Skip to content

Update module github.com/caddyserver/caddy/v2 to v2.11.4#10

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-caddyserver-caddy-v2-2.x
Open

Update module github.com/caddyserver/caddy/v2 to v2.11.4#10
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-caddyserver-caddy-v2-2.x

Conversation

@renovate

@renovate renovate Bot commented May 12, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/caddyserver/caddy/v2 v2.11.2v2.11.4 age confidence

Release Notes

caddyserver/caddy (github.com/caddyserver/caddy/v2)

v2.11.4

Compare Source

This release patches more security, security-adjacent, and normal bugs. The FrankenPHP project has collaborated on PHP-adjacent patches, which we are grateful for.

The recent surge of patches is mostly attributed to token predictors. We have had to reject more than 75% of "security" reports because they were AI slop spam (or just lazy/incorrect). Please use LLMs and agents wisely to avoid wasting precious maintainer resources. We have started blocking offending accounts that spam slop reports. Thank you to all who submit responsible reports following our security policy to make the project better. We appreciate that the community deems the Caddy project worthy of contribution to improve the broader ecosystem!

Security-related patches:

  • caddyhttp: Normalize Windows backslashes in path matcher (thanks @​Vincent550102)
  • rewrite: Prevent placeholder re-expansion in injected query (thanks @​WhiskerEnt)
  • templates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @​jmrcsnchz)
  • caddyhttp: Ignore header fields with underscores to prevent collisions (thanks @​Vincent550102 for the report and @​dunglas for the patch)

There are also several other various fixes and enhancements by many other contributors. Thank you everyone who participated!

What's Changed

New Contributors

Full Changelog: caddyserver/caddy@v2.11.3...v2.11.4

v2.11.3

Compare Source

This release improves several aspects of Caddy with minor features, bug fixes, and security patches. Thank you to everyone and their bots who contributed to help make this release the best one yet!

Security patches:

We've also merged a couple PRs that fix upstream security bugs in other projects like quic-go and CertMagic. Thank you to @​marten-seemann for maintaining quic-go so diligently!

What's Changed

New Contributors

Full Changelog: caddyserver/caddy@v2.11.2...v2.11.3


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented May 12, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 36 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.0 -> 1.25.1
cloud.google.com/go/auth v0.18.1 -> v0.20.0
github.com/caddyserver/certmagic v0.25.2 -> v0.25.3
github.com/go-jose/go-jose/v3 v3.0.4 -> v3.0.5
github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
github.com/go-sql-driver/mysql v1.8.1 -> v1.9.3
github.com/google/cel-go v0.27.0 -> v0.28.1
github.com/googleapis/enterprise-certificate-proxy v0.3.11 -> v0.3.15
github.com/googleapis/gax-go/v2 v2.17.0 -> v2.22.0
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a -> v0.0.0-20240606120523-5a60cdf6a761
github.com/jackc/pgx/v5 v5.6.0 -> v5.9.2
github.com/jackc/puddle/v2 v2.2.1 -> v2.2.2
github.com/klauspost/compress v1.18.4 -> v1.18.6
github.com/prometheus/procfs v0.19.2 -> v0.20.1
github.com/quic-go/quic-go v0.59.0 -> v0.59.1
github.com/smallstep/certificates v0.30.0-rc3 -> v0.30.2
github.com/smallstep/nosql v0.7.0 -> v0.8.0
go.etcd.io/bbolt v1.3.10 -> v1.4.3
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 -> v0.68.0
go.opentelemetry.io/otel v1.40.0 -> v1.43.0
go.step.sm/crypto v0.76.2 -> v0.81.0
go.uber.org/zap v1.27.1 -> v1.28.0
go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
golang.org/x/crypto v0.48.0 -> v0.52.0
golang.org/x/mod v0.33.0 -> v0.35.0
golang.org/x/net v0.51.0 -> v0.55.0
golang.org/x/oauth2 v0.35.0 -> v0.36.0
golang.org/x/sync v0.19.0 -> v0.20.0
golang.org/x/sys v0.41.0 -> v0.45.0
golang.org/x/term v0.40.0 -> v0.43.0
golang.org/x/text v0.34.0 -> v0.37.0
golang.org/x/time v0.14.0 -> v0.15.0
golang.org/x/tools v0.42.0 -> v0.44.0
google.golang.org/api v0.266.0 -> v0.277.0
google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 -> v0.0.0-20260406210006-6f92a3bedf2d
google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 -> v0.0.0-20260427160629-7cedc36a6bc4
google.golang.org/grpc v1.79.1 -> v1.81.0

@renovate renovate Bot force-pushed the renovate/github.com-caddyserver-caddy-v2-2.x branch from 47d89fd to ecfa756 Compare June 3, 2026 04:42
@renovate renovate Bot changed the title Update module github.com/caddyserver/caddy/v2 to v2.11.3 Update module github.com/caddyserver/caddy/v2 to v2.11.4 Jun 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants