chore(deps): update dependency caddyserver/caddy to v2.5.0 #72
Loading…
Reference in New Issue
Block a user
No description provided.
Delete Branch "renovate/caddyserver-caddy-2.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v2.4.6
->v2.5.0
Release Notes
caddyserver/caddy
v2.5.0
Compare Source
Caddy 2.5 introduces new features you'll love as well as a huge number of bug fixes and enhancements. Thank you to everyone who contributed!
Feel free to ask on the forum if you have any questions or feedback.
Highlights
lookup_srv
JSON field for upstreams (andsrv+
scheme prefix in the Caddyfile), which will be removed in the future.tracing
handler module and associatedtracing
directive.copy_response
is available to copy the proxy's response back to the client, andcopy_response_headers
may be used to selectively copy header values from the proxy's response./pki/ca/<id>
and/pki/ca/<id>/certificates
for getting information about Caddy's managed CAs, including the chain of root and intermediate certificates.Notable
X-Forwarded-Host
header will now be automatically set, along withX-Forwarded-For
andX-Forwarded-Proto
.X-Forwarded-*
headers will no longer be automatically trusted, to prevent spoofing. Now,trusted_proxies
must be configured to specify a list of downstream proxies which are trusted to have sent good values. You only need to configure trusted proxies if Caddy is not the first server being connected to. For example, if you have Cloudflare in front of Caddy, then you should configure this with Cloudflare's list of IP ranges.propagation_delay
orpropagation_timeout
to -1, respectively.3s
(was10s
), which should allow for more easily configuring load balancing retries.log_credentials
global option in the Caddyfile, or the server'slogs > should_log_credentials
field in JSON.DEBUG
level if the error was handled viaerrors
routes (handle_errors
in Caddyfile).common_log
field from HTTP access logs, and thesingle_field
encoder. If you relied on this, you may use the transform encoder plugin to encode logs in Common Log format.remote_addr
field has been replaced byremote_ip
andremote_port
fields in HTTP access logs, which split up the two parts of the remote address. This improves ease of use for some tooling which only expect an IP address, without a port.vars
matcher can now match on multiple possible values.{http.request.uuid}
placeholder.http_redirect
listener wrapper which can be used to redirect HTTP requests that come in on a server listening for HTTPS requests to be redirected tohttps://
.default_bind
global option lets you specify the default interface all sockets should bind to.pki
global option lets you configure the properties of the internal CAs managed by Caddy.method
directive allows rewriting the request method via Caddyfile.reverse_proxy
directive'shandle_response
subdirective has had its status replacement functionality moved to a newreplace_status
subdirective. This makes sure that the functionality ofhandle_response
is not overloaded, and usage is clearer.map
directive now casts outputs to the appropriate scalar type if possible (int, float, bool). If you need to force a string, you may use double quotes or backticks https://github.com/caddyserver/caddy/pull/4643.vars
directive allows setting some variables during request handling for later use in another handler or matcher.caddy fmt
CLI command now has a--diff
option which lets you visually see the formatting differences.load_interval
➡️load_delay
for clarification, and improved dynamic config loading.🛡️ Thanks to David Leadbeater for reporting a security vulnerability related to HTTP methods and metrics cardinality, which was fixed in this release.
New Contributors
Changelog
2e46c2a
admin, reverseproxy: Stop timers if canceled to avoid goroutine leak (#4482)40b5443
admin: Enforce and refactor origin checkingb4bfa29
admin: Require identity for remote (fix #4478)32aad90
admin: Write proper status on invalid requests (#4569) (fix #4561)ff137d1
caddyconfig: Support placeholders in HTTP loaderb47af6e
caddyfile: Copy input before parsing (fix #4422)e90d751
caddyfile: impove fmt warning message (#4444)5e5af50
caddyfile: make renew_interval option configurable (#4451)ddbb234
caddyhttp: Always log handled errors at debug level (#4584)6b385a3
caddyhttp: Don't attempt to manage Tailscale certsecac03c
caddyhttp: Enhance vars matcher (#4433)6e6ce2b
caddyhttp: Fix HTTP->HTTPS redir not preferring HTTPS port if ambiguous (#4530)3fe2c73
caddyhttp: FixMatchPath
sanitizing (#4499)44e5e9e
caddyhttp: Fix test when /tmp/etc already exists (#4544)2bb8550
caddyhttp: Honor wildcard hosts in log SkipHosts (#4606)180ae0c
caddyhttp: Implement http.request.uuid placeholder (#4285)7d5047c
caddyhttp: Log empty value for typical password headerseead337
caddyhttp: Log non-500 handler errors at debug level (#4429)5bf0ada
caddyhttp: Make logging of credential headers opt-in (#4438)186fdba
caddyhttp: Move HTTP redirect listener to an optional module (#4585)80d7a35
caddyhttp: Redirect HTTP requests on the HTTPS port to https:// (#4313)bf380d0
caddyhttp: Reject absurd methods (#4538)850e160
caddyhttp: Return HTTP 421 for mismatched Host header (#4023)f55b123
caddyhttp: Split up logged remote address into IP and port (#4403)ac14b64
caddyhttp: Support zone identifiers in remote_ip matcher (#4597)a1c4121
caddypki: Minor tweak, don't use context pointer78e381b
caddypki: Refactor /pki/ admin endpointsc634bbe
caddypki: Return error if no PEM data found9b7cdfa
caddypki: Try to fix lint warningsa79b405
caddytls: Add internal Caddyfilelifetime
,sign_with_root
opts (#4513)77a77c0
caddytls: Addpropagation_delay
, supportpropagation_timeout -1
(#4723)66de438
caddytls: FixMatchRemoteIP
provisoning with multiple CIDR ranges (#4522)57a708d
caddytls: Support external certificate Managers (like Tailscale) (#4541)d9b1d46
caddytls: dns_challenge_override_domain for challenge delegation (#4596)1a7a78a
cmd: Print error if fmt overwrite fails (fix #4524)bc447e3
core: Config LoadInterval -> LoadDelay for clarity7ea5b2a
core: Config load interval only reloads if changed (#4603)7f364c7
core: Load config at interval instead of just oncea72acd2
core: Retry dynamic config load if config unchangedceef70d
core: Retry dynamic config load if error or no-op (#4603)acbee94
core: Revert7f364c7
; simplify dynamic config load64a3218
core: Simplify shared listeners, fix deadline bug8e5aafa
fastcgi: Fix a TODO, prevent zap using reflection for logging env (#4437)c8f2834
fastcgi: Protect against requests with null bytes in the path (#4614)de490c7
fastcgi: Set SERVER_PORT to 80 or 443 depending on scheme (#4572)09ba9e9
fileserver: Addpass_thru
Caddyfile option (#4613)15c95e9
fileserver: Canonical redir when whole path is stripped (#4549)c8b5a81
fileserver: Fix handling of symlink sizes in directory listings (#4415)e81369e
fileserver: Move default browse template into a separate file (#4417)1e10f6f
fileserver: browse: do not encode the paths in breadcrumbs and page title (#4410)78b5356
fileserver: do not double-escape paths (#4447)0de5159
go.mod: Revert version bump of CEL (#4587)6f9b6ad
go.mod: Update smallstep/certificates, no longer need replace (#4475)4906b93
go.mod: Update smallstep/truststore, fix build on FreeBSD (#4473)c133153
go.mod: Update to latest smallstep/truststore, support FreeBSD (#4453)ff74a0a
go.mod: Upgrade dependenciese9dde23
headers: Fix+
in Caddyfile to properly append rather than set (#4506)1b7ff5d
httpcaddyfile: Adddefault_bind
global option (#4531)a8bb4a6
httpcaddyfile: Add{vars.*}
placeholder shortcut, reversevars
sort order (#4726)5a07156
httpcaddyfile: Add pki approot
andintermediate
cert/key config (#4514)3a1e0db
httpcaddyfile: Deprecate paths in site addresses; use zap logs (#4728)26d633b
httpcaddyfile: Disabling OCSP stapling for both managed and unmanaged (#4589)93a7a45
httpcaddyfile: Fix incorrect handling of IPv6 bind addresses (#4532)81ee34e
httpcaddyfile: Fix sorting edgecase for nestedhandle_path
(#4477)4b9849c
httpcaddyfile: Support configuringpki
app names via global options (#4450)5bd96a6
httpcaddyfile: Support explicitly turning offstrict_sni_host
(#4592)c921e08
logging: Addroll_local_time
Caddyfile option (#4583)0eb0b60
logging: Remove common_log field and single_field encoder (#4149) (#4282)249adc1
logging: Support turning off roll compression via Caddyfile (#4505)8887adb
logging: add a filter for cookies (#4425)bcac2be
logging: add a filter for query parameters (#4424)789efa5
logging: add a regexp filter (#4426)a1b417c
logging: add support for hashing data (#4434)eb891d4
metrics: Enforce smaller set of method labelsc04d24c
pki: Avoid provisioning thelocal
CA when not necessary (#4463)bbad693
pki: Implement API endpoints for certs andcaddy trust
(#4443)9ee68c1
reverseproxy: Adjust defaults, document defaults (#4436)7557d1d
reverseproxy: Avoid returning anil
error during GetClientCertificate (#4550)ab04559
reverseproxy: Dynamic upstreams (with SRV and A/AAAA support) (#4470)5333c35
reverseproxy: Fix incorrecthealth_headers
Caddyfile parsing (#4485)c50094f
reverseproxy: Implement trusted proxies forX-Forwarded-*
headers (#4507)f5e1049
reverseproxy: Make shallow-ish clone of the request (#4551)87a1f22
reverseproxy: Move status replacement intercept toreplace_status
(#4300)d058dee
reverseproxy: Refactor dial address parsing, augment command parsing (#4616)c7d6c4c
reverseproxy: copy_response and copy_response_headers for handle_response routes (#4391)bcb7a19
rewrite: Addmethod
Caddyfile directive (#4528)1feb659
rewrite: Fix a double-encode issue when using the{uri}
placeholder (#4516)6cadb60
templates: Document .OriginalReq1d0425b
templates: Elaborate on what's supported by the markdown function (#4564)a6199cf
templates: Fix docs for .Argsec14ccd
templates: fix inconsistent nested includes (#4452)d0b608a
tracing: New OpenTelemetry module (#4361)134b805
caddyfile: Prevent bad block opening tokens (#4655)c5fffb4
caddyfile: Support for raw token values; improvemap
,expression
(#4643)b82e22b
caddyhttp: retain all values of vars matcher when specified multiple times (#4629)bc15b4b
caddypki: Load intermediate for signing on-the-fly (#4669)6512832
cmd: Add--diff
option forcaddy fmt
(#4695)30b6d1f
cmd: Enhance .env (dotenv) file parsing22d8edb
cmd: Fix defaulting admin address if empty in config, fixesreload
(#4674)c232716
cmd: Set Origin header properly on API requestsd06d0e7
go.mod: Upgrade CertMagic to v0.16.0bf6a1b7
go.mod: Upgrade some dependencies79cbe7b
httpcaddyfile: Add 'vars' directivea58f240
httpcaddyfile: Fix #4640 (auto-HTTPS edgecase) (#4661)7d22966
logging: Caddyfile support forduration_format
(#4684)55b4c12
map: Evaluate placeholders in output vals (#4650)93c99f6
map: Support numeric and bool types with Caddyfile3d616e8
requestbody: Return HTTP 413 (fix #4558)3e3bb00
reverseproxy: Add_ms
placeholders for proxy durations (#4666)2196c92
reverseproxy: Don't clear name in SRV upstreamsdc4d147
reverseproxy: Expand SRV/A addrs for cache keyb8dbecb
reverseproxy: Include port in A upstreams cachee4ce40f
reverseproxy: Sync uphandleUpgradeResponse
with stdlib (#4664)afca242
staticfiles: Expand placeholder for index files (#4679)00234c8
templates: Switch toBurntSushi/toml
(#4700)Full Changelog: https://github.com/caddyserver/caddy/compare/v2.4.6...v2.5.0
Configuration
📅 Schedule: At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.