Traefik Release Notes

Important: Please read the migration guide.

CVE fixed

• Advisory GHSA-p8wx-ph99-xgcr
• Advisory GHSA-ww7c-q3mv-xx22
• Advisory GHSA-28hp-c82p-8vqj

Bug fixes

• [server] Reject CONNECT requests regardless of HTTP version (#14031 @juliens)
• [server] Reject CONNECT method before reaching the muxer (#14050 @juliens)
• [k8s/crd] Allow observability metadata on child routers (#14018 @bunnysayzz)
• [k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.3 (#14017 @rtribotte)
• [k8s/gatewayapi] Default HTTPRoute backend scheme to HTTP when no appProtocol (#13935 @Tyagiquamar)
• [k8s/ingress-nginx] Apply auth-tls client authentication to the whole host (#14057 @juliens)
• [k8s/ingress-nginx] Fix cross-namespace check on shared auth-tls-secret TLS options (#14066 @juliens)
• [fastproxy] Add a non-regression test for CR/LF in FastProxy request headers (#13642 @mturac)
• [fastproxy] Fix concurrent buffer reads on upgraded connections (#14023 @juliens)
• Bump golang.org/x/net to v0.60.0 (#14048 @kevinpollet)

Documentation

• [security] Fix typo in the Request Path page (#14036 @SethFalco)
• [k8s/crd] Fix broken Kubernetes CRD definitions links in CRD reference pages (#14047 @SatvikMishra08)
• [k8s] Document the safeNaming impact on cross-provider references (#13768 @lazerg)
• [k8s/gatewayapi] Fix broken links in the Gateway API routing page (#14072 @Neffi42)
• Fix broken anchor links to Restrict the Scope of Service Discovery (#14056 @SatvikMishra08)
• Add the documentation style guide to the Contributing section (#14061 @rachana5)
• Remove redundant period in README (#14068 @mxmrnn)

Important: Please read the migration guide.

CVE fixed

Advisory GHSA-53qr-784g-cj35

Advisory GHSA-cw35-4q88-3rmp

Advisory GHSA-fh26-gfpp-7xxx

Advisory GHSA-mwrr-6hp4-pxr6

Advisory GHSA-qm9f-w54v-q2qh

Advisory GHSA-qvj7-gq9c-hp7q

Advisory GHSA-rv2h-qh7j-xrjw

Advisory GHSA-mhjw-hmjv-p99x

Bug fixes

[acme] Bump github.com/go-acme/lego/v5 to v5.5.1 (#13929 @ldez)

[acme] Bump github.com/go-acme/lego/v5 to v5.5.2 (#13952 @ldez)

[acme] Close the newly created ACME storage file on Windows (#13860 @datrixlab)

[docker] Bump github.com/docker/cli to v29.8.1 (#13934 @kevinpollet)

[fastproxy] Isolate NTLM and Negotiate backend connections in FastProxy (#13914 @kevinpollet)

[k8s/gatewayapi] Allow configuring gateways (#13819 @kevinpollet)

[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.2 (#13984 @kevinpollet)

[k8s/gatewayapi] Do not create the Gateway API routers a previous one shadows (#13946 @rtribotte)

[k8s/gatewayapi] Do not let TLSRoute routers shadow TCPRoute routers (#13953 @rtribotte)

[k8s/gatewayapi] Fix HTTP/GRPC routes conflict (#13421 @AnatoleLucet)

[k8s/gatewayapi] Fix TLSRoute router name collision across listeners sharing an entry point (#13959 @rtribotte)

[k8s/gatewayapi] Report the BackendTLSPolicy ancestor in the namespace of its Gateway (#13964 @rtribotte)

[k8s/gatewayapi] Stable sort Gateways to keep the TLS certificate order stable (#13911 @rl-io)

[k8s/ingress-nginx] Build the ssl-passthrough HTTP route like any other ingress (#13915 @rtribotte)

[k8s/ingress-nginx] Do not normalize resource names in the ingress-nginx provider (#13922 @kevinpollet)

[k8s/ingress-nginx] Fix the ingress-nginx cross-links between the routing and provider docs (#13925 @simpleqt)

[k8s/ingress-nginx] Make trailing capture group optional in ImplementationSpecific paths (#13455 @mmatur)

[k8s/ingress-nginx] Remove Authorization header for basic and digest auth (#13631 @josmo)

[k8s/ingress-nginx] Set the Ssl-Client-* request headers on the Ingress-NGINX HTTP router (#13912 @rtribotte)

[k8s/ingress-nginx] Support wildcard origins in cors-allow-origin for the ingress-nginx provider (#13726 @kimsehyoung)

[logs, middleware, k8s/crd] Expose IngressRoute metadata in access logs (#12985 @mmatur)

[middleware] Avoid deprecated table.maxn in the rate limiter Lua script (#13825 @lazerg)

[otel] Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric to v1.46.0 (#13933 @kevinpollet)

[otel] Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.46.0 (#13932 @kevinpollet)

[otel] Bump otlploggrpc and otlploghttp to v0.22.0 (#13931 @kevinpollet)

[rules] Ignore negated matchers when parsing rule domains (#13863 @rtribotte)

[server] Bump golang.org/x/crypto to v0.57.0 (#13930 @kevinpollet)

[server] Silence encoded characters warning when some are disallowed (#13470 @Adel-Ayoub)

[service] Dedicate a sticky transport per ServersTransport (#13838 @sdelicata)

[service] Fix the second server selection bias in the P2C load balancer (#13644 @lazerg)

[service] Isolate preauthenticated NTLM and Kerberos backend connections (#13902 @kevinpollet)

[udp] Copy UDP datagrams into right-sized buffers before queuing (#13941 @rtribotte)

[webui] Bump react-router to v7 and vite to v8 (#13794 @gndz07)

Fix build with GOPROXY=direct (#12724 @mehrdadbn9)

Documentation

[accesslogs] Clarify access log buffering behavior (#13510 @amazon7737)

[accesslogs] Clarify that USR1 only reopens the access log file (#13955 @rtribotte)

[k8s] Clarify nativeLB load balancing behavior in Kubernetes reference docs (#13358 @zarko-a)

[security] Document the coordinated disclosure embargo for security reports (#13982 @emilevauge)

[server] Fix misleading trailer comments in header strategy handlers (#13938 @AleksaMCode)

[tcp] Fix 'allows to configure' grammar in TCP ServersTransport (#13894 @fng713)

Fix 'allow to match' grammar in TCP HostSNI rules (#13895 @fng713)

Fix case-sensitive option anchors (#13924 @simpleqt)

Fix the end anchor in the single-test example (#13898 @amazon7737)

CVE fixed:

Advisory GHSA-cw35-4q88-3rmp
Advisory GHSA-fh26-gfpp-7xxx
Advisory GHSA-qm9f-w54v-q2qh
Advisory GHSA-2272-4vv8-65ww
Advisory GHSA-mhjw-hmjv-p99x

Bug fixes:

• [docker] Bump github.com/docker/cli to v29.8.1 (#13934 @kevinpollet)
• [rules] Ignore negated matchers when parsing rule domains (#13863 @rtribotte)
• [server] Bump golang.org/x/crypto to v0.57.0 (#13930 @kevinpollet)
• [server] Ensure that the request TLS state is always set (#13985 @rtribotte)
• [service] Dedicate a sticky transport per ServersTransport (#13838 @sdelicata)
• [service] Isolate preauthenticated NTLM and Kerberos backend connections (#13902 @kevinpollet)
• [udp] Copy UDP datagrams into right-sized buffers before queuing (#13941 @rtribotte)

Important: Please read the migration guide.

CVE fixed

Advisory GHSA-qqjf-53cj-pwvv

Advisory GHSA-f52w-8j3h-j724

Advisory GHSA-v67p-phpq-fc8x

Advisory GHSA-w4v4-9rw7-5326

Advisory GHSA-8fcf-v89g-xpg6

Bug fixes

• [acme] Bump github.com/go-acme/lego/v5 to v5.4.1 (#13759 @ldez)
• [acme] Disable recursive nss propagation by default for DNS challenge (#13830 @rtribotte)
• [acme] Do not require recursive nameservers propagation by default for the DNS-01 challenge (#13710 @amazon7737)
• [acme, tls] Ignore negated matchers when parsing rule domains (#13725 @rtribotte)
• [consulcatalog, nomad] Build a collision-free item key in the Consul Catalog and Nomad providers (#13741 @rtribotte)
• [http3] Dedicate a transport per HTTP/3 client connection (#13812 @sdelicata)
• [k8s/ingress-nginx] Fix sticky cookie expiration per request (#13496 @makaiver)
• [k8s/ingress-nginx] Create HTTP redirect router for ssl-passthrough with force-ssl-redirect (#13457 @mmatur)
• [k8s/ingress-nginx] Preserve leading dot in sticky session cookie Domain attribute (#13456 @mmatur)
• [logs, middleware] Set access log entry level and time before formatting the OTLP body (#13767 @emilevauge)
• [logs, tls, k8s/crd] Downgrade default TLS resources namespace mismatch log to warning (#13780 @lazerg)
• [middleware] Fix {url} placeholder in customErrors middleware now includes correct scheme (#13320 @AnouarMohamed)
• [middleware, authentication] Prevent user enumeration through the basic auth singleflight key (#13816 @sdelicata)
• [server] Build the configuration copy once per change (#13746 @jspdown)
• [server] Do not forward h2c upgrade headers to the backend (#13797 @sdelicata)
• [server] Deny request with an opaque request target (#13796 @sdelicata)
• [server] Do not forward request trailer values to the backend (#13822 @rtribotte)
• [server] Bump github.com/quic-go/quic-go to v0.62.0 (#13807 @Nelwhix)
• [tls] Redact duplicate TLS certificates in provider merge logs (#13548 @xsergos)
• [webui] Fix displayed number on details pages (#13779 @gndz07)

Documentation

• [k8s] Add warning about Ingress API frozen state (#13783 @jnoordsij)
• [k8s] Remove namespace reference for providers.kubernetesGateway.labelSelector (#13790 @jnoordsij)
• [k8s/crd] Fix broken redirect for the Kubernetes CRD reference docs (#13811 @thev1ndu)

Tell scanning agents to read the security policy and decisions pages (#13753 @emilevauge)

Important: Please read the migration guide.

CVE fixed:

Advisory GHSA-cjr6-pf59-jq29

Advisory GHSA-7ghq-v6jf-g56c

Advisory GHSA-rf44-j88r-hh8c

Bug fixes:

• [fastproxy] Bump github.com/valyala/fasthttp to v1.73.0 (#13769 @mmatur)
• [file] Include the filename in file provider configuration errors (#13527 @lazerg)
• [http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 (#13717 @gndz07)
• [k8s] Fix typos in docs and an OCSP log message (#13722 @MsfPablo)
• [k8s, k8s/ingress-nginx] Fix redirect www host with a non-numeric port (#13708 @mmatur)
• [k8s/ingress-nginx] Fix TLS option name collision across namespaces in the ingress-nginx provider (#13721 @gndz07)
• [server] Add an entry point option to handle request headers with aliasing names (#13720 @rtribotte)
• [tcp, udp] Reject negative weights in TCP and UDP weighted services (#13749 @rtribotte)
• Bump etcd client modules to v3.5.33 (#13756 @mmatur)

Documentation:

• [k8s] Update redirections block reference in basic.md (#13723 @Larzenegger)
• [k8s] Fix formatting in Kubernetes setup guide (#13742 @stefkiourk)
• [security] Document the security threat model and settled security decisions (#13740 @emilevauge)
• [service] Clarify ServersTransport behavior for the errors middleware in Kubernetes (#13531 @lazerg)
• Fix v3.7.11 migration guide (#13730 @gndz07)
• Move Jean-Baptiste Doumenjou and Mathieu Lonjaret to past maintainers (#13736 @emilevauge)
• Reduce SECURITY.md to a pointer to the security documentation (#13732 @emilevauge)
• Update end of support dates (#13712 @nmengin)

Important: Please read the migration guide.

CVE fixed:

• Advisory GHSA-5w68-77r2-r64c
• Advisory GHSA-g55h-rg46-x9c5
• Advisory GHSA-j994-9gqj-9hwq
• Advisory GHSA-m6wx-622r-48r9

Bug fixes:

• [fastproxy] Reject out-of-range status codes from backends when using FastProxy (#13635 @gndz07)
• [http3] Bump github.com/quic-go/quic-go to v0.61.0 (#13688 @jnoordsij)
• [k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider (#13656 @rtribotte)
• [k8s/crd] Add an option to restrict the namespace of the default TLS resources (#13665 @rtribotte)
• [k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider (#13668 @rtribotte)
• [k8s/crd] Name failover generated services after the referenced Kubernetes Service (#13677 @rtribotte)
• [k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider (#13689 @gndz07)
• [k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect (#13641 @gndz07)
• [k8s/gatewayapi] Fix Gateway API router rules (#13645 @rtribotte)
• [k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider (#13638 @gndz07)
• [k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend (#13575 @rtribotte)
• [k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider (#13629 @gndz07)
• [k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware (#13670 @gndz07)
• [middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 (#13636 @kevinpollet)
• [tls] Add an option to disable the fallback to the default TLS options (#13639 @rtribotte)
• Bump golang.org/x dependencies (#13699 @mmatur)

Documentation:

• [accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation (#13609 @rtribotte)
• [api] Fix doubled word in API/dashboard reference docs (#13663 @latent-9)
• [docker] Remove :ro from docker.sock (#12656 @bluepuma77)
• [k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 (#13628 @rtribotte)
• [k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider (#13634 @rtribotte)
• [k8s/ingress-nginx] Docs: Update supported server snippet directives (#13687 @rtsui-harmonicinc)
• [middleware] Add rejectStatusCode to the ipAllowList middleware configuration example (#13664 @amazon7737)
• [middleware] Mark the errors middleware service option as required (#13684 @lazerg)
• [tls] Document the TLS options conflict resolution (#13640 @rtribotte)
• [tls] Clarify router TLS replaces entrypoint TLS (#13630 @sornapudisuresh)
• Document Redis keyspace notifications requirement (#13691 @omkar619-dev)
• Remove retired Go Report Card badge (#13637 @yardenshoham)
• Restore the systemd socket activation documentation (#13701 @lazerg)
• Update version support policy starting with v3.6 (#13627 @nmengin)

Important: Please read the migration guide.

CVE fixed

• Advisory GHSA-5w68-77r2-r64c
• Advisory GHSA-g55h-rg46-x9c5

Bug fixes

• [k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider (#13656 @rtribotte)
• [k8s/crd] Add an option to restrict the namespace of the default TLS resources (#13665 @rtribotte)
• [k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider (#13668 @rtribotte)
• [k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider (#13689 @gndz07)
• [k8s/gatewayapi] Fix Gateway API router rules (#13645 @rtribotte)
• [middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 (#13636 @kevinpollet)
• [tls] Add an option to disable the fallback to the default TLS options (#13639 @rtribotte)
• Bump golang.org/x dependencies (#13699 @mmatur)

CVE fixed

Advisory GHSA-fgjj-px3w-67xx

Advisory GHSA-62fc-8686-hfmq

Advisory GHSA-6765-c87h-8mrf

Bug fixes

• [acme] Bump github.com/go-acme/lego/v5 to v5.3.1 (#13547 @ldez)
• [middleware, authentication] Fix auth singleflight key collision (#13572 @mmatur)
• [k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider (#13580 @gndz07)
• [tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 (#13530 @kevinpollet)
• Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 (#13574 @mmatur)
• [k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider (#13573 @gndz07)
• [middleware] Bump github.com/klauspost/compress to v1.18.7 (#13587 @mmatur)
• [k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.1 (#13589 @rtribotte)

Documentation

• [k8s/ingress-nginx] Clarify auth-url/rewrite-target interaction on ingress-nginx provider (#13607 @gndz07)

CVE fixed

Advisory GHSA-fgjj-px3w-67xx

Advisory GHSA-62fc-8686-hfmq

Advisory GHSA-6765-c87h-8mrf

Bug fixes

• [acme] Bump github.com/go-acme/lego/v5 to v5.3.1 (#13547 @ldez)
• [middleware, authentication] Fix auth singleflight key collision (#13572 @mmatur)
• [k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider (#13580 @gndz07)
• [tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 (#13530 @kevinpollet)
• Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 (#13574 @mmatur)
• [k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider (#13573 @gndz07)
• [middleware] Bump github.com/klauspost/compress to v1.18.7 (#13587 @mmatur)