CADDY-2.10.1 release notes and known issues

Summary

This is probably our biggest patch release ever -- not that lots of things were broken, but there's lots of refinement happening thanks to broader adoption and contributions from many more people. Just look at the New Contributors below! Anyway, this release does contain some bug fixes and dependency upgrades which we hope will serve you well. Let us know if there's any issues! And thank you to all who contributed, especially our reliable maintainer team! This version of Caddy requires Go v1.25.0 or newer . What's Changed update quic-go to v0.51.0 by @marten-seemann in #6972 forwardproxy: reference correct field name in LoadModule by @mohammed90 in #6978 fix: Remove nil arg from zapslog.NewHandler call by @IndraGunawan in #6984 fileserver: Add support for .avif image format by @steffenbusch in #6988 reverseproxy: use DialTLSContext for TLS if servername has placeholder by @WeidiDeng in #6955 admin: Make sure that any admin routers are provisioned when local/re… by @Compy in #6997 log: default logger should respect {in,ex}clude by @mohammed90 in #6995 Move local admin server replacement logic below data structure initia… by @Compy in #7004 acme_server: fix policy parsing in caddyfile by @mohammed90 in #7006 implement Unwrap for interceptedResponseHandler by @WeidiDeng in #7016 fileserver: map invalid path errors to fs.ErrInvalid, and return 400 … by @Compy in #7017 caddyhttp: fix route sort by comparing paths without wildcard if they don't shar… by @WeidiDeng in #7015 refactor: use maps.Copy for cleaner map handling by @eveneast in #7009 refactor: use slices.Contains to simplify code by @tongjicoder in #7039 chore: upgrade .golangci.yml and workflow to v2 by @mohammed90 in #6924 build(deps): bump golangci/golangci-lint-action from 6 to 8 by @dependabot [bot] in #7044 fix: crash - null check on event origin by @suxatcode in #7047 fix: prevent error handler from overriding sub handler matchers by @Hellio404 in #6999 client_auth: wire up leaf verifier Caddyfile by @mohammed90 in #6772 caddyfile: reject blocks in log_skip directive by @IwatsukaYura in #7056 build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 by @dependabot [bot] in #7058 cmd: fix Commands function not returning all registered commands by @hslatman in #7059 ci: add dep review, OSSF scorecard actions by @mohammed90 in #7063 ci: add {base,head}-ref to dep review check by @mohammed90 in #7064 core: clean up new config if it failed to run by @WeidiDeng in #7068 chore: apply security best practices for CI by @mohammed90 in #7066 refactor: use the built-in max/min to simplify the code by @xiaoxiangirl in #7081 [ADD] sort buttons in grid mode by @filipRatajczak in #7089 update quic-go to v0.53.0 by @marten-seemann in #7094 refactor: replace HasPrefix+TrimPrefix with CutPrefix by @gopherorg in #7095 docs: fix some minor issues in the comments by @mountdisk in #7101 httpcaddyfile: Validates TLS DNS challenge options by @francislavoie in #7099 chore: fix struct name in comment by @bytetigers in #7114 reverse proxy: validate versions in http transport by @WeidiDeng in #7112 chore: fix function in comment by @bytesingsong in #7121 Fix: Support placeholders in header replacement search patterns by @zongzewu23 in #7117 fileserver: specify license for embedded JavaScript by @infertux in #7127 fix dead link by @eeemmmmmm in #7136 update quic-go to v0.54.0 by @marten-seemann in #7138 chore: fix minor issue in comment by @pingshuijie in #7140 refactor: use slices.Equal to simplify code by @minxinyi in #7141 ci: reduce dependabot spam by @mohammed90 in #7078 fix(provisioning): Context.App or Context.AppIfConfigured will return (val, nil) even if the app failed to provision or validate the first time by @alexandre-daubois in #7070 build(deps): bump the actions-deps group with 6 updates by @dependabot [bot] in #7142 Use KeepAliveConfig to pass keepalive_interval to listener's accepted sockets by @joshuamcbeth in #7151 build(deps): bump the all-updates group across 1 direct

Improvements and security content

• This is probably our biggest patch release ever -- not that lots of things were broken, but there's lots of refinement happening thanks to broader adoption and contributions from many more people. Just look at the New Contributors below! Anyway, this release does contain some bug fixes and dependency upgrades which we hope will serve you well. Let us know if there's any issues! And thank you to all who contributed, especially our reliable maintainer team! This version of Caddy requires Go v1.25.0 or newer . What's Changed update quic-go to v0.51.0 by @marten-seemann in #6972 forwardproxy: reference correct field name in LoadModule by @mohammed90 in #6978 fix: Remove nil arg from zapslog.NewHandler call by @IndraGunawan in #6984 fileserver: Add support for .avif image format by @steffenbusch in #6988 reverseproxy: use DialTLSContext for TLS if servername has placeholder by @WeidiDeng in #6955 admin: Make sure that any admin routers are provisioned when local/re… by @Compy in #6997 log: default logger should respect {in,ex}clude by @mohammed90 in #6995 Move local admin server replacement logic below data structure initia… by @Compy in #7004 acme_server: fix policy parsing in caddyfile by @mohammed90 in #7006 implement Unwrap for interceptedResponseHandler by @WeidiDeng in #7016 fileserver: map invalid path errors to fs.ErrInvalid, and return 400 … by @Compy in #7017 caddyhttp: fix route sort by comparing paths without wildcard if they don't shar… by @WeidiDeng in #7015 refactor: use maps.Copy for cleaner map handling by @eveneast in #7009 refactor: use slices.Contains to simplify code by @tongjicoder in #7039 chore: upgrade .golangci.yml and workflow to v2 by @mohammed90 in #6924 build(deps): bump golangci/golangci-lint-action from 6 to 8 by @dependabot [bot] in #7044 fix: crash - null check on event origin by @suxatcode in #7047 fix: prevent error handler from overriding sub handler matchers by @Hellio404 in #6999 client_auth: wire up leaf verifier Caddyfile by @mohammed90 in #6772 caddyfile: reject blocks in log_skip directive by @IwatsukaYura in #7056 build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 by @dependabot [bot] in #7058 cmd: fix Commands function not returning all registered commands by @hslatman in #7059 ci: add dep review, OSSF scorecard actions by @mohammed90 in #7063 ci: add {base,head}-ref to dep review check by @mohammed90 in #7064 core: clean up new config if it failed to run by @WeidiDeng in #7068 chore: apply security best practices for CI by @mohammed90 in #7066 refactor: use the built-in max/min to simplify the code by @xiaoxiangirl in #7081 [ADD] sort buttons in grid mode by @filipRatajczak in #7089 update quic-go to v0.53.0 by @marten-seemann in #7094 refactor: replace HasPrefix+TrimPrefix with CutPrefix by @gopherorg in #7095 docs: fix some minor issues in the comments by @mountdisk in #7101 httpcaddyfile: Validates TLS DNS challenge options by @francislavoie in #7099 chore: fix struct name in comment by @bytetigers in #7114 reverse proxy: validate versions in http transport by @WeidiDeng in #7112 chore: fix function in comment by @bytesingsong in #7121 Fix: Support placeholders in header replacement search patterns by @zongzewu23 in #7117 fileserver: specify license for embedded JavaScript by @infertux in #7127 fix dead link by @eeemmmmmm in #7136 update quic-go to v0.54.0 by @marten-seemann in #7138 chore: fix minor issue in comment by @pingshuijie in #7140 refactor: use slices.Equal to simplify code by @minxinyi in #7141 ci: reduce dependabot spam by @mohammed90 in #7078 fix(provisioning): Context.App or Context.AppIfConfigured will return (val, nil) even if the app failed to provision or validate the first time by @alexandre-daubois in #7070 build(deps): bump the actions-deps group with 6 updates by @dependabot [bot] in #7142 Use KeepAliveConfig to pass keepalive_interval to listener's accepted sockets by @joshuamcbeth in #7151 build(deps): bump the all-updates group across 1 direct

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence