Try our Chrome extension
Easily add the current web-page from your browser directly into your changedetection.io tool, more great features coming soon!
Chrome Webstore
Changedetection.io needs your support!
You can help us by supporting changedetection.io on these platforms;
- Rate us at AlternativeTo.net
- Star us on GitHub
- Follow us at Twitter/X
- G2 Software reviews
- Check us out on LinkedIn
- And tell your friends and colleagues :)
The more popular changedetection.io is, the more time we can dedicate to adding amazing features!
Many thanks :)
changedetection.io team
Henüz değil saniye önce.
False
Henüz değil saniye önce
14 saat önceTek bir anlık görüntüye git
Skip to content
Navigation Menu
Sign in Appearance settings
* Platform
+ AI CODE CREATION
o GitHub Copilot Write better code with AI
o GitHub Copilot app Direct agents from issue to merge
o MCP Registry Integrate external tools
+ DEVELOPER WORKFLOWS
o Actions Automate any workflow
o Codespaces Instant dev environments
o Issues Plan and track work
o Code Review Manage code changes
o Code Quality Enforce quality at merge
+ APPLICATION SECURITY
o GitHub Advanced Security Find and fix vulnerabilities
o Code security Secure your code as you build
o Secret protection Stop leaks before they start
+ EXPLORE
o Why GitHub
o Documentation
o Blog
o Changelog
o Marketplace
View all features
* Solutions
+ BY COMPANY SIZE
o Enterprises
o Small and medium teams
o Startups
o Nonprofits
+ BY USE CASE
o App Modernization
o DevSecOps
o DevOps
o CI/CD
o View all use cases
+ BY INDUSTRY
o Healthcare
o Financial services
o Manufacturing
o Government
o View all industries
View all solutions
* Resources
+ EXPLORE BY TOPIC
o AI
o Software Development
o DevOps
o Security
o View all topics
+ EXPLORE BY TYPE
o Customer stories
o Events & webinars
o Ebooks & reports
o Business insights
o GitHub Skills
+ SUPPORT & SERVICES
o Documentation
o Customer support
o Community forum
o Trust center
o Partners
View all resources
* Open Source
+ COMMUNITY
o GitHub Sponsors Fund open source developers
+ PROGRAMS
o Security Lab
o Maintainer Community
o Accelerator
o GitHub Stars
o Archive Program
+ REPOSITORIES
o Topics
o Trending
o Collections
* Enterprise
+ ENTERPRISE SOLUTIONS
o Enterprise platform AI-powered developer platform
+ AVAILABLE ADD-ONS
o GitHub Advanced Security Enterprise-grade security features
o Copilot for Business Enterprise-grade AI features
o Premium Support Enterprise-grade 24/7 support
* Pricing
Type / to search
Sign in
Sign up Appearance settings
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
Uh oh!
There was an error while loading. Please reload this page.
caddyserver / caddy Public
* Uh oh!
There was an error while loading. Please reload this page.
* Notifications You must be signed in to change notification settings
* Fork 4.9k
* Star 74.8k
* Code
* Issues 206
* Pull requests 83
* Issues 204
* Pull requests 78
* Actions
* Security and quality 17
* Insights
Additional navigation options
* Code
* Issues
* Pull requests
* Actions
* Security and quality
* Insights
Releases: caddyserver/caddy
Releases Tags
Releases · caddyserver/caddy
Release list
* v2.11.4
* v2.11.3
* v2.11.2
* v2.11.1
* v2.11.0-beta.2
* v2.11.0-beta.1
* v2.10.2
* v2.10.1
* v2.10.0
* v2.10.0-beta.4
Previous Next
Jump to release
* v2.11.4
* v2.11.3
* v2.11.2
* v2.11.1
* v2.11.0-beta.2
* v2.11.0-beta.1
* v2.10.2
* v2.10.1
* v2.10.0
* v2.10.0-beta.4
Previous Next
v2.11.4
v2.11.4 Latest
Latest
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 03 Jun 06:52
v2.11.4
This tag was signed with the committer’s verified signature.
mholt Matt Holt
SSH Key Fingerprint: +tijH5/rb2AXEwtxWzV3XtUZlfmJpAXA5Z9FMsCVwyo
Verified
Learn about vigilant mode.
e2eee6a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
This release patches more security, security-adjacent, and normal bugs. The FrankenPHP project has collaborated on PHP-adjacent patches, which we are grateful for.
The recent surge of patches is mostly attributed to token predictors. We have had to reject more than 75% of "security" reports because they were AI slop spam (or just lazy/incorrect). Please use LLMs and agents wisely to avoid wasting precious maintainer resources. We have started blocking offending accounts that spam slop reports. Thank you to all who submit responsible reports following our security policy to make the project better. We appreciate that the community deems the Caddy project worthy of contribution to improve the broader ecosystem!
Security-related patches:
* caddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102)
* rewrite: Prevent placeholder re-expansion in injected query (thanks @WhiskerEnt)
* templates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @jmrcsnchz)
* caddyhttp: Ignore header fields with underscores to prevent collisions (thanks @Vincent550102 for the report and @dunglas for the patch)
⚠️ These security patches may be breaking if your application relies on the buggy behaviors.
There are also several other various fixes and enhancements by many other contributors. Thank you everyone who participated!
What's Changed
* reverseproxy: further prevent body closes from dial errors by @jameshartig in #7715
* caddytls: Fix client auth (fix #7724) by @mholt in #7727
* chore: deps upgrade by @mohammed90 in #7751
* caddyhttp: omit Last-Modified for unusable mod times by @bb4242 in #7740
* caddytls: fix TLS state races and ECH rotation retry by @broady in #7756
* chore: clean up wording and typo fixes by @steadytao in #7745
* reverseproxy: Add regression test for DialInfo network override by @eyupcanakman in #7758
* caddyauth: add candidate placeholders for rejected identities by @steadytao in #7698
* cmd: support caddy start on IPv6-only hosts by @steadytao in #7744
* caddyfile: preserve implicit TLS issuer semantics by @steadytao in #7743
* reverseproxy: wraps request body to prevent closing if not read by @WeidiDeng in #7719
* caddytls: match IDN SNI in connection policies by @steadytao in #7742
* build(deps): bump the all-updates group across 1 directory with 9 updates by @dependabot[bot] in #7752
* caddyhttp: normalize Windows backslashes in path matcher by @Vincent550102 in #7763
* go.mod: update x/net by @steadytao in #7767
* rewrite: prevent placeholder re-expansion in injected query by @WhiskerEnt in #7761
* perf(replacer): optimize memory allocation for file placeholders by @Jualhosting in #7773
* caddytls: skip idna.ToASCII for pure ASCII SNI values by @sleet0922 in #7770
* encode: prioritize zstd and br over gzip in content negotiation by @Jualhosting in #7772
* httpcaddyfile: fix incorrect error message on duplicate matchers by @Brunotlps in #7780
* Patch for GHSA-vcc4-2c75-vc9v by @jmrcsnchz in #7785
New Contributors
* @jameshartig made their first contribution in #7715
* @bb4242 made their first contribution in #7740
* @broady made their first contribution in #7756
* @eyupcanakman made their first contribution in #7758
* @Vincent550102 made their first contribution in #7763
* @WhiskerEnt made their first contribution in #7761
* @Jualhosting made their first contribution in #7773
* @sleet0922 made their first contribution in #7770
* @Brunotlps made their first contribution in #7780
* @jmrcsnchz made their first contribution in #7785
Full Changelog: v2.11.3...v2.11.4
Contributors
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
broady, dunglas, and 14 other contributors
Assets 131
* caddy_2.11.4_buildable-artifact.pem
sha256:130c048be7d8843c03a084c9438b04c089265a2ba57d8efba37a75660267bdd3
3.21 KB 2026-06-03T04:37:27Z
* caddy_2.11.4_buildable-artifact.tar.gz
sha256:33777097f666d60d78bfb74df06978c933f32aa5a0d4ce0b0c5d028489984187
10.8 MB 2026-06-03T04:37:18Z
* caddy_2.11.4_buildable-artifact.tar.gz.sig
sha256:d6952fc538acc08e061d1c06a5cfbbac991301f6666dc4d9a72f75ac3386a4c6
96 Bytes 2026-06-03T04:37:27Z
* caddy_2.11.4_checksums.txt
sha256:7bfa272f3ece3ac987c1e06cd3c0acf126749d88110c20d7b83dcea3caaf0080
6.61 KB 2026-06-03T04:37:23Z
* caddy_2.11.4_checksums.txt.pem
sha256:438fc6a07e129eb89b30ef3aec8385038c3ddd82eb6019885c75a1cea9039b48
3.21 KB 2026-06-03T04:37:34Z
* caddy_2.11.4_checksums.txt.sig
sha256:8d9cbad73b412de3fe1cafe2cd8bf99d40d27965b98b217a9a3b8fe7fe687002
96 Bytes 2026-06-03T04:37:34Z
* caddy_2.11.4_freebsd_amd64.pem
sha256:88d3ef9d589e9b563139baf661c11c99248c3ca1f6b4bb5acd992de7c6babfbd
3.21 KB 2026-06-03T04:37:26Z
* caddy_2.11.4_freebsd_amd64.sbom
sha256:61421f7d8b919f2e25db740a5b8660f2d77698355c6b61a9f385416d419877d4
138 KB 2026-06-03T04:37:23Z
* caddy_2.11.4_freebsd_amd64.sbom.pem
sha256:5fa858be3d93afa9e3c22f1138409186f488523fce127668a72733845abc9512
3.21 KB 2026-06-03T04:37:33Z
* caddy_2.11.4_freebsd_amd64.sbom.sig
sha256:89773d3e85c4c4cbc7d62c2ba3a227d12d1721404baccd8fbcc8cff04fc78a96
96 Bytes 2026-06-03T04:37:33Z
* Source code (zip)
2026-06-03T03:54:40Z
* Source code (tar.gz)
2026-06-03T03:54:40Z
* Show all 131 assets Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 34 amddeus, pothi, goremykin, uwu-420, superboom12s, ArGul-0, lionslair, eddyizm, egoan82, SenseiDeElite, and 24 more reacted with thumbs up emoji 😄 5 amddeus, ArGul-0, banthes, SenseiDeElite, and andrew121410 reacted with laugh emoji 🎉 26 amddeus, steffenbusch, simonmader17, 7-zete-7, slymntrm, uwu-420, 0xfeeddeadbeef, AntonioBerna, ArGul-0, gandie, and 16 more reacted with hooray emoji ❤️ 23 amddeus, uwu-420, xaabi6, AntonioBerna, ArGul-0, soufianeamini, albertjoelbg, cgwhouse, mk12, SenseiDeElite, and 13 more reacted with heart emoji 🚀 14 amddeus, slymntrm, uwu-420, erwinkramer, ArGul-0, derhuerst, ederheisler, egoan82, SenseiDeElite, dikesh, and 4 more reacted with rocket emoji 👀 5 amddeus, ArGul-0, SenseiDeElite, andrew121410, and 270734714 reacted with eyes emoji
All reactions
* 👍 34 reactions
* 😄 5 reactions
* 🎉 26 reactions
* ❤️ 23 reactions
* 🚀 14 reactions
* 👀 5 reactions
75 people reacted
v2.11.3
v2.11.3
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 12 May 15:18
v2.11.3
This tag was signed with the committer’s verified signature.
francislavoie Francis Lavoie
SSH Key Fingerprint: 7P4LDj+mglsDSwpCoQU51fWKsU8A1wj9LZLtRC+Qzv0
Verified
Learn about vigilant mode.
cc58caa
This release improves several aspects of Caddy with minor features, bug fixes, and security patches. Thank you to everyone and their bots who contributed to help make this release the best one yet!
Security patches:
* fastcgi: Carrying over a patch from FrankenPHP for a bug that could allow non-PHP files to be executed; collaborated on by @dunglas, @KC1zs4, and @chenjj.
* vars: A more thorough fix for GHSA-m2w3-8f23-hxxf, collaborated by @everping and @vnxme.
* admin: Array index normalization to prevent remote admin socket auth bypass, by @Amemoyoi and bot.
* admin: More rigorous path prefix matching to prevent remote admin socket auth bypass, by @Amemoyoi and bot.
We've also merged a couple PRs that fix upstream security bugs in other projects like quic-go and CertMagic. Thank you to @marten-seemann for maintaining quic-go so diligently!
What's Changed
* caddyhttp: Sync placeholder expansion in vars and vars_regexp by @vnxme in #7573
* caddytls: Avoid ACME fallback for implicit Tailscale *.ts.net policies by @steadytao in #7577
* chore: Resolve recent CI failures by @mholt in #7593
* caddytls: Consolidate empty APs more smartly by @mholt in #7567
* rewrite: skip query rename when source key is absent by @steadytao in #7599
* root: introduce down-propagating Helper.BlockState for other directives/plugins to use by @henderkes in #7594
* http: make zstd checksum configurable by @ottenhoff in #7586
* notify: Always send "READY=1" even after an error by @francislavoie in #7597
* reverseproxy: Fix check for header_up Host {upstream_hostport} redundancy by @yubiuser in #7564
* caddytls: Expand placeholders in dns_challenge override_domain tls parameter by @pberkel in #7609
* tls: add system and combined CA pool modules by @HarshPatel5940 in #7406
* vars: Don't expand placeholders in values by @vnxme in #7629
* build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #7637
* build(deps): bump the all-updates group across 1 directory with 11 updates by @dependabot[bot] in #7641
* reverseproxy: make stream copy buffer size configurable by @steadytao in #7627
* vars: Add matcher placeholder handling tests by @steadytao in #7640
* build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #7621
* logging: Add journald encoder wrapper by @steadytao in #7623
* caddyfile: Improve import/global options UX for imports before global options by @steadytao in #7642
* chore: replace interface{} with any for modernization by @tsinglua in #7571
* chore: bump timberjack to v1.4.1 by @DeRuina in #7618
* logging: Preserve ts for journald-wrapped JSON logs by @steadytao in #7644
* fileserver: show symlink targets verbatim (#7476) by @maxtruxa in #7579
* fix(caddyfile): {block} in snippet by @prettysunflower in #7558
* caddyhttp: Document missing placeholders for escaped URI and prefixed query by @steffenbusch in #7659
* chore: add AGENTS.md by @mohammed90 in #7652
* build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.0 by @dependabot[bot] in #7655
* admin: Redact sensitive request headers in API logs by @steadytao in #7578
* reverseproxy: add lb_retry_match condition on response status by @seroperson in #7569
* caddyhttp: prefer port 443 in auto-HTTPS and add tests by @mholt in #7666
* fix: Propagate ECH keys to the QUIC listener by @steadytao in #7670
* chore: Use atomics where appropriate by @francislavoie in #7648
* metrics: Implement pushing via OLTP by @dunglas in #7664
* logging: Add regression coverage for rotated file mode by @steadytao in #7620
* httpcaddyfile: Inherit global ACME issuer settings in tls shortcuts by @steadytao in #7617
* build(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 by @dependabot[bot] in #7668
* admin: require path segment boundary in remote access control by @Amemoyoi in #7673
* reverseproxy: Add ability to clear dynamic upstreams cache during retries by @mholt in #7662
* listeners: clean up stale Unix socket files on Windows by @mfrischknecht in #7676
* admin: reject non-canonical config array indices by @Amemoyoi in #7592
* caddytls: Expand ACME credentials by @tribut in #7554
* caddyauth: set user placeholders before auth rejection by @cyphercodes in #7685
* caddyauth: revert user placeholders on auth rejection by @steadytao in #7688
* chore: Fix golangci-lint 2.12.1 findings by @steadytao in #7690
* httpcaddyfile: accept duration strings for log sampling interval by @tomholford in #7694
* tls: Add alpn to managed HTTPS records by @steadytao in #7653
* caddytls: avoid duplicate automation for wildcard-covered hosts by @Rijul-A in #7697
* docs: add documentation for fileExists and fileStat template functions by @steffenbusch in #7700
* rewrite: escape file matcher paths before rewriting by @cyphercodes in #7683
* metrics: Add nil check for metricsHandler in AdminMetrics.serveHTTP by @Br1an67 in #7553
New Contributors
* @steadytao made their first contribution in #7577
* @henderkes made their first contribution in #7594
* @yubiuser made their first contribution in #7564
* @pberkel made their first contribution in #7609
* @HarshPatel5940 made their first contribution in #7406
* @tsinglua made their first contribution in #7571
* @maxtruxa made their first contribution in #7579
* @seroperson made their first contribution in #7569
* @Amemoyoi made their first contribution in #7673
* @mfrischknecht made their first contribution in #7676
* @tribut made their first contribution in #7554
* @cyphercodes made their first contribution in #7685
* @tomholford made their first contribution in #7694
* @Rijul-A made their first contribution in #7697
* @Br1an67 made their first contribution in #7553
Full Changelog: v2.11.2...v2.11.3
Contributors
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
dunglas, tribut, and 27 other contributors
Assets 131
Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 30 ArGul-0, SmollaL1st, SenseiDeElite, Merlin-Clos, SanokKule, klimekop6, uwu-420, goremykin, tearsen, manticoreroko, and 20 more reacted with thumbs up emoji 😄 3 ArGul-0, SenseiDeElite, and sweetoonion reacted with laugh emoji 🎉 13 ArGul-0, GreyXor, Popo8701, SenseiDeElite, uwu-420, methbkts, steffenbusch, whiztech, alirezapkg, fgilio, and 3 more reacted with hooray emoji ❤️ 11 ArGul-0, ChrisIsEditing, SenseiDeElite, firescry, alexisometric, uwu-420, SeaweedbrainCY, davidetogni, alirezapkg, hl2guide, and sweetoonion reacted with heart emoji 🚀 8 ArGul-0, 0xfeeddeadbeef, SenseiDeElite, dikesh, uwu-420, derhuerst, egoan82, and xgimp reacted with rocket emoji 👀 5 ArGul-0, gandie, SenseiDeElite, uwu-420, and sweetoonion reacted with eyes emoji
All reactions
* 👍 30 reactions
* 😄 3 reactions
* 🎉 13 reactions
* ❤️ 11 reactions
* 🚀 8 reactions
* 👀 5 reactions
47 people reacted
v2.11.2
v2.11.2
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 06 Mar 02:43
v2.11.2
This tag was signed with the committer’s verified signature.
mholt Matt Holt
SSH Key Fingerprint: +tijH5/rb2AXEwtxWzV3XtUZlfmJpAXA5Z9FMsCVwyo
Verified
Learn about vigilant mode.
ffb6ab0
This commit was signed with the committer’s verified signature.
mholt Matt Holt
SSH Key Fingerprint: +tijH5/rb2AXEwtxWzV3XtUZlfmJpAXA5Z9FMsCVwyo
Verified
Learn about vigilant mode.
Caddy 2.11.2 contains numerous bug fixes and enhancements! I know that's a lame summary but it's really all over the place.
Highlights
* Reverse proxy got a lot of love with certain edge cases related to PROXY protocol, health check port, and closing body on retries. Dynamic upstreams are now tracked which enables passive health checking.
* Performance improvements for metrics.
* New tls_resolvers global option to control DNS resolvers for all sites when using the ACME DNS challenge.
* Log rolling now supports zstd compression; deprecated roll_gzip, which will be removed in the future. Use roll_compression instead.
* Refined logging and some error messages.
* Fixed a bug in rewrite handler that could cause some URIs to not be rewritten when URI path is an escaped form of target path. Thanks to @MaherAzzouzi for the report.
Security fixes
This release fixes two CVEs.
* @NucleiAv reported a bug in the forward_auth directive that could permit identity injection and potential privilege escalation.
* @sammiee5311 reported that vars_regexp double-expanded placeholders, allowing some unusual configs to reveal secrets.
In addition:
* Built on Go 1.26.1 (also released today) which patches several CVEs.
* Our documentation has been updated to note that file system case sensitivity may affect the behavior of the hide option of the file_server handler.
Thank you to everyone who contributed, and for our ongoing sponsorships that make this development possible!
Changelog
* 88616e8 api: Add all in-flight requests /reverse_proxy/upstreams (Fixes #7277) (#7517)
* d935a69 autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)
* 5d20adc build(deps): bump github.com/smallstep/certificates (#7535)
* 9371ee6 build(deps): bump the actions-deps group across 1 directory with 12 updates (#7536)
* 9798f69 caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)
* dc36082 caddyhttp: Collect metrics once per route instead of per handler (#7492)
* 174fa2d caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)
* eac02ee caddyhttp: Limit empty Host check to HTTP/1.1
* f283062 cmd: Custom binary names through CustomBinaryName and CustomLongDescription (#7513)
* cd9e166 cmd: Pass configFile, not configFlag, for reload command (#7532)
* 7b34e31 core: Check whether @id is unique (#7002)
* 566e710 fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)
* 2dd3852 fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)
* 2dbcdef forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)
* ce203aa go.mod: Upgrade x/net
* 76b198f http: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)
* 7ffb640 httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) (#7507)
* 45cf61b logging: Ensure slog error level logs don't print stack traces (#7512)
* 9873752 logging: Support zstd roll compression (#7515)
* 294dfff logging: add DirMode options and propagate FileMode to rotations (#7335)
* a6acb39 proxyproto: Generated test coverage (#7540)
* 11b56c6 reverseproxy: Fix health_port being ignored in health checks (#7533)
* db29860 reverseproxy: Track dynamic upstreams, enable passive healthchecking (#7539)
* d7b21c6 reverseproxy: fix tls dialing w/ proxy protocol (#7508)
* a5e7c6e reverseproxy: prevent body close on dial-error retries (#7547)
* 2ab043b reverseproxy: query escape request urls when proxy protocol is enabled (#7537)
* fbfb8fc rewrite: Force recomputing path when escaped path matches rewrite target
* f145bce tls: Add tls_resolvers global option for DNS challenge configuration (#7297)
Contributors
*
*
*
*
id, sammiee5311, and 2 other contributors
Assets 131
Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 18 egoan82, andrew121410, horlarme, war59312, SenseiDeElite, uwu-420, kfen, Yujonpradhananga, FHU-yezi, solt87, and 8 more reacted with thumbs up emoji 😄 2 SenseiDeElite and fiveneins reacted with laugh emoji 🎉 11 steffenbusch, baujahr, Pocok256, mfscpayload-690, andrew121410, whiztech, SenseiDeElite, uwu-420, xgimp, krzysion, and Heliodex reacted with hooray emoji ❤️ 22 roobie, mazetintin-source, TheRettom, ChrisIsEditing, mariannefeng, eddyizm, daiimus, BkSouX, CAPCHIK, expertblink, and 12 more reacted with heart emoji 🚀 7 deemru, egoan82, andrew121410, SenseiDeElite, uwu-420, dikesh, and xgimp reacted with rocket emoji 👀 1 SenseiDeElite reacted with eyes emoji
All reactions
* 👍 18 reactions
* 😄 2 reactions
* 🎉 11 reactions
* ❤️ 22 reactions
* 🚀 7 reactions
* 👀 1 reaction
47 people reacted
v2.11.1
v2.11.1
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 23 Feb 04:21
v2.11.1
This tag was signed with the committer’s verified signature.
francislavoie Francis Lavoie
SSH Key Fingerprint: 7P4LDj+mglsDSwpCoQU51fWKsU8A1wj9LZLtRC+Qzv0
Verified
Learn about vigilant mode.
6610e2f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.
There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.
Special Sponsor Shoutout
Extra big thanks to our major sponsors:
* ZeroSSL
* Stripe
* Railway
They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!
Notable changes
* Encrypted ClientHello (ECH) keys are rotated automatically.
* Time-rolling options for logs.
* SIGUSR1 can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.
* Reverse proxy now automatically rewrites the Host header to the address of the upstream when the upstream is HTTPS (#7454)
* log_append can now log request and response bodies, useful for debugging.
* Our project now implements and requires Assistance Disclosures (for AI/LLMs) on issues, PRs, comments, replies, reviews, etc.
* Many, many other minor improvements and bug fixes.
Thank you to everyone who was involved this release!
⚠️ Security patches
* fastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
* admin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)
* caddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.
* caddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.
* caddytls: CVE-2026-27586 by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.
* caddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.
🚨 Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your go.mod file. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses. (Then, turn Dependabot off.)
What's Changed
* caddyhttp: add replacer placeholders for escaped values by @Qusic in #7181
* AI assistance disclosure by @mholt in #7212
* caddyfile: Prevent trailing space on line before env variable - Fixes #6881 by @arpansaha13 in #7215
* add: encode header Content-Type graphql-response by @aro-lew in #7214
* caddyhttp: Removing redundant middleware next copy by @maxcelant in #7217
* build(deps): bump the all-updates group with 17 updates by @dependabot[bot] in #7236
* build(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in #7237
* encode: fix response corruption when handle_errors is used by @Siomachkin in #7235
* Fix PKI creation when auto_https is disabled (#7211) by @Siomachkin in #7238
* logging: Buffer the logs before config is loaded by @francislavoie in #7245
* fileserver: set Content-Length for precompressed files by @WeidiDeng in #7251
* refactor: use WaitGroup.Go to simplify code by @mickychang9 in #7253
* caddyfile: Allow block to do nothing if nothing passed to import by @BeeJay28 in #7206
* logging: Adjustments to BufferedLog to keep logs in the correct order by @francislavoie in #7257
* caddyhttp: Prevent commas in header values from being split in CLI commands by @gilbsgilbs in #7268
* update quic-go to v0.54.1 by @marten-seemann in #7273
* chore: ugh, lint fix... by @mohammed90 in #7275
* caddypki: check intermediate lifetime to actual root cert lifetime by @u5surf in #7272
* refactor: omit unnecessary reassignment by @asttool in #7276
* core: use reflect.TypeFor to check for encoding/json.RawMessage by @WeidiDeng in #7274
* core: Reloading with SIGUSR1 if config never changed via admin by @francislavoie in #7258
* build(deps): bump the actions-deps group with 8 updates by @dependabot[bot] in #7284
* httpcaddyfile: Add missing DNS challenge check for acme_dns by @rightaditya in #7270
* httpcaddyfile: Map default_bind to BindHost in globalACMEDefaults by @Monviech in #7278
* Argon2id Support for Basic Auth by @GreyXor in #7186
* update quic-go to v0.55.0 by @marten-seemann in #7288
* reverse_proxy: use http1 for outbound tls requests with placeholder t… by @WeidiDeng in #7296
* caddyhttp: Add server options keepalive_idle and keepalive_count by @joshuamcbeth in #7298
* chore: fix some comments by @wyrapeseed in #7303
* logging: Switch from lumberjack to timberjack, add time-rolling options by @aeris in #7244
* reverseproxy: Use http1.1 upgrade for websocket for extended connect of http2 and http3. by @tonyb486 in #7305
* caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers by @cseufert in #7265
* caddyhttp: wrap accepted connection to suppress tls.ConnectionState by @WeidiDeng in #7247
* logging: fix multiple regexp filters on same field (fixes #7049) by @s2010 in #7061
* intercept: use already buffered response if possible when intercepting by @WeidiDeng in #7028
* listeners: Add support for named socket activation by @Siomachkin in #7243
* reverseproxy: do not disable keepalive if proxy protocol is used by @WeidiDeng in #7300
* metrics: resolve per-host inifinite cardinality by @mohammed90 in #7306
* reverseproxy: use http.Protocols to handle h2c requests by @WeidiDeng in #6990
* refactor: use reflect.TypeFor by @wyrapeseed in #7313
* build(deps): bump the all-updates group across 1 directory with 2 updates by @dependabot[bot] in #7307
* build(deps): bump github.com/slackhq/nebula from 1.9.5 to 1.9.7 by @dependabot[bot] in #7315
* feat: switch to autoexport for OpenTelemetry span exporter by @PKeidel in #7317
* reverse_proxy: set default values for keepalive if only some of them are set by @WeidiDeng in #7318
* fix quote within quotes formatted incorrectly by fmt by @keystroke3 in #7045
* caddytls: correct documentation of LeafFolderLoader by @mohammed90 in #7327
* fix golangci-lint error G602 in caddyhttp by @cdenicola in #7334
* feat: allow customizing the Server header by @dunglas in #7338
* update quic-go to v0.56.0, enable qlog for HTTP/3 by @marten-seemann in #7345
* build(deps): bump the all-updates group with 4 updates by @dependabot[bot] in #7333
* feat: custom slog handlers for modules (log contextual data) by @dunglas in #7346
* ci: implement new release flow by @mohammed90 in #7341
* reverse_proxy: use interfaces to modify the behaviors of the transports by @WeidiDeng in #7353
* build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in #7355
* update quic-go to v0.57.0 by @marten-seemann in #7359
* refactor: replace HasSuffix+TrimSuffix with CutSuffix by @ledigang in #7357
* Fix retries for requests with bodies by @chebyrash in #7360
* ...
Read more
Contributors
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
willnorris, aeris, and 49 other contributors
Assets 131
Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 29 francislavoie, pothi, lifansama, uwu-420, mkalus, richwalm, harkabeeparolus, facl, trevordavies095, solt87, and 19 more reacted with thumbs up emoji 😄 4 lifansama, SenseiDeElite, andrew121410, and psviderski reacted with laugh emoji 🎉 16 francislavoie, lifansama, GreyXor, Angelfisch, whiztech, uwu-420, abdelfattahradwan, augusto-sb, armadi1809, danlsgiga, and 6 more reacted with hooray emoji ❤️ 20 francislavoie, ChrisIsEditing, lifansama, uwu-420, codecat, goremykin, trevordavies095, danlsgiga, firescry, steverusso, and 10 more reacted with heart emoji 🚀 17 francislavoie, dikesh, steffenbusch, lifansama, mikouaji, Angelfisch, uwu-420, derhuerst, danlsgiga, mohammed90, and 7 more reacted with rocket emoji 👀 1 SenseiDeElite reacted with eyes emoji
All reactions
* 👍 29 reactions
* 😄 4 reactions
* 🎉 16 reactions
* ❤️ 20 reactions
* 🚀 17 reactions
* 👀 1 reaction
52 people reacted
v2.11.0-beta.2
v2.11.0-beta.2 Pre-release
Pre-release
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 06 Jan 18:02
v2.11.0-beta.2
This tag was signed with the committer’s verified signature.
mholt Matt Holt
SSH Key Fingerprint: +tijH5/rb2AXEwtxWzV3XtUZlfmJpAXA5Z9FMsCVwyo
Verified
Learn about vigilant mode.
7b031e1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Welcome to the second beta version of 2.11. We are closer to a final release. This includes some minor new features and enhancements, and a fix for the ZeroSSL API issuer.
Thank you to everyone who contributed!
Changelog
* 8a87bb3 build(deps): bump github.com/smallstep/certificates (#7381)
* 7b031e1 build(deps): bump the all-updates group across 1 directory with 12 updates (#7421)
* be5f49f caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true (#7372)
* 6e0cbd0 caddyhttp: create a placeholder for and log ech status (#7328)
* 4037d05 caddyhttp: {http.request.body_base64} placeholder (#7367)
* 7ebe72b caddypki: Add support for multiple intermediates in signing chain (#7057)
* 3c9c67e caddytls: ECH key rotation (#7356)
* 374b7a6 caddytls: fix preferred chains options by appending values instead of replacing (#7387)
* 6a4296b caddytls: panic when using tls.ca_pool.source.http -> tls.ca (#7393)
* 9eabd44 cmd: Add --json flag to list-modules command (#7409)
* b2d21f6 go.mod: Upgrade CertMagic and ZeroSSL deps
* 34fd2df go.mod: update tscert package to latest (aea342f6) (#7397)
* decc8a4 logging: log_append Early option, Supports {http.response.body} (#7368)
* 409a072 notify: implement windows service status and error notifications (#7389)
* 1f1be3f tracing: Add span attributes to tracing module (#7269)
What's Changed
* build(deps): bump github.com/smallstep/certificates from 0.28.4 to 0.29.0 by @dependabot[bot] in #7381
* caddypki: Add support for multiple intermediates in signing chain by @hslatman in #7057
* caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true by @francislavoie in #7372
* multiplexing: Introduce packet conn wrappers by @vnxme in #7180
* docs: add maybe template function documentation by @steffenbusch in #7388
* caddyhttp: create a placeholder for and log ech status by @WeidiDeng in #7328
* caddytls: fix preferred chains options by appending values instead of replacing by @okrc in #7387
* feat: mark Assert* functions as test helpers by @dunglas in #7380
* caddytls: ECH key rotation by @mholt in #7356
* caddytls: panic when using tls.ca_pool.source.http -> tls.ca by @Zenexer in #7393
* notify: implement windows service status and error notifications by @FreyreCorona in #7389
* caddyhttp: {http.request.body_base64} placeholder by @francislavoie in #7367
* chore: update tscert package to latest (aea342f6) by @willnorris in #7397
* logging: log_append Early option, Supports {http.response.body} by @francislavoie in #7368
* update quic-go to v0.58.0 by @marten-seemann in #7404
* cmd: add --json flag to list-modules by @pauloappbr in #7409
* Add span attributes to tracing module by @felix-hilden in #7269
* readme: fix fence by @mohammed90 in #7416
* build(deps): bump the all-updates group across 1 directory with 12 updates by @dependabot[bot] in #7421
New Contributors
* @okrc made their first contribution in #7387
* @Zenexer made their first contribution in #7393
* @FreyreCorona made their first contribution in #7389
* @pauloappbr made their first contribution in #7409
* @felix-hilden made their first contribution in #7269
Full Changelog: v2.11.0-beta.1...v2.11.0-beta.2
Contributors
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
willnorris, dunglas, and 14 other contributors
Assets 149
Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 20 egoan82, uwu-420, Rick-Phoenix, firescry, ardhi21, nothingtosurprise, mikouaji, ludwig-austermann, steffenbusch, k4rtikp4til, and 10 more reacted with thumbs up emoji 🎉 8 GreyXor, uwu-420, danlsgiga, xgimp, firengate, lifansama, PKeidel, and psviderski reacted with hooray emoji ❤️ 6 uwu-420, hoho4190, ChrisIsEditing, firengate, brolnickij, and psviderski reacted with heart emoji 🚀 5 uwu-420, xgimp, dikesh, firengate, and psviderski reacted with rocket emoji
All reactions
* 👍 20 reactions
* 🎉 8 reactions
* ❤️ 6 reactions
* 🚀 5 reactions
27 people reacted
v2.11.0-beta.1
v2.11.0-beta.1 Pre-release
Pre-release
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 04 Dec 20:48
v2.11.0-beta.1
This tag was signed with the committer’s verified signature.
francislavoie Francis Lavoie
SSH Key Fingerprint: 7P4LDj+mglsDSwpCoQU51fWKsU8A1wj9LZLtRC+Qzv0
Verified
Learn about vigilant mode.
df9386f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Welcome to the beta version of 2.11. This is the first release made by our new, automated release process developed by @mohammed90 that was carried out and approved entirely by our maintainer team (together with @francislavoie) without intervention from @mholt, the original Caddy author. This represents a significant step forward in project autonomy and growth, ensuring that the project's stability and longevity is not reliant upon a single person.
This first beta release was primarily to test our new workflow, so there's still a couple things left to do before the stable release.
Featured here are numerous, mostly minor, bug fixes and enhancements, mostly affecting edge cases or niche corners of the software; for example, proxying H2C or HTTP/3, obscure Caddyfile scenarios, and named socket activation.
Some notable changes:
* SIGUSR1 can be used to reload configuration only if it was loaded from a file using the CLI, and not changed by the API since then.
* We replaced "lumberjack", our logging library, with a fork "timberjack" that supports the oft-requested time-rolling ability.
* Caddy can now bind listeners with named socket activation.
Before the final release, we expect ECH key rotation to be enabled as well as a few other patches/features
Thank you to our sponsors and contributors for all that you do!
Changelog
* 5473eb9 encode: fix response corruption when handle_errors is used (#7235)
* 13a4ec7 basicauth: Implement argon2id (#7186)
* 6d90c77 build(deps): bump github.com/slackhq/nebula from 1.9.5 to 1.9.7 (#7315)
* eead249 build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#7355)
* 2d0f3f8 build(deps): bump the actions-deps group with 5 updates (#7237)
* afbdcec build(deps): bump the actions-deps group with 8 updates (#7284)
* cd1c203 build(deps): bump the all-updates group across 1 directory with 2 updates (#7307)
* 39357d3 build(deps): bump the all-updates group with 17 updates (#7236)
* 786d537 build(deps): bump the all-updates group with 3 updates (#7376)
* 07d2aaf build(deps): bump the all-updates group with 4 updates (#7333)
* 0ba8786 caddyfile: Allow block to do nothing if nothing passed to import (#7206)
* 92c8bc7 caddyfile: fix nested quotes formatted incorrectly by fmt (#7045)
* 6d73d85 caddyfile: prevent adding trailing space on line before env variable (#7215)
* d7185fd caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers (#7265)
* de6b780 caddyhttp: Add server options keepalive_idle and keepalive_count (#7298)
* e0a8f95 caddyhttp: Normalize (lowercase) {label.N} placeholders
* 5e29536 caddyhttp: add replacer placeholders for escaped values (#7181)
* 8285eba caddyhttp: allow customizing the Server header (#7338)
* bc0e184 caddyhttp: omit unnecessary reassignment (#7276)
* 3553cfb caddyhttp: remove redundant middleware next copy (#7217)
* 1ce2a13 caddyhttp: wrap accepted connection to suppress tls.ConnectionState (#7247)
* d9cc24f caddypki: Disable internal auto-CA when auto_https is disabled (fix #7211) (#7238)
* 1e82f96 caddypki: check intermediate lifetime to actual root cert lifetime (#7272)
* 38848f7 caddytls: Allow disabling distributed solving (except http-01)
* ddec183 caddytls: correct documentation of LeafFolderLoader (#7327)
* f5c3094 cmd: prevent commas in header values from being split (#7268)
* 65e0ddc core: Reloading with SIGUSR1 if config never changed via admin (#7258)
* b3f2db2 core: custom slog handlers for modules (log contextual data) (#7346)
* b2ab419 core: use reflect.TypeFor to check for encoding/json.RawMessage (#7274)
* 806fef8 encode: add graphql-response header to list (#7214)
* 2cb4267 encode: modernize, replace HasSuffix+TrimSuffix with CutSuffix (#7357)
* b462615 fileserver: set Content-Length for precompressed files (#7251)
* 0c8798f go.mod: update quic-go to v0.54.1 (#7273)
* 3c003de httpcaddyfile: Add missing DNS challenge check for acme_dns (#7270)
* 2f1d270 httpcaddyfile: Map default_bind to BindHost in globalACMEDefaults (#7278)
* a7885aa intercept: use already buffered response if possible when intercepting (#7028)
* 156ce99 listeners: Add support for named socket activation (#7243)
* 39ace45 logging: Adjustments to BufferedLog to keep logs in the correct order (#7257)
* 012b4b3 logging: Buffer the logs before config is loaded (#7245)
* 10ac7da logging: Switch from lumberjack to timberjack, add time-rolling options (#7244)
* f5f25d8 logging: fix multiple regexp filters on same field (fixes #7049) (#7061)
* 595aab8 metrics: resolve per-host inifinite cardinality (#7306)
* 57587ed refactor: use reflect.TypeFor (#7313)
* 2ec28bc reverse_proxy: use http1 for outbound tls requests with placeholder that are likely websockets (#7296)
* a6da1ac reverse_proxy: use interfaces to modify the behaviors of the transports (#7353)
* 67a9e06 reverseproxy: Fix retries for requests with bodies (#7360)
* 7fb39ec reverseproxy: Use http1.1 upgrade for websocket for extended connect of http2 and http3 (#7305)
* 8aca108 reverseproxy: do not disable keepalive if proxy protocol is used (#7300)
* abe0aca reverseproxy: set default values for keepalive if only some of them are set (#7318)
* 1e21b66 reverseproxy: use http.Protocols to handle h2c requests (#6990)
* b54e870 tracing: switch to autoexport for OpenTelemetry span exporter (#7317)
What's Changed
* caddyhttp: add replacer placeholders for escaped values by @Qusic in #7181
* AI assistance disclosure by @mholt in #7212
* caddyfile: Prevent trailing space on line before env variable - Fixes #6881 by @arpansaha13 in #7215
* add: encode header Content-Type graphql-response by @aro-lew in #7214
* caddyhttp: Removing redundant middleware next copy by @maxcelant in #7217
* build(deps): bump the all-updates group with 17 updates by @dependabot[bot] in #7236
* build(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in #7237
* encode: fix response corruption when handle_errors is used by @Siomachkin in #7235
* Fix PKI creation when auto_https is disabled (#7211) by @Siomachkin in #7238
* logging: Buffer the logs before config is loaded by @francislavoie in #7245
* fileserver: set Content-Length for precompressed files by @WeidiDeng in #7251
* refactor: use WaitGroup.Go to simplify code by @mickychang9 in #7253
* caddyfile: Allow block to do nothing if nothing passed to import by @BeeJay28 in #7206
* logging: Adjustments to BufferedLog to keep logs in the correct order by @francislavoie in #7257
* caddyhttp: Prevent commas in header values from being split in CLI commands by @gilbsgilbs in #7268
* update quic-go to v0.54.1 by @marten-seemann in #7273
* chore: ugh, lint fix... by @mohammed90 in #7275
* caddypki: check intermediate lifetime to actual root cert lifetime by @u5surf in #7272
* refactor: omit unnecessary reassignment by @asttool in #7276
* core: use reflect.TypeFor to check for encoding/json.RawMessage by @WeidiDeng in #7274
* core: Reloading with SIGUSR1 if config never changed via admin by @francislavoie in #7258
* build(deps): bump the actions-deps group with 8 updates by @dependabot[bot] in #7284
* httpcaddyfile: Add missing DNS challenge check for acme_dns b...
Read more
Contributors
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
aeris, dunglas, and 29 other contributors
Assets 149
Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 26 dbrennand, Nmishin, petrhusak, eddyizm, LDeakin, egormanga, andrew121410, danlsgiga, cesg, WillemHeremans, and 16 more reacted with thumbs up emoji 😄 1 SenseiDeElite reacted with laugh emoji 🎉 13 GreyXor, danlsgiga, steffenbusch, erwinkramer, xgimp, usebeforefree, dom6770, SenseiDeElite, jrmarcello, FHU-yezi, and 3 more reacted with hooray emoji ❤️ 7 dom6770, oneingan, firescry, SenseiDeElite, ChrisIsEditing, uwu-420, and firengate reacted with heart emoji 🚀 16 pothi, danlsgiga, ddegasperi, Kunniii, xgimp, dikesh, Luiz-Trindade, dom6770, SenseiDeElite, egoan82, and 6 more reacted with rocket emoji 👀 3 SenseiDeElite, uwu-420, and firengate reacted with eyes emoji
All reactions
* 👍 26 reactions
* 😄 1 reaction
* 🎉 13 reactions
* ❤️ 7 reactions
* 🚀 16 reactions
* 👀 3 reactions
45 people reacted
v2.10.2
v2.10.2
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 23 Aug 03:10
v2.10.2
This tag was signed with the committer’s verified signature.
mholt Matt Holt
GPG key ID: 2A349DD577D586A5
Verified
Learn about vigilant mode.
551f793
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
This is a hotfix release to fix a couple critical issues from v2.10.1
What's Changed
* http: Make logger first, before TLS provisioning by @francislavoie in #7198
* httpcaddyfile: Fix acme_dns regression by @francislavoie in #7199
* caddyfile: Fix importing nested tokens for {block} by @BeeJay28 in #7189
Changelog
* 551f793 caddyfile: Fix importing nested tokens for {block} (#7189)
* 16fe83c http: Make logger first, before TLS provisioning (#7198)
* 4564261 httpcaddyfile: Fix acme_dns regression (#7199)
New Contributors
* @BeeJay28 made their first contribution in #7189
Full Changelog: v2.10.1...v2.10.2
Contributors
*
*
francislavoie and BeeJay28
Assets 149
Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 29 pothi, GopherGhaznix, erwinkramer, rafaelespinoza, matous-volf, dikesh, TrueNine, lxhao61, roland-5, steffenbusch, and 19 more reacted with thumbs up emoji 🎉 8 whiztech, GreyXor, francoism90, hongmd, github-actions[bot], xgimp, firengate, and Heliodex reacted with hooray emoji ❤️ 16 hoho4190, davidetogni, ChrisIsEditing, lxhao61, firescry, dzyanino, roland-5, nabbisen, francoism90, jpizquierdo, and 6 more reacted with heart emoji 🚀 7 github-actions[bot], hl2guide, dikesh, xgimp, firengate, derhuerst, and Heliodex reacted with rocket emoji 👀 2 handokota and firengate reacted with eyes emoji
All reactions
* 👍 29 reactions
* 🎉 8 reactions
* ❤️ 16 reactions
* 🚀 7 reactions
* 👀 2 reactions
46 people reacted
v2.10.1
v2.10.1
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 22 Aug 16:14
v2.10.1
This tag was signed with the committer’s verified signature.
mholt Matt Holt
GPG key ID: 2A349DD577D586A5
Verified
Learn about vigilant mode.
3723e89
This commit was signed with the committer’s verified signature.
mholt Matt Holt
GPG key ID: 2A349DD577D586A5
Verified
Learn about vigilant mode.
This is probably our biggest patch release ever -- not that lots of things were broken, but there's lots of refinement happening thanks to broader adoption and contributions from many more people. Just look at the New Contributors below!
Anyway, this release does contain some bug fixes and dependency upgrades which we hope will serve you well. Let us know if there's any issues! And thank you to all who contributed, especially our reliable maintainer team!
This version of Caddy requires Go v1.25.0 or newer.
What's Changed
* update quic-go to v0.51.0 by @marten-seemann in #6972
* forwardproxy: reference correct field name in LoadModule by @mohammed90 in #6978
* fix: Remove nil arg from zapslog.NewHandler call by @IndraGunawan in #6984
* fileserver: Add support for .avif image format by @steffenbusch in #6988
* reverseproxy: use DialTLSContext for TLS if servername has placeholder by @WeidiDeng in #6955
* admin: Make sure that any admin routers are provisioned when local/re… by @Compy in #6997
* log: default logger should respect {in,ex}clude by @mohammed90 in #6995
* Move local admin server replacement logic below data structure initia… by @Compy in #7004
* acme_server: fix policy parsing in caddyfile by @mohammed90 in #7006
* implement Unwrap for interceptedResponseHandler by @WeidiDeng in #7016
* fileserver: map invalid path errors to fs.ErrInvalid, and return 400 … by @Compy in #7017
* caddyhttp: fix route sort by comparing paths without wildcard if they don't shar… by @WeidiDeng in #7015
* refactor: use maps.Copy for cleaner map handling by @eveneast in #7009
* refactor: use slices.Contains to simplify code by @tongjicoder in #7039
* chore: upgrade .golangci.yml and workflow to v2 by @mohammed90 in #6924
* build(deps): bump golangci/golangci-lint-action from 6 to 8 by @dependabot[bot] in #7044
* fix: crash - null check on event origin by @suxatcode in #7047
* fix: prevent error handler from overriding sub handler matchers by @Hellio404 in #6999
* client_auth: wire up leaf verifier Caddyfile by @mohammed90 in #6772
* caddyfile: reject blocks in log_skip directive by @IwatsukaYura in #7056
* build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 by @dependabot[bot] in #7058
* cmd: fix Commands function not returning all registered commands by @hslatman in #7059
* ci: add dep review, OSSF scorecard actions by @mohammed90 in #7063
* ci: add {base,head}-ref to dep review check by @mohammed90 in #7064
* core: clean up new config if it failed to run by @WeidiDeng in #7068
* chore: apply security best practices for CI by @mohammed90 in #7066
* refactor: use the built-in max/min to simplify the code by @xiaoxiangirl in #7081
* [ADD] sort buttons in grid mode by @filipRatajczak in #7089
* update quic-go to v0.53.0 by @marten-seemann in #7094
* refactor: replace HasPrefix+TrimPrefix with CutPrefix by @gopherorg in #7095
* docs: fix some minor issues in the comments by @mountdisk in #7101
* httpcaddyfile: Validates TLS DNS challenge options by @francislavoie in #7099
* chore: fix struct name in comment by @bytetigers in #7114
* reverse proxy: validate versions in http transport by @WeidiDeng in #7112
* chore: fix function in comment by @bytesingsong in #7121
* Fix: Support placeholders in header replacement search patterns by @zongzewu23 in #7117
* fileserver: specify license for embedded JavaScript by @infertux in #7127
* fix dead link by @eeemmmmmm in #7136
* update quic-go to v0.54.0 by @marten-seemann in #7138
* chore: fix minor issue in comment by @pingshuijie in #7140
* refactor: use slices.Equal to simplify code by @minxinyi in #7141
* ci: reduce dependabot spam by @mohammed90 in #7078
* fix(provisioning): Context.App or Context.AppIfConfigured will return (val, nil) even if the app failed to provision or validate the first time by @alexandre-daubois in #7070
* build(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #7142
* Use KeepAliveConfig to pass keepalive_interval to listener's accepted sockets by @joshuamcbeth in #7151
* build(deps): bump the all-updates group across 1 directory with 17 updates by @dependabot[bot] in #7155
* cmd: Allow caddy adapt to read from stdin by @bosdhill in #7163
* feat: add bcrypt cost parameter to hash-password by @GreyXor in #7149
* fix typo in bcrypt cost flag name by @GreyXor in #7168
* chore: fix inconsistent function name in comment by @youzichuan in #7174
* caddytls: fix regression in external certificate manager support by @quagsirus in #7179
* http: free up quic listener when stopping by @WeidiDeng in #7177
* chore: bump Go to v1.25 by @dunglas in #7184
* caddyhttp: refactor to use reflect.TypeFor by @cuiweixie in #7187
* refactor: use a more modern writing style to simplify code by @joemicky in #7182
* http: disable keepalive when KeepAliveInterval is negative by @WeidiDeng in #7158
* http: clean up listeners if some of the listeners fail to bind by @WeidiDeng in #7176
* reverse_proxy: use the new KeepAliveConfig to set probe interval by @WeidiDeng in #7157
* ci: set proper build tags in golangci and minor cleanup by @dunglas in #7183
* doc: Add a few lines about Etag file content by @Pizmovc in #7173
* file_server: set Range header for precompressed static files to force Content Length header to appear by @WeidiDeng in #7042
* caddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests by @WeidiDeng in #6961
Changelog
* 44d078b acme_server: fix policy parsing in caddyfile (#7006)
* 320c572 admin: Make sure that any admin routers are provisioned when local/re… (#6997)
* 49dac61 bcrypt: add cost parameter to hash-password (#7149)
* 4bfc3b9 bcrypt: wrong cost flag name (#7168)
* 4b01d77 build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 (#7058)
* 45c9341 build(deps): bump golangci/golangci-lint-action from 6 to 8 (#7044)
* 5bc2afb build(deps): bump the actions-deps group with 6 updates (#7142)
* 007f406 build(deps): bump the all-updates group across 1 directory with 17 updates (#7155)
* 8524386 caddyhttp: Compare paths w/o wildcard if prefixes differ (#7015)
* 7590c9c caddyhttp: Free up quic listener when stopping (#7177)
* b15ed9b caddyhttp: refactor to use reflect.TypeFor (#7187)
* 14a63a2 caddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests (#6961)
* 731e6c2 caddytls: Improve ECH error logging (close #7152)
* 105eee6 caddytls: Set local_ip, not remote_ip (#6952)
* b898873 caddytls: fix regression in external certificate manager support (#7179)
* 1481c04 caddytls: wire up client_auth leaf verifier Caddyfile (#6772)
* 19ff47a cmd: Allow caddy adapt to read from stdin (#7163)
* e633d01 cmd: fix Commands function not returning all registered commands (#7059)
* 7099892...
Read more
Contributors
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
dunglas, Compy, and 33 other contributors
Assets 149
Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 29 matous-volf, overdigo, Icarus9913, lxhao61, koodimetsa, erwinkramer, nakrovati, Rick-Phoenix, mertssmnoglu, dzervelce, and 19 more reacted with thumbs up emoji 😄 3 ShadowNineX, andrew121410, and shangchiwu reacted with laugh emoji 🎉 13 baujahr, IceCodeNew, GreyXor, lxhao61, francoism90, koodimetsa, github-actions[bot], ojetepelon, quagsirus, andrew121410, and 3 more reacted with hooray emoji ❤️ 15 goremykin, jpizquierdo, lxhao61, francoism90, ahndmal, davidetogni, firescry, dcalixto, pothi, roland-5, and 5 more reacted with heart emoji 🚀 14 solracsf, francoism90, ratnesh-maurya, boggydigital, koodimetsa, GianniBYoung, patrickmichalina, github-actions[bot], dikesh, ojetepelon, and 4 more reacted with rocket emoji
All reactions
* 👍 29 reactions
* 😄 3 reactions
* 🎉 13 reactions
* ❤️ 15 reactions
* 🚀 14 reactions
52 people reacted
v2.10.0
v2.10.0
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 18 Apr 20:46
v2.10.0
This tag was signed with the committer’s verified signature.
mholt Matt Holt
GPG key ID: 2A349DD577D586A5
Verified
Learn about vigilant mode.
fb22a26
This commit was signed with the committer’s verified signature.
mholt Matt Holt
GPG key ID: 2A349DD577D586A5
Verified
Learn about vigilant mode.
Caddy 2.10 is here! Aside from bug fixes, this release features:
* Encrypted ClientHello (ECH): This new technology encrypts the last plaintext portion of a TLS connection: the ClientHello, which includes the domain name being connected to. The draft spec for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but nuanced capability; we highly recommend reading the ECH documentation on our website.
* Post-quantum (PQC) key exchange: Caddy now supports the standardized x25519mlkem768 cryptographic group by default.
* ACME profiles: ACME profiles are an experimental draft that allow you to choose properties of your certificates with more flexibility than traditional CSR methods. For example, Let's Encrypt will issue 6-day certificates under a certain profile. Caddy may eventually use that profile by default.
* Via header: The reverse proxy now sets a Via header instead of a duplicate Server header.
* Global DNS provider: You can now specify a default "global" DNS module to use instead of having to configure it locally in every part of your config that requires a DNS provider (for example, ACME DNS challenges, and ECH). This is the dns global option in the Caddyfile, or in JSON config, it's the dns parameter in the tls app configuration.
* Wildcards used by default: Previously, Caddy would obtain individual certificates for every domain in your config literally; now wildcards, if present, will be utilized for subdomains, rather than obtaining individual certificates. This change was motivated by the novel possibility for subdomain privacy afforded by ECH. It can be overridden with tls force_automate in the Caddyfile. The experimental auto_https prefer_wildcard option has been removed.
* libdns 1.0 APIs: Many of you use DNS provider modules to solve ACME DNS challenges or to enable dynamic DNS. They implement interfaces defined by libdns to get, set, append, and delete DNS records. After 5 years of production experience, including lessons learned with ECH, libdns APIs have been updated and 1.0 beta has been tagged. DNS provider packages will need to update their code to be compatible, which will help ensure stability and well-defined semantics for the future. Several packages have already updated or are in the process of updating (cloudflare, rfc2136, and desec to name a few).
* Global dns config: Now that several components of Caddy configuration may affect DNS records (ACME challenges, ECH publication, etc.), there is a new dns global option that can be used to specify your DNS provider config in a single place. This prevents repetition of credentials for servers where all the domains are managed by a single DNS provider.
Thank you to the many contributors who have helped to make this possible! 🎉 🥳 🍾
⚠️ While have traditionally supported the last 2 minor Go versions to accommodate some distribution / package manager policies, we now only support the latest minor Go version. The privacy and security benefits added in new Go versions (such as post-quantum cryptography) are worth making available to everyone as soon as possible, rather than holding back the entire user base or maintaining multiple code compilation configurations.
Encrypted ClientHello (ECH) details
(This is a brief overview. We recommend reading the full documentation.)
Typically, server names (domain names, or "SNI") are sent in the plaintext ClientHello when establishing TLS connections. With ECH, the true server name is encrypted (and wrapped) by an "outer" ClientHello which has a generic SNI of your choosing. With many sites on the same server sharing the same outer SNI, both clients and the server have more privacy related to domain names.
Caddy implements fully automated ECH, meaning that it generates (and soon, rotates), publishes, and serves ECH configurations simply by specifying a DNS provider, and the outer/public domain name to use.
Fully automated ECH requires a DNS module built into your Caddy binary. In order for a client, such as a browser, to know it can use ECH, and what parameters to use, the server's ECH configuration must be published. This config includes the public name, cryptographic parameters, and a public key for encrypting the inner ClientHello. By convention, browsers read the standardized HTTPS-type DNS record containing a ech SvcParamKey. Caddy sets this DNS record for all domains being protected, but it needs that DNS provider module plugged in and configured in order to do this. If you are already using the DNS ACME challenge, you should already have a DNS provider plugged in. If you prefer to build Caddy from source with a DNS module, it's easy with xcaddy, for example: $ xcaddy build --with github.com/caddy-dns/cloudflare
The minimum config needed to enable ClientHello is also the recommended config, as it maximizes privacy benefits in most situations. You just need the ech global option and a DNS provider specified. Here's an example using Cloudflare as the nameserver:
Caddyfile:
{
debug # not required; recommended while testing
dns cloudflare {env.CLOUDFLARE_API_KEY}
ech ech.example.net
}
example.com {
respond "Hello there!"
}
This protects all your sites (example.com in this case) behind the public name of ech.example.net. (As another example, Cloudflare uses cloudflare-ech.com for all the sites it serves. We recommend choosing a single public domain and use it to protect all your sites.)
The outer/public name you choose should point to your server. Caddy will obtain a certificate for this name in order to facilitate safe, reliable connections for clients when needed. Without a certificate, clients may be forced to connect insecurely, or fail to connect at all, in some cases, which not only leaves them vulnerable, but also risks exposing the names of your server's sites.
Caddy then uses the specified DNS provider to publish the ECH config(s) for your various site names. It creates (or augments) HTTPS-type records for the domains of your sites (not your ECH public name). Note that DNS provider modules are independently-maintained, and may not have been tested for compatibility with HTTPS-type records. Please contact your module's maintainers if you experience issues.
If you have more advanced configuration needs, you can use the JSON configuration (more details coming soon; for now, see #6862 or look at the source code; or use caddy adapt to convert a Caddyfile to JSON).
Testing and verifying Encrypted ClientHello
First make sure Caddy runs successfully with ECH enabled (and a DNS module) in the config. You should see logs that it is generating an ECH config and publishing it to your domain name(s).
You will need to use a client that supports ECH. Some custom builds of curl do, and Firefox and modern Chrome-based browsers do as well, but you need to enable DNS-over-HTTPS or DNS-over-TLS first (since, obviously, querying DNS in plaintext for a protected domain name will expose the domain and defeat the purpose of ECH).
If reusing an existing domain name, clear your DNS cache. Firefox has a way of doing this for its cache at about:networking#dns.
Once you have a suitable client, use Wireshark to capture network packets as you load your site. You should see only the outer/public name as SNI (ServerName Indicator) values in the packet capture. If at any time you see the true site name, ECH is not working properly -- it could be a client or server issue. Before filing a bug, please try to pinpoint it as a server issue first. But definitely report server bugs! Thank you!
(Note that ECH is not automatically published for CNAME'd domains, and the domain must already have a record in the zone.)
Commits
Beta 1:
* 96c5c55 admin: fix index validation for PUT requests (#6824)
* 3644ee3 build(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (#6876)
* eacd772 build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 (#6871)
* 9996d6a build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 (#6814)
* 1115158 caddyhttp: ResponseRecorder sets stream regardless of 1xx
* 8861eae caddytest: Support configuration defaults override (#6850)
* d7764df caddytls: Encrypted ClientHello (ECH) (#6862)
* a807fe0 caddytls: Enhance ECH documentation
* bc3d497 caddytls: Fix broken refactor
* 7b8f350 caddytls: Fix sni_regexp matcher to obtain layer4 contexts (#6804)
* 2c4295e caddytls: Initial support for ACME profiles
* d7872c3 caddytls: Refactor sni matcher (#6812)
* 172136a caddytls: Support post-quantum key exchange mechanism X25519MLKEM768
* 066d770 cmd: automatically set GOMEMLIMIT (#6809)
* 1f35a8a fastcgi: improve parsePHPFastCGI docs (#6779)
* 22563a7 file_server: use the UTC timezone for modified time (#6830)
* cfc3af6...
Read more
Contributors
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
*
dunglas, jbro, and 19 other contributors
Assets 149
Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 50 Hope-IT-Works, crishoj, nakrovati, sanbei101, heikkilamarko, tensorturtle, mundry, devhaozi, FHU-yezi, stevleibelt, and 40 more reacted with thumbs up emoji 🎉 40 0x1a8510f2, temirlan-k, steffenbusch, rahilarious, Tawmy, nabbisen, timelordx, garylavayou, LetUsFlow, Hope-IT-Works, and 30 more reacted with hooray emoji ❤️ 32 firescry, timelordx, LetUsFlow, Hope-IT-Works, draylegend, g0rbe, sanbei101, winnie-sg, mundry, FHU-yezi, and 22 more reacted with heart emoji 🚀 17 0x1a8510f2, Hope-IT-Works, Angelfisch, mundry, dikesh, FHU-yezi, su0f, abellion, Marcus1Pierce, andrew121410, and 7 more reacted with rocket emoji 👀 6 0x1a8510f2, Hope-IT-Works, sanbei101, andrew121410, xgimp, and firengate reacted with eyes emoji
All reactions
* 👍 50 reactions
* 🎉 40 reactions
* ❤️ 32 reactions
* 🚀 17 reactions
* 👀 6 reactions
94 people reacted
v2.10.0-beta.4
v2.10.0-beta.4 Pre-release
Pre-release
Compare
Choose a tag to compare
Sorry, something went wrong.
Filter
Loading
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
No results found
View all tags
github-actions released this 25 Mar 03:33
v2.10.0-beta.4
This tag was signed with the committer’s verified signature.
mholt Matt Holt
GPG key ID: 2A349DD577D586A5
Verified
Learn about vigilant mode.
7672b78
This commit was signed with the committer’s verified signature.
mholt Matt Holt
GPG key ID: 2A349DD577D586A5
Verified
Learn about vigilant mode.
This prerelease is outdated. Please see the latest release for notes. Thanks!
Assets 149
Loading
Uh oh!
There was an error while loading. Please reload this page.
👍 10 harkabeeparolus, longit644, mohammed90, nocive, macsign, alternativc, adarshmadrecha, ThorTuwy, itxw, and firengate reacted with thumbs up emoji ❤️ 5 nabbisen, hoho4190, alternativc, adarshmadrecha, and firengate reacted with heart emoji 🚀 6 matthewpi, hongmd, dikesh, alternativc, adarshmadrecha, and firengate reacted with rocket emoji
All reactions
* 👍 10 reactions
* ❤️ 5 reactions
* 🚀 6 reactions
15 people reacted
Previous 1 2 3 4 5 … 13 14 Next
Previous Next
Footer
© 2026 GitHub, Inc.
Footer navigation
* Terms
* Privacy
* Security
* Status
* Community
* Docs
* Contact
* Manage cookies
* Do not share my personal information
You can’t perform that action at this time.
İpucu: Paylaşmak veya yoksayma listelerine eklemek için metni vurgulayın.
— Download difference patch
Şimdilik, Farklar grafiksel olarak değil metin üzerinde gerçekleştirilir, yalnızca en son ekran görüntüsü mevcuttur.
Ekran görüntüsü için Playwright/WebDriver'ın etkinleştirilmesi gerekir