Traefik 3.5.1 → 3.7.5
33 releases · 8 breaking changes · 54 security fixes · 25 advisories fixed
54security8breaking1deprecated78feature244fix
Vulnerabilities fixed by this upgrade
- 6.4 GHSA-rh7m-2m44-x32f Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
- 7.8 CVE-2026-53622 HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
- 7.8 CVE-2026-48020 Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
- 6.4 CVE-2026-44774 Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
- 6.9 CVE-2026-41181 Errors middleware forwards Authorization and Cookie headers to separate error page service
- 7.8 CVE-2026-40912 StripPrefixRegex auth bypass via Path/RawPath desync
- 7.8 CVE-2026-35051 ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
- 7.8 CVE-2026-39858 Forwarded alias spoofing top pre-auth decision bypass
- 6.3 CVE-2026-41263 BasicAuth middleware: timing side-channel vulnerability
- 4.8 CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
- 7.8 CVE-2026-33186 Fix CVE-2026-33186
- 5.1 CVE-2026-33433 BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
- 6.3 CVE-2026-32695 Ingress Rule Injection Allows Host Restriction Bypass in Traefik
- 7.8 CVE-2026-32305 Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config
- 6.3 CVE-2026-32595 BasicAuth Middleware Timing Attack Allows Username Enumeration
- 7.7 CVE-2026-27141 HTTP/2 frames can cause a running server to panic
- 6.1 CVE-2026-29777 Kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values
- 7.5 CVE-2026-26999 TLS Handshake Error Handling Allows Stalled Connections on TCP Routers
- 7.5 CVE-2026-29054 Case-Sensitive Bypass in Connection Header Allows Removal of X-Forwarded Headers
- 4.4 CVE-2026-26998 ForwardAuth Middleware Allows Unbounded Response Body, Causing Potential Denial of Service
- 7.8 CVE-2025-68121 TLS ClientAuth Bypass on HTTP/3
- 7.5 CVE-2026-25949 TCP readTimeout bypass via STARTTLS on Postgres
- 5.9 CVE-2026-22045 ACME TLS-ALPN fast path lacks timeouts and close on handshake stall
- 7.8 CVE-2025-66490 Path Normalization Bypass in Traefik Router + Middleware Rules
- 5.9 CVE-2025-66491 Inverted TLS Verification Logic in Kubernetes NGINX Provider
Breaking changes
- breaking Remove unsupported servers[n].address from TCP label examples ( @sheddy-traefik) in 3.7.0
- breaking Add a Breaking change note to the changelog ( @nmengin) in 3.7.0
- breaking Remove extra dots in migration guide ( @rtribotte) in 3.7.0
- breaking Remove extraneous dots in migration guide ( @dathbe) in 3.7.0
- breaking Remove unsupported servers[n].address from TCP label examples ( @sheddy-traefik) in 3.6.11
- breaking Remove extraneous dots in migration guide ( by dathbe) in 3.6.8
- breaking Remove extra dots in migration guide ( by rtribotte) in 3.6.8
- breaking Add a Breaking change note to the changelog ( by nmengin) in 3.6.5
Security changes
- security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.7.5
- security CVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c) in 3.7.5
- security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.7.3
- security CVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66) in 3.7.3
- security CVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7) in 3.7.3
- security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.7.1
- security Advisory GHSA-rh7m-2m44-x32f in 3.7.1
- security Update vulnerability submission guidelines ( @emilevauge) in 3.7.0
- security [k8s] Improve the multi tenant security note ( @nmengin) in 3.7.0
- security Add vulnerability submission quality guidelines ( @emilevauge) in 3.7.0
- security [k8s] Improve the K8S multi-tenancy security note ( @nmengin) in 3.7.0
- security Bring back security section on API & Dashboard documentation page ( @gndz07) in 3.7.0
- security Update SECURITY.md ( @cwayne18) in 3.7.0
- security Update SECURITY.md to streamline information ( @emilevauge) in 3.7.0
- security Advisory GHSA-fgjj-px3w-67xx in 3.6.25
- security Advisory GHSA-62fc-8686-hfmq in 3.6.25
- security Advisory GHSA-6765-c87h-8mrf in 3.6.25
- security Advisory GHSA-3ccp-42pg-hgv6 in 3.6.24
- security Advisory GHSA-cxjq-mrr5-89rv in 3.6.23
- security Advisory GHSA-42cj-m3vj-89wv in 3.6.23
- security CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) in 3.6.22
- security CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) in 3.6.22
- security [security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge) in 3.6.22
- security CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) in 3.6.21
- security CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2) in 3.6.19
- security CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc) in 3.6.17
- security Advisory GHSA-rh7m-2m44-x32f in 3.6.17
- security CVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r) in 3.6.15
- security CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847) in 3.6.14
- security CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm) in 3.6.14
- security CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54) in 3.6.14
- security CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h) in 3.6.14
- security CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq) in 3.6.14
- security Update vulnerability submission guidelines ( @emilevauge) in 3.6.14
- security CVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c) in 3.6.12
- security CVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx) in 3.6.12
- security CVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr) in 3.6.11
- security CVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48) in 3.6.11
- security CVE-2026-32695 (Advisory GHSA-67jx-r9pv-98rj) in 3.6.11
- security [k8s] Improve the multi tenant security note ( @nmengin) in 3.6.11
- security Add vulnerability submission quality guidelines ( @emilevauge) in 3.6.11
- security CVE-2026-29777 (Advisory GHSA-8q2w-wr49-whqj) in 3.6.10
- security CVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j) in 3.6.10
- security CVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x) in 3.6.9
- security CVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94) in 3.6.9
- security CVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52) in 3.6.9
- security CVE-2026-25949 (Advisory GHSA-89p3-4642-cr2w) in 3.6.8
- security CVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697) in 3.6.8
- security warning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v3.6.4, but it restores by default the behavior that existed before… in 3.6.7
- security CVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj) in 3.6.7
- security Bring back security section on API & Dashboard documentation page ( by gndz07) in 3.6.7
- security [k8s] Improve the K8S multi-tenancy security note ( by nmengin) in 3.6.6
- security CVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide. in 3.6.4
- security CVE-2025-66491 (Advisory GHSA-7vww-mvcr-x6vj) in 3.6.4
Deprecations
- deprecated Fix migration guide URLs in deprecation notice ( @alexmar07) in 3.7.0
Every release in between
securityCVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)
securityCVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c)
fix[k8s/ingress-nginx] Skip ingress when auth-secret resolution fails ( @gndz07)
fix[k8s/ingress-nginx] Pass endpointslice fencing on ingress-nginx provider ( @Learloj)
fix[k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace ( @youkoulayley)
fix[server] Bump to github.com/pires/go-proxyproto v0.12.0 ( @timschumi)
fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)
fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)
fix[middleware] Fix redis write timeout option configuration ( @bzyy1024)
fix[webui] Bump react-router and jsdom ( @gndz07)
fix[k8s/gatewayapi] Fix BackendTLSPolicy status update ( @AnatoleLucet)
fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)
fix[webui] Bump axios to v1.17.0 ( @gndz07)
fix[tls] Fix snicheck with keepalive ( @juliens)
securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
securityCVE-2026-48491 (Advisory GHSA-5r4w-85f3-pw66)
securityCVE-2026-53622 (Advisory GHSA-9cr8-q42q-g8m7)
fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)
fix[webui, tcp] Fix TCP router service resolution in dashboard flow diagram ( @aliamerj)
fix[k8s/ingress-nginx] Trim quotes from proxy_set_header header name ( @crisbal)
fix[accesslogs] Escape double quotes in quoted log fields ( @KaanSimsek)
fix[k8s/gatewayapi] Escape exact gRPC method matches ( @nickmnt)
fix[logs, middleware] Allow query parameters to be dropped from RequestPath in access log ( @calinelson)
fix[k8s/ingress-nginx] Clear Ssl-Client-* headers when no client certificate is present ( @gndz07)
fix[k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 ( @kevinpollet)
fix[file] Improve file provider behavior regarding dangling symlinks ( @fh-yuxiao-zeng)
fix[server] Bump github.com/bytedance/sonic to v1.15.1 ( @kevinpollet)
fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)
fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)
fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)
fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)
fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)
fix[k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst ( @kevinpollet)
fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)
feature[k8s] Document new chart behavior on Gateway API ( @mloiseleur)
other[file] Replace generated File routing reference page ( @sheddy-traefik)
other[k8s/crd] Fix typo in accesslogs field name ( @PlayMTL)
other[k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence ( @emilevauge)
otherPolish grammar in migration guides ( @quyentonndbs)
other[middleware] Remove whitespace in HTML tag ( @marbon87)
featureAdd @LBF38 as a current maintainer ( @emilevauge)
featureAdd ingressClassName to Kubernetes CRD provider migration guide ( @kevinpollet)
feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/enable-global-auth to the list of supported annotations ( @filip2mac)
other[k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX ( @smellems)
securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
securityAdvisory GHSA-rh7m-2m44-x32f
fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)
fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)
feature[k8s/ingress-nginx] Use a metamodel to generate dynamic configuration in ingress-nginx ( @juliens)
feature[k8s/ingress-nginx] Add limit-connections support ( @amazon7737)
feature[webui] Display server weight in service detail view ( @murataslan1)
feature[webui, tls] Add certificates menu and overview ( @holomekc)
feature[provider] Add providers routing precedence configuration ( @juliens)
feature[k8s/ingress-nginx] Support NGINX global auth annotation ( @foxcool)
feature[k8s/ingress-nginx] Add limit-burst-multiplier annotation support ( @amazon7737)
feature[k8s/ingress-nginx, k8s/ingress, rules] Add wildcard host in Host and HostSNI matchers ( @juliens)
feature[k8s/gatewayapi] Support multiple certificateRefs on gateway listeners ( @mortennordbye)
feature[k8s/gatewayapi] Add secret support for BackendTLSPolicy caCertificateRefs ( @kevinpollet)
feature[accesslogs, k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/enable-access-log annotation ( @ris-tlp)
feature[accesslogs, k8s/ingress-nginx, k8s/ingress] Add Kubernetes Ingress logs fields ( @rtribotte)
feature[k8s/knative] Support knative v1.20.0 ( @idurgakalyan)
feature[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.5.1 ( @mmatur)
feature[k8s/ingress-nginx, middleware, authentication] Add support for auth-snippet ( @juliens)
feature[accesslogs, otel] Allow Stdio access logs alongsige OTLP logging ( @Mulgish)
feature[acme] Add CertificateTimeout ACME configuration option ( @ceko)
feature[k8s/ingress-nginx] Support nginx.ingress.kubernetes.io/allowlist-source-range ( @ris-tlp)
feature[k8s/crd] Add ingressClassName field to the CRDs spec ( @kkrypt0nn)
feature[k8s/crd] Service failover support in TraefikService CRD ( @jspdown)
feature[k8s/crd, service] Support cipher suites configuration with ServersTransport ( @NEwa-05)
feature[k8s/ingress, middleware, k8s/crd, service, k8s/gatewayapi] Services middleware and Gateway API filters on HTTP backends ( @juliens)
feature[k8s/ingress-nginx] Add nginx.ingress.kubernetes.io/proxy-connect-timeout annotation ( @gndz07)
feature[k8s/ingress-nginx] Add rewrite-target nginx annotations support ( @LBF38)
feature[k8s/ingress-nginx] Add support for app-root nginx annotation ( @LBF38)
feature[k8s/ingress-nginx] Add support for auth-signin annotation ( @DesalLama)
feature[k8s/ingress-nginx] Add support for from-to-www-redirect NGINX annotation ( @LBF38)
feature[k8s/ingress-nginx] Add support for proxy-read-timeout and proxy-send-timeout NGINX annotations ( @LBF38)
securityUpdate vulnerability submission guidelines ( @emilevauge)
security[k8s] Improve the multi tenant security note ( @nmengin)
securityAdd vulnerability submission quality guidelines ( @emilevauge)
breakingRemove unsupported servers[n].address from TCP label examples ( @sheddy-traefik)
security[k8s] Improve the K8S multi-tenancy security note ( @nmengin)
breakingAdd a Breaking change note to the changelog ( @nmengin)
securityBring back security section on API & Dashboard documentation page ( @gndz07)
deprecatedFix migration guide URLs in deprecation notice ( @alexmar07)
breakingRemove extra dots in migration guide ( @rtribotte)
breakingRemove extraneous dots in migration guide ( @dathbe)
securityUpdate SECURITY.md ( @cwayne18)
securityUpdate SECURITY.md to streamline information ( @emilevauge)
+242 more items in the release notessecurityAdvisory GHSA-fgjj-px3w-67xx
securityAdvisory GHSA-62fc-8686-hfmq
securityAdvisory GHSA-6765-c87h-8mrf
fix[acme] Bump github.com/go-acme/lego/v5 to v5.3.1 ( @ldez)
fix[middleware, authentication] Fix auth singleflight key collision ( @mmatur)
fix[k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider ( @gndz07)
fix[tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 ( @kevinpollet)
fixBump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 ( @mmatur)
fix[k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider ( @gndz07)
fix[middleware] Bump github.com/klauspost/compress to v1.18.7 ( @mmatur)
securityAdvisory GHSA-3ccp-42pg-hgv6
fix[middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs ( @kevinpollet)
fix[logs] Remove unrelated error from nonexistent cert resolver log ( @ArthurHlt)
fix[middleware] Disable Zstd support in the gzhttp wrapper ( @kevinpollet)
fix[server] Defer the CONNECT payload until the backend accepts the tunnel ( @sdelicata)
fix[server] Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy ( @sdelicata)
fix[server] Bump google.golang.org/grpc to v1.82.1 ( @piscue)
fix[server] Do not add back CONNECT requests to the pool ( @kevinpollet)
other[k8s] Align certificateRef and indicate ports ( @veenoise)
other[rules] Fix syntax notes in routing rule documentation ( @stevenlele)
featureAdd a migration note for CONNECT requests ( @kevinpollet)
securityAdvisory GHSA-cxjq-mrr5-89rv
securityAdvisory GHSA-42cj-m3vj-89wv
fix[acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 ( @rtribotte)
fix[k8s] Fix panic when endpointslice port value or name is nil ( @kevinpollet)
fix[k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider ( @gndz07)
fix[middleware] Fix handle empty unknown-length bodies in mirroring ( @amazon7737)
fix[middleware] Sanitize replaced path in ReplacePathRegex middleware ( @kevinpollet)
fix[otel] Bump go.opentelemetry.io/otel to v1.44.0 ( @rtribotte)
other[middleware] Clarify buffering middleware defaults ( @amazon7737)
featureAdd @amazon7737 as a current maintainer ( @emilevauge)
featureAdd @nandorKollar as a current maintainer ( @emilevauge)
fixFix changelog v2.11.51 ( @mmatur)
fixFix grammar in TLS, TCP service, and routing reference docs ( @almightymoon)
fixFix some function names in comments ( @blackflytech)
fixFix version in migration guide ( @kevinpollet)
fixFix X-Forwarded-Prefix documentation for dashboard redirection ( @kevinpollet)
securityCVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
securityCVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)
fix[acme, logs] Bump github.com/go-acme/lego/v5 ( @ldez)
fix[acme] Bump github.com/go-acme/lego/v5 ( @juliens)
fix[k8s/gatewayapi] Add missing Gateway API features in conformance tests ( @AnatoleLucet)
fix[k8s/gatewayapi] Ignore other gateways parentRefs and update route parent statuses only for managed gateways ( @rtribotte)
fix[k8s] Detect EndpointSlice condition changes ( @kevinpollet)
fix[k8s] Index Kubernetes EndpointSlice by service name ( @kevinpollet)
fix[k8s] Sort endpointslices to keep backend IPs consistent across rebuilds ( @kevinpollet)
fix[kv] Bump kvtools/redis to v1.2.1 ( @ldez)
fix[middleware, authentication] Fix x-forwarded-port in forward-auth ( @juliens)
fix[middleware, k8s/gatewayapi] Fix Host header not being modified by RequestHeaderModifier ( @mihuross)
fix[middleware, k8s/gatewayapi] Fix request scheme derivation when Gateway API RequestRedirect omits scheme ( @gndz07)
fix[middleware] Fix CORS Max-Age set to 0 by default ( @AnatoleLucet)
fix[middleware] Fix CORS wildcard when allow-credentials is true ( @AnatoleLucet)
fix[tls] Fix nondeterministic TLS certificate selection on shared SAN ( @rtribotte)
fix[server] Add an option to remove request headers with underscores ( @youkoulayley)
fix[server] Configurable max request header size ( @juliens)
fix[webui] Bump axios to v1.18.0 ( @gndz07)
fix[websocket] Fix connection upgrades when backend server is using h2c scheme ( @stffabi)
other[k8s] Align Helm chart documented values with chart v41 ( @mloiseleur)
other[k8s/crd] Fix broken CRD reference links in IngressRoute page ( @s3onghyun)
feature[k8s/ingress-nginx] Add Kubernetes Ingress NGINX to the providers list ( @nmengin)
other[middleware] Clarify entryPoint middleware reference format ( @mloiseleur)
security[security] Add HTTP/2 header memory exhaustion security documentation ( @emilevauge)
feature[server] Adds documentations on maxHeaderBytes ( @juliens)
fixFix inaccuracies in reference documentation ( @sheddy-traefik)
securityCVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc)
fix[k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace ( @youkoulayley)
fix[server] Bump to github.com/pires/go-proxyproto v0.12.0 ( @timschumi)
fix[tls] Fix routers with same host, different tlsoptions on different entryPoint ( @juliens)
fix[tls] Fix snicheck for routers with no hosts ( @rtribotte)
fix[middleware] Fix redis write timeout option configuration ( @bzyy1024)
fix[webui] Bump react-router and jsdom ( @gndz07)
fix[k8s/gatewayapi] Fix BackendTLSPolicy status update ( @AnatoleLucet)
fix[http3] Bump github.com/quic-go/quic-go to v0.59.1 ( @rtribotte)
fix[webui] Bump axios to v1.17.0 ( @gndz07)
fix[tls] Fix snicheck with keepalive ( @juliens)
securityCVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
fix[tls] Compute resolved tlsOptions after applying models ( @rtribotte)
fix[accesslogs] Escape double quotes in quoted log fields ( @KaanSimsek)
fix[k8s/gatewayapi] Escape exact gRPC method matches ( @nickmnt)
fix[logs, middleware] Allow query parameters to be dropped from RequestPath in access log ( @calinelson)
fix[k8s/gatewayapi] Bump github.com/moby/spdystream to v0.5.1 ( @kevinpollet)
fix[file] Improve file provider behavior regarding dangling symlinks ( @fh-yuxiao-zeng)
fix[server] Bump github.com/bytedance/sonic to v1.15.1 ( @kevinpollet)
fix[middleware, authentication] Add error on basic auth build if users is empty ( @rtribotte)
fix[k8s/ingress] Avoid ingress path matcher injection and backport 11d251415 ( @rtribotte)
fix[server] Move snicheck to ctx instead of simulated routing ( @juliens)
fix[middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation ( @rtribotte)
fix[server] Bump golang.org/x/net to v0.55.0 ( @kevinpollet)
fix[k8s/gatewayapi] Change default values and expose configuration for Kubernetes client QPS and Burst ( @kevinpollet)
fix[server] Bump golang.org/x/crypto to v0.52.0 ( @rtribotte)
other[file] Replace generated File routing reference page ( @sheddy-traefik)
other[k8s/crd] Fix typo in accesslogs field name ( @PlayMTL)
other[k8s/ingress-nginx] Surface the Ingress status race condition during NGINX coexistence ( @emilevauge)
otherPolish grammar in migration guides ( @quyentonndbs)
other[middleware] Remove whitespace in HTML tag ( @marbon87)
featureAdd @LBF38 as a current maintainer ( @emilevauge)
other[k8s/ingress-nginx] Capitalize NGINX in kubernetesIngressNGINX ( @smellems)
securityCVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
securityAdvisory GHSA-rh7m-2m44-x32f
fix[k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option ( @rtribotte)
fix[k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider ( @rtribotte)
fix[k8s/crd] Remove cross-provider sanitization for Kubernetes service loading ( @rtribotte)
fix[k8s/ingress-nginx] Fix typo in default CORS allowed headers ( @mliang2)
fix[logs, metrics, tracing] Bump go.opentelemetry.io/otel ( @juliens)
fix[docker, ecs] Migrate to github.com/moby/moby modules ( @thaJeztah)
fix[docker, ecs] Migrate to github.com/moby/moby modules ( @mmatur)
securityCVE-2026-41181 (Advisory GHSA-p6hg-qh38-555r)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.35.2 ( @ldez)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.35.1 ( @ldez)
fix[middleware] Add errorRequestHeaders option to Errors middleware ( @gndz07)
fix[k8s/ingress-nginx] Do not require a port for ExternalName services ( @kevinpollet)
fix[server] Bump github.com/vulcand/oxy to v2.1.0 ( @ldez)
otherMake FLAGS Make variable usable ( @twz123)
securityCVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847)
securityCVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm)
securityCVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54)
securityCVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h)
securityCVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.34.0 ( @ldez)
fix[docker] Downgrade log level for missing container on inspect ( @Otoru)
fix[sticky-session, k8s/crd] Make SameSite cookie value case-insensitive ( @murataslan1)
fix[k8s/crd, k8s] Honor allowCrossNamespace with chain middleware CRD ( @rtribotte)
fix[middleware] Remove untrusted X headers with underscores ( @rtribotte)
fix[middleware] Sanitize the request URL after stripping the prefix ( @kevinpollet)
fix[middleware] Deprecate ForwardAuth.TrustForwardHeader option ( @kevinpollet)
fix[middleware, authentication] Remove map lookup making the basic auth notFoundSecret empty ( @rtribotte)
fix[middleware, authentication] Fix trustForwardHeader on forward auth middleware ( @juliens)
fix[middleware, authentication] Cleanup and make ForwardAuth logs consistent ( @kevinpollet)
fix[webui] Upgrade form-data to 2.5.4, 3.0.4, 4.0.4 ( @orbisai0security)
other[k8s] Fix yaml indentation ( @isayme)
other[k8s] Clarify install config watchNamespace watches only one namespace ( @parkerfath)
other[k8s/crd] Update ingressroute.md ( @Rajakavitha1)
otherReverse versions order in migration guide ( @nmengin)
securityUpdate vulnerability submission guidelines ( @emilevauge)
fix[middleware] Bump github.com/klauspost/compress v1.18.4 and fix TestNegotiation ( @thaJeztah)
other[docker] Fix docker-compose.yaml location in Docker setup page ( @ScottA38)
other[docker, consul, ecs, k8s] Fix documentation on how to restrict the scope of service discovery ( @mloiseleur)
feature[k8s/ingress-nginx] Add OVHcloud (OpenStack Octavia) to Cloud-Specific IP Management ( @antonin-a)
other[k8s/ingress-nginx] Clarify IngressClass selection logic ( @kevinpollet)
featureAdd missing redirects for Getting started ( @nmengin)
featureAdd redirects for deleted pages ( @sheddy-traefik)
fixFix default value of http.sanitizePath ( @iTob191)
securityCVE-2026-33433 (Advisory GHSA-qr99-7898-vr7c)
securityCVE-2026-33186 (Advisory GHSA-46wh-3698-f2cx)
fix[k8s/ingress-nginx] Fix auth-response-headers whitespace trimming in ingress-nginx provider ( @mmatur)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.33.0 ( @ldez)
fix[server] Fix comment and unnecessary allocation in withRoutingPath ( @boinger)
fix[server, tcp] Fix postgres STARTTLS with TLS termination ( @mmatur)
fix[api] Fix allow colons and tildes in api.basePath validation ( @mmatur)
fix[grpc] Bump google.golang.org/grpc to v1.79.3 ( @mmatur)
fix[middleware, authentication] Prevent duplicate user headers in basic and digest auth middleware ( @juliens)
fix[middleware] Fix StripPrefix and StripPrefixRegex to slice the prefix using encoded prefix length ( @gndz07)
other[acme] Clarify CNAME explanation in ACME Documentation ( @sheddy-traefik)
feature[k8s/ingress-nginx] Add ingress-nginx migration banner on documentation pages ( @gndz07)
other[k8s/ingress-nginx] Clarify that NGINX Ingress watchNamespace watches only one namespace ( @parkerfath)
other[k8s/ingress] Improve Kubernetes Ingress Routing Documentation ( @sheddy-traefik)
securityCVE-2026-32595 (Advisory GHSA-g3hg-j4jv-cwfr)
securityCVE-2026-32305 (Advisory GHSA-wvvq-wgcr-9q48)
securityCVE-2026-32695 (Advisory GHSA-67jx-r9pv-98rj)
fix[logs, otel] Add OTel-conformant trace context attributes to access logs ( @mmatur)
fix[k8s/gatewayapi] Fix incorrect hostname matching between listener and route ( @TheColorman)
fix[k8s/ingress] Fix ingress router's rule ( @gndz07)
fix[webui] Remove AGPL license in code ( @Desel72)
fix[k8s/ingress-nginx] Fix proxy-ssl-verify annotation ( @LBF38)
fix[http] Add maxResponseBodySize configuration on HTTP provider ( @gndz07)
fix[tls] Support fragmented TLS client hello ( @rtribotte)
fix[middleware, authentication] Make basic auth check timing constant ( @rtribotte)
security[k8s] Improve the multi tenant security note ( @nmengin)
fixFix unnecessary escaping of pipe in regexp examples ( @diegmonti)
securityAdd vulnerability submission quality guidelines ( @emilevauge)
fixFix start up message format ( @mloiseleur)
breakingRemove unsupported servers[n].address from TCP label examples ( @sheddy-traefik)
otherBump mkdocs-traefiklabs to use consent mode ( @darkweaver87)
securityCVE-2026-29777 (Advisory GHSA-8q2w-wr49-whqj)
securityCVE-2026-27141 (Advisory GHSA-4hjq-9h5c-252j)
fix[docker] Bump Docker and OpenTelemetry dependencies ( by mmatur)
fix[fastproxy] Bump github.com/valyala/fasthttp to v1.69.0 ( by kevinpollet)
fix[healthcheck, grpc] Remove path parsing with grpc healthcheck ( by rtribotte)
fix[k8s/gatewayapi] Fix Gateway API router's rules ( by rtribotte)
fix[middleware] Fix HasSecureHeadersDefined returning false when stsSeconds is 0 ( by veeceey)
fix[otel] Bump go.opentelemetry.io/otel dependencies ( by rtribotte)
fix[server] Bump golang.org/x/net to v0.51.0 ( by kevinpollet)
fix[webui] Fix priority display in dashboard and ACME bypass redirect ( by mmatur)
fix[webui] Fix basePath validation for dashboard template ( by gndz07)
other[middleware] Correct documentation for Digest auth ( by Zash)
featureAdd missing .http to TOML table names ( by Darsstar)
fixFix incorrect TOML example in entrypoints docs ( by mfmfuyu)
fixFix API basepath option documentation ( by nmengin)
securityCVE-2026-26998 (Advisory GHSA-fw45-f5q2-2p4x)
securityCVE-2026-26999 (Advisory GHSA-xw98-5q62-jx94)
securityCVE-2026-29054 (Advisory GHSA-92mv-8f8w-wq52)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.32.0 ( by ldez)
fix[middleware] Fix case sensitivity on x-forwarded headers for Connection ( by LBF38)
fix[middleware, authentication] Handle empty/missing User-Agent header ( by a-stangl)
fix[middleware, authentication] Add maxResponseBodySize configuration to forwardAuth middleware ( by gndz07)
fix[server] Fix TLS handshake error handling ( by juliens)
other[docker] Update docker in-depth setup guide ( by mdevino)
other[k8s] Make labelSelector option casing more consistent ( by holysoles)
feature[k8s/ingress-nginx] Add temporary note to advertise the incoming NGINX annotations ( by nmengin)
otherIncreased content width in documentation ( by tobiasge)
otherCorrect encoded characters allowance in entrypoints.md ( by Apflkuacha)
securityCVE-2026-25949 (Advisory GHSA-89p3-4642-cr2w)
securityCVE-2025-68121 (Advisory GHSA-gv8r-9rw9-9697)
fix[acme] Remove invalid private key in log ( by juliens)
fix[acme] Alter TLS renewal period ( by LtHummus)
fix[healthcheck] Reject absolute URL in healthcheck path configuration ( by rtribotte)
fix[http3] Bump github.com/quic-go/quic-go to v0.59.0 ( by jnoordsij)
fix[metrics,tracing,accesslogs] Fix ObservabilityConfig SetDefaults ( by mmatur)
fix[server] Remove conn deadline after STARTTLS negociation ( by rtribotte)
fix[tls] Fix verifyServerCertMatchesURI function behavior ( by kevinpollet)
fix[tracing,otel] Use ParentBased sampler to respect parent span sampling decision ( by xe-leon)
fix[webui] Use url.Parse to validate X-Forwarded-Prefix value ( by kevinpollet)
fix[healthcheck] Validate healthcheck path configuration (#12642 by @rtribotte)
fix[tls, server] Cap TLS record length to RFC 8446 limit in ClientHello peeking (#12638 by @mmatur)
fix[service] Avoid recursion with services ( by juliens)
fix[webui] Bump dependencies of documentation and webui ( by gndz07)
other[k8s] Fix kubernetes.md with correct http redirections ( by MartenM)
fix[middleware,k8s/crd] Fix the errors middleware's document for Kubernetes CRD ( by yuito-it)
other[tls] Clarify SNI selection ( by AnuragEkkati)
fixFix typo on JWT documentation ( by mdevino)
featureAdd @gndz07 as a current maintainer ( by emilevauge)
breakingRemove extraneous dots in migration guide ( by dathbe)
otherDocument Path matcher placeholder removal in v3 migration guide ( by sheddy-traefik)
otherImprove Service Reference page ( by sheddy-traefik)
featureDocument negative priority support for routers ( by understood-the-assignment)
otherImprove the structure of the routing reference pages ( by sheddy-traefik)
otherClean Up Menu Entries & Update Expose Overview ( by sheddy-traefik)
featureSplit Expose User Guides & Add Multi-Layer Routing Section ( by sheddy-traefik)
breakingRemove extra dots in migration guide ( by rtribotte)
otherMerge v2.11 into v3.6 ( by mmatur)
otherMerge branch v2.11 into v3.6 ( by mmatur)
securitywarning: Breaking change :warning: As explained in the comment left on the CVE-2025-66490 fix, this new hotfix version makes the behavior opt-in. As a result, this release is breaking compared to the previous hotfix versions since v3.6.4, but it restores by default the behavior that existed before…
securityCVE-2026-22045 (Advisory GHSA-cwjm-3f7h-9hwqj)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.31.0 ( by ldez)
fix[acme] Add missing renew options ( by ldez)
fix[acme] Replace hardcoded references to LetsEncrypt in log messages ( by schildbach)
fix[k8s/ingress-nginx] Fix use-regex nginx annotation ( by LBF38)
fix[k8s/ingress-nginx] Prevent Ingress Nginx provider http router to attach to an entrypoint with TLS ( by rtribotte)
fix[k8s/ingress] Fix panic for empty defaultBackend and defaultBackend without resources ( by gndz07)
fix[k8s] Fix condition used for serving and fenced endpoints ( by LBF38)
fix[webui] Validate X-Forwarded-Prefix value for dashboard redirect ( by LBF38)
fix[acme] Add timeout to ACME-TLS/1 challenge handshake ( by LBF38)
fix[server] Make encoded character options opt-in ( by gndz07)
other[docker/swarm] Update swarm.md traefik version ( by DBouraoui)
other[k8s/ingress-nginx] Fix ingress-nginx annotations documentation ( by nmengin)
other[k8s] Fix Kubernetes reference yml file ( by mmatur)
fixFix code copy button positioning ( by AnuragEkkati)
fixFix typo in kubernetes.md ( by EdwardSalkeld)
securityBring back security section on API & Dashboard documentation page ( by gndz07)
fixFix link description in Traefik Proxy documentation ( by schaerfo)
featureAdd product comparison matrix and features page ( by sheddy-traefik)
otherMerge branch v2.11 into v3.6 ( by rtribotte)
otherMerge branch v2.11 into v3.6 ( by mmatur)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.30.1 ( by ldez)
fix[http3] Bump github.com/quic-go/quic-go to v0.58.0 ( by GreyXor)
fix[redis] Fix mutually exclusive verification for Redis ( by juliens)
fix[server] Fix deny encoded characters ( by rtribotte)
other[k8s/ingress,k8s] Fix Kubernetes Ingress provider documentation ( by nmengin)
feature[k8s/ingress-nginx] Add RBAC documentation for Ingress NGINX provider ( by nmn3m)
security[k8s] Improve the K8S multi-tenancy security note ( by nmengin)
otherRestore documentation on http.maxHeaderBytes ( by mloiseleur)
fixFix Menu Item Naming ( by sheddy-traefik)
otherMerge branch v2.11 into v3.6 ( by mmatur)
otherMerge branch v2.11 into v3.6 ( by kevinpollet)
fix[k8s/ingress-nginx] Fix NGINX sslredirect annotation support ( by rtribotte)
fix[server] Print access logs for rejected requests and warn about new behavior ( by kevinpollet)
feature[k8s/ingress-nginx] Add auth-signin to unsupported nginx annotations list ( by fibsifan)
breakingAdd a Breaking change note to the changelog ( by nmengin)
fixFix encodedCharacters entryPoint option documentation ( by rtribotte)
securityCVE-2025-66490 (Advisory GHSA-gm3x-23wp-hc2c): Breaking Change please read the migration guide.
securityCVE-2025-66491 (Advisory GHSA-7vww-mvcr-x6vj)
fix[server] Reject suspicious encoded characters ( by rtribotte)
fix[plugins] Validate plugin module name ( by kevinpollet)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.1 ( by GreyXor)
fix[http3] Bump github.com/quic-go/quic-go to v0.57.0 ( by GreyXor)
fix[server] Bump golang.org/x/crypto to v0.45.0 ( by kevinpollet)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.29.0 ( by ldez)
fix[k8s/ingress-nginx] Fix SSL redirect to match NGINX behavior ( by mmatur)
fix[k8s/ingress-nginx] Fix the service name for ingress-nginx provider ( by mmatur)
fix[k8s/ingress-nginx] Fix nginx.ingress.kubernetes.io/proxy-ssl-verify annotation support ( by rtribotte)
fix[middleware,authentication] Change ForwardAuth error log level from DEBUG to ERROR ( by murataslan1)
other[api] Fix typo in API dashboard configuration instructions ( by NAICOLAS)
feature[docker] Add documentation for loadbalancer.server.url in Docker and Swarm providers ( by webash)
other[k8s/gatewayapi] Fix links of Helm chart values reference to providers.kubernetesGateway.enabled ( by shouhei)
other[k8s/ingress-nginx] Fix default value of ingress-nginx provider in documentation ( by mloiseleur)
other[k8s/ingress-nginx] NGINX Ingress Controller to Traefik Migration Guide ( by sheddy-traefik)
other[k8s/ingress-nginx] Improve the configuration options display of the Kubernetes ingress-nginx provider ( by mloiseleur)
other[k8s/ingress-nginx] Improve ingress-nginx provider documentation ( by sheddy-traefik)
other[service] Fix loadbalancer doc for highest random weight ( by ozon2)
otherCorrectly Format the HTTP Service Documentation ( by sheddy-traefik)
featureAdd documentation about checkNewVersion ( by darkweaver87)
otherMerge branch v2.11 into v3.6 ( by kevinpollet)
otherMerge branch v2.11 into v3.6 ( by mmatur)
fix[k8s/ingress-nginx] Deprecate Kubernetes Ingress NGINX provider experimental flag ( by rtribotte)
fix[docker] Auto-negotiate Docker API Version ( by felixbuenemann)
fix[server] Fix multi-layer routing with models ( by juliens)
fix[udp] Revert "Avoid allocations in readLoop by using sync.Pool" ( by kevinpollet)
fix[webui] Fix blocked navigation on Safari ( by gndz07)
fix[webui] Restore remote Upgrade to Hub button web component ( by gndz07)
other[k8s] Fix Nginx provider documentation ( by nmengin)
other[k8s] Fix Gateway API version and the list of features supported ( by nmengin)
feature[acme] Add new certificatesresolvers options ( by ldez)
feature[consul,consulcatalog,nomad] Log provider namespace during startup ( by shreealt)
feature[docker] Allow discovering non-running Docker containers ( by acouvreur)
feature[ecs] AWS ECS IPv6 Support ( by wizbit)
feature[file,k8s/crd,service] Add least time load balancing strategy ( by sdelicata)
feature[healthcheck,tcp] Add TCP Healthcheck ( by ddtmachado)
feature[healthcheck] Add passive health checks ( by Nelwhix)
feature[k8s/crd] Add highest random weight in Kubernetes CRD ( by lbenguigui)
feature[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.4.0 ( by kevinpollet)
feature[k8s/ingress] Allow publishing services with type ExternalName ( by james-callahan)
feature[k8s] Add Knative provider ( by idurgakalyan)
feature[middleware,authentication] Add warning when maxBodySize is not set ( by kianelbo)
feature[middleware,server] Multi-layer routing ( by sdelicata)
feature[plugins] Support syscall ( by david-garcia-garcia)
feature[server] Implement HTTP2 HPACK table size options ( by GCHQDeveloper548)
feature[service,udp] Avoid allocations in readLoop by using sync.Pool ( by arturmelanchyk)
feature[service] Add HighestRandomWeight load balancing algorithm ( by mathieuHa)
feature[webui] Add Traefik Hub demo in dashboard ( by gndz07)
feature[webui] Reduce vertical padding in dashboard table rows for more compact layout ( by leccelecce)
fix[server] Make the aggregator compute provider namespace for router's parentRefs ( by rtribotte)
otherPrepare release v3.6.0-rc1 ( by kevinpollet)
fixFix broken link to migration guide on readme ( by 0slb)
fixFix broken links in TCP Service and HTTP Router documentation ( by sheddy-traefik)
fixFix typo in v3.6 migration guide ( by jnoordsij)
otherMerge branch v3.5 into master ( by rtribotte)
otherMerge branch v3.5 into master ( by kevinpollet)
otherMerge branch v3.5 into v3.6 ( by kevinpollet)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.28.0 ( by ldez)
fix[server] Filter unknown nodes with file and env for the deprecation loader ( by rtribotte)
feature[acme] Add missing ACME options and clean up table for more visibility ( by sheddy-traefik)
other[middleware] Fix default encodings in compress middleware ( by Belphemur)
otherUpdate Configuration Overview Page ( by sheddy-traefik)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.27.0 ( by ldez)
fix[acme] Bump github.com/go-acme/lego/v4 to v4.26.0 ( by ldez)
fix[http3] Bump github.com/quic-go/quic-go to v0.55.0 ( by GreyXor)
fix[kv] Bump github.com/kvtools/etcdv3 to v1.0.3 ( by kevinpollet)
fix[logs,metrics,tracing,accesslogs,otel] Fix otel not working without USER ( by mmatur)
fix[logs,otel] Enable stdout logging when OTLP is enabled ( by lbenguigui)
fix[metrics,otel] Rename traefik_tls_certs_not_after_milliseconds to traefik_tls_certs_not_after_seconds ( by shreealt)
fix[otel] Update OpenTelemetry to v1.38.0 and semantic conventions to v1.37.0 ( by rtribotte)
fix[otel] Do not fail when pod is not found in K8sAttributesDetector ( by xe-leon)
fix[tls] Make the staple updates continuous ( by rtribotte)
fix[webui] Fix version display regression ( by mdeliatf)
other[accesslogs] Fix link for accesslog.fields.names in documentation ( by rmbruntz)
other[acme] Fix Hetzner env var name inside documentation ( by ldez)
other[acme] Replace internal dead links ( by rtribotte)
other[acme] Clean and avoid collisions of anchors in option tables ( by rtribotte)
other[docker/swarm] Fix swarm code example ( by Dr4K4n)
other[healthcheck] Clarify health check requirement for server status metric ( by asafm)
other[k8s/crd] Fix typo in ingressroute.md from pirority to priority ( by miromichalicka)
fix[k8s] Fix incorrect option and lint page ( by sheddy-traefik)
feature[k8s] Add API basePath documentation and fix broken links ( by mloiseleur)
other[k8s] Merge TLSOption/TLSStore CRD documentation page ( by nmengin)
other[logs] Clarify log.filePath behavior in documentation ( by Alanxtl)
fix[metrics] Fix incorrect addInternals configuration option ( by shreealt)
other[middleware] Fix anchors in basic auth configuration options ( by homersimpsons)
other[middleware] Fix PreserveRequestMethod casing ( by LeTamanoir)
feature[middleware] Add missing reference docs for statusRewrites in errors middleware ( by sevensolutions)
other[middleware] Document rejectStatusCode ( by czocher)
other[otel] Align documentation on default otlp endpoint ( by mloiseleur)
other[otel] Fix metric name to metrics.otlp.grpc.insecure ( by germainlefebvre4)
feature[server,k8s/crd,k8s] Add dedicated pages for routers and fix doc links in CRDs ( by rtribotte)
other[tls] Fix typo in TLS certificate generation description ( by iraj-jelo)
fixFix wrong references to router's pages ( by rtribotte)
fixFix markdown rendering for table anchors ( by MaBauMeBad)
fixFix provider option descriptions ( by kevinpollet)
otherFormat HTTP headers as code ( by tyilo)
fixFix heading levels and add links ( by Granjow)
otherMerge branch v2.11 into v3.5 ( by kevinpollet)
otherMerge branch v2.11 into v3.5 ( by rtribotte)
fix[k8s/crd] ServersTransport: set minimum MaxIdleConnsPerHost=-1 ( by xe-leon)
fix[plugins] Refactor plugins system ( by jspdown)
fix[server] Use client conn to build the proxy protocol header ( by rtribotte)
fix[webui] Update hub-button-app to use a local script ( by mdeliatf)
other[acme,middleware] Fix broken links in documentation ( by mloiseleur)
other[k8s] Create Traefik Service CRD sub-resource documentation page ( by nmengin)
other[k8s] Fix conflict in IngressRouteTCP documentation ( by MatBon01)
fixFix typo in rules and priority documentation ( by Darkangeel-hd)
featureAdd govern section ( by sheddy-traefik)
fixFix entrypoint config examples ( by markormesher)
otherReorganize the menu entries ( by nmengin)
featureAdd New Secure Section to the Documentation ( by sheddy-traefik)
fix[middleware,accesslogs] Add GenericCLF log format for access logs ( by sdelicata)
fix[middleware] Fix customerrors query url replacement ( by DorianBlues)
fix[tls,service] Send proxy protocol header before TLS handshake ( by rtribotte)
fix[webui] Restore empty webui/static to use traefik as library ( by youkoulayley)
other[accesslogs] Fix path for access-logs header config ( by cgatt)
other[acme] Fixes typo for OCSP in CLI example ( by mloiseleur)
other[docker/swarm] Fixes typo for Swarm mode in CLI example ( by BilalBudhani)
other[kv] Fix broken links in KV store documentation ( by sheddy-traefik)
feature[middleware] Add redis options to ratelimit middleware & Include distributed rate limit middleware ( by sheddy-traefik)
other[server] Fix link to HTTP3 section in documentation ( by vincentbernat)
fixFix migration path in documentation ( by nmengin)