< back to search

shield Recommended update for caddy
openSUSE-2025-105

This update for caddy fixes the following issues: - Update to version 2.9.1: * go.mod: UPgrade CertMagic to 0.21.6 (fix ARI handshake maintenance) * header: `match` subdirective for response matching (#6765) * log: Only chmod if permission bits differ; make log dir (#6761) * fix: disable h3 for unix domain socket (#6769) * reverseproxy: buffer requests for fastcgi by default (#6759) * core: Only initiate exit once (should fix #6707) - Update to version 2.9.0: * go.mod: Upgrade CertMagic to v0.21.5 * testing: sort force-automated hosts (#6756) * httpcaddyfile: Implement experimental `force_automate` option (#6712) * encode: try to use sendfile when compression is not used (#6749) * caddyhttp: Allow matching Transfer-Encoding, add to access logs (#6629) * go.mod: Upgrade ACMEz to v3; and upgrade CertMagic * cmd: Disable go1.23 tlskyber=1 experiment * Update SECURITY.md * fastcgi: check for CONTENT_LENGTH when sending requests (#6661) * reverseproxy: Set Content-Length when body is fully buffered (#6638) * core: Change ListenerFunc signature (#6651) * reverseproxy: Only handle websocket protocol (#6740) * encode: write status immediate for success response for CONNECT requests (#6738) * encode: good defaults (#6737) * fileserver: add a test for precompressed defaults (#6743) * fileserver: good default for precompressed (#6736) * chore: fix some typo in HTTPLoader comment (#6735) * reverseproxy: Rewrite requests and responses for websocket over http2 (#6567) * chore: bump golang.org/x/net to v0.32.0 (#6728) * fileserver: Fix policy `Validate()` oversight (#6727) * cmd: Reject multiple configs for fmt command (#6717) * fileserver: Add `first_exist_fallback` strategy for `try_files` (#6699) * caddyhttp: Add `{?query}` placeholder (#6714) * ci: prevent jobs running on PRs from forks (#6720) * go.mod: Upgrade quic-go to 0.48.2 * metrics: add `go` and `process` collectors (#6704) * requestbody: Type-based error handling for `MaxBytesError` (#6701) * fastcgi: remove dir redirection when useless in php_fastcgi (#6698) * caddyhttp: Set default ReadHeaderTimeout (1 min) * cmd: ignore missing keys during storage export (#6697) * chore: make FastAbs comment more easy to understand (#6692) * chore: Add `provides` to `.deb` releases (#6691) * core: Implement FastAbs to avoid repeated os.Getwd calls (#6687) * reverseproxy: Revert #4952 - don't ignore context cancellation in stream mode * httpcaddyfile: Implement log `sampling` config (#6682) * reverseproxy: Allow `0` as weights for `weighted_round_robin` (#6681) * ci: use commit sha in goreleaser-check (#6677) * go.mod: Update certmagic * caddytls: Allow disabling storage cleaning, avoids writing two files (#6593) * rewrite: Don't add / in Caddyfile, do it after replacer (#6662) * fileserver: Add `file_limit` option for browse (to be experimental) (#6648) * go.mod: upgrade only some otel deps (#6676) * caddyhttp: Add `MatchWithError` to replace SetVar hack (#6596) * Fix tests * forwardauth: Skip copying missing response headers (#6608) * go.mod: Update dependencies * events: Use `WithLazy` to prevent eager serialization of the event data (#6671) * fileserver: Fix Caddyfile parsing * httpcaddyfile: Fixes for `prefer_wildcard` mode (#6636) * cmd: Allow `add-package` to select version of package (#6665) * chore: compile without nosql's support for Postgres and MySQL (#6655) * chore: Bump quic-go to 0.48.1, fixing a panic (#6654) * reverseproxy: Sync changes from stdlib for 1xx handling (#6656) * reverseproxy: Fix log message * tracing: Add `spanID` field to access logs and `http.vars.span_id` placeholder (#6646) * core: addresses.go funcs renames (#6622) * chore: fix some function names in comment (#6650) * fileserver: fix try_policy when instantiating file matcher from CEL (#6624) * sigtrap: always ignore SIGPIPE (#6645) * metrics: move `metrics` up, outside `servers` (#6606) * caddyhttp: Close http3 server gracefully (#6213) * chore: update quic-go to v0.48.0 (#6627) * reverseproxy: Use correct cases for websocket related headers (#6621) * caddyfile: Fix comma edgecase in address parsing (#6616) * docs: expand proxy protocol docs (#6620) * tests: fix caddyfile adapt warnings (#6619) * caddytls: Drop `rate_limit` and `burst`, has been deprecated (#6611) * caddyhttp: Use internal issuer for IPs when no APs configured * go.mod: Upgrade some dependencies * ci: install xcaddy to fix release flow (#6602) * metrics: scope metrics to active config, add optional per-host metrics (#6531) * caddyhttp: Implement `auto_https prefer_wildcard` option (#6146) * caddyhttp: Escaping placeholders in CEL, add `vars` and `vars_regexp` (#6594) * cmd: Better error handling when reloading (#6601) * caddytls: Support new tls.context module (#6369) * http: ReponseWriter prefer ReadFrom if available (#6565) * chore: Adjust incorrect `reverse_proxy` Caddyfile comment (#6598) * caddyhttp: Fix listener wrapper regression from #6573 (#6599) * core: Implement socket activation listeners (#6573) * doc: remove docs of deprecated directives (#6566) * caddyhttp: Optimize logs using zap's WithLazy() (#6590) * chore: Use slices package where possible (#6585) * caddytls: Give a better error message when given encrypted private keys (#6591) * caddyhttp: enable qlog, controlled by QLOGDIR env (#6581) * update quic-go to v0.47.0 (#6582) * ci: update the linter action version (#6575) * perf: use zap's Check() to prevent useless allocs (#6560) * rewrite: Avoid panic on bad arg count for `uri` (#6571) * caddytls: Add sni_regexp matcher (#6569) * caddyhttp: Make route provisioning idempotent (#6558) * reverse_proxy: add placeholder http.reverse_proxy.retries (#6553) * fileserver: browse: Configurable default sort (#6502) * rewrite: Only serialize request if necessary (#6541) * ci: prepare syso files for windows embedding in release (#6406) * tls: use Go default kex for the moment that include PQC (#6542) * ci: build and test with Go 1.23 (#6526) * reverseproxy: allow user to define source address (#6504) * caddyhttp: run `error` (msg) through replacer (#6536) * chore: Fix a typo (#6534) * cmd: Use a factory to create the caddy root command (#6533) * reverseproxy: Change errors writing the response to warning. (#6532) * reverseproxy: Active health checks request body option (#6520) * ci: don't exit early on error in remote CI machine (#6519) * cmd: ignore exec.ErrDot when starting caddy in background (#6512) * Move PrivateRangesCIDR() back: add a pass-through function (#6514) * matchers: fix a regression in #6480 (#6510) * reverseproxy: Disable keep alive for h2c requests (#6343) * go.mod: update update golang/x/net (#6500) * replacer: `{file.*}` global placeholder strips trailing newline (#6411) * caddytls,caddyhttp: Placeholders for some TLS and HTTP matchers (#6480) * go.mod: update quic-go package (#6498) * browse: Customizable default sort options (#6468) * proxyprotocol: Update WrapListener to use ConnPolicyFunc for PROXY protocol (#6485) * encode: flush already compressed data from the encoder (#6471) * chore: update golangci config (#6479) * caddytls: Caddyfile support for TLS conn and cert sel policies (#6462) * caddytls: Caddyfile support for TLS handshake matchers (#6461) * ci: correct `-tags nobadger` on binary build (#6470) * reverseproxy: Fix panic when using header-related flags (fix #6464) * reverseproxy: add health_upstream subdirective (#6451) * reverseproxy: Caddyfile support for health_method (#6454) * reverseproxy: Configurable method for active health checks (#6453) * reverseproxy: Add placeholder for networkAddr in active health check headers (#6450) * fixed bug in resolving ip version in dynamic upstreams (#6448) * browse: Exclude symlink target size from total, show arrow on size (#6412) * browse: fix Content-Security-Policy warnings in Firefox (#6443) * browse: add Content-Security-Policy w/ nonce (#6425) * reverseproxy: Add placeholder for host in active health check headers (#6440) * caddyhttp: Reject 0-RTT early data in IP matchers and set Early-Data header when proxying (#6427) * encode: Don't compress already-compressed fonts (#6432) * reverseproxy: Only log host is up status on change (fixes #6415) (#6419) * intercept: fix http.intercept.header.* placeholder (#6429) * reverseproxy: Wire up TLS options for H3 transport * fileserver: Remove newline characters from precomputed etags (#6394) * caddyhttp: Convert IDNs to ASCII when provisioning Host matcher * reverseproxy: add Max-Age option to sticky cookie (#6398) * caddyfile: Pass blocks to `import` for snippets (#6130) * logging: set file mode when the file already exist (#6391) * logging: Customizable zap cores (#6381) * go.mod: update tscert package (#6384) * logging: fix file mode configuration parsing (#6383) * caddyhttp: Write header if needed in responseRecorder.WriteResponse (#6380) * core: Split `run` into a public `ProvisionContext` and a private method (#6378) * logging: Customize log file permissions (#6314) * events: Getters for event info (close #6377) * ci: add version key for .goreleaser.yml (#6376) * cmd: remove zealous check of Caddyfile auto-detection (#6370) * caddyhttp: Add test cases to corpus (#6374) * Make it possible to configure the `DisableStorageCheck` setting for certmagic (#6368)

  • Release Date
    Mar 24 2025
  • References
  • Type
    recommended
  • Severity
    moderate

cloud_download Downloads

SUSE Package Hub 15.6 aarch64
SUSE Package Hub 15.6 s390x
SUSE Package Hub 15.6 x86_64
SUSE Package Hub 15.6 ppc64le