[dependabot]

Bumps the go-minor-and-patch group with 1 update: github.com/caddyserver/caddy/v2.

Updates github.com/caddyserver/caddy/v2 from 2.11.4 to 2.11.6

Release notes

Sourced from github.com/caddyserver/caddy/v2's releases.

v2.11.6

This patch release contains a large number of minor and some noticeable enhancements and bug fixes. Thank you to everyone who contributed or spent their LLM tokens responsibly to help with this release!

We have much more in the pipeline still, as AI has made contributions of all quality levels cheap and easy. We will be trying to go through them as quickly and efficiently as we can.

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

⚠️ Please read the breaking changes below before upgrading. Most of them come from security hardening, and most configs won't notice. If you were relying on one of the old behaviors, though, you'll want to know about it.

Highlights

• New url_pattern request matcher: Match requests with the URLPattern standard, the same syntax used by browsers (JS) and many web frameworks. It supports named groups, wildcards, and regexp components. Captured groups become placeholders ({http.url_pattern.<component>.<group>}), and there's a matching url_pattern CEL function too. Thanks @​dunglas! (#7787)
• Slowloris mitigation: New idle read/write timeouts reset on every successful read or write. A stalled connection gets cut off, and a slow one that's still making progress is left alone. You can also set optional minimum transfer rates, and there's a new timeouts handler directive for per-route tuning. (#7913)
• New tls_automate_names global option: Manage certificates for names without serving them in a site block. (#8015)
• New expected_underscore_headers server option: If dropping header fields with underscores in 2.11.4 broke your app, you can now list the specific headers to keep. (#7809)
• HTTP/3 over Tailscale and other low-MTU links now works, because the initial QUIC packet size is smaller. (#7886)
• Reverse proxy got more love:
  • partial responses are flushed to clients properly (#7849)
  • TCP half-close is propagated on upgraded streams (#8027)
  • versions 3 upstreams now honor tls_trust_pool (#8042)
  • active health check state is kept separate per check config, so one handler's failing probes don't mark the upstream down for everyone else (#7916)
  • the random_choose policy distributes correctly now (#7873)
• Server-sent events behind encode now stream immediately instead of being buffered. (#7905)
• Graceful shutdown now waits for servers left over from previous configs, so long-lived responses that started before a reload aren't cut off at exit. (#8009)
• Caddyfile: import now works inside named routes (#7986), and quoted braces are treated as literal arguments (#7875).
• Logging:
  • new set_cookie log filter (#7888)
  • roll_interval accepts days (d) (#7900)
  • recovered handler panics are logged at ERROR level (#7924)
  • write timeout errors show up in access logs (#7945)
• Performance: fewer allocations in request hot paths, encoding negotiation, and the reverse proxy, from @​jvoisin and @​dunglas. Directory browsing is much faster for large directories. (#7847, #7903, #7911, #7925, #7926, #7936)
• Other new stuff:
  • {http.request.proto_name} placeholder (#7782)
  • FastCGI populates SERVER_ADDR (#7912)
  • multiple authentication providers no longer clobber each other's responses (#7904)

⚠️ Breaking changes

• Go 1.26 is now the minimum version for building Caddy and plugins. (#8056)
• Request headers are limited to 16 KiB by default. Before, we used Go's 1 MB default. Requests with larger headers (giant cookies, oversized tokens, etc.) will now get 431 Request Header Fields Too Large. If you need more, raise it with the max_header_size server option.
• New 1-minute idle read/write timeouts by default. If a request body read or a response write stalls (makes no progress at all) for longer than that, the connection is aborted. Pauses between writes, like with SSE, don't count. Some long-lived streams where the client goes quiet mid-body may be affected. You can tune these with read_body_idle and write_idle in the timeouts server option, or per-route with the timeouts directive. (#7913)
• Request header fields containing . are now dropped, the same way underscores were in 2.11.4. PHP folds . to _, so these could be used to impersonate legitimate headers. If you need specific ones, allow them with the new expected_dot_headers server option.
• A wildcard site's client_auth no longer applies to more specific hostnames that have their own site blocks. For example, public.example.com no longer inherits mTLS from *.example.com. If you were counting on that inheritance, configure client_auth on the specific site explicitly. (#7920)
• Stricter config validation. Some configs that used to be silently accepted (and probably didn't do what you expected) are now errors:
  • duplicate named_routes (#7800)
  • duplicate forward_auth uri (#7814)
  • invalid weighted_round_robin weights (#7807)
  • a non-integer browse file_limit (#7988)
  • duplicate or ambiguous map inputs (#8067)
  • malformed map destination placeholders (#8074)

... (truncated)

Commits

• ac834b5 ci: pin cosign to v2 for release signing (#8092)
• 4ad0c6b Clarify release flow instructions
• 0a137e2 caddyhttp: use errors.AsType for request body limit errors (#8090)
• 90efc8f go.mod: Upgrade CertMagic, acmez, ZeroSSL, & some others
• ff112bb caddyhttp: wait for servers from previous configs on exit (#8009)
• 90ccea7 build: bump all dependencies - (Go 1.26 floor) (#8056)
• 5ee9a2d httpcaddyfile: new tls_automate_names global option (#8015)
• 256df3c map: reject malformed destination placeholders (#8074)
• ea1e94b map: Distinguish duplicate literal and regexp inputs (#8067)
• 69ec5df caddyauth: only replace known placeholders in basic auth credentials (#8017)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like github.com/caddyserver/caddy/v2 is updatable in another way, so this is no longer needed.