All Versions
281
Latest Version
Avg Release Cycle
10 days
Latest Release
11 days ago
Changelog History
Page 4
Changelog History
Page 4
-
v3.6.2 Changes
November 18, 2025Important : Please read the migration guide.
🐛 Bug fixes:
-
v3.6.1 Changes
November 13, 2025Important : Please read the migration guide.
🐛 Bug fixes:
- 🐳 [docker] Auto-negotiate Docker API Version (#12256 by felixbuenemann)
- [server] Fix multi-layer routing with models (#12258 by juliens)
- [udp] Revert "Avoid allocations in readLoop by using sync.Pool" (#12267 by kevinpollet)
- [webui] Fix blocked navigation on Safari (#12231 by gndz07)
- [webui] Restore remote Upgrade to Hub button web component (#12219 by gndz07)
📚 Documentation:
-
v2.11.51 Changes
June 30, 2026Important: Please read the migration guide.
🛠 CVE fixed:
- 🔒 CVE-2026-54763 (Advisory GHSA-x677-9fxg-v5c5)
- 🔒 CVE-2026-54764 (Advisory GHSA-3q9r-p662-5j8m)
🐛 Bug fixes:
- [acme] Bump github.com/go-acme/lego/v5 (#13359 @juliens)
- [middleware, authentication] Fix x-forwarded-port in forward-auth (#13344 @juliens)
- [middleware, authentication] Add an option to remove request headers with underscores (#13262 @youkoulayley)
- [webui] Bump axios to v1.18.0 (#13380 @gndz07)
- 🔧 Configurable max request header size (#13353 @juliens)
📚 Documentation:
- 🔒 [security] Add HTTP/2 header memory exhaustion security documentation (#13381 @emilevauge)
- ➕ Adds documentations on maxHeaderBytes (#13363 @juliens)
-
v2.11.50 Changes
June 10, 2026Bug fixes:
- [tls] Fix routers with same host, different tlsoptions on different entryPoint (#13329 @juliens)
- [tls] Fix snicheck for routers with no hosts (#13333 @rtribotte)
-
v2.11.49 Changes
June 05, 2026 -
v2.11.48 Changes
June 04, 2026Important: Please read the migration guide.
🛠 CVE fixed:
- 🔒 CVE-2026-48020 (Advisory GHSA-xf64-8mw2-4gr2)
🐛 Bug fixes:
- [tls] Compute resolved tlsOptions after applying models (#13291 @rtribotte)
- [middleware, authentication] Add error on basic auth build if users is empty (#13195 @rtribotte)
- [k8s/ingress] Avoid ingress path matcher injection and backport 11d2514 (#13227 @rtribotte)
- [server] Move snicheck to ctx instead of simulated routing (#13214 @juliens)
- [middleware] Reject requests with different paths after StripPrefix and StripPrefixRegex normalisation (#13215 @rtribotte)
- [server] Bump golang.org/x/net to v0.55.0 (#13251 @kevinpollet)
- [server] Bump golang.org/x/crypto to v0.52.0 (#13276 @rtribotte)
-
v2.11.46 Changes
May 11, 2026Important: Please read the migration guide.
🛠 CVE fixed:
- 🔒 CVE-2026-44774 (Advisory GHSA-96qj-4jj5-wcjc)
🐛 Bug fixes:
- [k8s/ingress, k8s/crd, k8s/gatewayapi] Add CrossProviderNamespaces option (#13094 @rtribotte)
- [k8s/crd] Fix cross-provider ref check for Kubernetes CRD provider (#13121 @rtribotte)
-
v2.11.45 Changes
May 05, 2026Important: Please read the migration guide.
🐛 Bug fixes:
- [k8s/crd] Remove cross-provider sanitization for Kubernetes service loading (#13087 @rtribotte)
- 🐳 [docker, ecs] Migrate to github.com/moby/moby modules (#13053 @mmatur)
-
v2.11.44 Changes
April 29, 2026 -
v2.11.43 Changes
April 22, 2026Important: Please read the migration guide.
🛠 CVE fixed:
- 🔒 CVE-2026-40912 (Advisory GHSA-6jwx-7vp4-9847)
- 🔒 CVE-2026-39858 (Advisory GHSA-5m6w-wvh7-57vm)
- 🔒 CVE-2026-35051 (Advisory GHSA-6384-m2mw-rf54)
- 🔒 CVE-2026-41263 (Advisory GHSA-6x2q-h3cr-8j2h)
- 🔒 CVE-2026-41174 (Advisory GHSA-xhjw-95fp-8vgq)
🐛 Bug fixes:
- [middleware, authentication] Remove map lookup making the basic auth notFoundSecret empty (#12960 @rtribotte)
- [middleware, authentication] Fix trustForwardHeader on forward auth middleware (#12994 @juliens)
- [middleware, authentication] Cleanup and make ForwardAuth logs consistent (#13013 @kevinpollet)
- [middleware] Remove untrusted X headers with underscores (#12961 @rtribotte)
- [middleware] Sanitize the request URL after stripping the prefix (#12990 @kevinpollet)
- [k8s/crd, k8s] Honor allowCrossNamespace with chain middleware CRD (#12976 @rtribotte)