollet)
fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)
other[file] Replace generated File routing reference page ( @sheddy-traefik)
other[k8s/crd] Fix typo in accesslogs field name ( @PlayMTL)
other[k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence ( @emilevauge)
otherPolish grammar in migration guides ( @quyentonndbs)
other[middleware] Remove whitespace in HTML tag ( @marbon87)
featureAdd @LBF38 as a current maintainer ( @emilevauge)
other[k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX ( @smellems)
securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)
fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)
fix[k8s/crd] Remove cross-provider sanitization for Kubernetes service loading ( @rtribotte)
fix[k8s/ingress-nginx] Fix typo in default CORS allowed headers ( @mliang2)
fix[logs, metrics, tracing] Bump go.opentelemetry.io/otel ( @juliens)
fix[docker, ecs] Migrate to github.com/moby/moby modules ( @thaJeztah)
fix[docker, ecs] Migrate to github.com/moby/moby modules ( @mmatur)
securityCVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.35.2 ( @ldez)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.35.1 ( @ldez)
fix[middleware] Add errorRequestHeaders option to Errors middleware ( @gndz07)
fix[k8s/ingress-nginx] Do not require a port for ExternalName services ( @kevinpollet)
fix[server] Bump github.com/vulcand/oxy to v2.1.0 ( @ldez)
otherMake FLAGS Make variable usable ( @twz123)
securityCVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847)
securityCVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm)
securityCVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54)
securityCVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h)
securityCVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.34.0 ( @ldez)
fix[docker] Downgrade log level for missing container on inspect ( @Otoru)
fix[sticky-session, k8s/crd] Make SameSite cookie value case-insensitive ( @murataslan1)
fix[k8s/crd, k8s] Honor allowCrossNamespace with chain middleware CRD ( @rtribotte)
fix[middleware] Remove untrusted X headers with underscores ( @rtribotte)
fix[middleware] Sanitize the request URL after stripping the prefix ( @kevinpollet)
fix[middleware] Deprecate ForwardAuth.TrustForwardHeader option ( @kevinpollet)
fix[middleware, authentication] Remove map lookup making the basic auth notFoundSecret empty ( @rtribotte)
fix[middleware, authentication] Fix trustForwardHeader on forward auth middleware ( @juliens)
fix[middleware, authentication] Cleanup and make ForwardAuth logs consistent ( @kevinpollet)
fix[webui] Upgrade form-data to 2.5.4, 3.0.4, 4.0.4 ( @orbisai0security)
other[k8s] Fix yaml indentation ( @isayme)
other[k8s] Clarify install config watchNamespace watches only one namespace ( @parkerfath)
other[k8s/crd] Update ingressroute.md ( @Rajakavitha1)
otherReverse versions order in migration guide ( @nmengin)
securityUpdate vulnerability submission guidelines ( @emilevauge)
fix[middleware] Bump github.com/klauspost/compress v1.18.4 and fix TestNegotiation ( @thaJeztah)
other[docker] Fix docker-compose.yaml location in Docker setup page ( @ScottA38)
other[docker, consul, ecs, k8s] Fix documentation on how to restrict the scope of service discovery ( @mloiseleur)
feature[k8s/ingress-nginx] Add OVHcloud (OpenStack Octavia) to Cloud-Specific IP Management ( @antonin-a)
other[k8s/ingress-nginx] Clarify IngressClass selection logic ( @kevinpollet)
featureAdd missing redirects for Getting started ( @nmengin)
featureAdd redirects for deleted pages ( @sheddy-traefik)
fixFix default value of http.sanitizePath ( @iTob191)
securityCVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c)
securityCVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx)
fix[k8s/ingress-nginx] Fix auth-response-headers whitespace trimming in ingress-nginx provider ( @mmatur)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.33.0 ( @ldez)
fix[server] Fix comment and unnecessary allocation in withRoutingPath ( @boinger)
fix[server, tcp] Fix postgres STARTTLS with TLS termination ( @mmatur)
fix[api] Fix allow colons and tildes in api.basePath validation ( @mmatur)
fix[grpc] Bump google.golang.org/grpc to v1.79.3 ( @mmatur)
fix[middleware, authentication] Prevent duplicate user headers in basic and digest auth middleware ( @juliens)
fix[middleware] Fix StripPrefix and StripPrefixRegex to slice the prefix using encoded prefix length ( @gndz07)
other[acme] Clarify CNAME explanation in ACME Documentation ( @sheddy-traefik)
feature[k8s/ingress-nginx] Add ingress-nginx migration banner on documentation pages ( @gndz07)
other[k8s/ingress-nginx] Clarify that NGINX Ingress watchNamespace watches only one namespace ( @parkerfath)
other[k8s/ingress] Improve Kubernetes Ingress Routing Documentation ( @sheddy-traefik)
securityCVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr)
securityCVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48)
securityCVE-2026-32695 (Advisory GHSA-67jx-r9pv-98rj)
fix[logs, otel] Add OTel-conformant trace context attributes to access logs ( @mmatur)
fix[k8s/gatewayapi] Fix incorrect hostname matching between listener and route ( @TheColorman)
fix[k8s/ingress] Fix ingress router's rule ( @gndz07)
fix[webui] Remove AGPL license in code ( @Desel72)
fix[k8s/ingress-nginx] Fix proxy-ssl-verify annotation ( @LBF38)
fix[http] Add maxResponseBodySize configuration on HTTP provider ( @gndz07)
fix[tls] Support fragmented TLS client hello ( @rtribotte)
fix[middleware, authentication] Make basic auth check timing constant ( @rtribotte)
security[k8s] Improve the multi tenant security note ( @nmengin)
fixFix unnecessary escaping of pipe in regexp examples ( @diegmonti)
securityAdd vulnerability submission quality guidelines ( @emilevauge)
fixFix start up message format ( @mloiseleur)
breakingRemove unsupported servers[n].address from TCP label examples ( @sheddy-traefik)
otherBump mkdocs-traefiklabs to use consent mode ( @darkweaver87)
securityCVE-2026-29777 (Advisory GHSA-8q2w-wr49-whqj)
securityCVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j)
fix[docker] Bump Docker and OpenTelemetry dependencies ( by mmatur)
fix[fastproxy] Bump github.com/valyala/fasthttp to v1.69.0 ( by kevinpollet)
fix[healthcheck, grpc] Remove path parsing with grpc healthcheck ( by rtribotte)
fix[k8s/gatewayapi] Fix Gateway API router's rules ( by rtribotte)
fix[middleware] Fix HasSecureHeadersDefined returning false when stsSeconds is 0 ( by veeceey)
fix[otel] Bump go.opentelemetry.io/otel dependencies ( by rtribotte)
fix[server] Bump golang.org/x/net to v0.51.0 ( by kevinpollet)
fix[webui] Fix priority display in dashboard and ACME bypass redirect ( by mmatur)
fix[webui] Fix basePath validation for dashboard template ( by gndz07)
other[middleware] Correct documentation for Digest auth ( by Zash)
featureAdd missing .http to TOML table names ( by Darsstar)
fixFix incorrect TOML example in entrypoints docs ( by mfmfuyu)
fixFix API basepath option documentation ( by nmengin)
securityCVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x)
securityCVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94)
securityCVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.32.0 ( by ldez)
fix[middleware] Fix case sensitivity on x-forwarded headers for Connection ( by LBF38)
fix[middleware, authentication] Handle empty/missing User-Agent header ( by a-stangl)
fix[middleware, authentication] Add maxResponseBodySize configuration to forwardAuth middleware ( by gndz07)
fix[server] Fix TLS handshake error handling ( by juliens)
other[docker] Update docker in-depth setup guide ( by mdevino)
other[k8s] Make labelSelector option casing more consistent ( by holysoles)
feature[k8s/ingress-nginx] Add temporary note to advertise the incoming NGINX annotations ( by nmengin)
otherIncreased content width in documentation ( by tobiasge)
otherCorrect encoded characters allowance in entrypoints.md ( by Apflkuacha)
securityCVE-2026-25949 (Advisory GHSA-89p3-4642-cr2w)
securityCVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697)
fix[acme] Remove invalid private key in log ( by juliens)
fix[acme] Alter TLS renewal period ( by LtHummus)
fix[healthcheck] Reject absolute URL in healthcheck path configuration ( by rtribotte)
fix[http3] Bump github.com/quic-go/quic-go to v0.59.0 ( by jnoordsij)
fix[metrics,tracing,accesslogs] Fix ObservabilityConfig SetDefaults ( by mmatur)
fix[server] Remove conn deadline after STARTTLS negociation ( by rtribotte)
fix[tls] Fix verifyServerCertMatchesURI function behavior ( by kevinpollet)
fix[tracing,otel] Use ParentBased sampler to respect parent span sampling decision ( by xe-leon)
fix[webui] Use url.Parse to validate X-Forwarded-Prefix value ( by kevinpollet)
fix[healthcheck] Validate healthcheck path configuration (#12642 by @rtribotte)
fix[tls, server] Cap TLS record length to RFC 8446 limit in ClientHello peeking (#12638 by @mmatur)
fix[service] Avoid recursion with services ( by juliens)
fix[webui] Bump dependencies of documentation and webui ( by gndz07)
other[k8s] Fix kubernetes.md with correct http redirections ( by MartenM)
fix[middleware,k8s/crd] Fix the errors middleware's document for Kubernetes CRD ( by yuito-it)
other[tls] Clarify SNI selection ( by AnuragEkkati)
fixFix typo on JWT documentation ( by mdevino)
featureAdd @gndz07 as a current maintainer ( by emilevauge)
breakingRemove extraneous dots in migration guide ( by dathbe)
otherDocument Path matcher placeholder removal in v3 migration guide ( by sheddy-traefik)
otherImprove Service Reference page ( by sheddy-traefik)
featureDocument negative priority support for routers ( by understood-the-assignment)
otherImprove the structure of the routing reference pages ( by sheddy-traefik)
otherClean Up Menu Entries & Update Expose Overview ( by sheddy-traefik)
featureSplit Expose User Guides & Add Multi-Layer Routing Section ( by sheddy-traefik)
breakingRemove extra dots in migration guide ( by rtribotte)
otherMerge v2.11 into v3.6 ( by mmatur)
otherMerge branch v2.11 into v3.6 ( by mmatur)
securitywarning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v3.6.4, but it restores by default the behavior that existed before…
securityCVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.31.0 ( by ldez)
fix[acme] Add missing renew options ( by ldez)
fix[acme] Replace hardcoded references to LetsEncrypt in log messages ( by schildbach)
fix[k8s/ingress-nginx] Fix use-regex nginx annotation ( by LBF38)
fix[k8s/ingress-nginx] Prevent Ingress Nginx provider http router to attach to an entrypoint with TLS ( by rtribotte)
fix[k8s/ingress] Fix panic for empty defaultBackend and defaultBackend without resources ( by gndz07)
fix[k8s] Fix condition used for serving and fenced endpoints ( by LBF38)
fix[webui] Validate X-Forwarded-Prefix value for dashboard redirect ( by LBF38)
fix[acme] Add timeout to ACME-TLS/1 challenge handshake ( by LBF38)
fix[server] Make encoded character options opt-in ( by gndz07)
other[docker/swarm] Update swarm.md traefik version ( by DBouraoui)
other[k8s/ingress-nginx] Fix ingress-nginx annotations documentation ( by nmengin)
other[k8s] Fix Kubernetes reference yml file ( by mmatur)
fixFix code copy button positioning ( by AnuragEkkati)
fixFix typo in kubernetes.md ( by EdwardSalkeld)
securityBring back security section on API & Dashboard documentation page ( by gndz07)
fixFix link description in Traefik Proxy documentation ( by schaerfo)
featureAdd product comparison matrix and features page ( by sheddy-traefik)
otherMerge branch v2.11 into v3.6 ( by rtribotte)
otherMerge branch v2.11 into v3.6 ( by mmatur)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.30.1 ( by ldez)
fix[http3] Bump github.com/quic-go/quic-go to v0.58.0 ( by GreyXor)
fix[redis] Fix mutually exclusive verification for Redis ( by juliens)
fix[server] Fix deny encoded characters ( by rtribotte)
other[k8s/ingress,k8s] Fix Kubernetes Ingress provider documentation ( by nmengin)
feature[k8s/ingress-nginx] Add RBAC documentation for Ingress NGINX provider ( by nmn3m)
security[k8s] Improve the K8S multi-tenancy security note ( by nmengin)
otherRestore documentation on http.maxHeaderBytes ( by mloiseleur)
fixFix Menu Item Naming ( by sheddy-traefik)
otherMerge branch v2.11 into v3.6 ( by mmatur)
otherMerge branch v2.11 into v3.6 ( by kevinpollet)
fix[k8s/ingress-nginx] Fix NGINX sslredirect annotation support ( by rtribotte)
fix[server] Print access logs for rejected requests and warn about new behavior ( by kevinpollet)
feature[k8s/ingress-nginx] Add auth-signin to unsupported nginx annotations list ( by fibsifan)
breakingAdd a Breaking change note to the changelog ( by nmengin)
fixFix encodedCharacters entryPoint option documentation ( by rtribotte)
securityCVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide.
securityCVE-2025-66491 (Advisory GHSA-7vww-mvcr-x6vj)
fix[server] Reject suspicious encoded characters ( by rtribotte)
fix[plugins] Validate plugin module name ( by kevinpollet)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.1 ( by GreyXor)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.0 ( by GreyXor)
fix[server] Bump golang.org/x/crypto to v0.45.0 ( by kevinpollet)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.29.0 ( by ldez)
fix[k8s/ingress-nginx] Fix SSL redirect to match NGINX behavior ( by mmatur)
fix[k8s/ingress-nginx] Fix the service name for ingress-nginx provider ( by mmatur)
fix[k8s/ingress-nginx] Fix nginx.ingress.kubernetes.io/proxy-ssl-verify annotation support ( by rtribotte)
fix[middleware,authentication] Change ForwardAuth error log level from DEBUG to ERROR ( by murataslan1)
other[api] Fix typo in API dashboard configuration instructions ( by NAICOLAS)
feature[docker] Add documentation for loadbalancer.server.url in Docker and Swarm providers ( by webash)
other[k8s/gatewayapi] Fix links of Helm chart values reference to providers.kubernetesGateway.enabled ( by shouhei)
other[k8s/ingress-nginx] Fix default value of ingress-nginx provider in documentation ( by mloiseleur)
other[k8s/ingress-nginx] NGINX Ingress Controller to Traefik Migration Guide ( by sheddy-traefik)
other[k8s/ingress-nginx] Improve the configuration options display of the Kubernetes ingress-nginx provider ( by mloiseleur)
other[k8s/ingress-nginx] Improve ingress-nginx provider documentation ( by sheddy-traefik)
other[service] Fix loadbalancer doc for highest random weight ( by ozon2)
otherCorrectly Format the HTTP Service Documentation ( by sheddy-traefik)
featureAdd documentation about checkNewVersion ( by darkweaver87)
otherMerge branch v2.11 into v3.6 ( by kevinpollet)
otherMerge branch v2.11 into v3.6 ( by mmatur)
fix[k8s/ingress-nginx] Deprecate Kubernetes Ingress NGINX provider experimental flag ( by rtribotte)
fix[docker] Auto-negotiate Docker API Version ( by felixbuenemann)
fix[server] Fix multi-layer routing with models ( by juliens)
fix[udp] Revert "Avoid allocations in readLoop by using sync.Pool" ( by kevinpollet)
fix[webui] Fix blocked navigation on Safari ( by gndz07)
fix[webui] Restore remote Upgrade to Hub button web component ( by gndz07)
other[k8s] Fix Nginx provider documentation ( by nmengin)
other[k8s] Fix Gateway API version and the list of features supported ( by nmengin)
feature[acme] Add new certificatesresolvers options ( by ldez)
feature[consul,consulcatalog,nomad] Log provider namespace during startup ( by shreealt)
feature[docker] Allow discovering non-running Docker containers ( by acouvreur)
feature[ecs] AWS ECS IPv6 Support ( by wizbit)
feature[file,k8s/crd,service] Add least time load balancing strategy ( by sdelicata)
feature[healthcheck,tcp] Add TCP Healthcheck ( by ddtmachado)
feature[healthcheck] Add passive health checks ( by Nelwhix)
feature[k8s/crd] Add highest random weight in Kubernetes CRD ( by lbenguigui)
feature[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.4.0 ( by kevinpollet)
feature[k8s/ingress] Allow publishing services with type ExternalName ( by james-callahan)
feature[k8s] Add Knative provider ( by idurgakalyan)
feature[middleware,authentication] Add warning when maxBodySize is not set ( by kianelbo)
feature[middleware,server] Multi-layer routing ( by sdelicata)
feature[plugins] Support syscall ( by david-garcia-garcia)
feature[server] Implement HTTP2 HPACK table size options ( by GCHQDeveloper548)
feature[service,udp] Avoid allocations in readLoop by using sync.Pool ( by arturmelanchyk)
feature[service] Add HighestRandomWeight load balancing algorithm ( by mathieuHa)
feature[webui] Add Traefik Hub demo in dashboard ( by gndz07)
feature[webui] Reduce vertical padding in dashboard table rows for more compact layout ( by leccelecce)
fix[server] Make the aggregator compute provider namespace for router's parentRefs ( by rtribotte)
otherPrepare release v3.6.0-rc1 ( by kevinpollet)
fixFix broken link to migration guide on readme ( by 0slb)
fixFix broken links in TCP Service and HTTP Router documentation ( by sheddy-traefik)
fixFix typo in v3.6 migration guide ( by jnoordsij)
otherMerge branch v3.5 into master ( by rtribotte)
otherMerge branch v3.5 into master ( by kevinpollet)
otherMerge branch v3.5 into v3.6 ( by kevinpollet)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.28.0 ( by ldez)
fix[server] Filter unknown nodes with file and env for the deprecation loader ( by rtribotte)
feature[acme] Add missing ACME options and clean up table for more visibility ( by sheddy-traefik)
other[middleware] Fix default encodings in compress middleware ( by Belphemur)
otherUpdate Configuration Overview Page ( by sheddy-traefik)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.27.0 ( by ldez)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.26.0 ( by ldez)
fix[http3] Bump github.com/quic-go/quic-go to v0.55.0 ( by GreyXor)
fix[kv] Bump github.com/kvtools/etcdv3 to v1.0.3 ( by kevinpollet)
fix[logs,metrics,tracing,accesslogs,otel] Fix otel not working without USER ( by mmatur)
fix[logs,otel] Enable stdout logging when OTLP is enabled ( by lbenguigui)
fix[metrics,otel] Rename traefik_tls_certs_not_after_milliseconds to traefik_tls_certs_not_after_seconds ( by shreealt)
fix[otel] Update OpenTelemetry to v1.38.0 and semantic conventions to v1.37.0 ( by rtribotte)
fix[otel] Do not fail when pod is not found in K8sAttributesDetector ( by xe-leon)
fix[tls] Make the staple updates continuous ( by rtribotte)
fix[webui] Fix version display regression ( by mdeliatf)
other[accesslogs] Fix link for accesslog.fields.names in documentation ( by rmbruntz)
other[acme] Fix Hetzner env var name inside documentation ( by ldez)
other[acme] Replace internal dead links ( by rtribotte)
other[acme] Clean and avoid collisions of anchors in option tables ( by rtribotte)
other[docker/swarm] Fix swarm code example ( by Dr4K4n)
other[healthcheck] Clarify health check requirement for server status metric ( by asafm)
other[k8s/crd] Fix typo in ingressroute.md from pirority to priority ( by miromichalicka)
fix[k8s] Fix incorrect option and lint page ( by sheddy-traefik)
feature[k8s] Add API basePath documentation and fix broken links ( by mloiseleur)
other[k8s] Merge TLSOption/TLSStore CRD documentation page ( by nmengin)
other[logs] Clarify log.filePath behavior in documentation ( by Alanxtl)
fix[metrics] Fix incorrect addInternals configuration option ( by shreealt)
other[middleware] Fix anchors in basic auth configuration options ( by homersimpsons)
other[middleware] Fix PreserveRequestMethod casing ( by LeTamanoir)
feature[middleware] Add missing reference docs for statusRewrites in errors middleware ( by sevensolutions)
other[middleware] Document rejectStatusCode ( by czocher)
other[otel] Align documentation on default otlp endpoint ( by mloiseleur)
other[otel] Fix metric name to metrics.otlp.grpc.insecure ( by germainlefebvre4)
feature[server,k8s/crd,k8s] Add dedicated pages for routers and fix doc links in CRDs ( by rtribotte)
other[tls] Fix typo in TLS certificate generation description ( by iraj-jelo)
fixFix wrong references to router's pages ( by rtribotte)
fixFix markdown rendering for table anchors ( by MaBauMeBad)
fixFix provider option descriptions ( by kevinpollet)
otherFormat HTTP headers as code ( by tyilo)
fixFix heading levels and add links ( by Granjow)
otherMerge branch v2.11 into v3.5 ( by kevinpollet)
otherMerge branch v2.11 into v3.5 ( by rtribotte)
fix[k8s/crd] ServersTransport: set minimum MaxIdleConnsPerHost=-1 ( by xe-leon)
fix[plugins] Refactor plugins system ( by jspdown)
fix[server] Use client conn to build the proxy protocol header ( by rtribotte)
fix[webui] Update hub-button-app to use a local script ( by mdeliatf)
other[acme,middleware] Fix broken links in documentation ( by mloiseleur)
other[k8s] Create Traefik Service CRD sub-resource documentation page ( by nmengin)
other[k8s] Fix conflict in IngressRouteTCP documentation ( by MatBon01)
fixFix typo in rules and priority documentation ( by Darkangeel-hd)
featureAdd govern section ( by sheddy-traefik)
fixFix entrypoint config examples ( by markormesher)
otherReorganize the menu entries ( by nmengin)
featureAdd New Secure Section to the Documentation ( by sheddy-traefik)
fix[middleware,accesslogs] Add GenericCLF log format for access logs ( by sdelicata)
fix[middleware] Fix customerrors query url replacement ( by DorianBlues)
fix[tls,service] Send proxy protocol header before TLS handshake ( by rtribotte)
fix[webui] Restore empty webui/static to use traefik as library ( by youkoulayley)
other[accesslogs] Fix path for access-logs header config ( by cgatt)
other[acme] Fixes typo for OCSP in CLI example ( by mloiseleur)
other[docker/swarm] Fixes typo for Swarm mode in CLI example ( by BilalBudhani)
other[kv] Fix broken links in KV store documentation ( by sheddy-traefik)
feature[middleware] Add redis options to ratelimit middleware & Include distributed rate limit middleware ( by sheddy-traefik)
other[server] Fix link to HTTP3 section in documentation ( by vincentbernat)
fixFix migration path in documentation ( by nmengin)
fix[accesslogs,otel] Provide Log Body in OTEL access Log ( by tomMoulard)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.25.1 ( by ldez)
fix[k8s/gatewayapi] Make app protocol case insensitive ( by shreealt)
fix[otel] Fix misspelling in docs ( by mmanciop)
fix[server] Bump to github.com/pires/go-proxyproto v0.8.1 ( by rtribotte)
fix[server] Silent expected errors on receiving sigterm signal ( by Kwuray)
fix[tracing] Fix capturedRequestHeaders and capturedResponseHeaders headers options not being canonicalized in tracing ( by mcuelenaere)
fix[tracing] Follow OTel semantic conventions for root span naming ( by Alex-Waring)
fix[webui] Update Traefik Proxy dashboard UI development deps ( by mdeliatf)
fixRefactor to use reflect.TypeFor ( by cuiweixie)
fix[docker] Fix missing middleware application for whoami service in docker guide ( by Copilot)
feature[k8s/gatewayapi] Fix documentation to match new gateway-api selector syntax ( by Firespray-31)
feature[middleware,hub] Add Traefik Hub Middlewares To Reference Section ( by sheddy-traefik)
feature[plugins] Add extend documentation ( by sheddy-traefik)
otherUpdate Broken Links in the Migration Docs ( by sheddy-traefik)
fixFix Documentation menu ( by nmengin)
fixFix invalid links in documentation ( by mloiseleur)
fixFix typo in index ( by ignyx)
otherRestore missing migration section ( by rtribotte)
otherClean Documentation ( by nmengin)
featureAdd back the link to Peka's page ( by kevinpollet)
otherMerge branch v2.11 into v3.5 ( by rtribotte)
otherMerge branch v2.11 into v3.5 ( by kevinpollet)
otherMerge branch v3.4 into v3.5 ( by rtribotte)
feature[acme] OCSP stapling ( by alekitto)
feature[acme] Add acme.httpChallenge.delay option ( by ldez)
feature[acme] Allow configuration of ACME provider http timeout ( by tkw1536)
feature[healthcheck] Add url option to healthcheck command ( by Nelwhix)
feature[healthcheck] Add unhealthy Interval to the health check configuration ( by sswastik02)
feature[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.3.0 ( by rtribotte)
feature[k8s/ingress] Make the behavior of prefix matching in Ingress consistent with Kubernetes doc ( by charlie0129)
feature[k8s] NGINX Ingress Provider ( by rtribotte)
feature[middleware,authentication] Handle context canceled in ForwardAuth middleware ( by bengentree)
feature[plugins] Ability to enable unsafe in yaegi through plugin manifest ( by Rydez)
feature[tls] Introduce X25519MLKEM768 for Post-Quantum-Secure TLS ( by fzoli)
feature[webui] Migrate Traefik Proxy dashboard UI to React ( by gndz07)
feature[webui] Improve visualization for StatusRewrites option of errors middleware ( by sevensolutions)
fix[healthcheck] Revert 11711 adding url param to healthcheck command ( by lbenguigui)
fix[logs,metrics,tracing,accesslogs,otel] Add missing resource attributes detectors ( by rtribotte)
fix[logs,tracing,k8s,otel] Add k8s resource attributes automatically ( by kevinpollet)
fix[metrics,otel] Add resourceAttributes option to OTel metrics ( by kevinpollet)
fix[middleware,tracing] Introduce trace verbosity config and produce less spans by default ( by rtribotte)
feature[docker,ecs,docker/swarm,consulcatalog,nomad] Add constraints key limitations for label providers ( by bluepuma77)
feature[k8s] Add extended NGinX annotation support documentation ( by nmengin)
breakingRemove dead link to Peka blog ( by kevinpollet)
otherPrepare release v3.5.0-rc2 ( by kevinpollet)
otherPrepare release v3.5.0-rc1 ( by rtribotte)
otherMerge branch v3.4 into v3.5 ( by rtribotte)
otherMerge branch v3.4 into v3.5 ( by kevinpollet)
otherMerge branch v3.4 into master ( by rtribotte)
otherMerge branch v3.4 into master ( by kevinpollet)
otherMerge branch v3.4 into master ( by mmatur)
otherMerge v3.4 into master ( by mmatur)
fix[http3] Bump github.com/quic-go/quic-go to v0.54.0 ( by GreyXor)
fixFix typo in entrypoints page ( by adk-swisstopo)
otherMerge branch v2.11 into v3.4 ( by kevinpollet)
otherMerge branch v2.11 into v3.4 ( by rtribotte)
fix[k8s/gatewayapi] Respect service.nativelb=false annotation when nativeLBByDefault is enabled ( by sdelicata)
fix[service] Fix concurrent access to balancer status map in WRR and P2C strategies ( by kevinpollet)
feature[docker,k8s] Add New Expose Guides ( by sheddy-traefik)
feature[docker,k8s] Add New Setup Guides ( by sheddy-traefik)
other[docker/swarm] Fix label for overriding swarm network on container ( by kevinpollet)
other[logs,accesslogs] Update Logs and Accesslogs Reference documentation with OTLP Options ( by sheddy-traefik)
otherUpdate what is Traefik page to include full Traefik Platform context ( by tomatokoolaid)
otherMerge branch v2.11 into v3.4 ( by kevinpollet)
fix[http3] Bump quic-go to v.0.49.0 ( by joshua-siw)
feature[acme] Add a note to certificatesDuration ( by sMteX)
feature[docker,k8s] Update Getting started Section with New Docker and Kubernetes Tutorial ( by sheddy-traefik)
other[docker] Remove obsolete version field in compose files ( by thomas-mauran)
feature[k8s] Add a note about Ingress Backend Resource support ( by edysli)
other[logs,metrics,tracing,accesslogs] Update the EntryPoints Documentation ( by sheddy-traefik)
feature[logs,metrics,tracing,accesslogs] Add New Observe Guides to the Documentation ( by sheddy-traefik)
other[middleware] Remove conflicting information from the CircuitBreaker documentation. ( by adk-swisstopo)
other[service] Clarify mirroring service default percent value ( by Alexy-vda)
feature[websocket] Add WebSocket guide ( by NX211)
otherMerge branch v2.11 into v3.4 ( by rtribotte)
securityCVE-2025-47952 (Advisory GHSA-vrch-868g-9jx5)
fix[docker] Do not warn network missing if connected to a container network ( by holysoles)
fix[k8s/crd] Fix CEL validation for RootCA in ServersTransport ( by rtribotte)
fix[middleware] Scope the rate limit counter key by source and by middleware ( by aromeyer)
fix[server] Use routing path in v3 matchers ( by kevinpollet)
fix[service] Make P2C strategy thread-safe ( by lbenguigui)
fix[webui] Do not display RemoveHeader option when not defined ( by kevinpollet)
other[acme] Fix ambiguous wording in ACME page ( by joshka)
fix[k8s] Fix incorrect case and missing rbac in documentation ( by mmatur)
other[middleware] Match encoded certificate to example data for TLS passthrough ( by holysoles)
otherMerge branch v2.11 into v3.4 ( by kevinpollet)
otherMerge branch v2.11 into v3.4 ( by mmatur)
otherMerge v2.11 into v3.4 ( by mmatur)
feature[acme] Add acme.profile and acme.emailAddresses options ( by ldez)
feature[docker,ecs,docker/swarm,consulcatalog,nomad] Allow configuring server URLs with label providers ( by yelvert)
feature[k8s/crd] Improve CEL validation on Ingress CRD resources ( by mloiseleur)
feature[k8s/crd] Remove default load-balancing strategy from CRD ( by kevinpollet)
feature[k8s/crd] Restrict regex validation of HTTP status codes for Ingress CRD resources ( by jnoordsij)
feature[k8s/gatewayapi] Set rule priority in Gateway API TLSRoute ( by augustozanellato)
feature[k8s/ingress] Add ingress status for ClusterIP and NodePort Service Type ( by mlec1)
feature[middleware,authentication] Add option to preserve request method in forwardAuth ( by an09mous)
feature[middleware] Support rewriting status codes in error page middleware ( by sevensolutions)
feature[middleware] Add Redis rate limiter ( by longquan0104)
feature[service] Add p2c load-balancing strategy for servers load-balancer ( by rtribotte)
feature[sticky-session] Support domain configuration for sticky cookies ( by jleal52)
feature[tls,k8s/crd,service] Allow root CA to be added through config maps ( by Nelwhix)
feature[tls] Add support to disable session ticket ( by avdhoot)
feature[udp] Add support for UDP routing in systemd socket activation ( by tsiid)
feature[webui] Add auto webui theme option and default to it ( by zizzfizzix)
featureReplace experimental maps and slices with stdlib ( by Juneezee)
featureBump github.com/redis/go-redis/v9 to v9.7.3 ( by kevinpollet)
otherPrepare release v3.4.0-rc1 ( by kevinpollet)
otherPrepare release v3.4.0-rc2 ( by rtribotte)
deprecatedDeprecate defaultRuleSyntax and ruleSyntax options ( by rtribotte)
otherMerge branch v3.3 into master ( by kevinpollet)
otherMerge branch v3.3 into master ( by mmatur)
otherMerge branch v3.3 into v3.4 ( by kevinpollet)
fix[logs,middleware,accesslogs] Add SpanID and TraceID accessLogs fields only when tracing is enabled ( by rtribotte)
securityCVE-2025-32431 (Advisory GHSA-6p68-w45g-48j7)
securityCVE-2025-22868 (Advisory GHSA-3wqc-mwfx-672p)
securityCVE-2025-22871 (Advisory GHSA-5423-jcjm-2gpv)
other[k8s/gatewayapi] Fix Kubernetes Gateway statusAddress documentation ( by kevinpollet)
other[tracing] Document how to pass multiple Headers on tracing with CLI ( by mloiseleur)
fixFix typos on what is Traefik docs page ( by matthewCmatt)
otherUpdate Welcome Page ( by sheddy-traefik)
otherMerge branch v2.11 into v3.3 ( by kevinpollet)
otherMerge branch v2.11 into v3.3 ( by rtribotte)
fix[k8s/gatewayapi] Set scheme to https with BackendTLSPolicy ( by rtribotte)
fix[middleware] Revert compress middleware algorithms priority to v2 behavior ( by rtribotte)
fix[middleware] Do not abort request when response content-type is malformed ( by kevinpollet)
fix[middleware] Compress data on flush when compression is not started ( by kevinpollet)
feature[middleware] Add back forwarded headers section in FAQ ( by kevinpollet)
featureNew Routing Reference Documentation ( by sheddy-traefik)
otherMerge branch v2.11 into v3.3 ( by kevinpollet)
otherMerge branch v2.11 into v3.3 ( by rtribotte)
fix[fastproxy] Bump github.com/valyala/fasthttp to v1.58.0 ( by kevinpollet)
fix[fastproxy] Add WebSocket headers if they are present in the request ( by kevinpollet)
fix[fastproxy] Chunked responses does not have a Content-Length header ( by kevinpollet)
fix[metrics,otel] Change request duration metric unit from millisecond to second ( by rtribotte)
fix[sticky-session] Fix double hash in sticky cookie ( by juliens)
fix[tracing] Use ResourceAttributes instead of GlobalAttributes ( by bruno-de-queiroz)
fix[tracing] Fix panic when calling Tracer ( by basgys)
other[acme] Update ACME provider configuration options ( by sheddy-traefik)
fix[acme] Fix incorrect grammar in ACME documentation ( by Peter-Maguire)
feature[metrics,tracing,accesslogs] Add missing options in entrypoints page ( by sheddy-traefik)
other[tracing] Replace globalAttributes with resourceAttributes in tracing reference ( by rtribotte)
otherMerge branch v2.11 into v3.3 ( by kevinpollet)
fix[api] Do not create observability model by default ( by rtribotte)
fix[fastproxy] Fix content-length header assertion ( by kevinpollet)
fix[fastproxy] Handle responses without content length header ( by rtribotte)
fix[k8s/crd,k8s] Add missing headerField in Middleware CRD ( by jspdown)
fix[tracing,accesslogs] Bring back TraceID and SpanID fields in access logs ( by rtribotte)
otherMerge branch v2.11 into v3.3 ( by rtribotte)
fix[fastproxy] Do not read response body for HEAD requests ( by kevinpollet)
fix[metrics,tracing,accesslogs] Fix observability configuration on EntryPoints ( by rtribotte)
fix[webui] Set content-type when serving webui index ( by kevinpollet)
deprecated[acme] Fix deprecated dnsChallenge propagation logging and documentation ( by thomscode)
feature[acme] Add missing trailing s to propagation.delayBeforeCheck option ( by jspiers)
otherMerge branch v2.11 into v3.3 ( by kevinpollet)
fix[websocket,server] Disable http2 connect setting for websocket by default ( by rtribotte)
feature[acme] Add options to control ACME propagation checks ( by ldez)
feature[api] Add support dump API endpoint ( by mmatur)
feature[http] Set Host header in HTTP provider request ( by nikonhub)
feature[k8s/crd,k8s] Make the IngressRoute kind optional ( by skirtan1)
feature[k8s/ingress,sticky-session,k8s/crd,k8s] Support serving endpoints ( by BZValoche)
feature[logs,accesslogs] OpenTelemetry Logs and Access Logs ( by rtribotte)
feature[logs,accesslogs] Add experimental flag for OTLP logs integration ( by kevinpollet)
feature[metrics,tracing,accesslogs] Manage observability at entrypoint and router level ( by rtribotte)
feature[middleware,authentication] Add an option to preserve the ForwardAuth Server Location header ( by Nelwhix)
feature[middleware,authentication] Only calculate basic auth hashes once for concurrent requests ( by michelheusschen)
feature[middleware,authentication] Send request body to authorization server for forward auth ( by kyo-ke)
feature[plugins] Add AbortOnPluginFailure option to abort startup on plugin load failure ( by bmagic)
feature[sticky-session] Configurable path for sticky cookies ( by IIpragmaII)
feature[webui,api] Configurable API & Dashboard base path ( by rtribotte)
fix[k8s/ingress,k8s/crd] Fix fenced server status computation ( by kevinpollet)
otherPrepare release v3.3.0-rc2 ( by rtribotte)
otherPrepare Release v3.3.0-rc1 ( by rtribotte)
otherMerge branch v3.2 into v3.3 ( by kevinpollet)
otherMerge branch v3.2 into v3.3 ( by mmatur)
otherMerge branch v3.2 into master ( by kevinpollet)
fix[websocket,server] Disable http2 connect setting for websocket by default ( by rtribotte)
fix[k8s/gatewayapi] Support empty value for core Kubernetes API group ( by rtribotte)
fix[tcp,k8s/crd] Pass TLS bool from IngressRouteTCP to TCPService ( by lipmem)
fix[tls] Upgrade github.com/spiffe/go-spiffe/v2 to v2.4.0 ( by mmatur)
fixRemove duplicate github.com/coreos/go-systemd dependency ( by Juneezee)
other[k8s/gatewayapi] Update Gateway API version support to v1.2.1 ( by kevinpollet)
featureAdd @jnoordsij to maintainers ( by emilevauge)
otherMerge branch v2.11 into v3.2 ( by kevinpollet)
otherMerge branch v2.11 into v3.2 ( by rtribotte)
otherMerge branch v2.11 into v3.2 ( by mmatur)
otherUpdate reference install documentation with current chart default ( by mloiseleur)
otherMerge branch v2.11 into v3.2 ( by kevinpollet)
securityCVE: CVE-2024-53259 (Advisory GHSA-hxr6-2p24-hf98)
fix[docker,docker/swarm] Rename traefik.docker.* labels for Docker Swarm to traefik.swarm.* ( by anchal00)
fix[k8s/gatewayapi] Update sigs.k8s.io/gateway-api to v1.2.1 ( by kevinpollet)
fix[plugins] Fix WASM settings ( by juliens)
fix[rules] Fix models mechanism for default rule syntax ( by rtribotte)
otherMove callout to the entrypoint page footer ( by kevinpollet)
fixFix incorrect links in v3 migration sections ( by kevinpollet)
featureNew Install Reference Documentation ( by sheddy-traefik)
securityCVE: CVE-2024-45410 (Advisory GHSA-h924-8g65-j9wg)
fix[k8s/ingress,k8s] Fix HostRegexp config for rule syntax v2 ( by kevinpollet)
fix[logs] Change level of peeking first byte error log to DEBUG for Postgres ( by rtribotte)
fix[service,fastproxy] Fix case problem for websocket upgrade ( by juliens)
other[acme,tls] Document how to use Certificates of cert-manager ( by mloiseleur)
feature[docker/swarm] Add tips about the use of docker in dynamic configuration for swarm provider ( by webash)
feature[middleware] Add Compress middleware to migration guide ( by logica0419)
otherMerge branch v2.11 into v3.2 ( by kevinpollet)
otherMerge branch v2.11 into v3.2 ( by rtribotte)
otherMerge branch v2.11 into v3.2 ( by juliens)
feature[acme] Remove same email requirement for certresolvers ( by Emrio)
feature[acme] Add support for custom CA certificates by certificate resolver ( by ldez)
feature[acme] Add 30 day certificatesDuration step ( by luker983)
feature[docker] Support HTTP BasicAuth for docker and swarm endpoint ( by 985492783)
feature[k8s,k8s/gatewayapi] Add supported features to the Gateway API GatewayClass status ( by rtribotte)
feature[k8s,k8s/gatewayapi] Update sigs.k8s.io/gateway-api to v1.2.0-rc1 ( by rtribotte)
feature[k8s,k8s/gatewayapi] Add support for backend protocol selection in HTTP and GRPC routes ( by rtribotte)
feature[k8s,k8s/gatewayapi] Improve Kubernetes GatewayAPI TCPRoute and TLSRoute support ( by rtribotte)
feature[k8s,k8s/gatewayapi] Support HTTPRoute destination port matching ( by kevinpollet)
feature[k8s,k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.2.0-rc2 ( by kevinpollet)
feature[k8s,k8s/gatewayapi] Add support for Gateway API BackendTLSPolicies ( by rtribotte)
feature[k8s,k8s/gatewayapi] Support NativeLB option in GatewayAPI provider ( by rtribotte)
feature[k8s,k8s/gatewayapi] Support ResponseHeaderModifier filter ( by kevinpollet)
feature[k8s,k8s/gatewayapi] Support GRPC routes ( by kevinpollet)
feature[k8s,k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.2.0 ( by rtribotte)
feature[metrics,otel] Allow setting service.name for OTLP metrics ( by cmartell-at-ocp)
feature[middleware,accesslogs] Record trace id and EntryPoint span id into access log ( by weijiany)
feature[middleware,authentication] Support LogUserHeader with forwardAuth middleware ( by GaleHuang)
feature[middleware] Add encodings option to the compression middleware ( by wollomatic)
feature[middleware] Add support for ipv6 subnet in ipStrategy ( by michal-kralik)
feature[nomad] Support for watching instead of polling Nomad ( by deverton-godaddy)
feature[server,performance] Introduce a fast proxy mode to improve HTTP/1.1 performances with backends ( by kevinpollet)
feature[server] Configurable max request header size ( by lucasrod16)
feature[service] Add mirrorBody option to HTTP mirroring ( by MatteoPaier)
feature[service] Add an option to preserve server path ( by mmatur)
fix[k8s,k8s/gatewayapi] Ensuring Gateway API reflected Traefik resource name unicity ( by rtribotte)
fix[k8s,k8s/gatewayapi] Preserve GRPCRoute filters order ( by kevinpollet)
fix[k8s,k8s/gatewayapi] Support http and https appProtocol for Kubernetes Service ( by WillDaSilva)
fix[k8s,k8s/gatewayapi] Avoid updating Accepted status for routes matching no Gateways ( by rtribotte)
fix[k8s,k8s/gatewayapi] Do not update gateway status when not selected by a gateway class ( by kevinpollet)
fix[service] Detect and drop broken conns in the fastproxy pool ( by kevinpollet)
other[k8s,k8s/gatewayapi] Document nativeLBByDefault annotation on Kubernetes Gateway provider ( by mloiseleur)
other[k8s/crd,k8s] Detail CRD update with v3.2 in the migration guide ( by mloiseleur)
feature[k8s/gatewayapi] Add missing RBAC in the migration guide ( by mloiseleur)
other[k8s] Fix instructions for downloading CRDs of Gateway API v1.2 ( by mloiseleur)
otherPrepare release v3.2.0-rc2 ( by kevinpollet)
otherPrepare Release v3.2.0-rc1 ( by rtribotte)
otherMerge branch v3.1 into v3.2 ( by kevinpollet)
otherMerge branch v3.1 into master ( by kevinpollet)
otherMerge branch v3.1 into master ( by mmatur)
+1 more item in the release notesfix[k8s,k8s/gatewayapi] Preserve HTTPRoute filters order ( by kevinpollet)
other[k8s,k8s/gatewayapi] Fix broken links in Kubernetes Gateway provider page ( by mloiseleur)
otherMerge branch v2.11 into v3.1 ( by kevinpollet)
fix[middleware] Reuse compression writers ( by michelheusschen)
fix[middleware] Use correct default weight in Accept-Encoding ( by michelheusschen)
fix[plugins] Close wasm middleware to prevent memory leak ( by ttys3)
otherMerge branch v2.11 into v3.1 ( by kevinpollet)
otherMerge branch v2.11 into v3.1 ( by mmatur)
fix[k8s/ingress,k8s] Disable IngressClass lookup when disableClusterScopeResources is enabled ( by jnoordsij)
fix[server] Rework condition to not log on timeout ( by rtribotte)
otherMerge branch v2.11 into v3.1 ( by kevinpollet)
otherMerge branch v2.11 into v3.1 ( by rtribotte)
fix[metrics] Guess Datadog socket type when prefix is unix ( by kevinpollet)
otherMention v3 in readme ( by kabaluyot)
otherMerge branch v2.11 into v3.1 ( by rtribotte)
securityCVE: CVE-2024-45410 (Advisory GHSA-62c8-mh53-4cqv)
fix[k8s/ingress,rules,k8s] Allow configuring rule syntax with Kubernetes Ingress annotation ( by rtribotte)
fix[k8s/ingress] Re-allow empty configuration for Kubernetes Ingress provider ( by rtribotte)
fix[middleware,metrics] Wrap capture for services used by pieces of middleware ( by rtribotte)
fix[plugins] Removes goexport dependency and adds _initialize ( by juliens)
other[k8s/crd,k8s] Remove mentions about APIVersion traefik.io/v1 ( by rtribotte)
other[k8s] Update quick-start-with-kubernetes.md to include required permissions ( by eastmane)
other[metrics] Mention missing metrics removal in the migration guide ( by rtribotte)
other[tracing] Fix tracing documentation ( by mmatur)
other[tracing] OTLP doc + potential panic ( by mmatur)
otherMerge v2.11 into v3.1 ( by kevinpollet)
otherMerge v2.11 into v3.1 ( by mmatur)
otherMerge v2.11 into v3.1 ( by rtribotte)
fix[k8s,k8s/gatewayapi] Include status addresses when comparing Gateway statuses ( by kevinpollet)
fix[k8s/ingress,k8s/crd,k8s] Allow to disable Kubernetes cluster scope resources discovery ( by rtribotte)
fix[logs] Change logs output from stderr to stdout ( by rtribotte)
fixFix grafana dashboard to work with scrape interval greater than 15s ( by swiffer)
feature[accesslogs] Add Access logs section to the migration guide ( by lbenguigui)
fix[http] Fix missing codeblock ending in HTTP discover documentation ( by djcode)
other[http] Fix yaml config example for HTTP provider headers ( by djcode)
other[k8s,k8s/gatewayapi] Use Standard channel by default with Gateway API ( by mloiseleur)
otherMerge branch v2.11 into v3.1 ( by rtribotte)
otherMerge v2.11 into v3.1 ( by mmatur)
fix[grpc] Bump google.golang.org/grpc to v1.64.1 ( by kevinpollet)
fix[k8s/gatewayapi] Do not update route status when nothing changed ( by kevinpollet)
fix[metrics] Fix grafana dashboard to work with scrape interval greater than 15s ( by davhdavh)
fix[metrics] Update open connections gauge with connections count ( by rtribotte)
fix[metrics] Use ServiceName in traefik_service_server_up metric ( by KrishnaSindhur)
other[k8s] Remove duplicated kubectl apply in Kubernetes Gateway documentation ( by battery-staple)
feature[k8s,k8s/gatewayapi] Support invalid HTTPRoute status ( by kevinpollet)
feature[k8s,k8s/gatewayapi] KubernetesGateway provider is no longer experimental ( by rtribotte)
feature[k8s,k8s/gatewayapi] Bump Gateway API to v1.1.0 ( by kevinpollet)
feature[k8s,k8s/gatewayapi] Fix route attachments to gateways ( by kevinpollet)
feature[k8s,k8s/gatewayapi] Support HTTPRoute method and query param matching ( by kevinpollet)
feature[k8s,k8s/gatewayapi] Support HTTPURLRewrite filter ( by SantoDE)
feature[k8s,k8s/gatewayapi] Set Gateway HTTPRoute status ( by kevinpollet)
feature[k8s,k8s/gatewayapi] Support ReferenceGrant for HTTPRoute backends ( by rtribotte)
feature[k8s,k8s/gatewayapi] Compute HTTPRoute priorities ( by kevinpollet)
feature[k8s,k8s/gatewayapi] Support RegularExpression for path matching ( by dmavrommatis)
feature[k8s/crd,k8s] Support HealthCheck for ExternalName services ( by marcmognol)
feature[k8s/ingress,k8s/crd,k8s,k8s/gatewayapi] Migrate to EndpointSlices API ( by jnoordsij)
feature[k8s/ingress,k8s/crd,k8s] Change log level from Warning to Info when ExternalName services is enabled ( by marcmognol)
feature[k8s/ingress,k8s/crd,k8s] Allow to use internal Node IPs for NodePort services ( by jorisvergeer)
feature[middleware,k8s,k8s/gatewayapi] Improve HTTPRoute Redirect Filter with port and scheme ( by rtribotte)
feature[middleware,k8s,k8s/gatewayapi] Support HTTPRoute redirect port and scheme ( by rtribotte)
feature[middleware] Support Content-Security-Policy-Report-Only in the headers middleware ( by SpecLad)
feature[middleware] Add support for Zstandard to the compression middleware ( by Belphemur)
feature[plugins] Enhance wasm plugins ( by juliens)
feature[plugins] Add logs for plugins load ( by mmatur)
feature[server] Support systemd socket-activation ( by juliens)
fix[k8s,k8s/gatewayapi] Retry on Gateway API resource status update ( by rtribotte)
fix[k8s,k8s/gatewayapi] Do not disable Gateway API provider if not enabled in experimental ( by kevinpollet)
fix[otel] Bump opentelemetry-go to v1.28 ( by arukiidou)
fix[plugins] Fix build only linux and darwin support wazergo ( by juliens)
fix[healthcheck,k8s/crd,k8s] Fix Healthcheck default value for ExternalName services ( by kevinpollet)
fix[middleware,metrics,tracing] Upgrade to OpenTelemetry Semantic Conventions v1.26.0 ( by mmatur)
fix[k8s,k8s/gatewayapi] Fix the Kubernetes Gateway API documentation ( by nmengin)
other[k8s,k8s/gatewayapi] Rework Kubernetes Gateway API documentation ( by kevinpollet)
otherPrepare release v3.1.0-rc3 ( by rtribotte)
otherPrepare release v3.1.0-rc2 ( by kevinpollet)
otherPrepare release v3.1.0-rc1 ( by rtribotte)
otherMerge current v3.0 into v3.1 ( by rtribotte)
otherMerge current v3.0 into master ( by mmatur)
otherMerge current v3.0 into master ( by ldez)
otherMerge current v3.0 into master ( by kevinpollet)
securityCVE: CVE-2024-39321 (Advisory GHSA-gxrv-wf35-62w9)
other[k8s] Fix some documentation links ( by rtribotte)
otherUpdate maintainers ( by emilevauge)
otherMerge current v2.11 into v3.0 ( by kevinpollet)
otherMerge current v2.11 into v3.0 ( by mmatur)
securityGHSA-rvj4-q8q5-8grf (Related to CVE-2024-35255)
otherMerge v2.11 into v3.0 ( by kevinpollet)
otherMerge v2.11 into v3.0 ( by mmatur)
securityGHSA-7jmw-8259-q9jx (Related to CVE-2024-24790)
fix[logs] Bump OTel dependencies ( by DrFaust92)
fix[logs] Append to log file if it exists ( by lbenguigui)
fix[metrics] Fix service name label_replace in Grafana ( by xdavidwu)
fix[middleware] Forward the correct status code when compression is disabled within the Brotli handler ( by rtribotte)
fix[middleware] Support Accept-Encoding header weights with Compress middleware ( by ldez)
otherUpdate v2 > v3 migration guide ( by 0anas01)
otherMerge current v2.11 into v3.0 ( by kevinpollet)
otherMerge current v2.11 into v3.0 ( by ldez)
securityGHSA-f7cq-5v43-8pwp (Related to CVE-2024-24788)
fix[k8s/ingress] Fix rule syntax version for all internal routers ( by HalloTschuess)
fix[metrics,tracing] Allow empty configuration for OpenTelemetry metrics and tracing ( by rtribotte)
fix[provider,tls] Bump tscert dependency to 28a91b69a046 ( by kevinpollet)
fix[rules,tcp] Fix the rule syntax mechanism for TCP ( by lbenguigui)
fix[tls,server] Remove deadlines when handling PostgreSQL connections ( by rtribotte)
fix[webui] Add support for IP White list ( by davidbaptista)
feature[http3] Add link to the new http3 config in migration ( by yyewolf)
other[logs] Fix log.compress value ( by mmatur)
other[metrics] Fix OTel documentation ( by nmengin)
other[middleware] Fix doc consistency forwardauth ( by mmatur)
other[middleware] Remove providers not supported in documentation ( by mmatur)
other[rules] Fix typo in PathRegexp explanation ( by BreadInvasion)
other[rules] Fix router documentation example ( by ldez)
feature[consul] ConsulCatalog StrictChecks ( by djenriquez)
feature[docker,docker/swarm] Split Docker provider ( by ldez)
feature[docker,service] Adds weight on ServersLoadBalancer ( by juliens)
feature[ecs] Add option to keep only healthy ECS tasks ( by Michampt)
feature[file] Reload provider file configuration on SIGHUP ( by sokoide)
feature[healthcheck] Support gRPC healthcheck ( by jjacque)
feature[healthcheck] Add a status option to the service health check ( by guoard)
feature[http] Support custom headers when fetching configuration through HTTP ( by kevinpollet)
feature[http3] Moves HTTP/3 outside the experimental section ( by sdelicata)
feature[k8s,hub] Remove deprecated code ( by ldez)
feature[k8s,k8s/gatewayapi] Support for cross-namespace references / GatewayAPI ReferenceGrants ( by pascal-hofmann)
feature[k8s,k8s/gatewayapi] Support HostSNIRegexp in GatewayAPI TLS routes ( by ddtmachado)
feature[k8s,k8s/gatewayapi] Upgrade gateway api to v1.0.0 ( by mmatur)
feature[k8s/crd,k8s] Support file path as input param for Kubernetes token value ( by sssash18)
feature[k8s/gatewayapi] Add option to set Gateway status address ( by kevinpollet)
feature[k8s/gatewayapi] Toggle support for experimental channel ( by SantoDE)
feature[k8s/gatewayapi] Add support for HTTPRequestRedirectFilter in k8s Gateway API ( by romantomjak)
feature[k8s/gatewayapi] Handle middlewares in filters extension reference ( by youkoulayley)
feature[k8s/ingress,k8s/crd,k8s,k8s/gatewayapi] Use runtime.Object in routerTransform ( by juliens)
feature[k8s/ingress,k8s] Add option to the Ingress provider to disable IngressClass lookup ( by jandillenkofer)
feature[k8s/ingress,k8s] Remove support of the networking.k8s.io/v1beta1 APIVersion ( by rtribotte)
feature[logs] Introduce static config hints ( by rtribotte)
feature[logs,performance] New logger for the Traefik logs ( by ldez)
feature[logs,plugins] Retry on plugin API calls ( by ldez)
feature[logs,provider] Improve provider logs ( by ldez)
feature[logs] Improve test logger assertions ( by ldez)
feature[marathon] Remove Marathon provider ( by rtribotte)
feature[metrics,tracing,accesslogs] Remove observability for internal resources ( by rtribotte)
feature[metrics,tracing] Upgrade opentelemetry dependencies ( by mmatur)
feature[metrics] Add support for sending DogStatsD metrics over Unix Socket ( by liamvdv)
feature[metrics] Remove InfluxDB v1 metrics middleware ( by tomMoulard)
feature[metrics] Upgrade OpenTelemetry dependencies ( by mmatur)
feature[metrics] Support gRPC and gRPC-Web protocol in metrics ( by longit644)
feature[middleware,accesslogs] Log TLS client subject ( by xmessi)
feature[middleware,metrics,tracing,otel] Add OpenTelemetry tracing and metrics support ( by tomMoulard)
feature[middleware] Disable Content-Type auto-detection by default ( by sdelicata)
feature[middleware] Add gRPC-Web middleware ( by juliens)
feature[middleware] Add support for Brotli ( by glinton)
feature[middleware] Renaming IPWhiteList to IPAllowList ( by wxmbugu)
feature[middleware,authentication,tracing] Add captured headers options for tracing ( by rtribotte)
+106 more items in the release notesfix[authentication, service] Support NTLM and Kerberos authentication in ForwardAuth ( @juliens)
fix[server] Reject CONNECT requests regardless of HTTP version ( @juliens)
fix[server] Reject CONNECT method before reaching the muxer ( @juliens)
fixBump golang.org/x/net to v0.60.0 ( @kevinpollet)
fix[docker] Bump github.com/docker/cli to v29.8.1 ( @kevinpollet)
fix[rules] Ignore negated matchers when parsing rule domains ( @rtribotte)
fix[server] Bump golang.org/x/crypto to v0.57.0 ( @kevinpollet)
fix[server] Ensure that the request TLS state is always set ( @rtribotte)
fix[service] Dedicate a sticky transport per ServersTransport ( @sdelicata)
fix[service] Isolate preauthenticated NTLM and Kerberos backend connections ( @kevinpollet)
fix[udp] Copy UDP datagrams into right-sized buffers before queuing ( @rtribotte)
securityAdvisory GHSA-qqjf-53cj-pwvv
securityAdvisory GHSA-f52w-8j3h-j724
securityAdvisory GHSA-w4v4-9rw7-5326
fix[acme] Disable recursive nss propagation by default for DNS challenge ( @rtribotte)
fix[http3] Dedicate a transport per HTTP/3 client connection ( @sdelicata)
fix[server] Deny request with an opaque request target ( @sdelicata)
fix[server] Do not forward h2c upgrade headers to the backend ( @sdelicata)
securityAdvisory GHSA-7ghq-v6jf-g56c
securityAdvisory GHSA-rf44-j88r-hh8c
fix[http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 ( @gndz07)
fix[server] Add an entry point option to handle request headers with aliasing names ( @rtribotte)
fix[tcp, udp] Reject negative weights in TCP and UDP weighted services ( @rtribotte)
fixBump etcd client modules to v3.5.33 ( @mmatur)
securityAdvisory GHSA-5w68-77r2-r64c
securityAdvisory GHSA-g55h-rg46-x9c5
fix[k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider ( @rtribotte)
fix[k8s/crd] Add an option to restrict the namespace of the default TLS resources ( @rtribotte)
fix[k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider ( @rtribotte)
fix[k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider ( @gndz07)
fix[k8s/gatewayapi] Fix Gateway API router rules ( @rtribotte)
fix[middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 ( @kevinpollet)
fix[tls] Add an option to disable the fallback to the default TLS options ( @rtribotte)
fixBump golang.org/x dependencies ( @mmatur)
securityAdvisory GHSA-62fc-8686-hfmq
fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)
fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)
fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)
fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)
securityAdvisory GHSA-3ccp-42pg-hgv6
fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)
fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)
fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)
fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)
featureAdd a migration note for CONNECT requests ( @kevinpollet)
securityAdvisory GHSA-cxjq-mrr5-89rv
fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)
fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)
fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)
fixFix changelog v2.11.51 ( @mmatur)
securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)
fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)
fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)
fix[middleware, authentication] Add an option to remove request headers with underscores ( @youkoulayley)
fix[webui] Bump axios to v1.18.0 ( @gndz07)
fixConfigurable max request header size ( @juliens)
security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)
featureAdds documentations on maxHeaderBytes ( @juliens)
fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)
fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)
fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)
fix[webui] Bump axios to v1.17.0 ( @gndz07)
fix[tls] Fix snicheck with keepalive ( @juliens)
securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)
fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)
fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)
fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)
fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)
fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)
fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)
securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)
fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)
fix[k8s/crd] Remove cross-provider sanitization for Kubernetes service loading ( @rtribotte)
fix[docker, ecs] Migrate to github.com/moby/moby modules ( @mmatur)
securityCVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r)
fix[middleware] Add errorRequestHeaders option to Errors middleware ( @gndz07)
fix[acme] Bump github.com/go-acme/lego to v4.35.2 ( @mmatur)
otherMake FLAGS Make variable usable ( @twz123)
securityCVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847)
securityCVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm)
securityCVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54)
securityCVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h)
securityCVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq)
fix[middleware, authentication] Remove map lookup making the basic auth notFoundSecret empty ( @rtribotte)
fix[middleware, authentication] Fix trustForwardHeader on forward auth middleware ( @juliens)
fix[middleware, authentication] Cleanup and make ForwardAuth logs consistent ( @kevinpollet)
fix[middleware] Remove untrusted X headers with underscores ( @rtribotte)
fix[middleware] Sanitize the request URL after stripping the prefix ( @kevinpollet)
fix[k8s/crd, k8s] Honor allowCrossNamespace with chain middleware CRD ( @rtribotte)
securityCVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c)
securityCVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx)
fix[grpc] Bump google.golang.org/grpc to v1.79.3 ( @mmatur)
fix[middleware, authentication] Prevent duplicate user headers in basic and digest auth middleware ( @juliens)
fix[middleware] Fix StripPrefix and StripPrefixRegex to slice the prefix using encoded prefix length ( @gndz07)
securityCVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr)
securityCVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48)
fix[http] Add maxResponseBodySize configuration on HTTP provider ( @gndz07)
fix[tls] Support fragmented TLS client hello ( @rtribotte)
fix[middleware, authentication] Make basic auth check timing constant ( @rtribotte)
otherBump mkdocs-traefiklabs to use consent mode ( @darkweaver87)
securityCVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j)
fix[docker] Bump Docker and OpenTelemetry dependencies ( by mmatur)
fix[server] Bump golang.org/x/net to v0.51.0 ( by kevinpollet)
securityCVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x)
securityCVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94)
securityCVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52)
fix[middleware] Fix case sensitivity on x-forwarded headers for Connection ( by LBF38)
fix[middleware, authentication] Add maxResponseBodySize configuration to forwardAuth middleware ( by gndz07)
fix[server] Fix TLS handshake error handling ( by juliens)
securityCVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697)
fix[healthcheck] Validate healthcheck path configuration ( by rtribotte)
fix[tls,server] Cap TLS record length to RFC 8446 limit in ClientHello peeking ( by mmatur)
fix[service] Avoid recursion with services ( by juliens)
fix[webui] Bump dependencies of documentation and webui ( by gndz07)
breakingRemove extra dots in migration guide ( by rtribotte)
securitywarning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v2.11.32, but it restores by default the behavior that existed…
securityCVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj)
fix[acme] Add timeout to ACME-TLS/1 challenge handshake ( by LBF38)
fix[server] Make encoded character options opt-in ( by gndz07)
fix[server] Fix deny encoded characters ( by rtribotte)
fix[server] Print access logs for rejected requests and warn about new behavior ( by rtribotte)
otherClarify doc about encoded characters rejection ( by rtribotte)
fixFix encoded characters entryPoint option documentation ( by rtribotte)
fixFix encoded characters option documentation ( by kevinpollet)
securityCVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide.
fix[server] Reject suspicious encoded characters ( by rtribotte)
fix[plugins] Validate plugin module name ( by kevinpollet)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.1 ( by GreyXor)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.0 ( by GreyXor)
fix[server] Bump golang.org/x/crypto to v0.45.0 ( by kevinpollet)
securityUpdate SECURITY.md to streamline information ( by emilevauge)
securityUpdate SECURITY.md ( by cwayne18)
fix[docker,docker/swarm] Auto-negotiate Docker API version ( by kevinpollet)
fix[http3] Bump github.com/quic-go/quic-go to v0.55.0 ( by kevinpollet)
fix[kv] Fix KV key name used to check if connection is alive ( by kevinpollet)
fix[server] Bump golang.org/x/net to v0.46.0 ( by kevinpollet)
fix[tracing] Bump gopkg.in/DataDog/dd-trace-go.v1 to v1.74.6 ( by hannahkm)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.25.2 ( by ldez)
fix[docker] Bump github.com/docker/docker to v28.3.3 ( by kevinpollet)
fixFix invalid links in documentation ( by mloiseleur)
otherUpdate releases docs for v3.5 ( by jnoordsij)
fix[logs] Redact logged install configuration ( by jspdown)
fix[plugins] Fix client arbitrary file access during archive extraction zipslip ( by odaysec)
fix[server] Disable MPTCP by default ( by rtribotte)
other[k8s/crd,k8s] Remove all mentions of ordering for TLSOption CurvePreferences field ( by jnoordsij)
fixBump github.com/go-viper/mapstructure/v2 to v2.3.0 ( by kevinpollet)
fix[middleware] Do not log redis sentinel username and password ( by kevinpollet)
other[kv] Fix KV reference rendering ( by rtribotte)
other[middleware,k8s/crd] Fix typo in redirect middleware documentation ( by rtribotte)
otherUpdate supported versions ( by jnoordsij)
securityCVE-2025-47952 (Advisory GHSA-vrch-868g-9jx5)
fix[k8s/ingress] Fix panic for ingress with backend resource ( by rtribotte)
fix[server] Normalize request path ( by kevinpollet)
feature[middleware,k8s] Add multi-tenant TLS guidance to the docs ( by sheddy-traefik)
feature[service] Add a note about how to disable connection reuse with backends ( by rtribotte)
fixFix broken link in documentation ( by sheddy-traefik)
otherChange version for path sanitization migration guide ( by rtribotte)
securityCVE-2025-32431 (Advisory GHSA-6p68-w45g-48j7)
securityCVE-2025-22868 (Advisory GHSA-3wqc-mwfx-672p)
securityCVE-2025-22871 (Advisory GHSA-5423-jcjm-2gpv)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.23.1 ( by ldez)
fix[metrics] Bump gopkg.in/DataDog/dd-trace-go.v1 to v1.72.2 ( by kevinpollet)
fix[middleware] Add Content-Length header to preflight response ( by lbenguigui)
fix[server] Sanitize request path ( by rtribotte)
fixBump github.com/redis/go-redis/v9 to v9.7.3 ( by kevinpollet)
fixBump golang.org/x/net to v0.38.0 ( by kevinpollet)
fixBump golang.org/x/oauth2 to v0.28.0 ( by rtribotte)
feature[middleware] Add content-length best practice documentation ( by sheddy-traefik)
otherTypo fix on the Explanation Section for User Guide HTTP Challenge. ( by YapWC)
fix[ecs,logs] Bump AWS SDK to v2 ( by Juneezee)
fix[logs,tls] Error level log for configuration-related TLS errors with backends ( by rtribotte)
fix[rules] Allow underscore character in HostSNI matcher ( by rohitlohar45)
fix[server] Bump github.com/vulcand/oxy/v2 to v2.0.3 ( by adamvduke)
fix[server] Bump golang.org/x/net to v0.37.0 ( by kevinpollet)
fix[webui] Change boolean module properties default value to undefined ( by rtribotte)
fixBump github.com/golang-jwt/jwt to v4.5.2 and v5.2.2 ( by kevinpollet)
fixBump github.com/redis/go-redis/v9 to v9.6.3 ( by kevinpollet)
fixBump golang.org/x/net to v0.36.0 ( by kevinpollet)
fixBump github.com/go-jose/go-jose/v4 to v4.0.5 ( by kevinpollet)
other[accesslogs] Remove documentation for OriginStatusLine and DownstreamStatusLine accessLogs fields ( by rtribotte)
other[middleware] Clarifies that retry middleware uses TCP, not HTTP status codes ( by geraldcroes)
feature[redis] Add tip for dynamic configuration updates of Redis ( by Alanxtl)
securityAdd Security Support ( by nmengin)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.22.2 ( by ldez)
fix[cli] Bump github.com/traefik/paerser to v0.2.2 ( by kevinpollet)
fix[middleware] Enable the retry middleware in the proxy ( by kevinpollet)
fix[middleware] Retry should send headers on Write ( by kevinpollet)
fix[acme] Graceful shutdown for ACME JSON write operation ( by juliens)
otherChange docker-compose to docker compose ( by khai-pi)
fix[middleware] Changing log message when client cert is not available to debug ( by Nelwhix)
fix[service] Do not create a logger instance for each proxy ( by kevinpollet)
fix[webui] Fix auto refresh not clearing on component unmount ( by DoubleREW)
breakingRemove awesome.traefik.io reference in documentation section ( by kevinpollet)
fix[websocket,server] Disable http2 connect setting for websocket by default ( by rtribotte)
fix[acme] Update go-acme/lego to v4.21.0 ( by ldez)
fix[middleware] Fix typo in basicauth note ( by tieje)
fix[service] Configure ErrorLog in httputil.ReverseProxy ( by peacewalker122)
fixBump golang.org/x/net to v0.33.0 ( by kevinpollet)
other[acme] Fix allowACMEByPass TOML example ( by hannesbraun)
other[k8s/crd] Update copyright for 2025 ( by kevinpollet)
fix[server] Update golang.org/x dependencies ( by rtribotte)
securityCVE: CVE-2024-53259 (Advisory GHSA-hxr6-2p24-hf98)
fix[acme] Update go-acme/lego to v4.20.4 ( by ldez)
fix[http3] Update github.com/quic-go/quic-go to v0.48.2 ( by kevinpollet)
securityCVE: CVE-2024-45410 (Advisory GHSA-h924-8g65-j9wg)
fix[acme] Update go-acme/lego to v4.20.2 ( by ldez)
fix[logs,server] Change level of peeking first byte error log to DEBUG ( by rtribotte)
fix[middleware,server] Drop untrusted X-Forwarded-Prefix header ( by rtribotte)
fix[server] Apply keepalive config to h2c entrypoints ( by davefu113)
fix[service] Fix internal handlers ServiceBuilder composition ( by juliens)
feature[accesslogs] Update access-logs.md, add examples for accesslog.format ( by bluepuma77)
fixFix the defaultRule CLI examples ( by kevinpollet)
fixFix spelling, grammar, and rephrase sections for clarity in some documentation pages ( by AntoineDeveloper)
fixFix absolute link in the migration guide ( by kevinpollet)
featureAdd X-Forwarded-Prefix to the migration guide ( by kevinpollet)
fixFix a small typo in entrypoints documentation ( by quiode)
featureAdd a warning about environment variables casing for static configuration ( by anchal00)
otherImprove documentation on dashboard ( by mloiseleur)
fix[middleware,service] Panic on aborted requests to properly close the connection ( by tonybart1337)
otherUpdate business callouts ( by tomatokoolaid)
fix[middleware] Bump github.com/klauspost/compress to dbd6c381492a ( by kevinpollet)
fix[webui] Upgrade to node 22.9 and yarn lock to fix vulnerabilities ( by kevinpollet)
fix[webui] Adopt a layout for the large amount of entrypoint port numbers ( by framebassman)
other[accesslogs] Clarify that only header fields may be redacted in access-logs ( by mattbnz)
otherUpdate business callout ( by tomatokoolaid)
fix[acme] Ensure defaultGeneratedCert.main as Subject's CN ( by Lamatte)
fix[middleware,authentication] Clean connection headers for forward auth request only ( by rtribotte)
fix[middleware] Bump github.com/klauspost/compress to 8e14b1b5a913 ( by kevinpollet)
fix[server] Rework condition to not log on timeout ( by rtribotte)
fix[webui] Remove unused boot files from webui ( by michelheusschen)
other[accesslogs] Specify default format value for access log ( by darkweaver87)
other[api] Update API documentation to mention pagination ( by lyrandy)
fix[http3] Bump github.com/quic-go/quic-go to v0.47.0 ( by rtribotte)
fix[server] Check if ACME certificate resolver is not nil ( by kevinpollet)
securityCVE: CVE-2024-45410 (Advisory GHSA-62c8-mh53-4cqv)
fix[acme] Update go-acme/lego to v4.18.0 ( by ldez)
fix[acme] Allow handling ACME challenges with custom routers ( by rtribotte)
fix[logs,middleware] Make the keys of the accessLog.fields.names map case-insensitive ( by SpecLad)
fix[logs,middleware] Ensure proper logs for aborted streaming responses ( by hood)
fix[middleware,server] Cleanup Connection headers before passing the middleware chain ( by kevinpollet)
fix[plugins] Upgrade paerser to v0.2.1 ( by mmatur)
fix[server,tcp] Prevent error logging when TCP WRR pool is empty ( by kevinpollet)
fix[webui] Upgrade webui dependencies ( by mloiseleur)
other[acme] Fix typo in multiple DNS challenge provider warning ( by tired-engineer)
other[k8s] Update k8s quickstart permissions ( by mmatur)
other[metrics] Remove documentation for unimplemented service retries metric ( by rtribotte)
other[middleware] Unify tab titles ( by jsoref)
otherGive valid examples for exposing dashboard with default Helm values ( by holysoles)
fix[docker] Update to github.com/docker/docker v27.1.1 ( by rtribotte)
fix[webui] Upgrade webui dependencies ( by mmatur)
fixFix embedded youtube video ( by mmatur)
otherUpdated index.md to include video ( by tomatokoolaid)
fix[logs] Make the log about new version more accurate ( by jmcbri)
fix[tls,k8s/crd,k8s] Enforce default cipher suites list ( by rtribotte)
other[acme] Modify certificatesDuration documentation ( by peacewalker122)
other[api] Improve explanation on API exposition ( by mloiseleur)
other[docker,consul,rancher,ecs] Improve doc on sensitive data stored into labels/tags ( by emilevauge)
other[docker,logs] Improve error and documentation on the needed link between router and service ( by mloiseleur)
other[docker] Document Docker port selection on multiple exposed ports ( by mbrodala)
otherUpdate the supported versions table for v3.1 release ( by jnoordsij)
otherUpdate PR approval process ( by emilevauge)
securityCVE: CVE-2024-39321 (Advisory GHSA-gxrv-wf35-62w9)
fix[ecs] Fix ECS config for OIDC + IRSA ( by mmatur)
fix[http3] Disable QUIC 0-RTT ( by mmatur)
fix[middleware,server] Remove interface names from IPv6 ( by JeroenED)
fix[docker,acme] Fix a typo in the ACME docker-compose docs ( by ciacon)
otherUpdate Advanced Capabilities Callout ( by tomatokoolaid)
otherUpdate maintainers ( by emilevauge)
fixFix readme badge for Semaphore CI ( by mmatur)
fixFix typo in keepAliveMaxTime docs ( by shochdoerfer)
securityGHSA-rvj4-q8q5-8grf (Related to CVE-2024-35255)
fix[acme] Update go-acme/lego to v4.17.4 ( by ldez)
otherUpdate the supported versions table ( by nmengin)
securityGHSA-7jmw-8259-q9jx (Related to CVE-2024-24790)
fix[acme] Update go-acme/lego to v4.17.3 ( by ldez)
other[acme] Fix .com and .org domain examples ( by rptaylor)
feature[middleware] Add a note about the Ratelimit middleware's behavior when the sourceCriterion header is missing ( by dgutzmann)
featureAdd user guides link to getting started ( by norlinhenrik)
breakingRemove helm default repo warning as repo has been long deprecated ( by corneliusroemer)
securityGHSA-f7cq-5v43-8pwp (Related to CVE-2024-24788)
fix[server] Remove deadlines for non-TLS connections ( by rtribotte)
fix[webui] Display of Content Security Policy values getting out of screen ( by brandonfl)
fix[webui] Fix provider icon size ( by framebassman)
other[k8s/crd] Fix migration/v2.md ( by stemar94)
other[k8s/gatewayapi] Fix HTTPRoute use of backendRefs ( by sakaru)
other[k8s/gatewayapi] Fix HTTPRoute path type ( by sakaru)
other[k8s] Improve mirroring example on Kubernetes ( by mloiseleur)
otherConsistent entryPoints capitalization in CLI flag usage ( by jnoordsij)
fixFix unfinished migration sentence for v2.11.2 ( by kevinpollet)
securityGHSA-7f4j-64p6-5h5v (related to CVE-2023-45288)
securityCVE-2024-28869
fix[server] Revert LingeringTimeout and change default value for ReadTimeout ( by kevinpollet)
fix[server] Set default ReadTimeout value to 60s ( by rtribotte)
fix[acme,tls] Enforce handling of ACME-TLS/1 challenges ( by rtribotte)
fix[acme] Update go-acme/lego to v4.16.1 ( by ldez)
fix[acme] Close created file in ACME local store CheckFile func ( by testwill)
fix[docker,http3] Update to quic-go v0.42.0 and docker/cli v24.0.9 ( by mloiseleur)
fix[docker,marathon,rancher,ecs,tls,nomad] Allow to configure TLSStore default generated certificate with labels ( by kevinpollet)
fix[ecs] Adjust ECS network interface detection logic ( by amaxine)
fix[logs,tls] Fix log when default TLSStore and TLSOptions are defined multiple times ( by rtribotte)
fix[middleware] Allow empty replacement with ReplacePathRegex middleware ( by rtribotte)
fix[plugins] Update Yaegi to v0.16.1 ( by ldez)
fix[provider,rules] Don't allow routers higher than internal ones ( by ldez)
fix[rules] Reserve priority range for internal routers ( by youkoulayley)
fix[server,tcp] Introduce Lingering Timeout ( by rtribotte)
fix[tcp] Enforce failure for TCP HostSNI with hostname ( by youkoulayley)
fix[tracing] Bump Elastic APM to v2.4.8 ( by rtribotte)
fix[webui] Fix dashboard exposition through a router ( by mmatur)
fix[webui] Display IPAllowlist middleware configuration in dashboard ( by youkoulayley)
fix[webui] Make text more readable in dark mode ( by hood)
fix[webui] Migrate to Quasar 2.x and Vue.js 3.x ( by andsarr)
fix[webui] Add a horizontal scroll for the mobile view ( by framebassman)
other[acme] Update gandiv5 env variable in providers table ( by dominiwe)
other[acme] Fix multiple dns provider documentation ( by mmatur)
other[docker] Fix paragraph in entrypoints and Docker docs ( by luigir-it)
other[k8s] Improve middleware example ( by mloiseleur)
other[metrics] Fix host header mention in prometheus metrics doc ( by MorphBonehunter)
other[metrics] Fix typo in statsd metrics docs ( by xpac1985)
other[middleware] Improve excludedIPs example with IPWhiteList and IPAllowList middleware ( by mloiseleur)
other[nomad] Improve documentation about Nomad ACL minimum rights ( by Thadir)
feature[server] Add specification for TCP TLS routers in documentation ( by shivanipawar00)
other[tls] Fix default value for peerCertURI option ( by marcmognol)
otherUpdate releases page ( by ldez)
featureAdd youkoulayley to maintainers ( by emilevauge)
featureAdd sdelicata to maintainers ( by emilevauge)
other[webui] Modify the Hub Button ( by mdeliatf)
feature[middleware] Deprecate IPWhiteList middleware in favor of IPAllowList ( by lbenguigui)
feature[redis] Add Redis Sentinel support ( by youkoulayley)
feature[server] Add KeepAliveMaxTime and KeepAliveMaxRequests features to entrypoints ( by juliens)
feature[sticky-session] Hash WRR sticky cookies ( by youkoulayley)
fix[acme] Update go-acme/lego to v4.15.0 ( by ldez)
fix[authentication] Fix NTLM and Kerberos ( by juliens)
fix[file] Fix file watcher ( by juliens)
fix[file] Update github.com/fsnotify/fsnotify to v1.7.0 ( by ldez)
fix[http3] Update quic-go to v0.40.1 ( by ldez)
fix[middleware,tcp] Add missing TCP IPAllowList middleware constructor ( by youkoulayley)
fix[nomad] Update the Nomad API dependency to v1.7.2 ( by jrasell)
fix[server] Fix ReadHeaderTimeout for PROXY protocol ( by juliens)
fix[webui] Fixes the Header Button ( by mdeliatf)
fix[webui] Fix URL encode resource's id before calling API endpoints ( by andsarr)
other[acme] Fix TLS challenge explanation ( by cavokz)
other[docker] Update wording of compose example ( by svx)
other[docker,acme] Fix typo ( by youpsla)
other[ecs] Mention ECS as supported backend ( by aleyrizvi)
deprecated[k8s/crd] Adjust deprecation notice for Kubernetes CRD provider ( by rtribotte)
other[middleware] Update the documentation for RateLimit to provide a better example ( by rmburton)
fix[server] Fix the keepAlive options for the CLI examples ( by immanuelfodor)
otherPrepare release v2.11.0-rc2 ( by rtribotte)
otherImprove Concepts documentation page ( by oliver-dvorski)
otherPrepare release v2.11.0-rc1 ( by mmatur)
fixFix description for anonymous usage statistics references ( by ariyonaty)
otherDocumentation enhancements ( by svx)
fix[logs] Fixed datadog logs json format issue ( by sssash18)
securityCVE-2023-45283
securityCVE-2023-45284
security[acme] Remove backoff for http challenge (CVE-2023-47124) ( by youkoulayley)
fix[consul,consulcatalog] Update github.com/hashicorp/consul/api ( by kevinpollet)
fix[http3] Update quic-go to v0.39.1 ( by tomMoulard)
fix[middleware] Fix stripPrefix middleware is not applied to retried attempts ( by niki-timofe)
security[provider] Refuse recursive requests (CVE-2023-47633) ( by rtribotte)
security[server] Deny request with fragment in URL path (CVE-2023-47106) ( by lbenguigui)
fix[tracing] Remove deprecated code usage for datadog tracer ( by mmatur)
other[governance] Update the review process and maintainers team documentation ( by geraldcroes)
other[governance] Guidelines Update ( by geraldcroes)
feature[metrics] Add a mention for the host header in metrics headers labels doc ( by rtribotte)
other[middleware] Rephrase BasicAuth and DigestAuth docs ( by sssash18)
other[middleware] Improve ErrorPages examples ( by arendhummeling)
featureAdd @lbenguigui to maintainers ( by kevinpollet)
securityGithub Advisory GHSA-7v4p-328v-8v5g Related to CVE-2023-39325
fix[accesslogs] Move origin fields capture to service level ( by rtribotte)
fix[accesslogs] Fix preflight response status in access logs ( by rtribotte)
fix[acme] Update go-acme/lego to v4.14.0 ( by ldez)
fix[acme] Update go-acme/lego to v4.13.3 ( by ldez)
fix[http3] Update quic-go to v0.37.5 ( by ldez)
fix[http3] Update quic-go to v0.39.0 ( by ldez)
fix[http3] Update quic-go to v0.37.6 ( by ldez)
fix[http3] Update quic-go to v0.38.0 ( by ldez)
fix[http3] Update quic-go to v0.38.1 ( by ldez)
fix[kv] Ignore ErrKeyNotFound error for the KV provider ( by sunyakun)
fix[middleware,authentication] Adjust forward auth to avoid connection leak ( by wdhongtw)
fix[middleware,server] Improve CNAME flattening to avoid unnecessary error logging ( by niallnsec)
fix[middleware] Allow X-Forwarded-For delete operation ( by rtribotte)
fix[server] Update x/net and grpc/grpc-go ( by rtribotte)
fix[webui] Add missing accessControlAllowOriginListRegex to middleware view ( by DBendit)
fixFix false positive in url anonymization ( by jspdown)
other[acme] Change Arvancloud URL ( by sajjadjafaribojd)
other[acme] Correct minor typo in crd-acme docs ( by ayyron-lmao)
other[healthcheck] Remove healthcheck interval configuration warning ( by rtribotte)
other[kv,redis] Docs describe the missing db parameter in redis provider ( by tokers)
other[middleware] Doc fix accessControlAllowHeaders examples ( by ebuildy)
otherUpdates business callout in the documentation ( by tomatokoolaid)
fix[acme] Update go-acme/lego to v4.13.2 ( by ldez)
fix[acme] Update go-acme/lego to v4.13.0 ( by ldez)
fix[k8s/ingress,k8s] fix: avoid panic on resource backends ( by ldez)
fix[middleware,tracing,plugins] fix: traceability of the middleware plugins ( by ldez)
otherUpdate maintainers guidelines ( by geraldcroes)
otherUpdate release documentation ( by rtribotte)
feature[webui] Updates the Hub tooltip content using a web component and adds an option to disable Hub button ( by mdeliatf)
fix[acme] Update go-acme/lego to v4.12.2 ( by ldez)
fix[acme] Update go-acme/lego to v4.12.1 ( by ldez)
fix[acme] Update go-acme/lego to v4.12.0 ( by ldez)
fix[acme] Update go-acme/lego to v4.11.0 ( by ldez)
fix[acme] Do not check for wildcard domains for non DNS challenge ( by erkexzcx)
fix[k8s/crd] Fix multiple subsets endpoint ( by joaosilva15)
fix[k8s/ingress,k8s/crd,k8s,hub] Clean code related to Hub ( by ldez)
fix[metrics] Enable Prometheus provider cleanup when only the router's metrics level is activated ( by rtribotte)
fix[middleware] Encode query semicolons ( by LandryBe)
fix[middleware] Missing trailer with custom errors middleware ( by rtribotte)
fix[middleware] Support informational headers in middlewares redefining the response writer. ( by rtribotte)
fix[plugins] Improve error messages related to plugins ( by ldez)
fix[tracing] Update DataDog tracing dependency to v1.50.1 ( by der-eismann)
other[accesslogs] Fix over-indented yaml configuration of access logs ( by ufUNnxagpM)
feature[tls] Add FAQ documentation about TLS certificates ( by rtribotte)
fixFix typo ( by green1052)
featureAdd business callouts ( by tomatokoolaid)
featureAdd logo for GitHub dark mode ( by ldez)
fix[middleware,oxy] Update vulcand/oxy to be5cf38 ( by rtribotte)
fixFix v2.10 migration guide ( by rtribotte)
feature[docker] Expose ContainerName in Docker provider ( by quinot)
feature[hub] Remove hub configuration out of experimental ( by mpl)
feature[k8s/crd] Introduce traefik.io API Group CRDs ( by rtribotte)
feature[k8s/ingress,k8s/crd,k8s] Native Kubernetes service load-balancing ( by rtribotte)
feature[middleware,metrics] Add prometheus metric requests_total with headers ( by rtribotte)
feature[nomad] Support multiple namespaces in the Nomad Provider ( by rtribotte)
feature[tracing] Add support to send DataDog traces via Unix Socket ( by der-eismann)
feature[webui] Modify the Hub Button ( by mdeliatf)
feature[webui] Display period setting of the RateLimit middleware in the webui ( by smatyas)
fix[docker] Only warn about missing docker network when network_mode is not host or container ( by sentriz)
fix[k8s/ingress,k8s] Bump k8s.io/client-go from v0.22.1 to v0.26.3 ( by ldez)
fix[plugins] Improve DeepCopy of PluginConf ( by ldez)
fix[plugins] Update Yaegi to v0.15.1 ( by ldez)
fix[server] Update vulcand/oxy to 03de175b3822 ( by longit644)
otherPrepare release v2.10.0-rc1 ( by ldez)
fixFix order of log levels ( by svx)
feature[docker] Update wording - add link descriptions ( by svx)
feature[middleware] Add accessControlAllowHeaders example ( by yingshaoxo)
other[tls] More details on Kubernetes options for mTLS ( by mloiseleur)
otherPrepare release v2.10.0-rc2 ( by mpl)
otherUpdate Call To Actions ( by svx)
otherImprove concepts page ( by svx)
otherUpdate wording ( by svx)
otherMerge branch v2.9 into v2.10 ( by ldez)
otherMerge branch v2.9 into v2.10 ( by mpl)
securityCVE-2023-29013 Related to CVE-2023-24534
fix[acme] Update go-acme/lego to v4.10.2 ( by ldez)
fix[http3] Update quic-go to v0.33.0 ( by ldez)
fix[metrics] Include user-defined default cert for traefik_tls_certs_not_after metric ( by rtribotte)
fix[middleware] Update vulcand/oxy to a0e9f7ff1040 ( by ldez)
fix[nomad] Fix default configuration settings for Nomad Provider ( by aofei)
fix[nomad] Fix Nomad client TLS defaults ( by rtribotte)
fix[server] Remove User-Agent header removal from ReverseProxy director func ( by rtribotte)
other[middleware] Clarify ratelimit middleware ( by mpl)
other[tcp] Correcting variable name 'server address' in TCP Router ( by ralphg6)
fix[server] Update golang.org/x/net to v0.7.0 ( by ldez)
securityfix CVE-2022-41724
fix[acme] Update go-acme/lego to v4.10.0 ( by ldez)
fix[ecs] Prevent panicking when a container has no network interfaces ( by rtribotte)
fix[file] Make file provider more resilient wrt first configuration ( by mpl)
fix[logs] Differentiate UDP stream and TCP connection in logs ( by rtribotte)
fix[middleware] Prevent from no rate limiting when average is zero ( by witalisoft)
fix[middleware] Prevents superfluous WriteHeader call in the error middleware ( by tomMoulard)
fix[middleware] Sanitize X-Forwarded-Proto header in RedirectScheme middleware ( by ldez)
fix[plugins] Update paerser to v0.2.0 ( by ldez)
fix[plugins] Update Yaegi to v0.15.0 ( by ldez)
fix[tls,http3] Bump quic-go to 89769f409f ( by mpl)
fix[tls,tcp] Adds the support for IPv6 in the TCP HostSNI matcher ( by rtribotte)
feature[acme] Add CNAME support and gotchas ( by mpl)
other[acme] Further Let's Encrypt ratelimit warnings ( by hcooper)
feature[k8s] Add info admonition about routing to k8 services ( by svx)
other[k8s] Improve TLSStore CRD documentation ( by mloiseleur)
feature[middleware] doc: add note about remoteaddr strategy ( by mpl)
featureUpdate copyright to match new standard ( by paulocfjunior)
otherUpdate copyright for 2023 ( by kevinpollet)
otherUpdate submitting pull requests to include language about drafts ( by tfny)
securityFixes CVE-2022-23469: Authorization header displayed in the debug logs
securityFixes CVE-2022-46153: Routes exposed with an empty TLSOption
fix[acme] Update go-acme/lego to v4.9.1 ( by @ldez)
fix[k8s/crd] Support of allowEmptyServices in TraefikService ( by @jeromeguiard)
fix[logs] Remove logs of the request ( by @ldez)
fix[plugins] Increase the timeout on plugin download ( by @ldez)
fix[server] Update golang.org/x/net ( by @ldez)
fix[tls] Handle broken TLS conf better ( by @mpl)
fix[tracing] Update DataDog tracing dependency to v1.43.1 ( by @rtribotte)
fix[webui] Add missing serialNumber passTLSClientCert option to middleware panel ( by @rtribotte)
feature[docker] Add networking example ( by @Janik)
feature[hub] Add information about the Hub Agent ( by @nmengin)
other[k8s/helm] Update Helm installation section ( by @mloiseleur)
other[middleware] Clarify PathPrefix matcher greediness ( by @mpl)
fix[logs,middleware] Create a new capture instance for each incoming request ( by sdelicata)
other[k8s/helm] Update helm repository ( by charlie-haley)
otherEnhance wording of building-testing page ( by svx)
featureAdd link descriptions and update wording ( by svx)
breakingRemoves the experimental tag on the Traefik Hub header ( by tfny)
fix[acme] Update go-acme/lego to v4.9.0 ( by tony-defa)
fix[kv,redis] Fix Redis configuration type ( by ldez)
fix[logs,middleware,metrics] Handle capture on redefined http.responseWriters ( by rtribotte)
fix[middleware,k8s] Remove raw cert escape in PassTLSClientCert middleware ( by rtribotte)
fix[plugins] Update Yaegi to v0.14.3 ( by ldez)
fixRemove side effect on default transport tests ( by sdelicata)
other[k8s] Fix links to gateway API guides ( by kevinpollet)
otherSimplify dashboard rule example ( by sosoba)
featureAdd v2.9 to release page ( by kevinpollet)
feature[acme,tls] ACME Default Certificate ( by rtribotte)
feature[consul,etcd,zk,kv,redis] Update valkeyrie to v1.0.0 ( by ldez)
feature[consulcatalog,nomad] Support Nomad canary deployment ( by rtribotte)
feature[consulcatalog] Move consulcatalog provider to only use health apis ( by kevinpollet)
feature[docker] Add support for reaching containers using host networking on Podman ( by freundTech)
feature[docker] Use IPv6 address ( by tomMoulard)
feature[docker] Add allowEmptyServices for Docker provider ( by jvasseur)
feature[ecs] Add support for ECS Anywhere ( by tuxpower)
feature[healthcheck] Add a method option to the service Health Check ( by ddtmachado)
feature[http3] Upgrade quic-go to v0.28.0 ( by tomMoulard)
feature[http] Start polling HTTP provider at the beginning ( by moutoum)
feature[k8s/crd,plugins] Load plugin configuration field value from Kubernetes Secret ( by rtribotte)
feature[logs,tcp] Quiet down TCP RST packet error on read operation ( by rtribotte)
feature[metrics] Add traffic size metrics ( by tomMoulard)
feature[middleware,pilot] Remove Pilot support ( by ldez)
feature[rules,tcp] Support ALPN for TCP + TLS routers ( by sh7dm)
feature[tcp,service,udp] Make the loadbalancers servers order random ( by qmloong)
feature[tls] Change default TLS options for more security ( by ddtmachado)
feature[tracing] Add Datadog GlobalTags support ( by sdelicata)
fix[acme] Fix ACME panic ( by ldez)
otherPrepare release v2.9.0 ( by tomMoulard)
other[metrics] Rework metrics overview page ( by ddtmachado)
otherPrepare release v2.9.0-rc5 ( by ldez)
otherPrepare release v2.9.0-rc4 ( by kevinpollet)
otherPrepare release v2.9.0-rc3 ( by kevinpollet)
otherPrepare release v2.9.0-rc2 (6c2c561 by ldez)
otherPrepare release v2.9.0-rc1 ( by rtribotte)
otherMerge current v2.8 into v2.9 ( by ldez)
otherMerge current v2.8 into v2.9 ( by kevinpollet)
otherMerge v2.8.5 into master ( by rtribotte)
otherMerge current v2.8 into master ( by rtribotte)
otherMerge current v2.8 into master ( by kevinpollet)
securityFixes CVE-2022-39271: HTTP/2 connections management could cause a deny of service
fix[server] Update golang.org/x/net to latest version ( by tspearconquest)
other[docker] Fix watch option description for Docker provider ( by bhuisgen)
other[ecs] Fix autoDiscoverClusters option documentation for ECS provider ( by johnpekcan)
other[k8s] Improve documentation for publishedService and IP options ( by samip5)
fix[consulcatalog] Fix UDP loadbalancer tags not being used with Consul Catalog ( by t3hchipmunk)
fix[docker,rancher,ecs,provider] Simplify AddServer algorithm ( by ldez)
fix[plugins] Allow empty plugin configuration ( by ldez)
fix[rules] Fix query parameter matching with equal ( by ldez)
fix[server] Optimize websocket headers handling ( by juliens)
feature[ecs] Add documentation for ECS constraints option ( by rtribotte)
other[k8s/gatewayapi] Fix link to RouteNamespaces ( by ldez)
featureAdd documentation for json schema usage to validate config in the FAQ ( by rtribotte)
featureAdd a note on case insensitive regex matching ( by NEwa-05)
fix[plugins] Update Yaegi to v0.14.2 ( by kevinpollet)
fix[server] Fix IPv6 addr with square brackets ( by moonlightwatch)
fix[webui,api] Display default TLS options in the dashboard ( by skwair)
feature[docker] Add healthcheck timeout seconds to value ( by fty4)
deprecatedUpdate deprecation notes about Pilot ( by nmengin)
featureAdded resources for businesses ( by tomatokoolaid)
fix[docker,docker/swarm] Fix Docker provider mem leak on operation retries ( by rtribotte)
fix[middleware] Fix retry middleware on panic ( by ldez)
fix[plugins] Allow Traefik starting even if plugin service is unavailable ( by ldez)
fixchore: update paerser to v0.1.9 ( by tomMoulard)
other[acme] Fix infoblox acme provider documentation ( by ldez)
other[k8s/crd] Fix serversTransport CRD documentation ( by cuishuang)
other[k8s/crd] Fix k8s for example for rootCAs serversTransport ( by ben-krieger)
feature[k8s] Add missing networking apiGroup in Kubernetes RBACs examples and references ( by fibsifan)
deprecatedUpdate deprecation notes about Pilot ( by nmengin)
fix[file] Update paerser to v0.1.8 ( by ldez)
fix[marathon] Add missing context in backoff for Marathon ( by rtribotte)
fix[k8s/ingress,k8s] Place namespace before name in router key for Ingress ( by longshine)
fix[kv] Update valkeyrie to a9a70ee ( by kevinpollet)
fix[logs,middleware,tracing] Remove request dump from IPWhitelist debug log and tracing message ( by rtribotte)
fix[metrics] Control allocation and copy of labelNamesValues type ( by rtribotte)
fix[metrics] Fix service up gauge for Prometheus metrics ( by juliens)
fix[plugins] Bump paerser to v0.1.6 ( by ldez)
fix[yaml] Add missing inline tag for YAML serialization ( by kevinpollet)
other[k8s] Fix wording of default behavior for namespaces option ( by markormesher)
feature[k8s] Add getting started guide for Kubernetes ( by moutoum)
feature[plugins] Remove Traefik Pilot and add a Traefik Plugins Catalog page ( by sdelicata)
otherUpdate Thank You page with proper branding and grammar fixes ( by tfny)
otherUpdate CONTRIBUTING.md to contain all information in one place ( by tfny)
otherUpdate the PR guidelines in Contributing docs ( by tfny)
fix[kv] Upgrade valkeyrie to v0.4.1 ( by moutoum)
fix[middleware,metrics] Improve performances when Prometheus metrics are enabled ( by juliens)
fix[middleware] Support forwarded websocket protocol in RedirectScheme ( by moutoum)
otherUpdate the language for advocating page ( by tfny)
featureAdd callout for anyone using Traefik to manage commercial applications ( by tomatokoolaid)
deprecatedUpdate deprecation notices ( by ddtmachado)
feature[consul,consulcatalog] Support multiple namespaces for Consul and ConsulCatalog providers ( by rtribotte)
feature[http3] Upgrade quic-go to v0.27.0 ( by tomMoulard)
feature[http3] Upgrade quic-go to v0.26.0 ( by sylr)
feature[logs] Add destination address to debug log ( by qmloong)
feature[middleware,provider,tls] Deprecate caOptional option in client TLS configuration ( by kevinpollet)
feature[middleware] Support URL replacement in errors middleware ( by tomMoulard)
feature[middleware] Allow config of additional CircuitBreaker params ( by aidy)
feature[provider] Implement Traefik provider for Nomad orchestrator ( by shoenig)
feature[server] Allow HTTP/2 max concurrent stream configuration ( by tomMoulard)
feature[tls,k8s/crd] Support certificates configuration in TLSStore CRD ( by kevinpollet)
feature[webui,pilot,hub] Add Traefik Hub button and deprecate Pilot ( by ldez)
feature[webui,plugins] Reach the catalog of plugins from the Traefik dashboard ( by seedy)
fix[nomad] Use configured token in the Nomad client ( by kevinpollet)
otherPrepare release v2.8.0-rc2 ( by rtribotte)
otherPrepare release v2.8.0-rc1 ( by rtribotte)
otherMerge current v2.7 into v2.8 ( by rtribotte)
otherMerge current v2.7 into master ( by rtribotte)
otherMerge current v2.7 into master ( by tomMoulard)