feat(deps): update caddyserver/caddy v2.10.2 → v2.11.1#1526
Merged
truecharts-admin merged 1 commit intomainfrom Feb 23, 2026
Merged
feat(deps): update caddyserver/caddy v2.10.2 → v2.11.1#1526truecharts-admin merged 1 commit intomainfrom
truecharts-admin merged 1 commit intomainfrom
Conversation
📦 App Size AnalysisNote Comparing 📈 Size Comparison Table
|
Crow-Control
approved these changes
Feb 23, 2026
Member
Crow-Control
left a comment
Crow-Control
left a comment
There was a problem hiding this comment.
Auto approved automated PR
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.10.2→2.11.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
caddyserver/caddy (caddyserver/caddy)
v2.11.1Compare Source
Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.
There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.
Special Sponsor Shoutout
Extra big thanks to our major sponsors:
They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!
Notable changes
SIGUSR1can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.log_appendcan now log request and response bodies, useful for debugging.Thank you to everyone who was involved this release!
CVE-2026-27590by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.CVE-2026-27589by @1seal - Cross-origin requests attempted withno-corsmode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)CVE-2026-27588by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.CVE-2026-27587by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.CVE-2026-27586by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.CVE-2026-27585by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.What's Changed
blockto do nothing if nothing passed toimportby @BeeJay28 in #7206SIGUSR1if config never changed via admin by @francislavoie in #7258acme_dnsby @rightaditya in #7270keepalive_idleandkeepalive_countby @joshuamcbeth in #7298lumberjacktotimberjack, add time-rolling options by @aeris in #7244trusted_proxies_unixfor trusting unix socketX-Forwarded-*headers by @cseufert in #7265LeafFolderLoaderby @mohammed90 in #7327{http.request.body_base64}placeholder by @francislavoie in #7367aea342f) by @willnorris in #7397log_appendEarly option, Supports{http.response.body}by @francislavoie in #7368prealloclint fix by @francislavoie in #7430time/tzdataby @francislavoie in #7432observe_catchall_hostsoption by @mohammed90 in #7434Hostto{upstream_hostport}automatically if TLS by @francislavoie in #7454dnswithacme_dns(fix #7294) by @rightaditya in #7458maintenance_intervalandrenewal_window_ratioby @Amirhf1 in #7479ech.goby @francislavoie in #7487New Contributors
Full Changelog: caddyserver/caddy@v2.10.2...v2.11.1
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.