This is a quick follow-up on top of 2.11.8, to fix a regression it introduced and a few more security issues, mostly in FastCGI. It contains only fixes backported from master, plus a couple of small additions. If you're on 2.11.8 and serve PHP, we recommend upgrading.

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

Highlights

• Fixed: PHP directory indexes (regression in 2.11.8). A request for a directory with a trailing slash, like /wp-admin/, was matched by the directory itself instead of its index.php, so it never reached PHP and usually got a 404. This broke WordPress admin pages and other apps that serve an index through a trailing-slash URL. A try_files pattern now only matches a directory when it ends in /. Thanks @dunglas! (#8352)
• Path matchers with placeholders now work as expected: placeholders like {env.FOO} are no longer lower-cased into {env.foo} before they're looked up, and their values are compared case-insensitively against the request path, like static patterns. Thanks @BenMacha! (#8343)
• New plain_time_format option for file_server browse: sets the time layout of plain-text directory listings (Accept: text/plain). Thanks @steffenbusch! (#8084)
• Fewer allocations in path cleaning, header rewriting and weighted_round_robin selection. Thanks @jvoisin! (#7842)
• For plugin authors: new httpcaddyfile.Helper.IsNamedRoute() tells a directive whether it's being parsed inside a named route. (#8354)

⚠️ Breaking changes

• Conflicting client_auth is now a Caddyfile error. When two site blocks share TLS connection policies for the same hostname but set different client_auth, the adapter used to keep the first one and silently drop the other, which could quietly remove a stricter mTLS requirement. (#8306)
• FastCGI requests that are ambiguous about which script they run get 400:
  • when the escaped path (which %-containing path matchers see) and the decoded path would select different scripts, e.g. /public/tool.php%2f..%2f..%2fadmin%2ftool.php (#8357)
  • on Windows, script paths with an 8.3 short name component (like ADMINI~1) or a : (NTFS alternate data streams) (#8356)
• FastCGI env values now take precedence over request headers, so a client can no longer override HTTP_* variables you set with env (see below). (#8358)

Security fixes

Thank you to everyone who reported responsibly and helped with patches:

• fastcgi: A client could override any HTTP_* variable set with the FastCGI transport's (or php_fastcgi's) env subdirective by sending a matching request header, for example choosing the user an application sees in HTTP_X_AUTH_USER. Configured values now win. Reported by @JebeenLee and @Camel4, fixed by @dunglas. (GHSA-q34h-28rj-5hjm, #8358)
• fastcgi: On Windows, NTFS 8.3 short names and alternate data streams could run a script that a path rule was meant to deny, completing the FastCGI fix from 2.11.8. Thanks @dunglas. (GHSA-9cr8-wmhh-39pm, #8356)
• fastcgi: Encoded slashes and dot segments could make a %-containing path matcher approve one script while another one runs. Thanks @dunglas. (#8357)
• fastcgi: Over HTTP/2, a host field sent next to :authority could make the application see a different host (HTTP_HOST) than the one Caddy routed the request to. Thanks @dunglas. (#8355)
• httpcaddyfile: A stricter client_auth could be silently dropped when merging TLS connection policies (see above). Thanks @sam-kota. (#8306)
• Updated go-jose to v4.1.6 for GHSA-mgcc-cww5-fp2q. (#8299)

⚠️ These security patches may be breaking if your application relies on the buggy behaviors.

🚨 Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your go.mod file. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses.

What's Changed

• caddyhttp: lower-case path patterns with placeholders at request time by @BenMacha in #8343
• httpcaddyfile: reject conflicting client_auth when merging TLS policies by @sam-kota in #8306
• build(deps): bump the actions-deps group across 1 directory with 10 updates by @dependabot[bot] in #8340
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 by @dependabot[bot] in #8299
• fileserver: make plain-text browse time format configurable by @steffenbusch in #8084
• fileserver: only match a dir when the pattern ends by / by @dunglas in #8352
• httpcaddyfile: add Helper.IsNamedRoute by @dunglas in #8354
• fastcgi: take HTTP_HOST from the routed host only by @dunglas in #8355
• fastcgi: reject Win 8.3 aliases and alt data streams paths by @dunglas in #8356
• caddyhttp: presize buffers in hot paths to reduce allocations by @jvoisin in #7842
• fastcgi: let configured env variables override request headers by @dunglas in #8358
• fastcgi: reject paths whose escaped form selects another script by @dunglas in #8357

Full Changelog: v2.11.8...v2.11.9

This patch release is a big batch of bug fixes and security hardening, plus a handful of small additions. This release is cut from our 2.11 maintenance branch: fixes are backported from master. We recommend upgrading, especially if you serve PHP or use {host} in file paths.

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

⚠️ Please read the breaking changes below before upgrading. Most of them reject configs or requests that never did what they looked like they did, so most setups won't notice.

Highlights

• Idle timeouts, round two. More fixes for the idle read/write timeouts introduced in 2.11.6:
  • Per-route timeouts now take precedence over the server-wide read_body_idle / write_idle, and nested timeouts use the innermost one. (#8121)
  • Over HTTP/2, a handler that paused reading the request body (like reverse_proxy uploading to a slow upstream) no longer loses the body and fails with 502. (#8125)
  • Deadlines set by handlers now act as a ceiling instead of being overridden, so things like Mercure's dispatch_timeout and FrankenPHP's request_body_timeout work again. Thanks @dunglas! (#8145, #8284)
  • HTTP/1.1 uploads that time out with a little body left no longer hang instead of sending the error response. Thanks @SiyXo511! (#8178)
• Binding privileged ports with fewer capabilities (Linux): If CAP_NET_BIND_SERVICE is permitted but not effective, Caddy raises it just for binding a privileged port. Packagers can use setcap cap_net_bind_service=+p instead of +ep, so Caddy still starts under --cap-drop ALL, OpenShift's restricted-v2, or systemd units with an empty CapabilityBoundingSet=. It also follows the kernel's ip_unprivileged_port_start instead of assuming 1024. (#8102, #8253)
• Small additions:
  • new log_level directive to set the access log level for matching requests, e.g. log_level @healthchecks DEBUG (#8201)
  • new {time.now.rfc3339} placeholder. Thanks @steadytao! (#8140)
  • new not matcher for TLS connection policies. Thanks @simonether! (#8138)
  • the tls matcher can be used in CEL expression matchers: tls(), tls('complete'), tls('early_data'). Thanks @stackedbyaradhya! (#8088)
• Reverse proxy:
  • headers you set yourself (like Strict-Transport-Security via header) are no longer lost when the upstream sends a 1xx response first, like 103 Early Hints (#8169)
  • request trailer values are forwarded, not just their names. Thanks @krishsinghhura! (#8246)
  • request-only expressions in lb_retry_match no longer retry successful responses (a regression since 2.11.3) (#8168)
  • dial errors through a forward proxy and to FastCGI backends are retried like other dial errors. Thanks @adarshxsh and @zemamba! (#8264, #8172)
  • weighted_round_robin no longer panics with fewer weights than upstreams, and no longer picks an unavailable upstream when there's only one weight; random_choose picks the least loaded host when all are busy (#8159, #8320, #8160)
  • with request_buffers / response_buffers unlimited, a body that fails partway is no longer treated as complete (#8207)
  • connections and sockets are no longer leaked when a protocol upgrade (e.g. WebSocket) fails during setup, or when a handle_response status isn't a number. Thanks @Version2beta and @BenMacha! (#8269, #8318)
  • HTTP/3 client cancellations are logged at debug level instead of as warnings. Thanks @larrasket! (#8135)
• encode: If-None-Match lists and weak tags get 304s properly (#8128), HEAD responses no longer get a bogus Content-Length (#8150), and Accept-Encoding / Cache-Control split across several header lines are all taken into account, with faster header handling in the proxy too. Thanks @Indra55, @jayhemnani9910 and @dunglas! (#8025)
• PHP / FastCGI: a Location response without a Status is now a 302 redirect, as CGI specifies (#8209), and an app that writes more than its declared Content-Length (like a PHP warning after the page) no longer corrupts HTTP/1.1 responses or kills HTTP/2 connections. Thanks @Sulaiman-Dauda! (#8212)
• TLS & ECH:
  • when Caddy rejects Encrypted ClientHello, it now sends retry configs, so clients with stale ECH configs can recover. Thanks @videah! (#8142)
  • an ECH public name that also has its own site block keeps that site's TLS settings (#8156)
  • client_auth modes request and verify_if_given no longer reject clients without a certificate when verifiers are configured (#8251)
  • a site block spanning several listener addresses no longer lets one listener's TLS connection policy (including client authentication) overwrite another's. Thanks @steadytao! (#8192)
  • repeated matcher lines in a TLS policy match block are all applied, not just the first. Thanks @simonether! (#8137)
  • merged automation policies keep a specific domain's policy ahead of a wildcard's (#8287), and an ACME issuer's network_proxy survives re-provisioning (#8288)
• Caddyfile:
  • caddy run prints the error again when startup fails, instead of silently exiting with code 1. Thanks @IndraGunawan! (#8180)
  • routes in a group that already matched no longer run their matchers, which fixes e.g. try_files {path} {path}.html?{query} =404 returning 404 for everything (#8189)
  • multiple handle_errors blocks and vars now follow Caddyfile order (#8195, #8197)
  • each ?Field default in a header block is checked on its own, and respects match (#8217)
  • import shows the real OS error for files it can't read (#8163), negative {args[...]} indices no longer panic (#8316), and very long heredoc markers no longer make parsing crawl (#8203, #8249)
• file_server: a path below a regular file (/index.php/foo) is a 404 again and works with pass_thru (#8131); browse handles symlinks in directories with escaped names (#8152) and offsets past the end (#8213)
• templates: template errors no longer keep stale Content-Length / Etag headers (#8149), bodyless responses no longer get Content-Length: 0 (which broke iOS PWAs) (#8153), plus fixes for humanize time layouts with colons and front matter closed with ... (#8215, #8259)
• Logging: include of a parent namespace includes its child modules (#8221), dir_mode from_file no longer creates unusable directories (#8225), and log routing to a site's logger ignores Host case (#8176)
• Admin API: with remote admin access_control, a request is allowed if any permission entry permits it, not just the first (#8317), and Cache-Control: must-revalidate is recognized alongside other directives (#8330)
• Other fixes: caddy hash-password handles Windows line endings and input without a final newline (#8227), a data race in the basic_auth cache is gone (#8278), the Windows service no longer gets stuck in START_PENDING (#8274), and uri strip_prefix / strip_suffix handle percent-escapes and literal % correctly (#8005, #8345)
• Release builds use Go 1.27 (Go 1.26 is still the minimum to build Caddy). (#8210)

⚠️ Breaking changes

• Requests with an invalid or dots-only host (like ..) are rejected with 400 on every protocol, before any route runs. Before, HTTP/2 and HTTP/3 also accepted hosts containing / or \. (#8328)
• request_body max_size now rejects a request with 413 as soon as its Content-Length is over the limit, even if nothing would have read the body. (#8337)
• php_fastcgi sites without an index.php: requests for paths that don't exist are now sent to PHP as index.php, as the documented first_exist_fallback try policy always promised, instead of falling through to file_server and returning 404. Also, PATH_INFO and DOCUMENT_URI are now derived from the normalized path (repeated slashes merged, . segments removed); REQUEST_URI is unchanged.
• A try_files / file candidate ending in / only matches a directory, so /foo.txt/ no longer matches the file /foo.txt. (#8326)
• encode now compresses responses even when the request has Cache-Control: no-transform (a response's no-transform is still honored), and responses that could have been encoded always get Vary: Accept-Encoding. To keep the old behavior: @transformable not header Cache-Control *no-transform* and encode @transformable. Malformed forms like no-cache; no-transform no longer disable compression. (#8301, #8025)
• Stricter config validation. Some configs that were silently accepted (and didn't do what you'd expect) are now errors:
  • more than one expression line in the same matcher set (combine them with &&) (#8183)
  • unknown TLS curves or protocol_min / protocol_max names, like TLS1.3 instead of tls1.3, which used to be silently ignored (#8266)
  • a repeated sni_regexp in a TLS policy match block (#8137)
  • ip_mask log filter sizes out of range, like 33 for IPv4 (#8241)
  • basic_auth usernames that end up identical after placeholder expansion (#8315)
  • ports longer than 11 characters ...

This patch release fixes regressions from 2.11.6, including a crash when proxying over HTTP/2 and streams that were cut off after a minute. If you're on 2.11.6, we recommend upgrading. It also adds support for the brand new Incremental header field (RFC 10036).

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

Highlights

• Fixed: crash and dropped streams caused by the new idle timeouts. 2.11.6 introduced default idle read/write timeouts, which caused some problems:

  • In 2.11.6, the request body's idle deadline could outlive the handler that set it:

    • Over HTTP/2, Caddy could panic with a nil pointer dereference when the reverse proxy was still reading a request body after the handler had returned. (#8101)
    • Over HTTP/1.1, streaming responses to requests with a body, such as SSE clients that open the stream with a POST, were cut off exactly 60 seconds after the body was read. (#8103)

    Both are fixed in #8107. Thanks @steadytao!

  • Over HTTP/2, streaming responses that paused between writes for longer than write_idle (1 minute by default), like quiet SSE streams, were reset with a stream error. As documented, only a write that stalls should count. Thanks @WeidiDeng! (#8118, #8119)

• Fixed: placeholders for missing cookies are empty again. Since 2.11.6, places that keep unknown placeholders as written, like respond headers, would output {http.request.cookie.*} literally when the cookie wasn't in the request. The same happened to {http.request.tls.*} on plain HTTP requests. Both are empty again. Thanks @steadytao! (#8019)

• New: support for the Incremental header field (RFC 10036). It's the standard replacement for NGINX's proprietary X-Accel-Buffering header. If an upstream response has Incremental: ?1, reverse_proxy forwards it immediately, the same as flush_interval -1, and encode streams it instead of holding it back. Great for Mercure, SSE and other streaming apps.

  • If the request_buffers or response_buffers options would prevent incremental forwarding, Caddy responds with 501 Not Implemented instead of silently buffering, as the RFC requires.
  • The new proxy_status_name option adds a Proxy-Status header to those responses, explaining why the message was refused.

  Thanks @dunglas! (#8020)

• Faster TLS handshakes: When nothing subscribes to certificate events and debug logging is off, CertMagic no longer builds event data for every handshake. Certificate lookup per handshake is about twice as fast, with 10 allocations instead of 15. Thanks @u5surf! (#8010)

• Unix sockets: When a reload moves a listener (or the admin endpoint) off a Unix socket, the old socket now closes right away and its file is removed. Before, clients connecting to the old path would hang until the next garbage collection, about 2 minutes later. Thanks @littfed! (#8061)

• Headers handler: Multiple Set-Cookie values in a JSON config's set are now sent as separate header fields, instead of being joined with commas into one field that clients can't parse. Thanks @Indra55! (#8080)

• caddy fmt no longer deletes an opening brace at the very end of the input. Thanks @n0liu! (#8047)

What's Changed

• events: tell CertMagic which events are worth emitting by @u5surf in #8010
• feat: implement the Incremental header field (RFC 10036) by @dunglas in #8020
• caddyfile: Keep an opening brace that ends the input by @n0liu in #8047
• listeners: close unix socket immediately and unlink file on reload by @littfed in #8061
• reverseproxy: stabilise half-close test by @steadytao in #8049
• caddyhttp: keep absent optional placeholders empty by @steadytao in #8019
• headers: Preserve separate Set-Cookie values by @Indra55 in #8080
• caddyhttp: end request-body deadline ownership with handler by @steadytao in #8107
• timeouts: fix idle writer terminate h2 response writers between writes by @WeidiDeng in #8119

New Contributors

• @n0liu made their first contribution in #8047
• @littfed made their first contribution in #8061

Full Changelog: v2.11.6...v2.11.7

This patch release contains a large number of minor and some noticeable enhancements and bug fixes. Thank you to everyone who contributed or spent their LLM tokens responsibly to help with this release!

We have much more in the pipeline still, as AI has made contributions of all quality levels cheap and easy. We will be trying to go through them as quickly and efficiently as we can.

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

⚠️ Please read the breaking changes below before upgrading. Most of them come from security hardening, and most configs won't notice. If you were relying on one of the old behaviors, though, you'll want to know about it.

Highlights

• New url_pattern request matcher: Match requests with the URLPattern standard, the same syntax used by browsers (JS) and many web frameworks. It supports named groups, wildcards, and regexp components. Captured groups become placeholders ({http.url_pattern.<component>.<group>}), and there's a matching url_pattern CEL function too. Thanks @dunglas! (#7787)
• Slowloris mitigation: New idle read/write timeouts reset on every successful read or write. A stalled connection gets cut off, and a slow one that's still making progress is left alone. You can also set optional minimum transfer rates, and there's a new timeouts handler directive for per-route tuning. (#7913)
• New tls_automate_names global option: Manage certificates for names without serving them in a site block. (#8015)
• New expected_underscore_headers server option: If dropping header fields with underscores in 2.11.4 broke your app, you can now list the specific headers to keep. (#7809)
• HTTP/3 over Tailscale and other low-MTU links now works, because the initial QUIC packet size is smaller. (#7886)
• Reverse proxy got more love:
  • partial responses are flushed to clients properly (#7849)
  • TCP half-close is propagated on upgraded streams (#8027)
  • versions 3 upstreams now honor tls_trust_pool (#8042)
  • active health check state is kept separate per check config, so one handler's failing probes don't mark the upstream down for everyone else (#7916)
  • the random_choose policy distributes correctly now (#7873)
• Server-sent events behind encode now stream immediately instead of being buffered. (#7905)
• Graceful shutdown now waits for servers left over from previous configs, so long-lived responses that started before a reload aren't cut off at exit. (#8009)
• Caddyfile: import now works inside named routes (#7986), and quoted braces are treated as literal arguments (#7875).
• Logging:
  • new set_cookie log filter (#7888)
  • roll_interval accepts days (d) (#7900)
  • recovered handler panics are logged at ERROR level (#7924)
  • write timeout errors show up in access logs (#7945)
• Performance: fewer allocations in request hot paths, encoding negotiation, and the reverse proxy, from @jvoisin and @dunglas. Directory browsing is much faster for large directories. (#7847, #7903, #7911, #7925, #7926, #7936)
• Other new stuff:
  • {http.request.proto_name} placeholder (#7782)
  • FastCGI populates SERVER_ADDR (#7912)
  • multiple authentication providers no longer clobber each other's responses (#7904)

⚠️ Breaking changes

• Go 1.26 is now the minimum version for building Caddy and plugins. (#8056)
• Request headers are limited to 16 KiB by default. Before, we used Go's 1 MB default. Requests with larger headers (giant cookies, oversized tokens, etc.) will now get 431 Request Header Fields Too Large. If you need more, raise it with the max_header_size server option.
• New 1-minute idle read/write timeouts by default. If a request body read or a response write stalls (makes no progress at all) for longer than that, the connection is aborted. Pauses between writes, like with SSE, don't count. Some long-lived streams where the client goes quiet mid-body may be affected. You can tune these with read_body_idle and write_idle in the timeouts server option, or per-route with the timeouts directive. (#7913)
• Request header fields containing . are now dropped, the same way underscores were in 2.11.4. PHP folds . to _, so these could be used to impersonate legitimate headers. If you need specific ones, allow them with the new expected_dot_headers server option.
• A wildcard site's client_auth no longer applies to more specific hostnames that have their own site blocks. For example, public.example.com no longer inherits mTLS from *.example.com. If you were counting on that inheritance, configure client_auth on the specific site explicitly. (#7920)
• Stricter config validation. Some configs that used to be silently accepted (and probably didn't do what you expected) are now errors:
  • duplicate named_routes (#7800)
  • duplicate forward_auth uri (#7814)
  • invalid weighted_round_robin weights (#7807)
  • a non-integer browse file_limit (#7988)
  • duplicate or ambiguous map inputs (#8067)
  • malformed map destination placeholders (#8074)
  • module paths with ambiguous @ version separators (#7974)
• Admin API /load now returns 400 with warnings inside a valid JSON body when a config is invalid. Before, it returned 200 with two concatenated JSON objects. (#7267)
• method matcher values are normalized to uppercase, so method get now matches GET requests. (#7832)

Security fixes

Thank you to everyone who reported responsibly and helped with patches:

• reverseproxy: When a route used both forward_auth and reverse_proxy, a request could be sent on the wrong upstream connection. Reported by @carlt, fixed by @WeidiDeng. (GHSA-6365-7ppr-5r92, #7859)
• reverseproxy: Hop-by-hop headers from upstreams are now stripped from 101 Switching Protocols responses too. Thanks @jirn073-76.
• caddyhttp: handle_path and uri strip_prefix/strip_suffix now canonicalize the resulting path, so it can't bypass path-based authorization. Thanks @steadytao.
• caddyhttp: Extended the 2.11.4 header-alias filter to . (see above) to prevent bypassing forward_auth copy_headers with PHP/FastCGI backends. Thanks @dunglas.
• caddyhttp: The path_regexp matcher now normalizes Windows backslashes like the path matcher does. This completes the fix for CVE-2026-52844. Thanks @thientd. (#7858)
• fileserver: Windows 8.3 short names are rejected in every path component, not just the last one. Thanks @DavidCarliez. (#7952)
• fileserver: Fixed ETag collisions between files with different modification times and sizes. Thanks @dunglas.
• fastcgi: The client's Proxy header is no longer passed to backends as HTTP_PROXY (HTTPoxy). Thanks @bzyy1024. (#7934)
• reverseproxy: Sticky session cookie hashes are compared in constant time. Thanks @alhudz. (#7853)
• admin: Request paths are normalized in the remote admin access check, and origin/host allow-lists compare case-insensitively (defense-in-depth). Thanks @AmariahAK, @mohammed90, and @hktitof. (#7910, #7973, #7993)
• caddyhttp: Oversized request bodies used through placeholders now correctly return 413. Thanks @hktitof. (#7969)

⚠️ These security patches may be breaking if your application relies on the buggy behaviors.

🚨 Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your go.mod file. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses. Note that doing so now also requires Go 1.26.

Thank you to everyone who was involved this release, especially our 40 new contributors! 🎉

What's Changed

• reverseproxy: replace placeholders specified for sni while using http3 by @WeidiDeng in #7737
• caddyhttp: add {http.request.proto_name} placeholder for spec-compliant protocol names by @Jualhosting in #7782
• httpcaddyfile: error on duplicate named_routes by @vijayvenkatj in #7800
• cmd: colored error message in WrapCommandFuncForCobra (#7760) by @u5surf in ht...

This release patches more security, security-adjacent, and normal bugs. The FrankenPHP project has collaborated on PHP-adjacent patches, which we are grateful for.

The recent surge of patches is mostly attributed to token predictors. We have had to reject more than 75% of "security" reports because they were AI slop spam (or just lazy/incorrect). Please use LLMs and agents wisely to avoid wasting precious maintainer resources. We have started blocking offending accounts that spam slop reports. Thank you to all who submit responsible reports following our security policy to make the project better. We appreciate that the community deems the Caddy project worthy of contribution to improve the broader ecosystem!

Security-related patches:

• caddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102)
• rewrite: Prevent placeholder re-expansion in injected query (thanks @WhiskerEnt)
• templates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @jmrcsnchz)
• caddyhttp: Ignore header fields with underscores to prevent collisions (thanks @Vincent550102 for the report and @dunglas for the patch)

⚠️ These security patches may be breaking if your application relies on the buggy behaviors.

There are also several other various fixes and enhancements by many other contributors. Thank you everyone who participated!

What's Changed

• reverseproxy: further prevent body closes from dial errors by @jameshartig in #7715
• caddytls: Fix client auth (fix #7724) by @mholt in #7727
• chore: deps upgrade by @mohammed90 in #7751
• caddyhttp: omit Last-Modified for unusable mod times by @bb4242 in #7740
• caddytls: fix TLS state races and ECH rotation retry by @broady in #7756
• chore: clean up wording and typo fixes by @steadytao in #7745
• reverseproxy: Add regression test for DialInfo network override by @eyupcanakman in #7758
• caddyauth: add candidate placeholders for rejected identities by @steadytao in #7698
• cmd: support caddy start on IPv6-only hosts by @steadytao in #7744
• caddyfile: preserve implicit TLS issuer semantics by @steadytao in #7743
• reverseproxy: wraps request body to prevent closing if not read by @WeidiDeng in #7719
• caddytls: match IDN SNI in connection policies by @steadytao in #7742
• build(deps): bump the all-updates group across 1 directory with 9 updates by @dependabot[bot] in #7752
• caddyhttp: normalize Windows backslashes in path matcher by @Vincent550102 in #7763
• go.mod: update x/net by @steadytao in #7767
• rewrite: prevent placeholder re-expansion in injected query by @WhiskerEnt in #7761
• perf(replacer): optimize memory allocation for file placeholders by @Jualhosting in #7773
• caddytls: skip idna.ToASCII for pure ASCII SNI values by @sleet0922 in #7770
• encode: prioritize zstd and br over gzip in content negotiation by @Jualhosting in #7772
• httpcaddyfile: fix incorrect error message on duplicate matchers by @Brunotlps in #7780
• Patch for GHSA-vcc4-2c75-vc9v by @jmrcsnchz in #7785

New Contributors

• @jameshartig made their first contribution in #7715
• @bb4242 made their first contribution in #7740
• @broady made their first contribution in #7756
• @eyupcanakman made their first contribution in #7758
• @Vincent550102 made their first contribution in #7763
• @WhiskerEnt made their first contribution in #7761
• @Jualhosting made their first contribution in #7773
• @sleet0922 made their first contribution in #7770
• @Brunotlps made their first contribution in #7780
• @jmrcsnchz made their first contribution in #7785

Full Changelog: v2.11.3...v2.11.4

This release improves several aspects of Caddy with minor features, bug fixes, and security patches. Thank you to everyone and their bots who contributed to help make this release the best one yet!

Security patches:

• fastcgi: Carrying over a patch from FrankenPHP for a bug that could allow non-PHP files to be executed; collaborated on by @dunglas, @KC1zs4, and @chenjj.
• vars: A more thorough fix for GHSA-m2w3-8f23-hxxf, collaborated by @everping and @vnxme.
• admin: Array index normalization to prevent remote admin socket auth bypass, by @Amemoyoi and bot.
• admin: More rigorous path prefix matching to prevent remote admin socket auth bypass, by @Amemoyoi and bot.

We've also merged a couple PRs that fix upstream security bugs in other projects like quic-go and CertMagic. Thank you to @marten-seemann for maintaining quic-go so diligently!

What's Changed

• caddyhttp: Sync placeholder expansion in vars and vars_regexp by @vnxme in #7573
• caddytls: Avoid ACME fallback for implicit Tailscale *.ts.net policies by @steadytao in #7577
• chore: Resolve recent CI failures by @mholt in #7593
• caddytls: Consolidate empty APs more smartly by @mholt in #7567
• rewrite: skip query rename when source key is absent by @steadytao in #7599
• root: introduce down-propagating Helper.BlockState for other directives/plugins to use by @henderkes in #7594
• http: make zstd checksum configurable by @ottenhoff in #7586
• notify: Always send "READY=1" even after an error by @francislavoie in #7597
• reverseproxy: Fix check for header_up Host {upstream_hostport} redundancy by @yubiuser in #7564
• caddytls: Expand placeholders in dns_challenge override_domain tls parameter by @pberkel in #7609
• tls: add system and combined CA pool modules by @HarshPatel5940 in #7406
• vars: Don't expand placeholders in values by @vnxme in #7629
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #7637
• build(deps): bump the all-updates group across 1 directory with 11 updates by @dependabot[bot] in #7641
• reverseproxy: make stream copy buffer size configurable by @steadytao in #7627
• vars: Add matcher placeholder handling tests by @steadytao in #7640
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #7621
• logging: Add journald encoder wrapper by @steadytao in #7623
• caddyfile: Improve import/global options UX for imports before global options by @steadytao in #7642
• chore: replace interface{} with any for modernization by @tsinglua in #7571
• chore: bump timberjack to v1.4.1 by @DeRuina in #7618
• logging: Preserve ts for journald-wrapped JSON logs by @steadytao in #7644
• fileserver: show symlink targets verbatim (#7476) by @maxtruxa in #7579
• fix(caddyfile): {block} in snippet by @prettysunflower in #7558
• caddyhttp: Document missing placeholders for escaped URI and prefixed query by @steffenbusch in #7659
• chore: add AGENTS.md by @mohammed90 in #7652
• build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.0 by @dependabot[bot] in #7655
• admin: Redact sensitive request headers in API logs by @steadytao in #7578
• reverseproxy: add lb_retry_match condition on response status by @seroperson in #7569
• caddyhttp: prefer port 443 in auto-HTTPS and add tests by @mholt in #7666
• fix: Propagate ECH keys to the QUIC listener by @steadytao in #7670
• chore: Use atomics where appropriate by @francislavoie in #7648
• metrics: Implement pushing via OLTP by @dunglas in #7664
• logging: Add regression coverage for rotated file mode by @steadytao in #7620
• httpcaddyfile: Inherit global ACME issuer settings in tls shortcuts by @steadytao in #7617
• build(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 by @dependabot[bot] in #7668
• admin: require path segment boundary in remote access control by @Amemoyoi in #7673
• reverseproxy: Add ability to clear dynamic upstreams cache during retries by @mholt in #7662
• listeners: clean up stale Unix socket files on Windows by @mfrischknecht in #7676
• admin: reject non-canonical config array indices by @Amemoyoi in #7592
• caddytls: Expand ACME credentials by @tribut in #7554
• caddyauth: set user placeholders before auth rejection by @cyphercodes in #7685
• caddyauth: revert user placeholders on auth rejection by @steadytao in #7688
• chore: Fix golangci-lint 2.12.1 findings by @steadytao in #7690
• httpcaddyfile: accept duration strings for log sampling interval by @tomholford in #7694
• tls: Add alpn to managed HTTPS records by @steadytao in #7653
• caddytls: avoid duplicate automation for wildcard-covered hosts by @Rijul-A in #7697
• docs: add documentation for fileExists and fileStat template functions by @steffenbusch in #7700
• rewrite: escape file matcher paths before rewriting by @cyphercodes in #7683
• metrics: Add nil check for metricsHandler in AdminMetrics.serveHTTP by @Br1an67 in #7553

New Contributors

• @steadytao made their first contribution in #7577
• @henderkes made their first contribution in #7594
• @yubiuser made their first contribution in #7564
• @pberkel made their first contribution in #7609
• @HarshPatel5940 made their first contribution in #7406
• @tsinglua made their first contribution in #7571
• @maxtruxa made their first contribution in #7579
• @seroperson made their first contribution in #7569
• @Amemoyoi made their first contribution in #7673
• @mfrischknecht made their first contribution in #7676
• @tribut made their first contribution in #7554
• @cyphercodes made their first contribution in #7685
• @tomholford made their first contribution in #7694
• @Rijul-A made their first contribution in #7697
• @Br1an67 made their first contribution in #7553

Full Changelog: v2.11.2...v2.11.3

Caddy 2.11.2 contains numerous bug fixes and enhancements! I know that's a lame summary but it's really all over the place.

Highlights

• Reverse proxy got a lot of love with certain edge cases related to PROXY protocol, health check port, and closing body on retries. Dynamic upstreams are now tracked which enables passive health checking.
• Performance improvements for metrics.
• New tls_resolvers global option to control DNS resolvers for all sites when using the ACME DNS challenge.
• Log rolling now supports zstd compression; deprecated roll_gzip, which will be removed in the future. Use roll_compression instead.
• Refined logging and some error messages.
• Fixed a bug in rewrite handler that could cause some URIs to not be rewritten when URI path is an escaped form of target path. Thanks to @MaherAzzouzi for the report.

Security fixes

This release fixes two CVEs.

• @NucleiAv reported a bug in the forward_auth directive that could permit identity injection and potential privilege escalation.
• @sammiee5311 reported that vars_regexp double-expanded placeholders, allowing some unusual configs to reveal secrets.

In addition:

• Built on Go 1.26.1 (also released today) which patches several CVEs.
• Our documentation has been updated to note that file system case sensitivity may affect the behavior of the hide option of the file_server handler.

Thank you to everyone who contributed, and for our ongoing sponsorships that make this development possible!

Changelog

• 88616e8 api: Add all in-flight requests /reverse_proxy/upstreams (Fixes #7277) (#7517)
• d935a69 autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)
• 5d20adc build(deps): bump github.com/smallstep/certificates (#7535)
• 9371ee6 build(deps): bump the actions-deps group across 1 directory with 12 updates (#7536)
• 9798f69 caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)
• dc36082 caddyhttp: Collect metrics once per route instead of per handler (#7492)
• 174fa2d caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)
• eac02ee caddyhttp: Limit empty Host check to HTTP/1.1
• f283062 cmd: Custom binary names through CustomBinaryName and CustomLongDescription (#7513)
• cd9e166 cmd: Pass configFile, not configFlag, for reload command (#7532)
• 7b34e31 core: Check whether @id is unique (#7002)
• 566e710 fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)
• 2dd3852 fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)
• 2dbcdef forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)
• ce203aa go.mod: Upgrade x/net
• 76b198f http: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)
• 7ffb640 httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) (#7507)
• 45cf61b logging: Ensure slog error level logs don't print stack traces (#7512)
• 9873752 logging: Support zstd roll compression (#7515)
• 294dfff logging: add DirMode options and propagate FileMode to rotations (#7335)
• a6acb39 proxyproto: Generated test coverage (#7540)
• 11b56c6 reverseproxy: Fix health_port being ignored in health checks (#7533)
• db29860 reverseproxy: Track dynamic upstreams, enable passive healthchecking (#7539)
• d7b21c6 reverseproxy: fix tls dialing w/ proxy protocol (#7508)
• a5e7c6e reverseproxy: prevent body close on dial-error retries (#7547)
• 2ab043b reverseproxy: query escape request urls when proxy protocol is enabled (#7537)
• fbfb8fc rewrite: Force recomputing path when escaped path matches rewrite target
• f145bce tls: Add tls_resolvers global option for DNS challenge configuration (#7297)

Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.

There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.

Special Sponsor Shoutout

Extra big thanks to our major sponsors:

• ZeroSSL
• Stripe
• Railway

They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!

Notable changes

• Encrypted ClientHello (ECH) keys are rotated automatically.
• Time-rolling options for logs.
• SIGUSR1 can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.
• Reverse proxy now automatically rewrites the Host header to the address of the upstream when the upstream is HTTPS (#7454)
• log_append can now log request and response bodies, useful for debugging.
• Our project now implements and requires Assistance Disclosures (for AI/LLMs) on issues, PRs, comments, replies, reviews, etc.
• Many, many other minor improvements and bug fixes.

Thank you to everyone who was involved this release!

⚠️ Security patches

• fastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
• admin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)
• caddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.
• caddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.
• caddytls: CVE-2026-27586 by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.
• caddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.

🚨 Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your go.mod file. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses. (Then, turn Dependabot off.)

What's Changed

• caddyhttp: add replacer placeholders for escaped values by @Qusic in #7181
• AI assistance disclosure by @mholt in #7212
• caddyfile: Prevent trailing space on line before env variable - Fixes #6881 by @arpansaha13 in #7215
• add: encode header Content-Type graphql-response by @aro-lew in #7214
• caddyhttp: Removing redundant middleware next copy by @maxcelant in #7217
• build(deps): bump the all-updates group with 17 updates by @dependabot[bot] in #7236
• build(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in #7237
• encode: fix response corruption when handle_errors is used by @Siomachkin in #7235
• Fix PKI creation when auto_https is disabled (#7211) by @Siomachkin in #7238
• logging: Buffer the logs before config is loaded by @francislavoie in #7245
• fileserver: set Content-Length for precompressed files by @WeidiDeng in #7251
• refactor: use WaitGroup.Go to simplify code by @mickychang9 in #7253
• caddyfile: Allow block to do nothing if nothing passed to import by @BeeJay28 in #7206
• logging: Adjustments to BufferedLog to keep logs in the correct order by @francislavoie in #7257
• caddyhttp: Prevent commas in header values from being split in CLI commands by @gilbsgilbs in #7268
• update quic-go to v0.54.1 by @marten-seemann in #7273
• chore: ugh, lint fix... by @mohammed90 in #7275
• caddypki: check intermediate lifetime to actual root cert lifetime by @u5surf in #7272
• refactor: omit unnecessary reassignment by @asttool in #7276
• core: use reflect.TypeFor to check for encoding/json.RawMessage by @WeidiDeng in #7274
• core: Reloading with SIGUSR1 if config never changed via admin by @francislavoie in #7258
• build(deps): bump the actions-deps group with 8 updates by @dependabot[bot] in #7284
• httpcaddyfile: Add missing DNS challenge check for acme_dns by @rightaditya in #7270
• httpcaddyfile: Map default_bind to BindHost in globalACMEDefaults by @Monviech in #7278
• Argon2id Support for Basic Auth by @GreyXor in #7186
• update quic-go to v0.55.0 by @marten-seemann in #7288
• reverse_proxy: use http1 for outbound tls requests with placeholder t… by @WeidiDeng in #7296
• caddyhttp: Add server options keepalive_idle and keepalive_count by @joshuamcbeth in #7298
• chore: fix some comments by @wyrapeseed in #7303
• logging: Switch from lumberjack to timberjack, add time-rolling options by @aeris in #7244
• reverseproxy: Use http1.1 upgrade for websocket for extended connect of http2 and http3. by @tonyb486 in #7305
• caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers by @cseufert in #7265
• caddyhttp: wrap accepted connection to suppress tls.ConnectionState by @WeidiDeng in #7247
• logging: fix multiple regexp filters on same field (fixes #7049) by @S2010 in #7061
• intercept: use already buffered response if possible when intercepting by @WeidiDeng in #7028
• listeners: Add support for named socket activation by @Siomachkin in #7243
• reverseproxy: do not disable keepalive if proxy protocol is used by @WeidiDeng in #7300
• metrics: resolve per-host inifinite cardinality by @mohammed90 in #7306
• reverseproxy: use http.Protocols to handle h2c requests by @WeidiDeng in #6990
• refactor: use reflect.TypeFor by @wyrapeseed in #7313
• build(deps): bump the all-updates group across 1 directory with 2 updates by @dependabot[bot] in #7307
• build(deps): bump github.com/slackhq/nebula from 1.9.5 to 1.9.7 by @dependabot[bot] in #7315
• feat: switch to autoexport for OpenTelemetry span exporter by @PKeidel in #7317
• reverse_proxy: set default values for keepalive if only some of them are set by @WeidiDeng in #7318
• fix quote within quotes formatted incorrectly by fmt by @keystroke3 in #7045
• caddytls: correct documentation of LeafFolderLoader by @mohammed90 in #7327
• fix golangci-lint error G602 in caddyhttp by @cdenicola in #7334
• feat: allow customizing the Server header by @dunglas in #7338
• update quic-go to v0.56.0, enable qlog for HTTP/3 by @marten-seemann in #7345
• build(deps): bump the all-updates group with 4 updates by @dependabot[bot] in #7333
• feat: custom slog handlers for modules (log contextual data) by @dunglas in #7346
• ci: implement new release flow by @mohammed90 in #7341
• reverse_proxy: use interfaces to modify the behaviors of the transports by @WeidiDeng in #7353
• build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in #7355
• update quic-go to v0.57.0 by @marten-seemann in #7359
• refactor: replace HasSuffix+TrimSuffix with CutSuffix by @ledigang in #7357
• Fix retries for requests with bodies by @chebyrash in #7360
• ...

Welcome to the second beta version of 2.11. We are closer to a final release. This includes some minor new features and enhancements, and a fix for the ZeroSSL API issuer.

Thank you to everyone who contributed!

Changelog

• 8a87bb3 build(deps): bump github.com/smallstep/certificates (#7381)
• 7b031e1 build(deps): bump the all-updates group across 1 directory with 12 updates (#7421)
• be5f49f caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true (#7372)
• 6e0cbd0 caddyhttp: create a placeholder for and log ech status (#7328)
• 4037d05 caddyhttp: {http.request.body_base64} placeholder (#7367)
• 7ebe72b caddypki: Add support for multiple intermediates in signing chain (#7057)
• 3c9c67e caddytls: ECH key rotation (#7356)
• 374b7a6 caddytls: fix preferred chains options by appending values instead of replacing (#7387)
• 6a4296b caddytls: panic when using tls.ca_pool.source.http -> tls.ca (#7393)
• 9eabd44 cmd: Add --json flag to list-modules command (#7409)
• b2d21f6 go.mod: Upgrade CertMagic and ZeroSSL deps
• 34fd2df go.mod: update tscert package to latest (aea342f6) (#7397)
• decc8a4 logging: log_append Early option, Supports {http.response.body} (#7368)
• 409a072 notify: implement windows service status and error notifications (#7389)
• 1f1be3f tracing: Add span attributes to tracing module (#7269)

What's Changed

• build(deps): bump github.com/smallstep/certificates from 0.28.4 to 0.29.0 by @dependabot[bot] in #7381
• caddypki: Add support for multiple intermediates in signing chain by @hslatman in #7057
• caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true by @francislavoie in #7372
• multiplexing: Introduce packet conn wrappers by @vnxme in #7180
• docs: add maybe template function documentation by @steffenbusch in #7388
• caddyhttp: create a placeholder for and log ech status by @WeidiDeng in #7328
• caddytls: fix preferred chains options by appending values instead of replacing by @okrc in #7387
• feat: mark Assert* functions as test helpers by @dunglas in #7380
• caddytls: ECH key rotation by @mholt in #7356
• caddytls: panic when using tls.ca_pool.source.http -> tls.ca by @Zenexer in #7393
• notify: implement windows service status and error notifications by @FreyreCorona in #7389
• caddyhttp: {http.request.body_base64} placeholder by @francislavoie in #7367
• chore: update tscert package to latest (aea342f6) by @willnorris in #7397
• logging: log_append Early option, Supports {http.response.body} by @francislavoie in #7368
• update quic-go to v0.58.0 by @marten-seemann in #7404
• cmd: add --json flag to list-modules by @pauloappbr in #7409
• Add span attributes to tracing module by @felix-hilden in #7269
• readme: fix fence by @mohammed90 in #7416
• build(deps): bump the all-updates group across 1 directory with 12 updates by @dependabot[bot] in #7421

New Contributors

• @okrc made their first contribution in #7387
• @Zenexer made their first contribution in #7393
• @FreyreCorona made their first contribution in #7389
• @pauloappbr made their first contribution in #7409
• @felix-hilden made their first contribution in #7269

Full Changelog: v2.11.0-beta.1...v2.11.0-beta.2

Welcome to the beta version of 2.11. This is the first release made by our new, automated release process developed by @mohammed90 that was carried out and approved entirely by our maintainer team (together with @francislavoie) without intervention from @mholt, the original Caddy author. This represents a significant step forward in project autonomy and growth, ensuring that the project's stability and longevity is not reliant upon a single person.

This first beta release was primarily to test our new workflow, so there's still a couple things left to do before the stable release.

Featured here are numerous, mostly minor, bug fixes and enhancements, mostly affecting edge cases or niche corners of the software; for example, proxying H2C or HTTP/3, obscure Caddyfile scenarios, and named socket activation.

Some notable changes:

• SIGUSR1 can be used to reload configuration only if it was loaded from a file using the CLI, and not changed by the API since then.
• We replaced "lumberjack", our logging library, with a fork "timberjack" that supports the oft-requested time-rolling ability.
• Caddy can now bind listeners with named socket activation.

Before the final release, we expect ECH key rotation to be enabled as well as a few other patches/features

Thank you to our sponsors and contributors for all that you do!

Changelog

• 5473eb9 encode: fix response corruption when handle_errors is used (#7235)
• 13a4ec7 basicauth: Implement argon2id (#7186)
• 6d90c77 build(deps): bump github.com/slackhq/nebula from 1.9.5 to 1.9.7 (#7315)
• eead249 build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#7355)
• 2d0f3f8 build(deps): bump the actions-deps group with 5 updates (#7237)
• afbdcec build(deps): bump the actions-deps group with 8 updates (#7284)
• cd1c203 build(deps): bump the all-updates group across 1 directory with 2 updates (#7307)
• 39357d3 build(deps): bump the all-updates group with 17 updates (#7236)
• 786d537 build(deps): bump the all-updates group with 3 updates (#7376)
• 07d2aaf build(deps): bump the all-updates group with 4 updates (#7333)
• 0ba8786 caddyfile: Allow block to do nothing if nothing passed to import (#7206)
• 92c8bc7 caddyfile: fix nested quotes formatted incorrectly by fmt (#7045)
• 6d73d85 caddyfile: prevent adding trailing space on line before env variable (#7215)
• d7185fd caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers (#7265)
• de6b780 caddyhttp: Add server options keepalive_idle and keepalive_count (#7298)
• e0a8f95 caddyhttp: Normalize (lowercase) {label.N} placeholders
• 5e29536 caddyhttp: add replacer placeholders for escaped values (#7181)
• 8285eba caddyhttp: allow customizing the Server header (#7338)
• bc0e184 caddyhttp: omit unnecessary reassignment (#7276)
• 3553cfb caddyhttp: remove redundant middleware next copy (#7217)
• 1ce2a13 caddyhttp: wrap accepted connection to suppress tls.ConnectionState (#7247)
• d9cc24f caddypki: Disable internal auto-CA when auto_https is disabled (fix #7211) (#7238)
• 1e82f96 caddypki: check intermediate lifetime to actual root cert lifetime (#7272)
• 38848f7 caddytls: Allow disabling distributed solving (except http-01)
• ddec183 caddytls: correct documentation of LeafFolderLoader (#7327)
• f5c3094 cmd: prevent commas in header values from being split (#7268)
• 65e0ddc core: Reloading with SIGUSR1 if config never changed via admin (#7258)
• b3f2db2 core: custom slog handlers for modules (log contextual data) (#7346)
• b2ab419 core: use reflect.TypeFor to check for encoding/json.RawMessage (#7274)
• 806fef8 encode: add graphql-response header to list (#7214)
• 2cb4267 encode: modernize, replace HasSuffix+TrimSuffix with CutSuffix (#7357)
• b462615 fileserver: set Content-Length for precompressed files (#7251)
• 0c8798f go.mod: update quic-go to v0.54.1 (#7273)
• 3c003de httpcaddyfile: Add missing DNS challenge check for acme_dns (#7270)
• 2f1d270 httpcaddyfile: Map default_bind to BindHost in globalACMEDefaults (#7278)
• a7885aa intercept: use already buffered response if possible when intercepting (#7028)
• 156ce99 listeners: Add support for named socket activation (#7243)
• 39ace45 logging: Adjustments to BufferedLog to keep logs in the correct order (#7257)
• 012b4b3 logging: Buffer the logs before config is loaded (#7245)
• 10ac7da logging: Switch from lumberjack to timberjack, add time-rolling options (#7244)
• f5f25d8 logging: fix multiple regexp filters on same field (fixes #7049) (#7061)
• 595aab8 metrics: resolve per-host inifinite cardinality (#7306)
• 57587ed refactor: use reflect.TypeFor (#7313)
• 2ec28bc reverse_proxy: use http1 for outbound tls requests with placeholder that are likely websockets (#7296)
• a6da1ac reverse_proxy: use interfaces to modify the behaviors of the transports (#7353)
• 67a9e06 reverseproxy: Fix retries for requests with bodies (#7360)
• 7fb39ec reverseproxy: Use http1.1 upgrade for websocket for extended connect of http2 and http3 (#7305)
• 8aca108 reverseproxy: do not disable keepalive if proxy protocol is used (#7300)
• abe0aca reverseproxy: set default values for keepalive if only some of them are set (#7318)
• 1e21b66 reverseproxy: use http.Protocols to handle h2c requests (#6990)
• b54e870 tracing: switch to autoexport for OpenTelemetry span exporter (#7317)

What's Changed

• caddyhttp: add replacer placeholders for escaped values by @Qusic in #7181
• AI assistance disclosure by @mholt in #7212
• caddyfile: Prevent trailing space on line before env variable - Fixes #6881 by @arpansaha13 in #7215
• add: encode header Content-Type graphql-response by @aro-lew in #7214
• caddyhttp: Removing redundant middleware next copy by @maxcelant in #7217
• build(deps): bump the all-updates group with 17 updates by @dependabot[bot] in #7236
• build(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in #7237
• encode: fix response corruption when handle_errors is used by @Siomachkin in #7235
• Fix PKI creation when auto_https is disabled (#7211) by @Siomachkin in #7238
• logging: Buffer the logs before config is loaded by @francislavoie in #7245
• fileserver: set Content-Length for precompressed files by @WeidiDeng in #7251
• refactor: use WaitGroup.Go to simplify code by @mickychang9 in #7253
• caddyfile: Allow block to do nothing if nothing passed to import by @BeeJay28 in #7206
• logging: Adjustments to BufferedLog to keep logs in the correct order by @francislavoie in #7257
• caddyhttp: Prevent commas in header values from being split in CLI commands by @gilbsgilbs in #7268
• update quic-go to v0.54.1 by @marten-seemann in #7273
• chore: ugh, lint fix... by @mohammed90 in #7275
• caddypki: check intermediate lifetime to actual root cert lifetime by @u5surf in #7272
• refactor: omit unnecessary reassignment by @asttool in #7276
• core: use reflect.TypeFor to check for encoding/json.RawMessage by @WeidiDeng in #7274
• core: Reloading with SIGUSR1 if config never changed via admin by @francislavoie in #7258
• build(deps): bump the actions-deps group with 8 updates by @dependabot[bot] in #7284
• httpcaddyfile: Add missing DNS challenge check for acme_dns b...