dependabot[bot] opened a new pull request, #18: URL: https://github.com/apache/casbin-caddy-authz/pull/18
Bumps [github.com/caddyserver/caddy/v2](https://github.com/caddyserver/caddy) from 2.2.1 to 2.11.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/caddyserver/caddy/releases";>github.com/caddyserver/caddy/v2's releases</a>.</em></p> <blockquote> <h2>v2.11.1</h2> <p>Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.</p> <p>There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.</p> <h2>Special Sponsor Shoutout</h2> <p>Extra big thanks to our major sponsors:</p> <ul> <li><a href="https://zerossl.com";>ZeroSSL</a></li> <li><a href="https://stripe.com";>Stripe</a></li> <li><a href="https://railway.com/?utm_medium=sponsor&utm_source=oss&utm_campaign=caddy";>Railway</a></li> </ul> <p>They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!</p> <h2>Notable changes</h2> <ul> <li>Encrypted ClientHello (ECH) keys are rotated automatically.</li> <li>Time-rolling options for logs.</li> <li><code>SIGUSR1</code> can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.</li> <li>Reverse proxy now automatically rewrites the Host header to the address of the upstream when the upstream is HTTPS (<a href="https://redirect.github.com/caddyserver/caddy/issues/7454";>#7454</a>)</li> <li><code>log_append</code> can now log request and response bodies, useful for debugging.</li> <li>Our project now implements and requires Assistance Disclosures (for AI/LLMs) on issues, PRs, comments, replies, reviews, etc.</li> <li>Many, many other minor improvements and bug fixes.</li> </ul> <p>Thank you to everyone who was involved this release!</p> <h3>:warning: Security patches</h3> <ul> <li>fastcgi: <code>CVE-2026-27590</code> by <a href="https://github.com/dunglas";><code>@dunglas</code></a> and <a href="https://github.com/AbdrrahimDahmani";><code>@AbdrrahimDahmani</code></a> - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.</li> <li>admin: <code>CVE-2026-27589</code> by <a href="https://github.com/1seal";><code>@1seal</code></a> - Cross-origin requests attempted with <code>no-cors</code> mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)</li> <li>caddyhttp: <code>CVE-2026-27588</code> by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.</li> <li>caddyhttp: <code>CVE-2026-27587</code> by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.</li> <li>caddytls: <code>CVE-2026-27586</code> by <a href="https://github.com/moscowchill";><code>@moscowchill</code></a> - TLS client authentication silently fails open when CA certificate file is missing or malformed.</li> <li>caddyhttp: <code>CVE-2026-27585</code> by <a href="https://github.com/parrot409";><code>@parrot409</code></a> - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.</li> </ul> <p>:rotating_light: <strong>Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your <code>go.mod</code> file. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses.</strong> (Then, <a href="https://words.filippo.io/dependabot/";>turn Dependabot off</a>.)</p> <h2>What's Changed</h2> <ul> <li>caddyhttp: add replacer placeholders for escaped values by <a href="https://github.com/Qusic";><code>@Qusic</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7181";>caddyserver/caddy#7181</a></li> <li>AI assistance disclosure by <a href="https://github.com/mholt";><code>@mholt</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7212";>caddyserver/caddy#7212</a></li> <li>caddyfile: Prevent trailing space on line before env variable - Fixes <a href="https://redirect.github.com/caddyserver/caddy/issues/6881";>#6881</a> by <a href="https://github.com/arpansaha13";><code>@arpansaha13</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7215";>caddyserver/caddy#7215</a></li> <li>add: encode header Content-Type graphql-response by <a href="https://github.com/aro-lew";><code>@aro-lew</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7214";>caddyserver/caddy#7214</a></li> <li>caddyhttp: Removing redundant middleware next copy by <a href="https://github.com/maxcelant";><code>@maxcelant</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7217";>caddyserver/caddy#7217</a></li> <li>build(deps): bump the all-updates group with 17 updates by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/caddyserver/caddy/pull/7236";>caddyserver/caddy#7236</a></li> <li>build(deps): bump the actions-deps group with 5 updates by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/caddyserver/caddy/pull/7237";>caddyserver/caddy#7237</a></li> <li>encode: fix response corruption when handle_errors is used by <a href="https://github.com/Siomachkin";><code>@Siomachkin</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7235";>caddyserver/caddy#7235</a></li> <li>Fix PKI creation when auto_https is disabled (<a href="https://redirect.github.com/caddyserver/caddy/issues/7211";>#7211</a>) by <a href="https://github.com/Siomachkin";><code>@Siomachkin</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7238";>caddyserver/caddy#7238</a></li> <li>logging: Buffer the logs before config is loaded by <a href="https://github.com/francislavoie";><code>@francislavoie</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7245";>caddyserver/caddy#7245</a></li> <li>fileserver: set Content-Length for precompressed files by <a href="https://github.com/WeidiDeng";><code>@WeidiDeng</code></a> in <a href="https://redirect.github.com/caddyserver/caddy/pull/7251";>caddyserver/caddy#7251</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/caddyserver/caddy/commit/6610e2f1bd8f54853006eefd3849c9965190e57f";><code>6610e2f</code></a> chore: Disable windows/arm build target (Go 1.26 disabled) (<a href="https://redirect.github.com/caddyserver/caddy/issues/7503";>#7503</a>)</li> <li><a href="https://github.com/caddyserver/caddy/commit/03243e42fe46f6bf276cbbf5dcdc7e18fde461d7";><code>03243e4</code></a> go.mod: Upgrade dependencies</li> <li><a href="https://github.com/caddyserver/caddy/commit/cb436f0a0ed62e0a5d4af158486bba39fc575fe1";><code>cb436f0</code></a> fileserver: Fix tests on Windows</li> <li><a href="https://github.com/caddyserver/caddy/commit/a1081194bfae4e0d8c227ec44aecb95eded55d1e";><code>a108119</code></a> Merge commit from fork</li> <li><a href="https://github.com/caddyserver/caddy/commit/eec32a0bb5a11651c6a7b04ce82dc50610f2b27e";><code>eec32a0</code></a> Merge commit from fork</li> <li><a href="https://github.com/caddyserver/caddy/commit/a2825c5dd952769f139a16448dc1ca1be61b6058";><code>a2825c5</code></a> fileserver: Replace \ with \ in file matcher paths</li> <li><a href="https://github.com/caddyserver/caddy/commit/db256b53e517191f52eca4ea11d415d7a11e729f";><code>db256b5</code></a> build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (<a href="https://redirect.github.com/caddyserver/caddy/issues/7497";>#7497</a>)</li> <li><a href="https://github.com/caddyserver/caddy/commit/6772ffb805d688475369a697e3962fa48cbf6bd2";><code>6772ffb</code></a> Revert "listeners: Add support for named socket activation (<a href="https://redirect.github.com/caddyserver/caddy/issues/7243";>#7243</a>)"</li> <li><a href="https://github.com/caddyserver/caddy/commit/95941a71e87d6ccd6318bfd95c56929b01edfafd";><code>95941a7</code></a> chore: Add nolints to work around haywire linters (<a href="https://redirect.github.com/caddyserver/caddy/issues/7493";>#7493</a>)</li> <li><a href="https://github.com/caddyserver/caddy/commit/3adcafd4c1120f071e1c1b1407566780144e7fc9";><code>3adcafd</code></a> admin: Fix tests locally, properly isolate storage (<a href="https://redirect.github.com/caddyserver/caddy/issues/7486";>#7486</a>)</li> <li>Additional commits viewable in <a href="https://github.com/caddyserver/caddy/compare/v2.2.1...v2.11.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/casbin-caddy-authz/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
