Traefik

CVE fixed:

• Advisory GHSA-fgjj-px3w-67xx
• Advisory GHSA-62fc-8686-hfmq
• Advisory GHSA-6765-c87h-8mrf

Bug fixes:

• [acme] Bump github.com/go-acme/lego/v5 to v5.3.1 (#13547 @ldez)
• [middleware, authentication] Fix auth singleflight key collision (#13572 @mmatur)
• [k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider (#13580 @gndz07)
• [tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 (#13530 @kevinpollet)
• Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 (#13574 @mmatur)
• [k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider (#13573 @gndz07)
• [middleware] Bump github.com/klauspost/compress to v1.18.7 (#13587 @mmatur)
• [k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.1 (#13589 @rtribotte)

Documentation:

• [k8s/ingress-nginx] Clarify auth-url/rewrite-target interaction on ingress-nginx provider (#13607 @gndz07)

CVE fixed:

• Advisory GHSA-fgjj-px3w-67xx
• Advisory GHSA-62fc-8686-hfmq
• Advisory GHSA-6765-c87h-8mrf

Bug fixes:

• [acme] Bump github.com/go-acme/lego/v5 to v5.3.1 (#13547 @ldez)
• [middleware, authentication] Fix auth singleflight key collision (#13572 @mmatur)
• [k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider (#13580 @gndz07)
• [tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 (#13530 @kevinpollet)
• Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 (#13574 @mmatur)
• [k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider (#13573 @gndz07)
• [middleware] Bump github.com/klauspost/compress to v1.18.7 (#13587 @mmatur)

CVE fixed:

• Advisory GHSA-62fc-8686-hfmq

Bug fixes:

• [tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 (#13530 @kevinpollet)
• Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 (#13574 @mmatur)
• [k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider (#13573 @gndz07)
• [middleware] Bump github.com/klauspost/compress to v1.18.7 (#13587 @mmatur)

Important: Please read the migration guide.

CVE fixed:

• Advisory GHSA-3ccp-42pg-hgv6

Bug fixes:

• [k8s/ingress-nginx] Fix redirect with use-regex in IngressNGINX provider (#13476 @AmariahAK)
• [middleware] Disable Zstd support in the gzhttp wrapper (#13533 @kevinpollet)
• [server] Defer the CONNECT payload until the backend accepts the tunnel (#13542 @sdelicata)
• [server] Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy (#13543 @sdelicata)
• [server] Bump google.golang.org/grpc to v1.82.1 (#13551 @piscue)
• [server] Do not add back CONNECT requests to the pool (#13556 @kevinpollet)

Documentation:

• [k8s/gatewayapi] Document Gateway API generated service names change in the migration guide (#13541 @rtribotte)
• [k8s/ingress-nginx] Fix typo in nginx annotation proxy-buffer-numbers (#13545 @fischerman)
• Add a migration note for CONNECT requests (#13554 @kevinpollet)

Important: Please read the migration guide.

CVE fixed:

• Advisory GHSA-3ccp-42pg-hgv6

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet)
• [logs] Remove unrelated error from nonexistent cert resolver log (#13469 @ArthurHlt)
• [middleware] Disable Zstd support in the gzhttp wrapper (#13533 @kevinpollet)
• [server] Defer the CONNECT payload until the backend accepts the tunnel (#13542 @sdelicata)
• [server] Discard CONNECT body in forwardauth and reject CONNECT requests with fast proxy (#13543 @sdelicata)
• [server] Bump google.golang.org/grpc to v1.82.1 (#13551 @piscue)
• [server] Do not add back CONNECT requests to the pool (#13556 @kevinpollet)

Documentation:

• [k8s] Align certificateRef and indicate ports (#13473 @veenoise)
• [rules] Fix syntax notes in routing rule documentation (#13501 @stevenlele)
• Add a migration note for CONNECT requests (#13554 @kevinpollet)

Important: Please read the migration guide.

CVE fixed:

• Advisory GHSA-3ccp-42pg-hgv6

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet)
• [server] Defer the CONNECT payload until the backend accepts the tunnel (#13542 @sdelicata)
• [server] Bump google.golang.org/grpc to v1.82.1 (#13551 @piscue)
• [server] Do not add back CONNECT requests to the pool (#13556 @kevinpollet)

Documentation:

• Add a migration note for CONNECT requests (#13554 @kevinpollet)

CVE fixed:

• Advisory GHSA-8rxv-jg7p-wvg3

Bug fixes:

• [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet)
• [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#13506 @gndz07)
• [logs] Remove unrelated error from nonexistent cert resolver log (#13469 @ArthurHlt)
• [middleware] Fix panic in retry middleware with Websockets (#13520 @juliens)

Documentation:

• [k8s] Align certificateRef and indicate ports (#13473 @veenoise)
• [rules] Fix syntax notes in routing rule documentation (#13501 @stevenlele)
• [k8s/crd] Fix duplicated options table in ServersTransport CRD reference (#13518 @rachana5)

Important: Please read the migration guide.

CVE fixed:

• Advisory GHSA-cxjq-mrr5-89rv
• Advisory GHSA-42cj-m3vj-89wv
• Advisory GHSA-qq9q-x9w4-chhj

Bug fixes:

• [middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation (#13398 @dfeinblatt)
• [rules] Fix consistency between HostSNI() and Host() (#13460 @juliens)
• [k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to resolve against the HTTPRoute namespace (#13462 @gndz07)
• [middleware] Fix handle empty unknown-length bodies in mirroring (#13399 @amazon7737)
• [k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider (#13458 @gndz07)
• [middleware] Sanitize replaced path in ReplacePathRegex middleware (#13466 @kevinpollet)
• [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte)
• [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#13478 @rtribotte)
• [k8s] Fix panic when endpointslice port value or name is nil (#13481 @kevinpollet)

Documentation:

• Fix version in migration guide (#13434 @kevinpollet)
• Fix changelog v2.11.51 (#13430 @mmatur)
• Add v3.7 to supported version docs (#13118 @jnoordsij)
• Fix some function names in comments (#13443 @blackflytech)
• Add @nandorKollar as a current maintainer (#13451 @emilevauge)
• Add @amazon7737 as a current maintainer (#13450 @emilevauge)
• [middleware] Clarify buffering middleware defaults (#13401 @amazon7737)
• Fix grammar in TLS, TCP service, and routing reference docs (#13461 @almightymoon)
• Fix X-Forwarded-Prefix documentation for dashboard redirection (#13472 @kevinpollet)

CVE fixed:

• Advisory GHSA-cxjq-mrr5-89rv
• Advisory GHSA-42cj-m3vj-89wv

Bug fixes:

• [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte)
• [k8s] Fix panic when endpointslice port value or name is nil (#13481 @kevinpollet)
• [k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider (#13458 @gndz07)
• [middleware] Fix handle empty unknown-length bodies in mirroring (#13399 @amazon7737)
• [middleware] Sanitize replaced path in ReplacePathRegex middleware (#13466 @kevinpollet)
• [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#13478 @rtribotte)

Documentation:

• [middleware] Clarify buffering middleware defaults (#13401 @amazon7737)
• Add @amazon7737 as a current maintainer (#13450 @emilevauge)
• Add @nandorKollar as a current maintainer (#13451 @emilevauge)
• Fix changelog v2.11.51 (#13430 @mmatur)
• Fix grammar in TLS, TCP service, and routing reference docs (#13461 @almightymoon)
• Fix some function names in comments (#13443 @blackflytech)
• Fix version in migration guide (#13434 @kevinpollet)
• Fix X-Forwarded-Prefix documentation for dashboard redirection (#13472 @kevinpollet)

CVE fixed:

• Advisory GHSA-cxjq-mrr5-89rv

Bug fixes:

• [middleware] Sanitize replaced path in ReplacePathRegex middleware (#13466 @kevinpollet)
• [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte)
• [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#13478 @rtribotte)

Documentation:

• Fix changelog v2.11.51 (#13430 @mmatur)