TRAEFIK-3.7.11 release notes and known issues

Summary

Important: Please read the migration guide . CVE fixed: Advisory GHSA-5w68-77r2-r64c Advisory GHSA-g55h-rg46-x9c5 Advisory GHSA-j994-9gqj-9hwq Advisory GHSA-m6wx-622r-48r9 Bug fixes: [fastproxy] Reject out-of-range status codes from backends when using FastProxy ( #13635 @gndz07 ) [http3] Bump github.com/quic-go/quic-go to v0.61.0 ( #13688 @jnoordsij ) [k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider ( #13656 @rtribotte ) [k8s/crd] Add an option to restrict the namespace of the default TLS resources ( #13665 @rtribotte ) [k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider ( #13668 @rtribotte ) [k8s/crd] Name failover generated services after the referenced Kubernetes Service ( #13677 @rtribotte ) [k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider ( #13689 @gndz07 ) [k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect ( #13641 @gndz07 ) [k8s/gatewayapi] Fix Gateway API router rules ( #13645 @rtribotte ) [k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider ( #13638 @gndz07 ) [k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend ( #13575 @rtribotte ) [k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider ( #13629 @gndz07 ) [k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware ( #13670 @gndz07 ) [middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 ( #13636 @kevinpollet ) [tls] Add an option to disable the fallback to the default TLS options ( #13639 @rtribotte ) Bump golang.org/x dependencies ( #13699 @mmatur ) Documentation: [accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation ( #13609 @rtribotte ) [api] Fix doubled word in API/dashboard reference docs ( #13663 @latent-9 ) [docker] Remove :ro from docker.sock ( #12656 @bluepuma77 ) [k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 ( #13628 @rtribotte ) [k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider ( #13634 @rtribotte ) [k8s/ingress-nginx] Docs: Update supported server snippet directives ( #13687 @rtsui-harmonicinc) [middleware] Add rejectStatusCode to the ipAllowList middleware configuration example ( #13664 @amazon7737 ) [middleware] Mark the errors middleware service option as required ( #13684 @lazerg ) [tls] Document the TLS options conflict resolution ( #13640 @rtribotte ) [tls] Clarify router TLS replaces entrypoint TLS ( #13630 @sornapudisuresh ) Document Redis keyspace notifications requirement ( #13691 @omkar619-dev ) Remove retired Go Report Card badge ( #13637 @yardenshoham ) Restore the systemd socket activation documentation ( #13701 @lazerg ) Update version support policy starting with v3.6 ( #13627 @nmengin )

Improvements and security content

• Important: Please read the migration guide . CVE fixed: Advisory GHSA-5w68-77r2-r64c Advisory GHSA-g55h-rg46-x9c5 Advisory GHSA-j994-9gqj-9hwq Advisory GHSA-m6wx-622r-48r9 Bug fixes: [fastproxy] Reject out-of-range status codes from backends when using FastProxy ( #13635 @gndz07 ) [http3] Bump github.com/quic-go/quic-go to v0.61.0 ( #13688 @jnoordsij ) [k8s/crd] Prevent generated name collisions in the Kubernetes CRD provider ( #13656 @rtribotte ) [k8s/crd] Add an option to restrict the namespace of the default TLS resources ( #13665 @rtribotte ) [k8s/crd] Scope generated Kubernetes Service names to their parent in the CRD provider ( #13668 @rtribotte ) [k8s/crd] Name failover generated services after the referenced Kubernetes Service ( #13677 @rtribotte ) [k8s/crd] Add safe naming option to avoid collisions for Kubernetes CRD provider ( #13689 @gndz07 ) [k8s/gatewayapi] Preserve encoded path segments in Gateway API URLRewrite and RequestRedirect ( #13641 @gndz07 ) [k8s/gatewayapi] Fix Gateway API router rules ( #13645 @rtribotte ) [k8s/ingress-nginx] Dedupe client-auth TLS options across ingresses sharing a host for ingress-nginx provider ( #13638 @gndz07 ) [k8s/ingress-nginx] Apply auth, custom-headers, custom errors and ssl-redirect to ingress default backend ( #13575 @rtribotte ) [k8s/ingress-nginx] Honor asDefault and exclude internal entrypoints from default selection for ingress-nginx provider ( #13629 @gndz07 ) [k8s/ingress] Enforce crossProviderNamespace for Kubernetes Ingress service middleware ( #13670 @gndz07 ) [middleware, authentication] Bump github.com/containous/go-http-auth to b975dcaa8c48 ( #13636 @kevinpollet ) [tls] Add an option to disable the fallback to the default TLS options ( #13639 @rtribotte ) Bump golang.org/x dependencies ( #13699 @mmatur ) Documentation: [accesslogs] Clarify OriginStatus and DownstreamStatus in access logs documentation ( #13609 @rtribotte ) [api] Fix doubled word in API/dashboard reference docs ( #13663 @latent-9 ) [docker] Remove :ro from docker.sock ( #12656 @bluepuma77 ) [k8s/gatewayapi] Clarify v3.7.10 migration guide for Gateway API 1.6.1 ( #13628 @rtribotte ) [k8s/gatewayapi] Document the Experimental Channel CRDs requirement of the Kubernetes Gateway provider ( #13634 @rtribotte ) [k8s/ingress-nginx] Docs: Update supported server snippet directives ( #13687 @rtsui-harmonicinc) [middleware] Add rejectStatusCode to the ipAllowList middleware configuration example ( #13664 @amazon7737 ) [middleware] Mark the errors middleware service option as required ( #13684 @lazerg ) [tls] Document the TLS options conflict resolution ( #13640 @rtribotte ) [tls] Clarify router TLS replaces entrypoint TLS ( #13630 @sornapudisuresh ) Document Redis keyspace notifications requirement ( #13691 @omkar619-dev ) Remove retired Go Report Card badge ( #13637 @yardenshoham ) Restore the systemd socket activation documentation ( #13701 @lazerg ) Update version support policy starting with v3.6 ( #13627 @nmengin )

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence