What traefik/traefik shipped

Two patch releases this week: v3.7.17 and v2.11.61, both with a CVE advisory fix. Also in: a gRPC bidirectional stream regression test, stricter HTTP Host matcher validation, path parameter handling for dot-segments, and lower zstd memory in the Compress middleware.

Two patch releases landed this week: v3.7.17 and v2.11.61, each fixing advisory GHSA-xv5x-242w-7hf7 along with dependency updates. For HTTP routing, Host matcher values that are not valid hostnames or IP addresses are now rejected, matching HostSNI validation. Path sanitization removes parameters from dot-segments and empty segments, so /foo/..;bar/baz forwards as /baz. The Compress middleware now uses gzhttp's zstd encoder options to limit memory per response, and BasicAuth rejects passwords over 1024 bytes. A regression test covers gRPC bidirectional streams that could hang when a backend ends the stream while the client is still sending.

V3.8.0-rc.1, v3.7.17 and v2.11.61 are out. New this week: HTTPRoute RequestMirror and retry support, Gateway backend client certificates, ClusterTrustBundle CA references, and fixes for NTLM and Kerberos connection leaks.

Three releases this week: v3.8.0-rc.1, v3.7.17 and v2.11.61. The release candidate adds per-router responding timeouts, an acme reusePrivateKey option and managedFields stripping in Kubernetes informers. Gateway API support grew with the HTTPRoute RequestMirror filter, HTTPRoute retries, Gateway backend client certificates and ClusterTrustBundle CA certificate references. We also fixed backend connection leaks for NTLM and Kerberos authentication, avoided generated name collisions across namespaces in the ingress-nginx provider, and updated the Docker Basic guide to use v3.7. See the migration guide before upgrading.

V3.7.16 and v2.11.60 are out with a security advisory fix and NTLM/Kerberos support in ForwardAuth. Also new: a per-router roundTrip timeout, Gateway API frontend mTLS, HTTPRoute backendRequest timeouts, a gatewayClass option, and a fix for flush, hijack and deadlines in wrapped

Two patch releases this week: v3.7.16 and v2.11.60 fix advisory GHSA-hrpp-p4fc-wwf8 and add NTLM and Kerberos support in ForwardAuth, also available in ingress-nginx auth-url on v3.7. On the Gateway API side, there is now support for the HTTPRoute backendRequest timeout, client certificate validation on Gateway.Spec.TLS.Frontend, and a gatewayClass option to watch a GatewayClass by name, with labelSelector deprecated in its favor. A new per-router respondingTimeouts.roundTrip option bounds the whole client transaction, and a fix makes http.ResponseController flush, hijack and deadlines work through the middleware chain.

V3.7.15 and v2.11.59 are out, fixing three security advisories and rejecting CONNECT requests on every HTTP version. Also this week: a new tap middleware, auth-tls-secret fixes in the Kubernetes Ingress provider, and HTTPRoute backends defaulting to http when appProtocol is unset

Traefik v3.7.15 and v2.11.59 are released. Both fix three security advisories and reject all CONNECT requests, whatever the HTTP version, because CONNECT over HTTP/2 was not handled properly. The v2.11.59 release also bumps golang.org/x/net to v0.60.0. Beyond the releases, the Kubernetes Ingress provider gets fixes to the auth-tls-secret annotation: the cross-namespace check now runs for every Ingress, and client authentication applies to the whole host. HTTPRoute backends now default to http when appProtocol is unset. A new tap middleware sends a copy of requests and responses to Traefik services as JSON records, and non-root routers can carry observability metadata.

Release v3.7.14 (langres) and v2.11.58 (mimolette) are prepared. Merged v3.7 into master, merged v2.11 into v3.7, and regenerated Gateway API conformance reports. Also fixed a certificate typo in SPIFFE test comments.

This week Traefik prepared two releases: v3.7.14 (langres) and v2.11.58 (mimolette). The v3.7 branch was merged into master, with Gateway API conformance reports regenerated against master, and the v2.11 branch was merged into v3.7. A one-word spelling mistake in SPIFFE mTLS test comments was corrected from ceritificate to certificate. Users on the v3.7 and v2.11 lines can update to the new releases.

Traefik ships Gateway API ListenerSet support, fixes OTLP histogram aggregation, and expands Ingress NGINX annotation coverage for better Kubernetes integration.

This week's Traefik updates focus on Kubernetes improvements and observability. Gateway API ListenerSet support enables multi-tenant isolation, OTLP metrics now respect exporter configuration, and new Ingress NGINX annotations handle rate limiting allowlists and app-root paths correctly. These changes improve both enterprise deployments and cloud-native integrations.

Fixed TLSRoute router collisions, Gateway API shadowing issues, and cross-namespace BackendTLSPolicy handling. Improved UDP buffer efficiency and added QUERY HTTP method support.

This week's releases focused on Gateway API stability and performance. We fixed router name collisions in TLSRoute deployments, resolved shadowing issues between different route types, and corrected BackendTLSPolicy ancestor reporting across namespaces. Performance improvements include optimized UDP datagram handling and P2C load balancer corrections. Added QUERY HTTP method support for expanded protocol compatibility.

Improved NTLM and Kerberos connection isolation in FastProxy. Fixed SSL-passthrough routing consistency. Prevented Ingress-NGINX resource name collisions with dotted names.

This week we improved handling of connection-bound authentication schemes. FastProxy now properly isolates NTLM and Negotiate connections matching the default proxy. SSL-passthrough Ingress routes follow standard routing paths. We also fixed a Kubernetes resource naming issue in the Ingress-NGINX provider that could cause collisions when resource names contain dots.