Update module github.com/caddyserver/caddy/v2 to v2.11.1#9
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
Update module github.com/caddyserver/caddy/v2 to v2.11.1#9renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.10.2→v2.11.1Release Notes
caddyserver/caddy (github.com/caddyserver/caddy/v2)
v2.11.1Compare Source
Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.
There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.
Special Sponsor Shoutout
Extra big thanks to our major sponsors:
They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!
Notable changes
SIGUSR1can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.log_appendcan now log request and response bodies, useful for debugging.Thank you to everyone who was involved this release!
CVE-2026-27590by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.CVE-2026-27589by @1seal - Cross-origin requests attempted withno-corsmode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)CVE-2026-27588by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.CVE-2026-27587by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.CVE-2026-27586by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.CVE-2026-27585by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.🚨 Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your
go.modfile. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses. (Then, turn Dependabot off.)What's Changed
blockto do nothing if nothing passed toimportby @BeeJay28 in #7206SIGUSR1if config never changed via admin by @francislavoie in #7258acme_dnsby @rightaditya in #7270keepalive_idleandkeepalive_countby @joshuamcbeth in #7298lumberjacktotimberjack, add time-rolling options by @aeris in #7244trusted_proxies_unixfor trusting unix socketX-Forwarded-*headers by @cseufert in #7265LeafFolderLoaderby @mohammed90 in #7327{http.request.body_base64}placeholder by @francislavoie in #7367aea342f) by @willnorris in #7397log_appendEarly option, Supports{http.response.body}by @francislavoie in #7368prealloclint fix by @francislavoie in #7430time/tzdataby @francislavoie in #7432observe_catchall_hostsoption by @mohammed90 in #7434Hostto{upstream_hostport}automatically if TLS by @francislavoie in #7454dnswithacme_dns(fix #7294) by @rightaditya in #7458maintenance_intervalandrenewal_window_ratioby @Amirhf1 in #7479ech.goby @francislavoie in #7487New Contributors
Full Changelog: caddyserver/caddy@v2.10.2...v2.11.1
v2.11.0Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.