# Caddy changelog

> HTTP/2 web server with automatic HTTPS and certificate management.

- Vendor: Caddy
- Category: Infrastructure & DevOps
- License: Apache-2.0
- Language: Go
- Official site: https://caddyserver.com
- Tracked by: What's New (https://whatsnew.fyi/product/caddy)
- Harvested from: GitHub (caddyserver/caddy)
- Entries below: 12 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: release facts (products, versions, dates, links, CVE ids and flags) are open data under CC BY 4.0, from the API at https://whatsnew.fyi/api/v1 or the nightly dataset at https://github.com/whatsnew-fyi/dataset. The summaries, labels and curation are © What's New: quote freely with attribution and a link back; wholesale republication of them is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v2.11.7

- Date: 2026-10-03
- Version: v2.11.7
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.7
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.11.7

- **fixed** — Fixed crash and nil pointer dereference when proxying over HTTP/2 where the reverse proxy was still reading a request body after the handler had returned
- **fixed** — Fixed streaming responses to requests with a body being cut off exactly 60 seconds after the body was read over HTTP/1.1
- **fixed** — Fixed streaming responses over HTTP/2 that paused between writes for longer than the write_idle timeout being reset with a stream error
- **fixed** — Fixed placeholders for missing cookies and TLS fields to remain empty instead of being output literally
- **added** — Added support for the Incremental header field (RFC 10036) which enables immediate forwarding of upstream responses
- **added** — Added proxy_status_name option to add a Proxy-Status header explaining why an incremental message was refused
- **changed** — CertMagic no longer builds event data for every TLS handshake when nothing subscribes to certificate events and debug logging is off, making certificate lookup about twice as fast
- **fixed** — Fixed Unix socket listeners and admin endpoint to close immediately and remove the socket file when a reload moves the listener off the socket
- **fixed** — Fixed headers handler to send multiple Set-Cookie values in JSON config as separate header fields instead of joining them with commas
- **fixed** — Fixed caddy fmt to no longer delete an opening brace at the very end of the input

This patch release fixes regressions from 2.11.6, including a crash when proxying over HTTP/2 and streams that were cut off after a minute. **If you're on 2.11.6, we recommend upgrading.** It also adds support for the brand new `Incremental` header field (RFC 10036).

**Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.**

##### Highlights

- **Fixed: crash and dropped streams caused by the new idle timeouts.** 2.11.6 introduced default idle read/write timeouts, which caused some problems:
  - In 2.11.6, the request body's idle deadline could outlive the handler that set it:
    - Over HTTP/2, Caddy could panic with a nil pointer dereference when the reverse proxy was still reading a request body after the handler had returned. (#8101)
    - Over HTTP/1.1, streaming responses to requests with a body, such as SSE clients that open the stream with a `POST`, were cut off exactly 60 seconds after the body was read. (#8103)

    Both are fixed in #8107. Thanks @steadytao!
  - Over HTTP/2, streaming responses that paused between writes for longer than [`write_idle`](https://caddyserver.com/docs/caddyfile/options#timeouts) (1 minute by default), like quiet SSE streams, were reset with a stream error. As documented, only a write that stalls should count. Thanks @WeidiDeng! (#8118, #8119)
- **Fixed: placeholders for missing cookies are empty again.** Since 2.11.6, places that keep unknown placeholders as written, like [`respond`](https://caddyserver.com/docs/caddyfile/directives/respond) headers, would output `{http.request.cookie.*}` literally when the cookie wasn't in the request. The same happened to `{http.request.tls.*}` on plain HTTP requests. Both are empty again. Thanks @steadytao! (#8019)
- **New: support for the [`Incremental`](https://www.rfc-editor.org/rfc/rfc10036.html) header field (RFC 10036).** It's the standard replacement for NGINX's proprietary `X-Accel-Buffering` header. If an upstream response has `Incremental: ?1`, [`reverse_proxy`](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#streaming) forwards it immediately, the same as [`flush_interval -1`](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#flush_interval), and [`encode`](https://caddyserver.com/docs/caddyfile/directives/encode) streams it instead of holding it back. Great for [Mercure](https://mercure.rocks), SSE and other streaming apps.
  - If the [`request_buffers`](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#request_buffers) or [`response_buffers`](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#response_buffers) options would prevent incremental forwarding, Caddy responds with `501 Not Implemented` instead of silently buffering, as the RFC requires.
  - The new [`proxy_status_name`](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#proxy_status_name) option adds a `Proxy-Status` header to those responses, explaining why the message was refused.

  Thanks @dunglas! (#8020)
- **Faster TLS handshakes:** When nothing subscribes to certificate events and debug logging is off, CertMagic no longer builds event data for every handshake. Certificate lookup per handshake is about twice as fast, with 10 allocations instead of 15. Thanks @u5surf! (#8010)
- **Unix sockets:** When a reload moves a listener (or the admin endpoint) off a Unix socket, the old socket now closes right away and its file is removed. Before, clients connecting to the old path would hang until the next garbage collection, about 2 minutes later. Thanks @littfed! (#8061)
- **Headers handler:** Multiple `Set-Cookie` values in a JSON config's `set` are now sent as separate header fields, instead of being joined with commas into one field that clients can't parse. Thanks @Indra55! (#8080)
- **`caddy fmt`** no longer deletes an opening brace at the very end of the input. Thanks @n0

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.7]_

### v2.11.6

- Date: 2026-10-01
- Version: v2.11.6
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.6
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.11.6

- **added** — New url_pattern request matcher supporting URLPattern standard syntax with named groups, wildcards, and regexp components
- **added** — Slowloris mitigation with idle read/write timeouts that reset on successful reads or writes, and optional minimum transfer rates
- **added** — New timeouts handler directive for per-route timeout tuning
- **added** — New tls_automate_names global option to manage certificates for names without serving them in a site block
- **added** — New expected_underscore_headers server option to whitelist specific header fields with underscores
- **added** — New set_cookie log filter
- **added** — http.request.proto_name placeholder
- **changed** — Go 1.26 is now the minimum version for building Caddy and plugins
- **changed** — Request headers are limited to 16 KiB by default instead of 1 MB
- **changed** — New 1-minute idle read/write timeouts by default for request body reads and response writes
- **changed** — Request header fields containing dots are now dropped by default
- **changed** — Wildcard site client_auth no longer applies to more specific hostnames with their own site blocks
- **changed** — HTTP/3 over Tailscale and low-MTU links now works with smaller initial QUIC packet size
- **changed** — Reverse proxy partial responses are flushed to clients properly
- **changed** — Reverse proxy TCP half-close is propagated on upgraded streams
- **changed** — Reverse proxy versions 3 upstreams now honor tls_trust_pool
- **changed** — Reverse proxy active health check state is kept separate per check config
- **changed** — Reverse proxy random_choose policy distributes correctly
- **changed** — Server-sent events behind encode now stream immediately instead of being buffered
- **changed** — Graceful shutdown now waits for servers from previous configs to prevent cutting off long-lived responses

This patch release contains a large number of minor and some noticeable enhancements and bug fixes. Thank you to everyone who contributed or spent their LLM tokens responsibly to help with this release!

We have much more in the pipeline still, as AI has made contributions of all quality levels cheap and easy. We will be trying to go through them as quickly and efficiently as we can.

**Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.**

:warning: **Please read the breaking changes below before upgrading.** Most of them come from security hardening, and most configs won't notice. If you were relying on one of the old behaviors, though, you'll want to know about it.

##### Highlights

- **New [`url_pattern` request matcher](https://caddyserver.com/docs/caddyfile/matchers#url-pattern):** Match requests with the [URLPattern](https://urlpattern.spec.whatwg.org/) standard, the same syntax used by browsers (JS) and many web frameworks. It supports named groups, wildcards, and regexp components. Captured groups become placeholders (`{http.url_pattern.<component>.<group>}`), and there's a matching `url_pattern` CEL function too. Thanks @dunglas! (#7787)
- **Slowloris mitigation:** New idle read/write timeouts reset on every successful read or write. A stalled connection gets cut off, and a slow one that's still making progress is left alone. You can also set optional minimum transfer rates, and there's a new [`timeouts`](https://caddyserver.com/docs/caddyfile/directives/timeouts) handler directive for per-route tuning. (#7913)
- **New [`tls_automate_names`](https://caddyserver.com/docs/caddyfile/options#tls-automate-names) global option:** Manage certificates for names without serving them in a site block. (#8015)
- **New [`expected_underscore_headers`](https://caddyserver.com/docs/caddyfile/options#expected-underscore-headers) server option:** If dropping header fields with underscores in 2.11.4 broke your app, you can now list the specific headers to keep. (#7809)
- **HTTP/3 over Tailscale and other low-MTU links** now works, because the initial QUIC packet size is smaller. (#7886)
- **Reverse proxy got more love:**
  - partial responses are flushed to clients properly (#7849)
  - TCP half-close is propagated on upgraded streams (#8027)
  - `versions 3` upstreams now honor [`tls_trust_pool`](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#tls_trust_pool) (#8042)
  - [active health check](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#active-health-checks) state is kept separate per check config, so one handler's failing probes don't mark the upstream down for everyone else (#7916)
  - the `random_choose` policy distributes correctly now (#7873)
- **Server-sent events behind [`encode`](https://caddyserver.com/docs/caddyfile/directives/encode)** now stream immediately instead of being buffered. (#7905)
- **Graceful shutdown** now waits for servers left over from previous configs, so long-lived responses that started before a reload aren't cut off at exit. (#8009)
- **Caddyfile:** [`import`](https://caddyserver.com/docs/caddyfile/directives/import) now works inside [named routes](https://caddyserver.com/docs/caddyfile/concepts#named-routes) (#7986), and quoted braces are treated as literal arguments (#7875).
- **Logging:**
  - new [`set_cookie`](https://caddyserver.com/docs/caddyfile/directives/log#set-cookie) log filter (#7888)
  - [`roll_interval`](https://caddyserver.com/docs/caddyfile/directives/log#roll_interval) accepts days (`d`) (#7900)
  - recovered handler panics are logged at ERROR level (#7924)
  - write timeout errors show up in access logs (#7945)
- **Performance:** fewer allocations in request hot paths, encoding negotiation, and the reverse proxy, from @jvoisin and @dunglas. Directory browsing is much faster for large directories. (#7847, #79

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.6]_

### v2.11.4

- Date: 2026-06-03
- Version: v2.11.4
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.4
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.11.4

- **security** — Normalize Windows backslashes in path matcher in caddyhttp
- **security** — Prevent placeholder re-expansion in injected query in rewrite
- **security** — Improve stripHTML action to more reliably remove malformed HTML in templates
- **security** — Ignore header fields with underscores in caddyhttp to prevent collisions
- **fixed** — Fix client auth in caddytls
- **fixed** — Further prevent body closes from dial errors in reverseproxy
- **fixed** — Omit Last-Modified header for unusable modification times in caddyhttp
- **fixed** — Fix TLS state races and ECH rotation retry in caddytls
- **fixed** — Wrap request body in reverseproxy to prevent closing if not read
- **fixed** — Match IDN SNI in connection policies in caddytls
- **fixed** — Skip idna.ToASCII for pure ASCII SNI values in caddytls
- **fixed** — Fix incorrect error message on duplicate matchers in httpcaddyfile
- **added** — Add candidate placeholders for rejected identities in caddyauth
- **added** — Support caddy start on IPv6-only hosts in cmd
- **changed** — Preserve implicit TLS issuer semantics in caddyfile
- **changed** — Prioritize zstd and br over gzip in content negotiation in encode
- **changed** — Optimize memory allocation for file placeholders in replacer

This release patches more security, security-adjacent, and normal bugs. The FrankenPHP project has collaborated on PHP-adjacent patches, which we are grateful for.

The recent surge of patches is mostly attributed to token predictors. We have had to reject more than 75% of "security" reports because they were AI slop spam (or just lazy/incorrect). Please use LLMs and agents wisely to avoid wasting precious maintainer resources. We have started blocking offending accounts that spam slop reports. Thank you to all who submit responsible reports following our security policy to make the project better. We appreciate that the community deems the Caddy project worthy of contribution to improve the broader ecosystem!

Security-related patches:
- caddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102)
- rewrite: Prevent placeholder re-expansion in injected query (thanks @WhiskerEnt)
- templates: Improved `stripHTML` action to more reliably remove malformed HTML (thanks to @jmrcsnchz)
- caddyhttp: Ignore header fields with underscores to prevent collisions (thanks @Vincent550102 for the report and @dunglas for the patch)

:warning: These security patches may be breaking if your application relies on the buggy behaviors.

There are also several other various fixes and enhancements by many other contributors. Thank you everyone who participated!

##### What's Changed
* reverseproxy: further prevent body closes from dial errors by @jameshartig in https://github.com/caddyserver/caddy/pull/7715
* caddytls: Fix client auth (fix #7724) by @mholt in https://github.com/caddyserver/caddy/pull/7727
* chore: deps upgrade by @mohammed90 in https://github.com/caddyserver/caddy/pull/7751
* caddyhttp: omit Last-Modified for unusable mod times by @bb4242 in https://github.com/caddyserver/caddy/pull/7740
* caddytls: fix TLS state races and ECH rotation retry by @broady in https://github.com/caddyserver/caddy/pull/7756
* chore: clean up wording and typo fixes by @steadytao in https://github.com/caddyserver/caddy/pull/7745
* reverseproxy: Add regression test for DialInfo network override by @eyupcanakman in https://github.com/caddyserver/caddy/pull/7758
* caddyauth: add candidate placeholders for rejected identities by @steadytao in https://github.com/caddyserver/caddy/pull/7698
* cmd: support caddy start on IPv6-only hosts by @steadytao in https://github.com/caddyserver/caddy/pull/7744
* caddyfile: preserve implicit TLS issuer semantics by @steadytao in https://github.com/caddyserver/caddy/pull/7743
* reverseproxy: wraps request body to prevent closing if not read by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7719
* caddytls: match IDN SNI in connection policies by @steadytao in https://github.com/caddyserver/caddy/pull/7742
* build(deps): bump the all-updates group across 1 directory with 9 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7752
* caddyhttp: normalize Windows backslashes in path matcher by @Vincent550102 in https://github.com/caddyserver/caddy/pull/7763
* go.mod: update x/net by @steadytao in https://github.com/caddyserver/caddy/pull/7767
* rewrite: prevent placeholder re-expansion in injected query by @WhiskerEnt in https://github.com/caddyserver/caddy/pull/7761
* perf(replacer): optimize memory allocation for file placeholders by @Jualhosting in https://github.com/caddyserver/caddy/pull/7773
* caddytls: skip idna.ToASCII for pure ASCII SNI values by @sleet0922 in https://github.com/caddyserver/caddy/pull/7770
* encode: prioritize zstd and br over gzip in content negotiation by @Jualhosting in https://github.com/caddyserver/caddy/pull/7772
* httpcaddyfile: fix incorrect error message on duplicate matchers by @Brunotlps in https://github.com/caddyserver/caddy/pull/7780
* Patch for GHSA-vcc4-2c75-vc9v by @jmrcsnchz in https://github.com/caddyserver/caddy/pull/7785

##### New Contributors
* @jameshartig made their first contribution in https:

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.4]_

### v2.11.3

- Date: 2026-05-12
- Version: v2.11.3
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.3
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.11.3

- **security** — fastcgi: Fix a bug that could allow non-PHP files to be executed
- **security** — vars: Apply a more thorough fix for placeholder expansion vulnerability
- **security** — admin: Normalize array indices to prevent remote admin socket auth bypass
- **security** — admin: Implement more rigorous path prefix matching to prevent remote admin socket auth bypass
- **changed** — caddyhttp: Sync placeholder expansion in vars and vars_regexp
- **changed** — caddytls: Avoid ACME fallback for implicit Tailscale *.ts.net policies
- **changed** — caddytls: Consolidate empty APs more smartly
- **changed** — rewrite: Skip query rename when source key is absent
- **added** — root: Introduce down-propagating Helper.BlockState for other directives and plugins to use
- **changed** — http: Make zstd checksum configurable
- **changed** — notify: Always send READY=1 even after an error
- **fixed** — reverseproxy: Fix check for header_up Host {upstream_hostport} redundancy
- **changed** — caddytls: Expand placeholders in dns_challenge override_domain tls parameter
- **added** — tls: Add system and combined CA pool modules
- **changed** — vars: Don't expand placeholders in values
- **changed** — reverseproxy: Make stream copy buffer size configurable
- **added** — logging: Add journald encoder wrapper
- **changed** — caddyfile: Improve import and global options UX for imports before global options
- **added** — reverseproxy: Add lb_retry_match condition on response status

This release improves several aspects of Caddy with minor features, bug fixes, and security patches. Thank you to everyone and their bots who contributed to help make this release the best one yet!

**Security patches:**

- fastcgi: Carrying over a patch from FrankenPHP for a bug that could allow non-PHP files to be executed; collaborated on by @dunglas, @KC1zs4, and @chenjj.
- vars: A more thorough fix for https://github.com/advisories/GHSA-m2w3-8f23-hxxf, collaborated by @everping and @vnxme.
- admin: Array index normalization to prevent remote admin socket auth bypass, by @Amemoyoi and bot.
- admin: More rigorous path prefix matching to prevent remote admin socket auth bypass, by @Amemoyoi and bot.

We've also merged a couple PRs that fix upstream security bugs in other projects like quic-go and CertMagic. Thank you to @marten-seemann for maintaining quic-go so diligently!

##### What's Changed
* caddyhttp: Sync placeholder expansion in `vars` and `vars_regexp` by @vnxme in https://github.com/caddyserver/caddy/pull/7573
* caddytls: Avoid ACME fallback for implicit Tailscale *.ts.net policies by @steadytao in https://github.com/caddyserver/caddy/pull/7577
* chore: Resolve recent CI failures by @mholt in https://github.com/caddyserver/caddy/pull/7593
* caddytls: Consolidate empty APs more smartly by @mholt in https://github.com/caddyserver/caddy/pull/7567
* rewrite: skip query rename when source key is absent by @steadytao in https://github.com/caddyserver/caddy/pull/7599
* root: introduce down-propagating Helper.BlockState for other directives/plugins to use by @henderkes in https://github.com/caddyserver/caddy/pull/7594
* http: make zstd checksum configurable by @ottenhoff in https://github.com/caddyserver/caddy/pull/7586
* notify: Always send "READY=1" even after an error by @francislavoie in https://github.com/caddyserver/caddy/pull/7597
* reverseproxy: Fix check for `header_up Host {upstream_hostport}` redundancy by @yubiuser in https://github.com/caddyserver/caddy/pull/7564
* caddytls: Expand placeholders in dns_challenge override_domain tls parameter by @pberkel in https://github.com/caddyserver/caddy/pull/7609
* tls: add system and combined CA pool modules by @HarshPatel5940 in https://github.com/caddyserver/caddy/pull/7406
* vars: Don't expand placeholders in values by @vnxme in https://github.com/caddyserver/caddy/pull/7629
* build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7637
* build(deps): bump the all-updates group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7641
* reverseproxy: make stream copy buffer size configurable by @steadytao in https://github.com/caddyserver/caddy/pull/7627
* vars: Add matcher placeholder handling tests by @steadytao in https://github.com/caddyserver/caddy/pull/7640
* build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7621
* logging: Add journald encoder wrapper by @steadytao in https://github.com/caddyserver/caddy/pull/7623
* caddyfile: Improve import/global options UX for imports before global options by @steadytao in https://github.com/caddyserver/caddy/pull/7642
* chore: replace `interface{}` with `any` for modernization by @tsinglua in https://github.com/caddyserver/caddy/pull/7571
* chore: bump timberjack to v1.4.1 by @DeRuina in https://github.com/caddyserver/caddy/pull/7618
* logging: Preserve ts for journald-wrapped JSON logs by @steadytao in https://github.com/caddyserver/caddy/pull/7644
* fileserver: show symlink targets verbatim (#7476) by @maxtruxa in https://github.com/caddyserver/caddy/pull/7579
* fix(caddyfile): {block} in snippet by @prettysunflower in https://github.com/caddyserver/caddy/pull/7558
* caddyhttp: Document missing placeholders for escaped URI and prefixed query by

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.3]_

### v2.11.2

- Date: 2026-03-06
- Version: v2.11.2
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.2
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.11.2

- **added** — Add `tls_resolvers` global option to control DNS resolvers for all sites when using the ACME DNS challenge
- **added** — Support `zstd` compression for log rolling
- **added** — Add ability to track dynamic upstreams to enable passive health checking in reverse proxy
- **added** — Add `CustomBinaryName` and `CustomLongDescription` for custom binary names
- **changed** — Deprecate `roll_gzip` in favor of `roll_compression` for log rolling
- **changed** — Collect metrics once per route instead of per handler
- **changed** — Limit empty Host check to HTTP/1.1
- **changed** — Refine logging and error messages
- **changed** — Sort auto-HTTPS redirect routes by host specificity
- **changed** — Evaluate tls.client placeholders more accurately
- **fixed** — Fix reverse proxy edge case with PROXY protocol, health check port, and closing body on retries
- **fixed** — Fix `health_port` being ignored in health checks
- **fixed** — Fix TLS dialing with proxy protocol
- **fixed** — Prevent body close on dial-error retries in reverse proxy
- **fixed** — Fix query escaping of request URLs when proxy protocol is enabled
- **fixed** — Fix rewrite handler bug that could cause some URIs to not be rewritten when URI path is an escaped form of target path
- **fixed** — Fix nil pointer dereference in proxyWrapper
- **fixed** — Fix missing TLS connection policies when auto_https is default
- **fixed** — Fix parser panic when no token were added by empty block
- **security** — Fix bug in `forward_auth` directive that could permit identity injection and potential privilege escalation
- **security** — Fix `vars_regexp` double-expanding placeholders that could reveal secrets

Caddy 2.11.2 contains numerous bug fixes and enhancements! I know that's a lame summary but it's really all over the place.

##### Highlights

- Reverse proxy got a lot of love with certain edge cases related to PROXY protocol, health check port, and closing body on retries. Dynamic upstreams are now tracked which enables passive health checking.
- Performance improvements for metrics.
- New `tls_resolvers` global option to control DNS resolvers for all sites when using the ACME DNS challenge.
- Log rolling now supports `zstd` compression; deprecated `roll_gzip`, which will be removed in the future. Use `roll_compression` instead.
- Refined logging and some error messages.
- Fixed a bug in rewrite handler that could cause some URIs to not be rewritten when URI path is an escaped form of target path. Thanks to @MaherAzzouzi for the report.

##### Security fixes

This release fixes two CVEs.

- @NucleiAv reported a bug in the `forward_auth` directive that could permit identity injection and potential privilege escalation.
- @sammiee5311 reported that `vars_regexp` double-expanded placeholders, allowing some unusual configs to reveal secrets.

In addition:

- Built on Go 1.26.1 (also released today) which patches several CVEs.
- Our documentation has been updated to note that file system case sensitivity may affect the behavior of the `hide` option of the `file_server` handler.

Thank you to everyone who contributed, and for our ongoing sponsorships that make this development possible!


##### Changelog
* 88616e86e6e656738426bb86b4a42dcc20a59f77 api: Add all in-flight requests /reverse_proxy/upstreams (Fixes #7277) (#7517)
* d935a6956c16902623b8e8f6d1aafec4f6124f46 autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)
* 5d20adc7a97f70d6fe722099356cca2027908576 build(deps): bump github.com/smallstep/certificates (#7535)
* 9371ee67c64d2d2c81f9530be0d9749ecdbd2b00 build(deps): bump the actions-deps group across 1 directory with 12 updates (#7536)
* 9798f6964d58eb5703d1498804962faca2dae4ea caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)
* dc360828598440beb1dfdb21c0ba14e09bcd565b caddyhttp: Collect metrics once per route instead of per handler (#7492)
* 174fa2ddb93f830370b05058d1ea51ad1512597d caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)
* eac02ee98f9f61d79ae774aa49aa102ddf2076ba caddyhttp: Limit empty Host check to HTTP/1.1
* f283062d37c50627d53ca682ebae2ce219b35515 cmd: Custom binary names through `CustomBinaryName` and `CustomLongDescription` (#7513)
* cd9e1660aa454e6536ad740c9d1aaecf3c3552ed cmd: Pass configFile, not configFlag, for reload command (#7532)
* 7b34e3107eb6071fea3a3f94a5c913c32a55afd0 core: Check whether @id is unique (#7002)
* 566e710991a6b752933178e2c6126181efc563aa fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)
* 2dd3852416e2b04bc90b98643673ec9e131c32e6 fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)
* 2dbcdefbbee68e7b4a31ac66361a0f4e3bcd2eea forward_auth: `copy_headers` does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)
* ce203aa9e1ff2686777019f45c36c283debb7986 go.mod: Upgrade x/net
* 76b198f586e4e2482a0278ba52c176cff70af8cf http: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)
* 7ffb640a4da666203ab43396eaeb2b6b84bb983f httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) (#7507)
* 45cf61b1276b2cf79ce0147df8fa48c96e8e5356 logging: Ensure `slog` error level logs don't print stack traces (#7512)
* 987375297862d9cd0a3fa33cfb199c25e504ad1b logging: Support `zstd` roll compression (#7515)
* 294dfff4435c31b7c8d20d26067365b0a0016610 logging: add DirMode options and propagate FileMode to rotations (#7335)
* a6acb3902cb6453153db0738bd8210e093449ce1 proxyproto: Generated test coverage (#7540)
* 11b56c6cfc25f8c814fa66cb02060548d12c40

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.2]_

### v2.11.1

- Date: 2026-02-23
- Version: v2.11.1
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.1
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.11.1

- **added** — Encrypted ClientHello (ECH) keys are rotated automatically
- **added** — Time-rolling options for logs
- **added** — SIGUSR1 can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API
- **added** — Reverse proxy now automatically rewrites the Host header to the address of the upstream when the upstream is HTTPS
- **added** — log_append can now log request and response bodies, useful for debugging
- **added** — Add replacer placeholders for escaped values
- **added** — Encode header Content-Type graphql-response
- **changed** — Allow block to do nothing if nothing passed to import
- **fixed** — CVE-2026-27590: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport
- **fixed** — CVE-2026-27589: Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked
- **fixed** — CVE-2026-27588: The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
- **fixed** — CVE-2026-27587: The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass
- **fixed** — CVE-2026-27586: TLS client authentication silently fails open when CA certificate file is missing or malformed
- **fixed** — CVE-2026-27585: Improper sanitization of glob characters in file matcher may lead to bypassing security protections
- **fixed** — Encode response corruption when handle_errors is used
- **fixed** — PKI creation when auto_https is disabled
- **fixed** — Prevent trailing space on line before env variable
- **fixed** — Prevent commas in header values from being split in CLI commands
- **fixed** — Set Content-Length for precompressed files

Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.

There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.

##### Special Sponsor Shoutout

Extra big thanks to our major sponsors:

- [ZeroSSL](https://zerossl.com)
- [Stripe](https://stripe.com)
- [Railway](https://railway.com/?utm_medium=sponsor&utm_source=oss&utm_campaign=caddy)

They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!

##### Notable changes

- Encrypted ClientHello (ECH) keys are rotated automatically.
- Time-rolling options for logs.
- `SIGUSR1` can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.
- Reverse proxy now automatically rewrites the Host header to the address of the upstream when the upstream is HTTPS (#7454)
- `log_append` can now log request and response bodies, useful for debugging.
- Our project now implements and requires Assistance Disclosures (for AI/LLMs) on issues, PRs, comments, replies, reviews, etc.
- Many, many other minor improvements and bug fixes.

Thank you to everyone who was involved this release!

###### :warning: Security patches

- fastcgi: `CVE-2026-27590` by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
- admin: `CVE-2026-27589` by @1seal - Cross-origin requests attempted with `no-cors` mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)
- caddyhttp:  `CVE-2026-27588` by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.
- caddyhttp: `CVE-2026-27587` by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.
- caddytls: `CVE-2026-27586` by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.
- caddyhttp: `CVE-2026-27585` by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.

:rotating_light:  **Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your `go.mod` file. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses.** (Then, [turn Dependabot off](https://words.filippo.io/dependabot/).)

##### What's Changed
* caddyhttp: add replacer placeholders for escaped values by @Qusic in https://github.com/caddyserver/caddy/pull/7181
* AI assistance disclosure by @mholt in https://github.com/caddyserver/caddy/pull/7212
* caddyfile: Prevent trailing space on line before env variable - Fixes #6881 by @arpansaha13 in https://github.com/caddyserver/caddy/pull/7215
* add: encode header Content-Type graphql-response by @aro-lew in https://github.com/caddyserver/caddy/pull/7214
* caddyhttp: Removing redundant middleware next copy by @maxcelant in https://github.com/caddyserver/caddy/pull/7217
* build(deps): bump the all-updates group with 17 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7236
* build(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7237
* encode: fix response corruption when handle_errors is used by @Siomachkin in https://github.com/caddyserver/caddy/pull/7235
* Fix PKI creation when auto_https is disabled (#7211) b

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.1]_

### v2.11.0-beta.2

- Date: 2026-01-06
- Version: v2.11.0-beta.2
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.0-beta.2
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.11.0-beta.2
- Labels: Pre-release

- **added** — Add {http.request.body_base64} placeholder
- **added** — Add support for multiple intermediates in signing chain
- **added** — Create a placeholder for and log ECH status
- **added** — Add --json flag to list-modules command
- **added** — Implement Windows service status and error notifications
- **added** — Add span attributes to tracing module
- **added** — Add log_append early option with support for {http.response.body}
- **changed** — Fix preferred chains options by appending values instead of replacing
- **changed** — Implement ECH key rotation
- **changed** — Upgrade CertMagic and ZeroSSL dependencies
- **changed** — Update tscert package to latest version
- **fixed** — Fix logging on wildcard sites when SkipUnmappedHosts is true
- **fixed** — Fix panic when using tls.ca_pool.source.http to tls.ca

Welcome to the second beta version of 2.11. We are closer to a final release. This includes some minor new features and enhancements, and a fix for the ZeroSSL API issuer.

Thank you to everyone who contributed!

##### Changelog
* 8a87bb3ffb8706bbfcaada1d52008a8eb07ad790 build(deps): bump github.com/smallstep/certificates (#7381)
* 7b031e1eb5bc0bae9a8394d93f20399932ebd4d3 build(deps): bump the all-updates group across 1 directory with 12 updates (#7421)
* be5f49fbeb046fb123583e5887ddf576a312a8e4 caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true (#7372)
* 6e0cbd0fa0d3022b41fc2c17b80f15402e685643 caddyhttp: create a placeholder for and log ech status (#7328)
* 4037d0576094c5f9f570825601615b62cb8d85b1 caddyhttp: {http.request.body_base64} placeholder (#7367)
* 7ebe72bbfe342688a325325ea79e46970d017eb7 caddypki: Add support for multiple intermediates in signing chain (#7057)
* 3c9c67e804eb3db9a3ac6532ddd2434246058cd5 caddytls: ECH key rotation (#7356)
* 374b7a637f2b6f8d0f2723ad2e7908a41023e8d5 caddytls: fix preferred chains options by appending values instead of replacing (#7387)
* 6a4296b1a45d81f52bf8ab01d0bcaa4423fee3ff caddytls: panic when using tls.ca_pool.source.http -> tls.ca (#7393)
* 9eabd443cb170ed846a70a84acf87002683ad29b cmd: Add --json flag to list-modules command (#7409)
* b2d21f650a7ecd61d0a7ee85f3d423b89cddc371 go.mod: Upgrade CertMagic and ZeroSSL deps
* 34fd2dfcff4a9533bd3b63da56edb782effe561d go.mod: update tscert package to latest (aea342f6) (#7397)
* decc8a4d6fc476b21165400ddc3c02d94ee9f47f logging: `log_append` Early option, Supports `{http.response.body}` (#7368)
* 409a0721354354a2d13e5c110be0f7f03363652b notify: implement windows service status and error notifications (#7389)
* 1f1be3f4fe281643fd4ac8c1217d5ade7f82f6b9 tracing: Add span attributes to tracing module (#7269)

##### What's Changed
* build(deps): bump github.com/smallstep/certificates from 0.28.4 to 0.29.0 by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7381
* caddypki: Add support for multiple intermediates in signing chain by @hslatman in https://github.com/caddyserver/caddy/pull/7057
* caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true by @francislavoie in https://github.com/caddyserver/caddy/pull/7372
* multiplexing: Introduce packet conn wrappers by @vnxme in https://github.com/caddyserver/caddy/pull/7180
* docs: add maybe template function documentation by @steffenbusch in https://github.com/caddyserver/caddy/pull/7388
* caddyhttp: create a placeholder for and log ech status by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7328
* caddytls: fix preferred chains options by appending values instead of replacing by @okrc in https://github.com/caddyserver/caddy/pull/7387
* feat: mark Assert* functions as test helpers by @dunglas in https://github.com/caddyserver/caddy/pull/7380
* caddytls: ECH key rotation by @mholt in https://github.com/caddyserver/caddy/pull/7356
* caddytls: panic when using tls.ca_pool.source.http -> tls.ca by @Zenexer in https://github.com/caddyserver/caddy/pull/7393
* notify: implement windows service status and error notifications by @FreyreCorona in https://github.com/caddyserver/caddy/pull/7389
* caddyhttp: `{http.request.body_base64}` placeholder by @francislavoie in https://github.com/caddyserver/caddy/pull/7367
* chore: update tscert package to latest (aea342f6) by @willnorris in https://github.com/caddyserver/caddy/pull/7397
* logging: `log_append` Early option, Supports `{http.response.body}` by @francislavoie in https://github.com/caddyserver/caddy/pull/7368
* update quic-go to v0.58.0 by @marten-seemann in https://github.com/caddyserver/caddy/pull/7404
* cmd: add --json flag to list-modules by @pauloappbr in https://github.com/caddyserver/caddy/pull/7409
* Add span attributes to tracing module by @felix-hilden in https://github.com/caddyserver/caddy/pull/7269
* readme: fix fence by @mohammed90 in https://git

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.0-beta.2]_

### v2.11.0-beta.1

- Date: 2025-12-04
- Version: v2.11.0-beta.1
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.0-beta.1
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.11.0-beta.1
- Labels: Pre-release

- **fixed** — Encode module no longer corrupts response when handle_errors is used
- **added** — Basic auth module now supports argon2id hashing
- **added** — Add trusted_proxies_unix option for trusting unix socket X-Forwarded-* headers
- **added** — Add server options keepalive_idle and keepalive_count
- **added** — Add replacer placeholders for escaped values
- **added** — Allow customizing the Server header
- **changed** — Normalize (lowercase) {label.N} placeholders
- **fixed** — Disable internal auto-CA when auto_https is disabled
- **changed** — Check intermediate lifetime against actual root cert lifetime
- **added** — Allow disabling distributed solving except for http-01 challenge
- **fixed** — Prevent commas in header values from being split
- **changed** — Reloading with SIGUSR1 now works if config was never changed via admin API
- **added** — Custom slog handlers for modules to log contextual data
- **added** — Add graphql-response header to encode list
- **fixed** — Set Content-Length for precompressed files
- **added** — Add support for named socket activation
- **changed** — Adjust BufferedLog to keep logs in the correct order
- **changed** — Buffer the logs before config is loaded
- **changed** — Replace lumberjack logging library with timberjack fork that supports time-rolling ability
- **fixed** — Fix nested quotes formatted incorrectly by fmt in Caddyfile

Welcome to the beta version of 2.11. This is the first release made by our [new, automated release process](https://github.com/caddyserver/caddy/pull/7383) developed by @Mohammed90 that was carried out and approved entirely by our maintainer team (together with @francislavoie) without intervention from @mholt, the original Caddy author. This represents a significant step forward in [project autonomy and growth](https://caddy.community/t/next-steps-for-the-caddy-project-maintainership/33076), ensuring that the project's stability and longevity is not reliant upon a single person.

This first beta release was primarily to test our new workflow, so there's still a couple things left to do before the stable release.

Featured here are numerous, mostly minor, bug fixes and enhancements, mostly affecting edge cases or niche corners of the software; for example, proxying H2C or HTTP/3, obscure Caddyfile scenarios, and named socket activation.

Some notable changes:

- SIGUSR1 can be used to reload configuration only if it was loaded from a file using the CLI, and not changed by the API since then.
- We replaced "lumberjack", our logging library, with a fork "timberjack" that supports the oft-requested time-rolling ability.
- Caddy can now bind listeners with named socket activation.

Before the final release, we expect ECH key rotation to be enabled as well as a few other patches/features

Thank you to our sponsors and contributors for all that you do!

##### Changelog
* 5473eb95d8e94505b8c06955bd200f37179c54a2  encode: fix response corruption when handle_errors is used (#7235)
* 13a4ec7597f8e9ebe105b0ee89102ba521f21173 basicauth: Implement argon2id (#7186)
* 6d90c7707dac3026c1b28fba615b1962d2cd45e1 build(deps): bump github.com/slackhq/nebula from 1.9.5 to 1.9.7 (#7315)
* eead249382ac14c29d82ec75f30df7638e879567 build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#7355)
* 2d0f3f887bc1f70c52fc183ebcc6225f7f91c041 build(deps): bump the actions-deps group with 5 updates (#7237)
* afbdcec08bbd7471b9b5e5ed209881dfcc51bd6c build(deps): bump the actions-deps group with 8 updates (#7284)
* cd1c203777e89a64c8426c049727c58fbebc1276 build(deps): bump the all-updates group across 1 directory with 2 updates (#7307)
* 39357d3e5cb6124e8af651460cc8ab6975c637b8 build(deps): bump the all-updates group with 17 updates (#7236)
* 786d5378771d068440b7ddd8c310851bb7b9afe0 build(deps): bump the all-updates group with 3 updates (#7376)
* 07d2aaf22ef8225575b9557640806bc895067905 build(deps): bump the all-updates group with 4 updates (#7333)
* 0ba8786b35eaec5ec53f8562bec9587e6b1e6a8b caddyfile: Allow `block` to do nothing if nothing passed to `import` (#7206)
* 92c8bc73228aad9eb0b396fdb687c024124d8dbd caddyfile: fix nested quotes formatted incorrectly by fmt (#7045)
* 6d73d85c1fd3d20acaaadc0fb69e3f562d92f685 caddyfile: prevent adding trailing space on line before env variable (#7215)
* d7185fd002a2c57d20a98d3e94442da7b259b3ad caddyhttp: Add `trusted_proxies_unix` for trusting unix socket `X-Forwarded-*` headers (#7265)
* de6b78009b840eb395c33b8d65c5d32746df38b6 caddyhttp: Add server options `keepalive_idle` and `keepalive_count` (#7298)
* e0a8f9541d155b7385b78d2b8bbe2fad53bb6295 caddyhttp: Normalize (lowercase) {label.N} placeholders
* 5e2953670ed7eecbc34146b5d12cca7dd85ac580 caddyhttp: add replacer placeholders for escaped values (#7181)
* 8285eba8426e3c75ed81d6a8c5cd6ec685430d47 caddyhttp: allow customizing the Server header (#7338)
* bc0e1841305b2cc82aeaf9953e527d9819a88c83 caddyhttp: omit unnecessary reassignment (#7276)
* 3553cfb6adb2954a53d559c1841c8072b9921e61 caddyhttp: remove redundant middleware next copy (#7217)
* 1ce2a13ad10eab5693b425056c571621f5d860e9 caddyhttp: wrap accepted connection to suppress tls.ConnectionState (#7247)
* d9cc24f3df663e1bab58dc08ac12bf818c9f6852 caddypki: Disable internal auto-CA when auto_https is disabled (fix #7211) (#7238)
* 1e82f9652ec561cc0c84bec501976045aa01a310 caddypk

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.11.0-beta.1]_

### v2.10.2

- Date: 2025-08-23
- Version: v2.10.2
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.10.2
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.10.2

- **fixed** — Make logger first, before TLS provisioning
- **fixed** — Fix acme_dns regression
- **fixed** — Fix importing nested tokens for {block}

This is a hotfix release to fix a couple critical issues from v2.10.1

##### What's Changed
* http: Make logger first, before TLS provisioning by @francislavoie in https://github.com/caddyserver/caddy/pull/7198
* httpcaddyfile: Fix `acme_dns` regression by @francislavoie in https://github.com/caddyserver/caddy/pull/7199
* caddyfile: Fix importing nested tokens for `{block}` by @BeeJay28 in https://github.com/caddyserver/caddy/pull/7189

##### Changelog
* 551f793700fe1550845c824470b623fd1aa03d36 caddyfile: Fix importing nested tokens for `{block}` (#7189)
* 16fe83c7afe2152b0bb53ae35078a28f87e6dcf2 http: Make logger first, before TLS provisioning (#7198)
* 4564261d8350f8010b7e001e646e260e9bba5746 httpcaddyfile: Fix `acme_dns` regression (#7199)

##### New Contributors
* @BeeJay28 made their first contribution in https://github.com/caddyserver/caddy/pull/7189

**Full Changelog**: https://github.com/caddyserver/caddy/compare/v2.10.1...v2.10.2

### v2.10.1

- Date: 2025-08-22
- Version: v2.10.1
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.10.1
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.10.1

- **changed** — Update quic-go to v0.51.0
- **fixed** — forwardproxy: reference correct field name in LoadModule
- **fixed** — Remove nil arg from zapslog.NewHandler call
- **added** — fileserver: Add support for .avif image format
- **fixed** — reverseproxy: use DialTLSContext for TLS if servername has placeholder
- **fixed** — admin: Make sure that any admin routers are provisioned when local/re
- **fixed** — log: default logger should respect {in,ex}clude
- **fixed** — Move local admin server replacement logic below data structure initia
- **fixed** — acme_server: fix policy parsing in caddyfile
- **fixed** — implement Unwrap for interceptedResponseHandler
- **fixed** — fileserver: map invalid path errors to fs.ErrInvalid, and return 400
- **fixed** — caddyhttp: fix route sort by comparing paths without wildcard if they don't shar
- **fixed** — crash - null check on event origin
- **fixed** — prevent error handler from overriding sub handler matchers
- **fixed** — client_auth: wire up leaf verifier Caddyfile
- **fixed** — caddyfile: reject blocks in log_skip directive
- **fixed** — cmd: fix Commands function not returning all registered commands
- **fixed** — core: clean up new config if it failed to run
- **added** — sort buttons in grid mode
- **changed** — Update quic-go to v0.53.0

This is probably our biggest patch release ever -- not that lots of things were broken, but there's lots of refinement happening thanks to broader adoption and contributions from many more people. Just look at the New Contributors below!

Anyway, this release does contain some bug fixes and dependency upgrades which we hope will serve you well. Let us know if there's any issues! And thank you to all who contributed, especially our reliable maintainer team!

This version of Caddy requires [Go v1.25.0 or newer](https://golang.org/dl/).

##### What's Changed
* update quic-go to v0.51.0 by @marten-seemann in https://github.com/caddyserver/caddy/pull/6972
* forwardproxy: reference correct field name in LoadModule by @mohammed90 in https://github.com/caddyserver/caddy/pull/6978
* fix: Remove `nil` arg from `zapslog.NewHandler` call by @IndraGunawan in https://github.com/caddyserver/caddy/pull/6984
* fileserver: Add support for .avif image format by @steffenbusch in https://github.com/caddyserver/caddy/pull/6988
* reverseproxy: use DialTLSContext for TLS if servername has placeholder by @WeidiDeng in https://github.com/caddyserver/caddy/pull/6955
* admin: Make sure that any admin routers are provisioned when local/re… by @Compy in https://github.com/caddyserver/caddy/pull/6997
* log: default logger should respect `{in,ex}clude` by @mohammed90 in https://github.com/caddyserver/caddy/pull/6995
* Move local admin server replacement logic below data structure initia… by @Compy in https://github.com/caddyserver/caddy/pull/7004
* acme_server: fix policy parsing in caddyfile by @mohammed90 in https://github.com/caddyserver/caddy/pull/7006
* implement Unwrap for interceptedResponseHandler by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7016
* fileserver: map invalid path errors to fs.ErrInvalid, and return 400 … by @Compy in https://github.com/caddyserver/caddy/pull/7017
* caddyhttp: fix route sort by comparing paths without wildcard if they don't shar… by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7015
* refactor: use maps.Copy for cleaner map handling by @eveneast in https://github.com/caddyserver/caddy/pull/7009
* refactor: use slices.Contains to simplify code by @tongjicoder in https://github.com/caddyserver/caddy/pull/7039
* chore: upgrade .golangci.yml and workflow to v2 by @mohammed90 in https://github.com/caddyserver/caddy/pull/6924
* build(deps): bump golangci/golangci-lint-action from 6 to 8 by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7044
* fix: crash - null check on event origin by @suxatcode in https://github.com/caddyserver/caddy/pull/7047
* fix: prevent error handler from overriding sub handler matchers by @Hellio404 in https://github.com/caddyserver/caddy/pull/6999
* client_auth: wire up leaf verifier Caddyfile by @mohammed90 in https://github.com/caddyserver/caddy/pull/6772
* caddyfile: reject blocks in log_skip directive by @IwatsukaYura in https://github.com/caddyserver/caddy/pull/7056
* build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7058
* cmd: fix `Commands` function not returning all registered commands by @hslatman in https://github.com/caddyserver/caddy/pull/7059
* ci: add dep review, OSSF scorecard actions by @mohammed90 in https://github.com/caddyserver/caddy/pull/7063
* ci: add `{base,head}-ref` to  dep review check by @mohammed90 in https://github.com/caddyserver/caddy/pull/7064
* core: clean up new config if it failed to run by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7068
* chore: apply security best practices for CI by @mohammed90 in https://github.com/caddyserver/caddy/pull/7066
* refactor: use the built-in max/min to simplify the code by @xiaoxiangirl in https://github.com/caddyserver/caddy/pull/7081
* [ADD] sort buttons in grid mode by @filipRatajczak in https://github.com/caddyserver/caddy/pull/7089
* update quic-go to v0.53.0 by @

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.10.1]_

### v2.10.0

- Date: 2025-04-18
- Version: v2.10.0
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.10.0
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.10.0

- **added** — Support for Encrypted ClientHello (ECH) to encrypt the ClientHello portion of TLS connections including the domain name
- **added** — Support for post-quantum key exchange using the standardized x25519mlkem768 cryptographic group
- **added** — ACME profiles as an experimental draft to choose certificate properties with more flexibility than traditional CSR methods
- **added** — Global DNS provider configuration option to specify a default DNS module instead of configuring it locally in every part of the config
- **changed** — Reverse proxy now sets a Via header instead of a duplicate Server header
- **changed** — Wildcards are now utilized by default for subdomains instead of obtaining individual certificates
- **changed** — Support for libdns 1.0 APIs with updated interfaces for DNS provider modules
- **changed** — Only the latest minor Go version is now supported instead of the last 2 minor versions
- **removed** — Remove experimental auto_https prefer_wildcard option

Caddy 2.10 is here! Aside from bug fixes, this release features:

- **Encrypted ClientHello (ECH):** This new technology encrypts the last plaintext portion of a TLS connection: the ClientHello, which includes the domain name being connected to. The [draft spec](https://www.ietf.org/archive/id/draft-ietf-tls-esni-24.html) for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but nuanced capability; we highly recommend reading [the ECH documentation](https://caddyserver.com/docs/automatic-https#encrypted-clienthello-ech) on our website.
- **Post-quantum (PQC) key exchange:** Caddy now supports the standardized `x25519mlkem768` cryptographic group by default.
- **ACME profiles:** ACME profiles are an experimental draft that allow you to choose properties of your certificates with more flexibility than traditional CSR methods. For example, [Let's Encrypt will issue 6-day certificates](https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/) under a certain profile. Caddy may eventually use that profile by default.
- **Via header:** The reverse proxy now sets a Via header instead of a duplicate Server header.
- **Global DNS provider:** You can now specify a default "global" DNS module to use instead of having to configure it locally in every part of your config that requires a DNS provider (for example, ACME DNS challenges, and ECH). This is the `dns` global option in the Caddyfile, or in JSON config, it's the `dns` parameter in the `tls` app configuration.
- **Wildcards used by default:** Previously, Caddy would obtain individual certificates for every domain in your config literally; now wildcards, if present, will be utilized for subdomains, rather than obtaining individual certificates. This change was motivated by the novel possibility for subdomain privacy afforded by ECH. It can be overridden with `tls force_automate` in the Caddyfile. The experimental `auto_https prefer_wildcard` option has been removed.
- **libdns 1.0 APIs:** Many of you use [DNS provider modules](https://github.com/caddy-dns) to solve ACME DNS challenges or to enable dynamic DNS. They implement interfaces defined by [libdns](https://github.com/libdns/libdns) to get, set, append, and delete DNS records. After 5 years of production experience, including lessons learned with ECH, libdns APIs have been updated and 1.0 beta has been tagged. DNS provider packages will need to update their code to be compatible, which will help ensure stability and well-defined semantics for the future. Several packages have already updated or are in the process of updating (cloudflare, rfc2136, and desec to name a few).
- **Global `dns` config:** Now that several components of Caddy configuration may affect DNS records (ACME challenges, ECH publication, etc.), there is a new `dns` global option that can be used to specify your DNS provider config in a single place. This prevents repetition of credentials for servers where all the domains are managed by a single DNS provider.

**Thank you to the many contributors who have helped to make this possible!** :tada: :partying_face: :champagne: 

:warning: While have traditionally supported the last 2 minor Go versions to accommodate some distribution / package manager policies, we now only support the latest minor Go version. The privacy and security benefits added in new Go versions (such as post-quantum cryptography) are worth making available to everyone as soon as possible, rather than holding back the entire user base or maintaining multiple code compilation configurations.

##### Encrypted ClientHello (ECH) details

(This is a brief overview. We recommend reading [the full documentation](https://caddyserver.com/docs/automatic-https#encrypted-clienthello-ech).)

Typically, server names (domain names, or "SNI") are sent in the plaintext ClientHello when establishing TLS connections. With ECH, the true server name is encrypted (and wrapped) by an "outer" ClientHello w

_[Truncated at 4000 characters — full notes: https://github.com/caddyserver/caddy/releases/tag/v2.10.0]_

### v2.10.0-beta.4

- Date: 2025-03-25
- Version: v2.10.0-beta.4
- Original notes: https://github.com/caddyserver/caddy/releases/tag/v2.10.0-beta.4
- Permalink: https://whatsnew.fyi/product/caddy/releases/v2.10.0-beta.4
- Labels: Pre-release

This prerelease is outdated. Please see the latest release for notes. Thanks!