What traefik/traefik shipped
Written by FoxPlug from the repository's own releases; not affiliated with Traefik. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/traefik/traefik; Traefik did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Release v3.7.14 was prepared, also known as langres. Pull request #14009
- Release v2.11.58 was prepared, also known as mimolette. Pull request #14007
- The v3.7 branch was merged into master, and the Gateway API conformance reports were regenerated. Pull request #14020
- The v3.7 branch was merged into master again to keep it up to date. Pull request #14012
- The v2.11 branch was merged into v3.7. Pull request #14008
- A spelling typo in SPIFFE test comments was fixed, changing ceritificate to certificate. Pull request #14001
Why it matters
This week brings two new releases, v3.7.14 and v2.11.58, so users on those lines can update. Branch merges keep master and v3.7 current, and the Gateway API conformance reports were regenerated against master. A test comment typo fix makes the SPIFFE mTLS tests easier to read.
Changelog entry
- Prepare release v3.7.14 (langres). Pull request #14009
- Prepare release v2.11.58 (mimolette). Pull request #14007
- Merge branch v3.7 into master; regenerate Gateway API conformance reports against master. Pull request #14020
- Merge branch v3.7 into master. Pull request #14012
- Merge branch v2.11 into v3.7. Pull request #14008
- Fix typo in SPIFFE test comments: ceritificate to certificate. Pull request #14001
Release v3.7.14 (langres) and v2.11.58 (mimolette) are prepared. Merged v3.7 into master, merged v2.11 into v3.7, and regenerated Gateway API conformance reports. Also fixed a certificate typo in SPIFFE test comments.
This week Traefik prepared two releases: v3.7.14 (langres) and v2.11.58 (mimolette). The v3.7 branch was merged into master, with Gateway API conformance reports regenerated against master, and the v2.11 branch was merged into v3.7. A one-word spelling mistake in SPIFFE mTLS test comments was corrected from ceritificate to certificate. Users on the v3.7 and v2.11 lines can update to the new releases.
Week of September 28, 2026
What shipped
- Gateway API ListenerSet (GEP-1713) support added for multi-tenant isolation with per-listener certificate management and cross-namespace delegation. Pull request #12909
- Traefik request duration histograms no longer force explicit bucket aggregation, allowing exporters to use their own histogram aggregation settings. Pull request #13873
- Kubernetes Ingress NGINX provider now supports nginx.ingress.kubernetes.io/limit-allowlist annotation to exempt IPs and CIDR ranges from rate limiting. Pull request #12918
- Ingress NGINX app-root annotation now works for Ingresses that do not declare a forward slash path. Pull request #13601
- Authorization header is now removed for basic and digest auth in ingress-nginx provider. Pull request #13631
- SSL-passthrough default backend no longer gets a TLS router created for it. Pull request #13992
- Request TLS state is now always set via an entry point middleware. Pull request #13985
- Partially configured internal entry points now default to:8080 when required. Pull request #13939
- New reusePrivateKey option added to control certificate private key reuse behavior. Pull request #13004
- Security submission documentation now includes coordinated disclosure embargo details. Pull request #13982
Why it matters
This week brings improved Gateway API support for complex Kubernetes deployments, better observability with OTLP metrics control, and expanded Ingress NGINX annotation compatibility. These changes address enterprise deployment patterns and strengthen security practices.
Changelog entry
- Gateway API ListenerSet (GEP-1713) support for per-listener certificate management and cross-namespace delegation Pull request #12909
- Traefik request duration histograms no longer override exporter histogram aggregation settings Pull request #13873
- Kubernetes Ingress NGINX: support for nginx.ingress.kubernetes.io/limit-allowlist annotation Pull request #12918
- Kubernetes Ingress NGINX: app-root annotation now works for Ingresses without explicit forward slash path Pull request #13601
- Kubernetes Ingress NGINX: Authorization header removed after basic and digest authentication Pull request #13631
- Kubernetes Ingress NGINX: SSL-passthrough default backend no longer creates TLS router Pull request #13992
- Request TLS state always set via entry point middleware Pull request #13985
- Partially configured internal entry points default to:8080 Pull request #13939
- New reusePrivateKey option to control certificate private key reuse Pull request #13004
Traefik ships Gateway API ListenerSet support, fixes OTLP histogram aggregation, and expands Ingress NGINX annotation coverage for better Kubernetes integration.
This week's Traefik updates focus on Kubernetes improvements and observability. Gateway API ListenerSet support enables multi-tenant isolation, OTLP metrics now respect exporter configuration, and new Ingress NGINX annotations handle rate limiting allowlists and app-root paths correctly. These changes improve both enterprise deployments and cloud-native integrations.
Week of September 21, 2026
What shipped
- Fixed TLSRoute router name collisions when multiple TLS listeners share an entry point. Pull request #13959
- Gateway API provider now creates only the router serving a given rule on a given entry point, preventing routers from shadowing each other. Pull request #13946
- TLSRoute routers no longer shadow TCPRoute routers that share the same entry point and rule. Pull request #13953
- BackendTLSPolicy ancestor now reports in the namespace of its Gateway instead of the backend namespace. Pull request #13964
- GRPCRoute and TLSRoute BackendTLSPolicy ancestors now report in the namespace of their Gateway. Pull request #13966
- Added QUERY HTTP method to metrics labeling instead of grouping it as EXTENSION_METHOD. Pull request #13667
- Fixed selection bias in the P2C load balancer when drawing the second index. Pull request #13644
- Rate limiter Lua script now uses # operator instead of deprecated table.maxn for Redis-compatible servers. Pull request #13825
- UDP listener now copies datagrams into right-sized buffers instead of queuing full 64 KiB allocations. Pull request #13941
- Gateway API conformance entry points now have a 1s read timeout. Pull request #13947
Why it matters
This week focused on Gateway API correctness and cross-namespace routing, fixing collisions and shadowing issues that affected multi-listener deployments. Performance improvements to UDP handling and the P2C load balancer reduce resource waste, while the QUERY method support expands HTTP compatibility.
Changelog entry
- Fixed TLSRoute router name collision across listeners sharing an entry point Pull request #13959
- Gateway API provider now avoids creating shadowed routers when multiple routes share an entry point and rule Pull request #13946
- TLSRoute routers no longer shadow TCPRoute routers on the same entry point and rule Pull request #13953
- BackendTLSPolicy ancestor now reports in the Gateway namespace for cross-namespace deployments Pull request #13964
- GRPCRoute and TLSRoute BackendTLSPolicy ancestors now report in the namespace of their Gateway Pull request #13966
- Added QUERY HTTP method to metrics labeling Pull request #13667
- Fixed selection bias in P2C load balancer for second server index Pull request #13644
- Rate limiter Lua script now compatible with Redis using newer Lua versions Pull request #13825
- UDP listener now uses right-sized buffers for datagrams to reduce memory allocation Pull request #13941
- Gateway API conformance entry points now have 1s read timeout Pull request #13947
Fixed TLSRoute router collisions, Gateway API shadowing issues, and cross-namespace BackendTLSPolicy handling. Improved UDP buffer efficiency and added QUERY HTTP method support.
This week's releases focused on Gateway API stability and performance. We fixed router name collisions in TLSRoute deployments, resolved shadowing issues between different route types, and corrected BackendTLSPolicy ancestor reporting across namespaces. Performance improvements include optimized UDP datagram handling and P2C load balancer corrections. Added QUERY HTTP method support for expanded protocol compatibility.
Week of September 14, 2026
What shipped
- FastProxy now isolates NTLM and Negotiate backend connections to the frontend connection that authenticated them, matching the behavior of the default proxy. Pull request #13914
- NTLM and Kerberos credential-bearing requests are dispatched on dedicated connection-scoped transports before reaching the shared backend connection pool. Pull request #13902
- SSL-passthrough Ingress routes now follow the same routing path as other Ingress routes, with the TCP router forwarding connections without decryption. Pull request #13915
- The Ingress-NGINX provider no longer normalizes namespace and resource names, preventing collisions when names contain dots. Pull request #13922
- The Ssl-Client-* request headers are now set on the HTTP router when the nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream annotation is enabled. Pull request #13912
- Documentation grammar corrected in TCP HostSNI rules reference. Pull request #13895
- Documentation grammar corrected in TCP ServersTransport reference. Pull request #13894
- Test fixed to properly wait for connection handler to return before starting subsequent connections. Pull request #13870
- Integration test example regular expression end anchor corrected. Pull request #13898
- Branch v3.7 merged into master. Pull request #13889
Why it matters
This week's changes improve authentication handling for connection-bound schemes like NTLM and Kerberos, ensure consistent Ingress routing behavior, and fix a Kubernetes resource naming issue that could cause configuration collisions. These fixes strengthen reliability for users relying on advanced authentication and Kubernetes integration.
Changelog entry
- FastProxy: isolate NTLM and Negotiate backend connections to frontend connection Pull request #13914
- Dispatch NTLM and Kerberos credential-bearing requests on dedicated connection-scoped transports Pull request #13902
- Route ssl-passthrough Ingress through standard routing path Pull request #13915
- Ingress-NGINX provider: do not normalize resource names Pull request #13922
- Set Ssl-Client-* request headers on Ingress-NGINX HTTP router for auth-tls-pass-certificate-to-upstream Pull request #13912
Improved NTLM and Kerberos connection isolation in FastProxy. Fixed SSL-passthrough routing consistency. Prevented Ingress-NGINX resource name collisions with dotted names.
This week we improved handling of connection-bound authentication schemes. FastProxy now properly isolates NTLM and Negotiate connections matching the default proxy. SSL-passthrough Ingress routes follow standard routing paths. We also fixed a Kubernetes resource naming issue in the Ingress-NGINX provider that could cause collisions when resource names contain dots.