Caddy: baixar versions anteriors

This patch release fixes regressions from 2.11.6, including a crash when proxying over HTTP/2 and streams that were cut off after a minute. If you're on 2.11.6, we recommend upgrading. It also adds support for the brand new Incremental header field (RFC 10036).
Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.
Highlights
- Fixed: crash and dropped streams caused by the new idle timeouts. 2.11.6 introduced default idle read/write timeouts, which caused some problems:
- In 2.11.6, the request body's idle deadline could outlive the handler that set it:
- Over HTTP/2, Caddy could panic with a nil pointer dereference when the reverse proxy was still reading a request body after the handler had returned. (#8101)
- Over HTTP/1.1, streaming responses to requests with a body, such as SSE clients that open the stream with a POST, were cut off exactly 60 seconds after the body was read. (#8103)
Both are fixed in #8107. Thanks @steadytao!
- Over HTTP/2, streaming responses that paused between writes for longer than write_idle (1 minute by default), like quiet SSE streams, were reset with a stream error. As documented, only a write that stalls should count. Thanks @WeidiDeng! (#8118, #8119)
- Fixed: placeholders for missing cookies are empty again. Since 2.11.6, places that keep unknown placeholders as written, like respond headers, would output {http.request.cookie.*} literally when the cookie wasn't in the request. The same happened to {http.request.tls.*} on plain HTTP requests. Both are empty again. Thanks @steadytao! (#8019)
- New: support for the Incremental header field (RFC 10036). It's the standard replacement for NGINX's proprietary X-Accel-Buffering header. If an upstream response has Incremental: ?1, reverse_proxy forwards it immediately, the same as flush_interval -1, and encode streams it instead of holding it back. Great for Mercure, SSE and other streaming apps.
- If the request_buffers or response_buffers options would prevent incremental forwarding, Caddy responds with 501 Not Implemented instead of silently buffering, as the RFC requires.
- The new proxy_status_name option adds a Proxy-Status header to those responses, explaining why the message was refused.
Thanks @dunglas! (#8020)
- Faster TLS handshakes: When nothing subscribes to certificate events and debug logging is off, CertMagic no longer builds event data for every handshake. Certificate lookup per handshake is about twice as fast, with 10 allocations instead of 15. Thanks @u5surf! (#8010)
- Unix sockets: When a reload moves a listener (or the admin endpoint) off a Unix socket, the old socket now closes right away and its file is removed. Before, clients connecting to the old path would hang until the next garbage collection, about 2 minutes later. Thanks @littfed! (#8061)
- Headers handler: Multiple Set-Cookie values in a JSON config's set are now sent as separate header fields, instead of being joined with commas into one field that clients can't parse. Thanks @Indra55! (#8080)
- caddy fmt no longer deletes an opening brace at the very end of the input. Thanks @n0liu! (#8047)

What's Changed
- events: tell CertMagic which events are worth emitting by @u5surf in #8010
- feat: implement the Incremental header field (RFC 10036) by @dunglas in #8020
- caddyfile: Keep an opening brace that ends the input by @n0liu in #8047
- listeners: close unix socket immediately and unlink file on reload by @littfed in #8061
- reverseproxy: stabilise half-close test by @steadytao in #8049
- caddyhttp: keep absent optional placeholders empty by @steadytao in #8019
- headers: Preserve separate Set-Cookie values by @Indra55 in #8080
- caddyhttp: end request-body deadline ownership with handler by @steadytao in #8107
- timeouts: fix idle writer terminate h2 response writers between writes by @WeidiDeng in #8119

New Contributors
- @n0liu made their first contributio

This patch release contains a large number of minor and some noticeable enhancements and bug fixes. Thank you to everyone who contributed or spent their LLM tokens responsibly to help with this release!
We have much more in the pipeline still, as AI has made contributions of all quality levels cheap and easy. We will be trying to go through them as quickly and efficiently as we can.
Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.
What's Changed
- reverseproxy: replace placeholders specified for sni while using http3 by @WeidiDeng in #7737
- caddyhttp: add {http.request.proto_name} placeholder for spec-compliant protocol names by @Jualhosting in #7782
- httpcaddyfile: error on duplicate named_routes by @vijayvenkatj in #7800
- cmd: colored error message in WrapCommandFuncForCobra (#7760) by @u5surf in #7768
- chore: add missing "is" in SECURITY.md by @AliMickey in #7802
- reverseproxy: validate on weighted_round_robin loadbalancing policy by @vijayvenkatj in #7807
- forwardauth: error on duplicate uri subdirective by @vijayvenkatj in #7814
- encode: add standard benchmark and conformance harness by @ottenhoff in #7804
- caddyhttp: restore allow_underscore_in_headers server option by @bluegate-studio in #7809
- rewrite: fix wrong index check in trimPathPrefix by @alhudz in #7812
- intercept: fix replace_status being silently dropped by @oksusucha in #7810
- fileserver: append repeated hide subdirectives instead of overwriting by @luccinmasirika in #7817
- rewrite: scope keyed query replace to its named key by @alhudz in #7818
- reverseproxy: log status 499 instead of 0 when client disconnects by @larrasket in #7827
- tracing: fix BatchSpanProcessor goroutine leak on config reload by @Dean2026 in #7826
- caddyhttp: normalize method names to uppercase in MatchMethod.Provision by @yintaisha in #7832
- caddyhttp: add URL pattern request matcher by @dunglas in #7787
- caddyhttp: fix escaped path matcher over-matching longer paths by @alhudz in #7828
- core: preserve metrics registry in Context.WithValue by @dunglas in #7861
- reverseproxy: compare sticky-session cookie hash in constant time by @alhudz in #7853
- reverseproxy: fix misleading handle_response error for extra matcher args by @TowyTowy in #7869
- reverseproxy: save dial info in a context key instead of a variable k… by @WeidiDeng in #7859
- caddyhttp: fix path_regexp (MatchPathRE) Windows backslash bypass by @thientd in #7858
- intercept: fix misleading handle_response error for extra matcher args by @TowyTowy in #7871
- build(deps): bump cel-go from v0.28.1 to v0.29.2 by @techknowlogick in #7872
- reverseproxy: fix broken reservoir sampling in random_choose policy by @TowyTowy in #7873
- caddyfile: treat quoted braces as literal arguments by @elee1766 in #7875
- logging: hash query parameter values in QueryFilter by @PichuChen in #7884
- chore: fix sabotage spelling in nolint comments by @futurehua in #7892
- pki: Handle error immediately after reading root from disk by @hslatman in #7896
- log: support d (day) in roll_interval directive by @mohammed90 in #7900
- deps: update GitHub Actions and Go modules by @steadytao in #7876
- build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 by @dependabot[bot] in #7908
- core: reduce QUIC initial packet size for low-MTU paths by @Salynn in #7886
- rewrite: preserve non-canonical path encoding after uri replace by @larrasket in #7907
- caddyhttp: use canonical header key casing to avoid re-canonicalization by @dunglas in #7911
- caddyconfig: Register nested named-route invokes transitively by @SillyZir in #7898
- encode: reduce allocations in AcceptedEncodings by @jvoisin in #7847
- encode: flush headers immediately for server-sent events responses by @SillyZir in #7905
- fileserver: speed up directory browsing for large directories by @firefart in #7903
- caddyauth: isolate provider responses to preven

This release patches more security, security-adjacent, and normal bugs. The FrankenPHP project has collaborated on PHP-adjacent patches, which we are grateful for.
The recent surge of patches is mostly attributed to token predictors. We have had to reject more than 75% of "security" reports because they were AI slop spam (or just lazy/incorrect). Please use LLMs and agents wisely to avoid wasting precious maintainer resources. We have started blocking offending accounts that spam slop reports. Thank you to all who submit responsible reports following our security policy to make the project better. We appreciate that the community deems the Caddy project worthy of contribution to improve the broader ecosystem!
Security-related patches:
- caddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102)
- rewrite: Prevent placeholder re-expansion in injected query (thanks @WhiskerEnt)
- templates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @jmrcsnchz)
- caddyhttp: Ignore header fields with underscores to prevent collisions (thanks @Vincent550102 for the report and @dunglas for the patch)
There are also several other various fixes and enhancements by many other contributors. Thank you everyone who participated!
What's Changed
- reverseproxy: further prevent body closes from dial errors by @jameshartig in #7715
- caddytls: Fix client auth (fix #7724) by @mholt in #7727
- chore: deps upgrade by @mohammed90 in #7751
- caddyhttp: omit Last-Modified for unusable mod times by @bb4242 in #7740
- caddytls: fix TLS state races and ECH rotation retry by @broady in #7756
- chore: clean up wording and typo fixes by @steadytao in #7745
- reverseproxy: Add regression test for DialInfo network override by @eyupcanakman in #7758
- caddyauth: add candidate placeholders for rejected identities by @steadytao in #7698
- cmd: support caddy start on IPv6-only hosts by @steadytao in #7744
- caddyfile: preserve implicit TLS issuer semantics by @steadytao in #7743
- reverseproxy: wraps request body to prevent closing if not read by @WeidiDeng in #7719
- caddytls: match IDN SNI in connection policies by @steadytao in #7742
- build(deps): bump the all-updates group across 1 directory with 9 updates by @dependabot[bot] in #7752
- caddyhttp: normalize Windows backslashes in path matcher by @Vincent550102 in #7763
- go.mod: update x/net by @steadytao in #7767
- rewrite: prevent placeholder re-expansion in injected query by @WhiskerEnt in #7761
- perf(replacer): optimize memory allocation for file placeholders by @Jualhosting in #7773
- caddytls: skip idna.ToASCII for pure ASCII SNI values by @sleet0922 in #7770
- encode: prioritize zstd and br over gzip in content negotiation by @Jualhosting in #7772
- httpcaddyfile: fix incorrect error message on duplicate matchers by @Brunotlps in #7780
- Patch for GHSA-vcc4-2c75-vc9v by @jmrcsnchz in #7785

New Contributors
- @jameshartig made their first contribution in #7715
- @bb4242 made their first contribution in #7740
- @broady made their first contribution in #7756
- @eyupcanakman made their first contribution in #7758
- @Vincent550102 made their first contribution in #7763
- @WhiskerEnt made their first contribution in #7761
- @Jualhosting made their first contribution in #7773
- @sleet0922 made their first contribution in #7770
- @Brunotlps made their first contribution in #7780
- @jmrcsnchz made their first contribution in #7785

This release improves several aspects of Caddy with minor features, bug fixes, and security patches. Thank you to everyone and their bots who contributed to help make this release the best one yet!
Security patches:
- fastcgi: Carrying over a patch from FrankenPHP for a bug that could allow non-PHP files to be executed; collaborated on by @dunglas, @KC1zs4, and @chenjj.
- vars: A more thorough fix for GHSA-m2w3-8f23-hxxf, collaborated by @everping and @vnxme.
- admin: Array index normalization to prevent remote admin socket auth bypass, by @Amemoyoi and bot.
- admin: More rigorous path prefix matching to prevent remote admin socket auth bypass, by @Amemoyoi and bot.
We've also merged a couple PRs that fix upstream security bugs in other projects like quic-go and CertMagic. Thank you to @marten-seemann for maintaining quic-go so diligently!
What's Changed
- caddyhttp: Sync placeholder expansion in vars and vars_regexp by @vnxme in #7573
- caddytls: Avoid ACME fallback for implicit Tailscale *.ts.net policies by @steadytao in #7577
- chore: Resolve recent CI failures by @mholt in #7593
- caddytls: Consolidate empty APs more smartly by @mholt in #7567
- rewrite: skip query rename when source key is absent by @steadytao in #7599
- root: introduce down-propagating Helper.BlockState for other directives/plugins to use by @henderkes in #7594
- http: make zstd checksum configurable by @ottenhoff in #7586
- notify: Always send "READY=1" even after an error by @francislavoie in #7597
- reverseproxy: Fix check for header_up Host {upstream_hostport} redundancy by @yubiuser in #7564
- caddytls: Expand placeholders in dns_challenge override_domain tls parameter by @pberkel in #7609
- tls: add system and combined CA pool modules by @HarshPatel5940 in #7406
- vars: Don't expand placeholders in values by @vnxme in #7629
- build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #7637
- build(deps): bump the all-updates group across 1 directory with 11 updates by @dependabot[bot] in #7641
- reverseproxy: make stream copy buffer size configurable by @steadytao in #7627
- vars: Add matcher placeholder handling tests by @steadytao in #7640
- build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #7621
- logging: Add journald encoder wrapper by @steadytao in #7623
- caddyfile: Improve import/global options UX for imports before global options by @steadytao in #7642
- chore: replace interface{} with any for modernization by @tsinglua in #7571
- chore: bump timberjack to v1.4.1 by @DeRuina in #7618
- logging: Preserve ts for journald-wrapped JSON logs by @steadytao in #7644
- fileserver: show symlink targets verbatim (#7476) by @maxtruxa in #7579
- fix(caddyfile): {block} in snippet by @prettysunflower in #7558
- caddyhttp: Document missing placeholders for escaped URI and prefixed query by @steffenbusch in #7659
- chore: add AGENTS.md by @mohammed90 in #7652
- build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.0 by @dependabot[bot] in #7655
- admin: Redact sensitive request headers in API logs by @steadytao in #7578
- reverseproxy: add lb_retry_match condition on response status by @seroperson in #7569
- caddyhttp: prefer port 443 in auto-HTTPS and add tests by @mholt in #7666
- fix: Propagate ECH keys to the QUIC listener by @steadytao in #7670
- chore: Use atomics where appropriate by @francislavoie in #7648
- metrics: Implement pushing via OLTP by @dunglas in #7664
- logging: Add regression coverage for rotated file mode by @steadytao in #7620
- httpcaddyfile: Inherit global ACME issuer settings in tls shortcuts by @steadytao in #7617
- build(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 by @dependabot[bot] in #7668
- admin: require path segment boundary in remote access control by @Amemoyoi in #7673
- reverseproxy: Add ability to clear dynamic upstreams cache during retries by @mholt in #7662
- listeners: clean up stale 

Caddy 2.11.2 contains numerous bug fixes and enhancements! I know that's a lame summary but it's really all over the place.
Highlights
- Reverse proxy got a lot of love with certain edge cases related to PROXY protocol, health check port, and closing body on retries. Dynamic upstreams are now tracked which enables passive health checking.
- Performance improvements for metrics.
- New tls_resolvers global option to control DNS resolvers for all sites when using the ACME DNS challenge.
- Log rolling now supports zstd compression; deprecated roll_gzip, which will be removed in the future. Use roll_compression instead.
- Refined logging and some error messages.
- Fixed a bug in rewrite handler that could cause some URIs to not be rewritten when URI path is an escaped form of target path. Thanks to @MaherAzzouzi for the report.
Security fixes
This release fixes two CVEs.
- @NucleiAv reported a bug in the forward_auth directive that could permit identity injection and potential privilege escalation.
- @sammiee5311 reported that vars_regexp double-expanded placeholders, allowing some unusual configs to reveal secrets.
In addition:
- Built on Go 1.26.1 (also released today) which patches several CVEs.
- Our documentation has been updated to note that file system case sensitivity may affect the behavior of the hide option of the file_server handler.
Thank you to everyone who contributed, and for our ongoing sponsorships that make this development possible!
Changelog
- 88616e8 api: Add all in-flight requests /reverse_proxy/upstreams (Fixes #7277) (#7517)
- d935a69 autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)
- 5d20adc build(deps): bump github.com/smallstep/certificates (#7535)
- 9371ee6 build(deps): bump the actions-deps group across 1 directory with 12 updates (#7536)
- 9798f69 caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)
- dc36082 caddyhttp: Collect metrics once per route instead of per handler (#7492)
- 174fa2d caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)
- eac02ee caddyhttp: Limit empty Host check to HTTP/1.1
- f283062 cmd: Custom binary names through CustomBinaryName and CustomLongDescription (#7513)
- cd9e166 cmd: Pass configFile, not configFlag, for reload command (#7532)
- 7b34e31 core: Check whether @id is unique (#7002)
- 566e710 fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)
- 2dd3852 fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)
- 2dbcdef forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)
- ce203aa go.mod: Upgrade x/net
- 76b198f http: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)
- 7ffb640 httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) (#7507)
- 45cf61b logging: Ensure slog error level logs don't print stack traces (#7512)
- 9873752 logging: Support zstd roll compression (#7515)
- 294dfff logging: add DirMode options and propagate FileMode to rotations (#7335)
- a6acb39 proxyproto: Generated test coverage (#7540)
- 11b56c6 reverseproxy: Fix health_port being ignored in health checks (#7533)
- db29860 reverseproxy: Track dynamic upstreams, enable passive healthchecking (#7539)
- d7b21c6 reverseproxy: fix tls dialing w/ proxy protocol (#7508)
- a5e7c6e reverseproxy: prevent body close on dial-error retries (#7547)
- 2ab043b reverseproxy: query escape request urls when proxy protocol is enabled (#7537)
- fbfb8fc rewrite: Force recomputing path when escaped path matches rewrite target
- f145bce tls: Add tls_resolvers global option for DNS challenge configuration (#7297)

Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.
There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.
Special Sponsor Shoutout
Extra big thanks to our major sponsors:
- ZeroSSL
- Stripe
- Railway
They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!
Notable changes
- Encrypted ClientHello (ECH) keys are rotated automatically.
- Time-rolling options for logs.
- SIGUSR1 can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.
- Reverse proxy now automatically rewrites the Host header to the address of the upstream when the upstream is HTTPS (#7454)
- log_append can now log request and response bodies, useful for debugging.
- Our project now implements and requires Assistance Disclosures (for AI/LLMs) on issues, PRs, comments, replies, reviews, etc.
- Many, many other minor improvements and bug fixes.
Thank you to everyone who was involved this release!
⚠️ Security patches
- fastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
- admin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)
- caddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.
- caddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.
- caddytls: CVE-2026-27586 by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.
- caddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.
What's Changed
- caddyhttp: add replacer placeholders for escaped values by @Qusic in #7181
- AI assistance disclosure by @mholt in #7212
- caddyfile: Prevent trailing space on line before env variable - Fixes #6881 by @arpansaha13 in #7215
- add: encode header Content-Type graphql-response by @aro-lew in #7214
- caddyhttp: Removing redundant middleware next copy by @maxcelant in #7217
- build(deps): bump the all-updates group with 17 updates by @dependabot[bot] in #7236
- build(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in #7237
- encode: fix response corruption when handle_errors is used by @Siomachkin in #7235
- Fix PKI creation when auto_https is disabled (#7211) by @Siomachkin in #7238
- logging: Buffer the logs before config is loaded by @francislavoie in #7245
- fileserver: set Content-Length for precompressed files by @WeidiDeng in #7251
- refactor: use WaitGroup.Go to simplify code by @mickychang9 in #7253
- caddyfile: Allow block to do nothing if nothing passed to import by @BeeJay28 in #7206
- logging: Adjustments to BufferedLog to keep logs in the correct order by @francislavoie in #7257
- caddyhttp: Prevent commas in header values from being split in CLI commands by @gilbsgilbs in #7268
- update quic-go to v0.54.1 by @marten-seemann in #7273
- chore: ugh, lint fix... by @mohammed90 in #7275
- caddypki: check intermediate lifetime to actual root cert lifetime by @u5surf in #7272
- refactor: omit unnecessary reassignment by @asttool in #7276
- core: use reflect.TypeFor to check for encoding/json.RawMessage by @WeidiDeng in #7274
- core: Relo

This is a hotfix release to fix a couple critical issues from v2.10.1
What's Changed
- http: Make logger first, before TLS provisioning by @francislavoie in #7198
- httpcaddyfile: Fix acme_dns regression by @francislavoie in #7199
- caddyfile: Fix importing nested tokens for {block} by @BeeJay28 in #7189
Changelog
- 551f793 caddyfile: Fix importing nested tokens for {block} (#7189)
- 16fe83c http: Make logger first, before TLS provisioning (#7198)
- 4564261 httpcaddyfile: Fix acme_dns regression (#7199)
New Contributors
- @BeeJay28 made their first contribution in #7189
Full Changelog: v2.10.1...v2.10.2

This is probably our biggest patch release ever -- not that lots of things were broken, but there's lots of refinement happening thanks to broader adoption and contributions from many more people. Just look at the New Contributors below!
Anyway, this release does contain some bug fixes and dependency upgrades which we hope will serve you well. Let us know if there's any issues! And thank you to all who contributed, especially our reliable maintainer team!
What's Changed
- update quic-go to v0.51.0 by @marten-seemann in #6972
- forwardproxy: reference correct field name in LoadModule by @mohammed90 in #6978
- fix: Remove nil arg from zapslog.NewHandler call by @IndraGunawan in #6984
- fileserver: Add support for .avif image format by @steffenbusch in #6988
- reverseproxy: use DialTLSContext for TLS if servername has placeholder by @WeidiDeng in #6955
- admin: Make sure that any admin routers are provisioned when local/re… by @Compy in #6997
- log: default logger should respect {in,ex}clude by @mohammed90 in #6995
- Move local admin server replacement logic below data structure initia… by @Compy in #7004
- acme_server: fix policy parsing in caddyfile by @mohammed90 in #7006
- implement Unwrap for interceptedResponseHandler by @WeidiDeng in #7016
- fileserver: map invalid path errors to fs.ErrInvalid, and return 400 … by @Compy in #7017
- caddyhttp: fix route sort by comparing paths without wildcard if they don't shar… by @WeidiDeng in #7015
- refactor: use maps.Copy for cleaner map handling by @eveneast in #7009
- refactor: use slices.Contains to simplify code by @tongjicoder in #7039
- chore: upgrade .golangci.yml and workflow to v2 by @mohammed90 in #6924
- build(deps): bump golangci/golangci-lint-action from 6 to 8 by @dependabot[bot] in #7044
- fix: crash - null check on event origin by @suxatcode in #7047
- fix: prevent error handler from overriding sub handler matchers by @Hellio404 in #6999
- client_auth: wire up leaf verifier Caddyfile by @mohammed90 in #6772
- caddyfile: reject blocks in log_skip directive by @IwatsukaYura in #7056
- build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 by @dependabot[bot] in #7058
- cmd: fix Commands function not returning all registered commands by @hslatman in #7059
- ci: add dep review, OSSF scorecard actions by @mohammed90 in #7063
- ci: add {base,head}-ref to dep review check by @mohammed90 in #7064
- core: clean up new config if it failed to run by @WeidiDeng in #7068
- chore: apply security best practices for CI by @mohammed90 in #7066
- refactor: use the built-in max/min to simplify the code by @xiaoxiangirl in #7081
- [ADD] sort buttons in grid mode by @filipRatajczak in #7089
- update quic-go to v0.53.0 by @marten-seemann in #7094
- refactor: replace HasPrefix+TrimPrefix with CutPrefix by @gopherorg in #7095
- docs: fix some minor issues in the comments by @mountdisk in #7101
- httpcaddyfile: Validates TLS DNS challenge options by @francislavoie in #7099
- chore: fix struct name in comment by @bytetigers in #7114
- reverse proxy: validate versions in http transport by @WeidiDeng in #7112
- chore: fix function in comment by @bytesingsong in #7121
- Fix: Support placeholders in header replacement search patterns by @zongzewu23 in #7117
- fileserver: specify license for embedded JavaScript by @infertux in #7127
- fix dead link by @eeemmmmmm in #7136
- update quic-go to v0.54.0 by @marten-seemann in #7138
- chore: fix minor issue in comment by @pingshuijie in #7140
- refactor: use slices.Equal to simplify code by @minxinyi in #7141
- ci: reduce dependabot spam by @mohammed90 in #7078
- fix(provisioning): Context.App or Context.AppIfConfigured will return (val, nil) even if the app failed to provision or validate the first time by @alexandre-daubois in #7070
- build(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #7142
- Use KeepAliveConfig to pass keepalive_interval to listener's accepted sockets by @joshuamcbeth in #7151
- build(deps): bump t

Caddy 2.10 is here! Aside from bug fixes, this release features:
- Encrypted ClientHello (ECH): This new technology encrypts the last plaintext portion of a TLS connection: the ClientHello, which includes the domain name being connected to. The draft spec for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but nuanced capability; we highly recommend reading the ECH documentation on our website.
- Post-quantum (PQC) key exchange: Caddy now supports the standardized x25519mlkem768 cryptographic group by default.
- ACME profiles: ACME profiles are an experimental draft that allow you to choose properties of your certificates with more flexibility than traditional CSR methods. For example, Let's Encrypt will issue 6-day certificates under a certain profile. Caddy may eventually use that profile by default.
- Via header: The reverse proxy now sets a Via header instead of a duplicate Server header.
- Global DNS provider: You can now specify a default "global" DNS module to use instead of having to configure it locally in every part of your config that requires a DNS provider (for example, ACME DNS challenges, and ECH). This is the dns global option in the Caddyfile, or in JSON config, it's the dns parameter in the tls app configuration.
- Wildcards used by default: Previously, Caddy would obtain individual certificates for every domain in your config literally; now wildcards, if present, will be utilized for subdomains, rather than obtaining individual certificates. This change was motivated by the novel possibility for subdomain privacy afforded by ECH. It can be overridden with tls force_automate in the Caddyfile. The experimental auto_https prefer_wildcard option has been removed.
- libdns 1.0 APIs: Many of you use DNS provider modules to solve ACME DNS challenges or to enable dynamic DNS. They implement interfaces defined by libdns to get, set, append, and delete DNS records. After 5 years of production experience, including lessons learned with ECH, libdns APIs have been updated and 1.0 beta has been tagged. DNS provider packages will need to update their code to be compatible, which will help ensure stability and well-defined semantics for the future. Several packages have already updated or are in the process of updating (cloudflare, rfc2136, and desec to name a few).
- Global dns config: Now that several components of Caddy configuration may affect DNS records (ACME challenges, ECH publication, etc.), there is a new dns global option that can be used to specify your DNS provider config in a single place. This prevents repetition of credentials for servers where all the domains are managed by a single DNS provider.
Thank you to the many contributors who have helped to make this possible! 🎉 🥳 🍾
⚠️ While have traditionally supported the last 2 minor Go versions to accommodate some distribution / package manager policies, we now only support the latest minor Go version. The privacy and security benefits added in new Go versions (such as post-quantum cryptography) are worth making available to everyone as soon as possible, rather than holding back the entire user base or maintaining multiple code compilation configurations.
Encrypted ClientHello (ECH) details
(This is a brief overview. We recommend reading the full documentation.)
Typically, server names (domain names, or "SNI") are sent in the plaintext ClientHello when establishing TLS connections. With ECH, the true server name is encrypted (and wrapped) by an "outer" ClientHello which has a generic SNI of your choosing. With many sites on the same server sharing the same outer SNI, both clients and the server have more privacy related to domain names.
Caddy implements fully automated ECH, meaning that it generates (and soon, rotates), publishes, and serves ECH configurations simply by specifying a DNS provider, and the outer/public domain name to use.
Fully automated ECH requires a DNS module built into your Caddy binary. In 

This is a patch release fixing a few issues related to FastCGI, HTTP/3 and unix sockets, log file permissions, repeated TERM signals, and an ARI edge case. It also adds Caddyfile support for response matching in the header directive.Thanks to everyone who reported bugs and helped with fixes!Changelog
- core: Only initiate exit once (should fix #6707)
- fix: disable h3 for unix domain socket (#6769)
- go.mod: Upgrade CertMagic to 0.21.6 (fix ARI handshake maintenance)
- header: match subdirective for response matching (#6765)
- log: Only chmod if permission bits differ; make log dir (#6761)
- reverseproxy: buffer requests for fastcgi by default (#6759)
What's Changed
- reverse proxy: fastcgi buffer requests for fastcgi by default by @WeidiDeng in #6759
- fix: disable h3 for unix domain socket by @Geun-Oh in #6769
- log: Only chmod if permission bits differ by @mholt in #6761
- header: match subdirective for response matching by @lilnasy in #6765
New Contributors
- @Geun-Oh made their first contribution in #6769
- @lilnasy made their first contribution in #6765
Full Changelog: https://github.com/caddyserver/caddy/compare/v2.9.0...v2.9.1

Happy New Year! We're pleased to release Caddy 2.9. Aside from some minor new features, this release is mainly focused on refinements and bug fixes in many areas, including:
- Config loading
- Events
- Logging
- Placeholders
- Reverse proxy and HTTP server performance
- Matchers
- HTTP (esp. HTTP/3)
- Metrics (per-host metrics)
- Security
- TLS automation & ACME ARI
We realize there is extensive interest in Encrypted Client Hello (ECH) and post-quantum ciphers. These are slated to be supported in Go 1.24, which is scheduled for a stable release in approximately February. We did not want to force users to go through the inconvenience of installing pre-release, non-stock installations of Go, even though the RCs are quite stable and production-ready, in order to even compile Caddy, which is quite common given our plugin ecosystem. We anticipate a Caddy 2.10 release in the near future with these capabilities, built on Go 1.24.We hope you will enjoy the 2.9 release. Thanks to all contributors, bug reporters, and helpers, and those organizations which deployed pre-release versions to production to help verify patches and features.Changelog
- caddyfile: Fix comma edgecase in address parsing (#6616)
- caddyhttp: Add {?query} placeholder (#6714)
- caddyhttp: Allow matching Transfer-Encoding, add to access logs (#6629)
- caddyhttp: Set default ReadHeaderTimeout (1 min)
- caddyhttp: Add MatchWithError to replace SetVar hack (#6596)
- caddyhttp: Close http3 server gracefully (#6213)
- caddyhttp: Use internal issuer for IPs when no APs configured
- caddytls: Allow disabling storage cleaning, avoids writing two files (#6593)
- caddytls: Drop rate_limit and burst, has been deprecated (#6611)
- cmd: Allow add-package to select version of package (#6665)
- cmd: Disable go1.23 tlskyber=1 experiment
- cmd: Reject multiple configs for fmt command (#6717)
- cmd: ignore missing keys during storage export (#6697)
- core: addresses.go funcs renames (#6622)
- core: Change ListenerFunc signature (#6651)
- core: Implement FastAbs to avoid repeated os.Getwd calls (#6687)
- encode: good defaults (#6737)
- encode: try to use sendfile when compression is not used (#6749)
- encode: write status immediate for success response for CONNECT requests (#6738)
- events: Use WithLazy to prevent eager serialization of the event data (#6671)
- fastcgi: check for CONTENT_LENGTH when sending requests (#6661)
- fastcgi: remove dir redirection when useless in php_fastcgi (#6698)
- fileserver: Add first_exist_fallback strategy for try_files (#6699)
- fileserver: Fix policy Validate() oversight (#6727)
- fileserver: add a test for precompressed defaults (#6743)
- fileserver: good default for precompressed (#6736)
- fileserver: Add file_limit option for browse (to be experimental) (#6648)
- fileserver: Fix Caddyfile parsing
- fileserver: fix try_policy when instantiating file matcher from CEL (#6624)
- forwardauth: Skip copying missing response headers (#6608)
- go.mod: Upgrade ACMEz to v3; and upgrade CertMagic
- go.mod: Upgrade CertMagic to v0.21.5
- go.mod: upgrade only some otel deps (#6676)
- go.mod: Upgrade quic-go to 0.48.2
- httpcaddyfile: Fixes for prefer_wildcard mode (#6636)
- httpcaddyfile: Implement experimental force_automate option (#6712)
- httpcaddyfile: Implement log sampling config (#6682)
- metrics: add go and process collectors (#6704)
- metrics: move metrics up, outside servers (#6606)
- requestbody: Type-based error handling for MaxBytesError (#6701)
- reverseproxy: Fix log message
- reverseproxy: Use correct cases for websocket related headers (#6621)
- reverseproxy: Allow 0 as weights for weighted_round_robin (#6681)
- reverseproxy: Only handle websocket protocol (#6740)
- reverseproxy: Revert #4952 - don't ignore context cancellation in stream mode
- reverseproxy: Rewrite requests and responses for websocket over http2 (#6567)
- reverseproxy: Set Content-Length when body is fully buffered (#6638)
- reverseproxy: Sync changes from stdlib for 1xx hand

In this version we've made several fixes and enhancements with help from several contributors. Most changes are small, but some notable ones:- The templates middleware is now officially extensible (experimentally). This means modules can add custom functions/actions for templates to execute.
- TLS storage cleaning is now synchronized across the cluster and remembered across restarts. This should greatly lower costs for expensive storage backends like DynamoDB.
- Placeholders are now evaluated in config for certificate loaders.
- Numerous bug fixes.
Thank you to everyone who contributed!Changelog
- 65c489a0 Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)
- ae5e2d96 caddyfile: Fix variadic placeholder false positive when token contains : (#5883)
- db55da59 caddyhttp: Adjust scheme placeholder docs (#5910)
- df5edf6b caddytls: Context to DecisionFunc (#5923)
- 6d9a8337 caddytls: Sync distributed storage cleaning (#5940)
- 11a082c0 cmd: Add newline character to version string in CLI output (#5895)
- 979c413f cmd: upgrade: resolve symlink of the executable (#5891)
- 64820706 core: Apply SO_REUSEPORT to UDP sockets (#5725)
- 15adb893 core: quic listener will manage the underlying socket by itself (#5749)
- 801ec756 fileserver: Add .m4v for browse template icon
- b809ed71 go.mod: CVE-2023-45142 Update opentelemetry (#5908)
- b4c7313c go.mod: Upgrade quic-go to v0.39.1
- 36fce3fa go.mod: update quic-go version to v0.40.0 (#5922)
- ec2de22a httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)
- f0ea489d httpcaddyfile: Remove port from logger names (#5881)
- 87f63b12 httpredirectlistener: Only set read limit for when request is HTTP (#5917)
- 16834d64 templates: Clarify include args docs, add .ClientIP (#5898)
- 0259853a templates: Delete headers on httpError to reset to clean slate (#5905)
- 2f7ceb57 templates: Offically make templates extensible (#5939)
- 908e9569 tls: accept placeholders in string values of certificate loaders (#5963)
Full Changelog: