Important: Please read the migration guide. CVE fixed: Advisory GHSA-xv5x-242w-7hf7 Bug fixes: [acme] Bump github.com/go-acme/lego/v5 to v5.6.0 (#14166 @ldez) [acme] Bump github.com/go-jose/go-jose/v4 to v4.1.6 (#14165 @Mheaus) [http3] Bump github.com/quic-go/quic-go to v0.64.1 (#14132 @janpachol) [k8s/gatewayapi] Preserve Gateway status conditions owned by other controllers (#14128 @Neffi42) [k8s…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-xv5x-242w-7hf7 Bug fixes: [acme] Bump github.com/go-jose/go-jose/v4 to v4.1.6 (#14165 @Mheaus) [server] Add an entry point option to limit the number of request header values (#14111 @juliens) [server] Bump golang.org/x/net to v0.62.0 (#14176 @kevinpollet) [server] Fix backend connection leak for NTLM and Kerberos authentication…
Important: Please read the migration guide. Enhancement: [acme] Add reusePrivateKey option (#13004 @ldez) [docker, k8s/ingress, middleware, k8s/crd, k8s/gatewayapi] Add per router responding timeouts (#13537 @sdelicata) [k8s] Strip managedFields in informers (#13396 @kevinpollet) [k8s, k8s/gatewayapi] Support BackendTLSPolicy for TLSRoute (#13332 @kevinpollet) [k8s, nomad] Remove redundant provide…
CVE fixed: Advisory GHSA-hrpp-p4fc-wwf8 Bug fixes: [authentication, service, k8s/ingress-nginx] Support NTLM and Kerberos in ForwardAuth and ingress-nginx auth-url (#14091 @juliens) [authentication, service] Support NTLM and Kerberos authentication in ForwardAuth (#14084 @juliens) [k8s/gatewayapi] Fix Gateway API conformance suite setup with the containerd image store (#14089 @Neffi42) Documentati…
CVE fixed: Advisory GHSA-hrpp-p4fc-wwf8 Bug fixes: [authentication, service] Support NTLM and Kerberos authentication in ForwardAuth (#14084 @juliens)
Important: Please read the migration guide. CVE fixed: Advisory GHSA-p8wx-ph99-xgcr Advisory GHSA-ww7c-q3mv-xx22 Advisory GHSA-28hp-c82p-8vqj Bug fixes: [server] Reject CONNECT requests regardless of HTTP version (#14031 @juliens) [server] Reject CONNECT method before reaching the muxer (#14050 @juliens) [k8s/crd] Allow observability metadata on child routers (#14018 @bunnysayzz) [k8s/gatewayapi]…
Important: Please read the migration guide. Bug fixes: [server] Reject CONNECT requests regardless of HTTP version (#14031 @juliens) [server] Reject CONNECT method before reaching the muxer (#14050 @juliens) Bump golang.org/x/net to v0.60.0 (#14048 @kevinpollet)
Important: Please read the migration guide. CVE fixed: Advisory GHSA-qqjf-53cj-pwvv Advisory GHSA-f52w-8j3h-j724 Advisory GHSA-v67p-phpq-fc8x Advisory GHSA-w4v4-9rw7-5326 Advisory GHSA-2272-4vv8-65ww Advisory GHSA-8fcf-v89g-xpg6 Bug fixes: [acme] Bump github.com/go-acme/lego/v5 to v5.4.1 (#13759 @ldez) [acme] Disable recursive nss propagation by default for DNS challenge (#13830 @rtribotte) [acme]…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-53qr-784g-cj35 Advisory GHSA-cw35-4q88-3rmp Advisory GHSA-fh26-gfpp-7xxx Advisory GHSA-mwrr-6hp4-pxr6 Advisory GHSA-qm9f-w54v-q2qh Advisory GHSA-qvj7-gq9c-hp7q Advisory GHSA-rv2h-qh7j-xrjw Advisory GHSA-mhjw-hmjv-p99x Bug fixes: [acme] Bump github.com/go-acme/lego/v5 to v5.5.1 (#13929 @ldez) [acme] Bump github.com/go-acme/lego/v5…
CVE fixed: Advisory GHSA-cw35-4q88-3rmp Advisory GHSA-fh26-gfpp-7xxx Advisory GHSA-qm9f-w54v-q2qh Advisory GHSA-2272-4vv8-65ww Advisory GHSA-mhjw-hmjv-p99x Bug fixes: [docker] Bump github.com/docker/cli to v29.8.1 (#13934 @kevinpollet) [rules] Ignore negated matchers when parsing rule domains (#13863 @rtribotte) [server] Bump golang.org/x/crypto to v0.57.0 (#13930 @kevinpollet) [server] Ensure tha…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-qqjf-53cj-pwvv Advisory GHSA-f52w-8j3h-j724 Advisory GHSA-w4v4-9rw7-5326 Bug fixes: [acme] Disable recursive nss propagation by default for DNS challenge (#13830 @rtribotte) [http3] Dedicate a transport per HTTP/3 client connection (#13812 @sdelicata) [server] Deny request with an opaque request target (#13796 @sdelicata) [server…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-cjr6-pf59-jq29 Advisory GHSA-7ghq-v6jf-g56c Advisory GHSA-rf44-j88r-hh8c Bug fixes: [fastproxy] Bump github.com/valyala/fasthttp to v1.73.0 (#13769 @mmatur) [file] Include the filename in file provider configuration errors (#13527 @lazerg) [http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 (#13717 @gndz07)…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-7ghq-v6jf-g56c Advisory GHSA-rf44-j88r-hh8c Bug fixes: [http3] Apply read timeout, idle timeout, and max header bytes for HTTP/3 (#13717 @gndz07) [server] Add an entry point option to handle request headers with aliasing names (#13720 @rtribotte) [tcp, udp] Reject negative weights in TCP and UDP weighted services (#13749 @rtribot…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-5w68-77r2-r64c Advisory GHSA-g55h-rg46-x9c5 Advisory GHSA-j994-9gqj-9hwq Advisory GHSA-m6wx-622r-48r9 Bug fixes: [fastproxy] Reject out-of-range status codes from backends when using FastProxy (#13635 @gndz07) [http3] Bump github.com/quic-go/quic-go to v0.61.0 (#13688 @jnoordsij) [k8s/crd] Prevent generated name collisions in the…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-5w68-77r2-r64c Advisory GHSA-g55h-rg46-x9c5 Bug fixes: [k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider (#13656 @rtribotte) [k8s/crd] Add an option to restrict the namespace of the default TLS resources (#13665 @rtribotte) [k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD prov…
CVE fixed: Advisory GHSA-fgjj-px3w-67xx Advisory GHSA-62fc-8686-hfmq Advisory GHSA-6765-c87h-8mrf Bug fixes: [acme] Bump github.com/go-acme/lego/v5 to v5.3.1 (#13547 @ldez) [middleware, authentication] Fix auth singleflight key collision (#13572 @mmatur) [k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider (#13580 @gndz07) [tracing] Bump github.com/DataDog/dd-trace-go/v…
CVE fixed: Advisory GHSA-fgjj-px3w-67xx Advisory GHSA-62fc-8686-hfmq Advisory GHSA-6765-c87h-8mrf Bug fixes: [acme] Bump github.com/go-acme/lego/v5 to v5.3.1 (#13547 @ldez) [middleware, authentication] Fix auth singleflight key collision (#13572 @mmatur) [k8s/gatewayapi] Avoid router name collisions in Kubernetes Gateway API provider (#13580 @gndz07) [tracing] Bump github.com/DataDog/dd-trace-go/v…
CVE fixed: Advisory GHSA-62fc-8686-hfmq Bug fixes: [tracing] Bump github.com/DataDog/dd-trace-go/v2 to 2.8.1 (#13530 @kevinpollet) Bump golang.org/x/text to v0.40.0 and golang.org/x/net v0.57.0 (#13574 @mmatur) [k8s/crd] Fix cross-namespace service reference check in Kubernetes CRD provider (#13573 @gndz07) [middleware] Bump github.com/klauspost/compress to v1.18.7 (#13587 @mmatur)
Important: Please read the migration guide. CVE fixed: Advisory GHSA-3ccp-42pg-hgv6 Bug fixes: [k8s/ingress-nginx] Fix redirect with use-regex in IngressNGINX provider (#13476 @AmariahAK) [middleware] Disable Zstd support in the gzhttp wrapper (#13533 @kevinpollet) [server] Defer the CONNECT payload until the backend accepts the tunnel (#13542 @sdelicata) [server] Discard CONNECT body in forwardau…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-3ccp-42pg-hgv6 Bug fixes: [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet) [logs] Remove unrelated error from nonexistent cert resolver log (#13469 @ArthurHlt) [middleware] Disable Zstd support in the gzhttp wrapper (#13533 @kevinpollet) [server] Defer the CONNECT payload until the backend…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-3ccp-42pg-hgv6 Bug fixes: [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet) [server] Defer the CONNECT payload until the backend accepts the tunnel (#13542 @sdelicata) [server] Bump google.golang.org/grpc to v1.82.1 (#13551 @piscue) [server] Do not add back CONNECT requests to the pool (#13…
CVE fixed: Advisory GHSA-8rxv-jg7p-wvg3 Bug fixes: [middleware, k8s/crd] Add missing ErrorRequestHeaders field to CRDs (#13498 @kevinpollet) [k8s/ingress-nginx] Sanitize rewritten target on ingress-nginx provider (#13506 @gndz07) [logs] Remove unrelated error from nonexistent cert resolver log (#13469 @ArthurHlt) [middleware] Fix panic in retry middleware with Websockets (#13520 @juliens) Document…
Important: Please read the migration guide. CVE fixed: Advisory GHSA-cxjq-mrr5-89rv Advisory GHSA-42cj-m3vj-89wv Advisory GHSA-qq9q-x9w4-chhj Bug fixes: [middleware, k8s/ingress-nginx] Add app-root middleware with nginx variable interpolation (#13398 @dfeinblatt) [rules] Fix consistency between HostSNI() and Host() (#13460 @juliens) [k8s, k8s/gatewayapi] Fix ExtensionRef filters on backendRefs to…
CVE fixed: Advisory GHSA-cxjq-mrr5-89rv Advisory GHSA-42cj-m3vj-89wv Bug fixes: [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte) [k8s] Fix panic when endpointslice port value or name is nil (#13481 @kevinpollet) [k8s/crd] Fix cross-provider ref check for TCP ServersTransport in Kubernetes CRD provider (#13458 @gndz07) [middleware] Fix handle empty unknown-length bodies…
CVE fixed: Advisory GHSA-cxjq-mrr5-89rv Bug fixes: [middleware] Sanitize replaced path in ReplacePathRegex middleware (#13466 @kevinpollet) [acme] Bump software.sslmate.com/src/go-pkcs12 to v0.7.3 (#13477 @rtribotte) [otel] Bump go.opentelemetry.io/otel to v1.44.0 (#13478 @rtribotte) Documentation: Fix changelog v2.11.51 (#13430 @mmatur)
Important: Please read the migration guide. CVE fixed: CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) CVE-2026-54765 (Advisory GHSA-6p8f-p8j2-rqmv) Bug fixes: [acme, logs] Bump github.com/go-acme/lego/v5 (#13154 @ldez) [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens) [k8s, k8s/ingress-nginx] Fix ingress-nginx ssl passthrough status updates (#132…
Important: Please read the migration guide. CVE fixed: CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) Bug fixes: [acme, logs] Bump github.com/go-acme/lego/v5 (#13154 @ldez) [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens) [k8s/gatewayapi] Add missing Gateway API features in conformance tests (#13356 @AnatoleLucet) [k8s/gatewayapi] Ignore other g…
Important: Please read the migration guide. CVE fixed: CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5) CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m) Bug fixes: [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens) [middleware, authentication] Fix x-forwarded-port in forward-auth (#13344 @juliens) [middleware, authentication] Add an option to remove request headers with underscores (#13262 @youkou…
CVE fixed: CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) CVE-2026-54762 (Advisory GHSA-4mr2-fg2p-w63c) Bug fixes: [k8s/ingress-nginx] Skip ingress when auth-secret resolution fails (#13323 @gndz07) [k8s/ingress-nginx] Pass endpointslice fencing on ingress-nginx provider (#13290 @Learloj) [k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace (#13322 @youkoulayley) [server] Bu…
CVE fixed: CVE-2026-54761 (Advisory GHSA-3g6v-2r68-prfc) Bug fixes: [k8s/gatewayapi] Reject cross-provider references with backendRefs.namespace (#13322 @youkoulayley) [server] Bump to github.com/pires/go-proxyproto v0.12.0 (#13313 @timschumi) [tls] Fix routers with same host, different tlsoptions on different entryPoint (#13329 @juliens) [tls] Fix snicheck for routers with no hosts (#13333 @rtrib…