Traefik 3.7.14 → 3.7.18
4 releases · 1 breaking change · 6 security fixes · 5 advisories fixed
6security1breaking0deprecated2feature47fix
Vulnerabilities fixed by this upgrade
- 7.5 GHSA-xv5x-242w-7hf7 Per-connection backend transport leak from unauthenticated Negotiate/NTLM headers (3.7.14+)
- 7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
- 2.1 GHSA-28hp-c82p-8vqj Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
- 8.2 GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
- 7.0 GHSA-p8wx-ph99-xgcr ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
Breaking changes
- breaking Remove redundant period in README ( @mxmrnn) in 3.7.15
Security changes
- security [security] Point security announcements to GitHub advisories ( @nmengin) in 3.7.17
- security Advisory GHSA-hrpp-p4fc-wwf8 in 3.7.16
- security Advisory GHSA-p8wx-ph99-xgcr in 3.7.15
- security Advisory GHSA-ww7c-q3mv-xx22 in 3.7.15
- security Advisory GHSA-28hp-c82p-8vqj in 3.7.15
- security [security] Fix typo in the Request Path page ( @SethFalco) in 3.7.15
Every release in between
fix[authentication] Limit BasicAuth password length ( @Neffi42)
fix[authentication] Support connection-bound authentication schemes in Proxy-Authorization ( @Neffi42)
fix[k8s/ingress-nginx] Apply host-less auth-tls annotations to the default TLS option ( @rtribotte)
fix[k8s/ingress-nginx] Apply Ingress NGINX CORS before the redirect annotations ( @lazerg)
fix[k8s/ingress-nginx] Fix Ssl-Client-* headers when Ingresses share a host ( @Neffi42)
fix[k8s/knative] Bump knative.dev/pkg to v0.0.0-20261102011501-7b6dcbbe4ea4 ( @kevinpollet)
fix[middleware] Accept uppercase Q weight in compress Accept-Encoding parsing ( @locker95)
fix[middleware] Bump github.com/vulcand/oxy to v2.3.2 ( @ldez)
fix[middleware, performance] Limit zstd encoder memory in the Compress middleware ( @juliens)
fix[plugins] Fix deterministic randomness in WASM plugins ( @yugfletcher)
fix[plugins] Bump github.com/traefik/yaegi to v0.16.3 ( @juliens)
fix[server] Validate HTTP Host matcher values ( @Milad93R)
fix[server] Resolve dot-segments and empty segments with path parameters ( @Neffi42)
fix[server, grpc] Add regression test for gRPC bidirectional streams ( @ozenyunus35)
fix[service] Fix SPIFFE configuration for the TCP servers transport ( @simpleqt)
fix[tcp] Detect TCP connection reset on read when the error is wrapped ( @noakky)
other[k8s/ingress-nginx] List missing ingress-nginx annotations as unsupported ( @lazerg)
other[middleware] Use a Secret for basicAuth in the Chain middleware Kubernetes example ( @lazerg)
other[middleware] Fix grammar in observability and InFlightReq pages ( @m-shahi)
other[plugins] Fix typos in plugin type error and documentation ( @sarankumar1325)
featureAdd version to the dot-segments migration note ( @kevinpollet)
fixFix Docker Hub link in README ( @GUOZIJAN)
fixFix broken anchors in providers overview, SPIFFE and v3 migration docs ( @SatvikMishra08)
fixFix dead and redirecting external links ( @rachana5)
otherMove AI assistance disclosure to the pull request description ( @Neffi42)
otherUpdate download and GitHub star counts ( @tomatokoolaid)
fix[acme] Bump github.com/go-acme/lego/v5 to v5.6.0 ( @ldez)
fix[acme] Bump github.com/go-jose/go-jose/v4 to v4.1.6 ( @Mheaus)
fix[http3] Bump github.com/quic-go/quic-go to v0.64.1 ( @janpachol)
fix[k8s/gatewayapi] Preserve Gateway status conditions owned by other controllers ( @Neffi42)
fix[k8s/ingress-nginx] Avoid generated name collisions across namespaces in the ingress-nginx provider ( @Neffi42)
fix[logs, k8s/gatewayapi] Lower user configuration error logs to debug ( @rtribotte)
fix[middleware] Bump github.com/andybalholm/brotli to v1.2.7 ( @albe2669)
fix[middleware] Fix broken flush, hijack, and deadlines in wrapped ResponseWriters ( @Neffi42)
fix[middleware, authentication, k8s/crd, k8s, k8s/ingress-nginx] Resolve secret references when building middlewares ( @sdelicata)
fix[server] Add an entry point option to limit the number of request header values ( @juliens)
fix[server] Add global default for aliasHeadersStrategy ( @nikolas-sapa)
fix[server] Bump golang.org/x/net to v0.62.0 ( @kevinpollet)
fix[server] Fix backend connection leak for NTLM and Kerberos authentication ( @juliens)
fix[server, fastproxy] Fix FastProxy backend connection leak for NTLM and Kerberos ( @juliens)
other[docker] Update Docker Basic guide to use Traefik v3.7 ( @Saku0512)
security[security] Point security announcements to GitHub advisories ( @nmengin)
securityAdvisory GHSA-hrpp-p4fc-wwf8
fix[authentication, service, k8s/ingress-nginx] Support NTLM and Kerberos in ForwardAuth and ingress-nginx auth-url ( @juliens)
fix[authentication, service] Support NTLM and Kerberos authentication in ForwardAuth ( @juliens)
fix[k8s/gatewayapi] Fix Gateway API conformance suite setup with the containerd image store ( @Neffi42)
other[k8s/ingress-nginx] Document that rewrite is supported in configuration-snippet ( @bingtang9)
securityAdvisory GHSA-p8wx-ph99-xgcr
securityAdvisory GHSA-ww7c-q3mv-xx22
securityAdvisory GHSA-28hp-c82p-8vqj
fix[server] Reject CONNECT requests regardless of HTTP version ( @juliens)
fix[server] Reject CONNECT method before reaching the muxer ( @juliens)
fix[k8s/crd] Allow observability metadata on child routers ( @bunnysayzz)
fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.3 ( @rtribotte)
fix[k8s/gatewayapi] Default HTTPRoute backend scheme to HTTP when no appProtocol ( @Tyagiquamar)
fix[k8s/ingress-nginx] Apply auth-tls client authentication to the whole host ( @juliens)
fix[k8s/ingress-nginx] Fix cross-namespace check on shared auth-tls-secret TLS options ( @juliens)
fix[fastproxy] Add a non-regression test for CR/LF in FastProxy request headers ( @mturac)
fix[fastproxy] Fix concurrent buffer reads on upgraded connections ( @juliens)
fixBump golang.org/x/net to v0.60.0 ( @kevinpollet)
security[security] Fix typo in the Request Path page ( @SethFalco)
other[k8s/crd] Fix broken Kubernetes CRD definitions links in CRD reference pages ( @SatvikMishra08)
other[k8s] Document the safeNaming impact on cross-provider references ( @lazerg)
other[k8s/gatewayapi] Fix broken links in the Gateway API routing page ( @Neffi42)
fixFix broken anchor links to Restrict the Scope of Service Discovery ( @SatvikMishra08)
featureAdd the documentation style guide to the Contributing section ( @rachana5)
breakingRemove redundant period in README ( @mxmrnn)