Update dependency caddyserver/caddy to v2.11.4#276
Merged
Conversation
jupblb
approved these changes
Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.9.1→v2.11.4Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
caddyserver/caddy (caddyserver/caddy)
v2.11.4Compare Source
This release patches more security, security-adjacent, and normal bugs. The FrankenPHP project has collaborated on PHP-adjacent patches, which we are grateful for.
The recent surge of patches is mostly attributed to token predictors. We have had to reject more than 75% of "security" reports because they were AI slop spam (or just lazy/incorrect). Please use LLMs and agents wisely to avoid wasting precious maintainer resources. We have started blocking offending accounts that spam slop reports. Thank you to all who submit responsible reports following our security policy to make the project better. We appreciate that the community deems the Caddy project worthy of contribution to improve the broader ecosystem!
Security-related patches:
stripHTMLaction to more reliably remove malformed HTML (thanks to @jmrcsnchz)There are also several other various fixes and enhancements by many other contributors. Thank you everyone who participated!
What's Changed
New Contributors
Full Changelog: caddyserver/caddy@v2.11.3...v2.11.4
v2.11.3Compare Source
This release improves several aspects of Caddy with minor features, bug fixes, and security patches. Thank you to everyone and their bots who contributed to help make this release the best one yet!
Security patches:
We've also merged a couple PRs that fix upstream security bugs in other projects like quic-go and CertMagic. Thank you to @marten-seemann for maintaining quic-go so diligently!
What's Changed
varsandvars_regexpby @vnxme in #7573header_up Host {upstream_hostport}redundancy by @yubiuser in #7564interface{}withanyfor modernization by @tsinglua in #7571AGENTS.mdby @mohammed90 in #7652lb_retry_matchcondition on response status by @seroperson in #7569New Contributors
Full Changelog: caddyserver/caddy@v2.11.2...v2.11.3
v2.11.2Compare Source
Caddy 2.11.2 contains numerous bug fixes and enhancements! I know that's a lame summary but it's really all over the place.
Highlights
tls_resolversglobal option to control DNS resolvers for all sites when using the ACME DNS challenge.zstdcompression; deprecatedroll_gzip, which will be removed in the future. Useroll_compressioninstead.Security fixes
This release fixes two CVEs.
forward_authdirective that could permit identity injection and potential privilege escalation.vars_regexpdouble-expanded placeholders, allowing some unusual configs to reveal secrets.In addition:
hideoption of thefile_serverhandler.Thank you to everyone who contributed, and for our ongoing sponsorships that make this development possible!
Changelog
88616e8api: Add all in-flight requests /reverse_proxy/upstreams (Fixes #7277) (#7517)d935a69autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)5d20adcbuild(deps): bump github.com/smallstep/certificates (#7535)9371ee6build(deps): bump the actions-deps group across 1 directory with 12 updates (#7536)9798f69caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)dc36082caddyhttp: Collect metrics once per route instead of per handler (#7492)174fa2dcaddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)eac02eecaddyhttp: Limit empty Host check to HTTP/1.1f283062cmd: Custom binary names throughCustomBinaryNameandCustomLongDescription(#7513)cd9e166cmd: Pass configFile, not configFlag, for reload command (#7532)7b34e31core: Check whether @id is unique (#7002)566e710fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)2dd3852fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)2dbcdefforward_auth:copy_headersdoes not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)ce203aago.mod: Upgrade x/net76b198fhttp: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)7ffb640httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) (#7507)45cf61blogging: Ensureslogerror level logs don't print stack traces (#7512)9873752logging: Supportzstdroll compression (#7515)294dffflogging: add DirMode options and propagate FileMode to rotations (#7335)a6acb39proxyproto: Generated test coverage (#7540)11b56c6reverseproxy: Fixhealth_portbeing ignored in health checks (#7533)db29860reverseproxy: Track dynamic upstreams, enable passive healthchecking (#7539)d7b21c6reverseproxy: fix tls dialing w/ proxy protocol (#7508)a5e7c6ereverseproxy: prevent body close on dial-error retries (#7547)2ab043breverseproxy: query escape request urls when proxy protocol is enabled (#7537)fbfb8fcrewrite: Force recomputing path when escaped path matches rewrite targetf145bcetls: Addtls_resolversglobal option for DNS challenge configuration (#7297)v2.11.1Compare Source
Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.
There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.
Special Sponsor Shoutout
Extra big thanks to our major sponsors:
They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!
Notable changes
SIGUSR1can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.log_appendcan now log request and response bodies, useful for debugging.Thank you to everyone who was involved this release!
CVE-2026-27590by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.CVE-2026-27589by @1seal - Cross-origin requests attempted withno-corsmode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)CVE-2026-27588by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.CVE-2026-27587by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.CVE-2026-27586by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.CVE-2026-27585by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.🚨 Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your
go.modfile. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses. (Then, turn Dependabot off.)What's Changed
blockto do nothing if nothing passed toimportby @BeeJay28 in #7206SIGUSR1if config never changed via admin by @francislavoie in #7258acme_dnsby @rightaditya in #7270keepalive_idleandkeepalive_countby @joshuamcbeth in #7298lumberjacktotimberjack, add time-rolling options by @aeris in #7244trusted_proxies_unixfor trusting unix socketX-Forwarded-*headers by @cseufert in #7265LeafFolderLoaderby @mohammed90 in #7327{http.request.body_base64}placeholder by @francislavoie in #7367aea342f) by @willnorris in #7397log_appendEarly option, Supports{http.response.body}by @francislavoie in #7368prealloclint fix by @francislavoie in #7430time/tzdataby @francislavoie in #7432observe_catchall_hostsoption by @mohammed90 in #7434Hostto{upstream_hostport}automatically if TLS by @francislavoie in #7454dnswithacme_dns(fix #7294) by @rightaditya in #7458maintenance_intervalandrenewal_window_ratioby @Amirhf1 in #7479ech.goby @francislavoie in #7487New Contributors
Configuration
📅 Schedule: (UTC)
* * 1 */3 *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.