[dependabot]

Bumps github.com/caddyserver/caddy/v2 from 2.11.4 to 2.11.7.

Release notes

Sourced from github.com/caddyserver/caddy/v2's releases.

v2.11.7

This patch release fixes regressions from 2.11.6, including a crash when proxying over HTTP/2 and streams that were cut off after a minute. If you're on 2.11.6, we recommend upgrading. It also adds support for the brand new Incremental header field (RFC 10036).

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

Highlights

• Fixed: crash and dropped streams caused by the new idle timeouts. 2.11.6 introduced default idle read/write timeouts, which caused some problems:

  • In 2.11.6, the request body's idle deadline could outlive the handler that set it:

    • Over HTTP/2, Caddy could panic with a nil pointer dereference when the reverse proxy was still reading a request body after the handler had returned. (#8101)
    • Over HTTP/1.1, streaming responses to requests with a body, such as SSE clients that open the stream with a POST, were cut off exactly 60 seconds after the body was read. (#8103)

    Both are fixed in #8107. Thanks @​steadytao!

  • Over HTTP/2, streaming responses that paused between writes for longer than write_idle (1 minute by default), like quiet SSE streams, were reset with a stream error. As documented, only a write that stalls should count. Thanks @​WeidiDeng! (#8118, #8119)

• Fixed: placeholders for missing cookies are empty again. Since 2.11.6, places that keep unknown placeholders as written, like respond headers, would output {http.request.cookie.*} literally when the cookie wasn't in the request. The same happened to {http.request.tls.*} on plain HTTP requests. Both are empty again. Thanks @​steadytao! (#8019)

• New: support for the Incremental header field (RFC 10036). It's the standard replacement for NGINX's proprietary X-Accel-Buffering header. If an upstream response has Incremental: ?1, reverse_proxy forwards it immediately, the same as flush_interval -1, and encode streams it instead of holding it back. Great for Mercure, SSE and other streaming apps.

  • If the request_buffers or response_buffers options would prevent incremental forwarding, Caddy responds with 501 Not Implemented instead of silently buffering, as the RFC requires.
  • The new proxy_status_name option adds a Proxy-Status header to those responses, explaining why the message was refused.

  Thanks @​dunglas! (#8020)

• Faster TLS handshakes: When nothing subscribes to certificate events and debug logging is off, CertMagic no longer builds event data for every handshake. Certificate lookup per handshake is about twice as fast, with 10 allocations instead of 15. Thanks @​u5surf! (#8010)

• Unix sockets: When a reload moves a listener (or the admin endpoint) off a Unix socket, the old socket now closes right away and its file is removed. Before, clients connecting to the old path would hang until the next garbage collection, about 2 minutes later. Thanks @​littfed! (#8061)

• Headers handler: Multiple Set-Cookie values in a JSON config's set are now sent as separate header fields, instead of being joined with commas into one field that clients can't parse. Thanks @​Indra55! (#8080)

• caddy fmt no longer deletes an opening brace at the very end of the input. Thanks @​n0liu! (#8047)

What's Changed

• events: tell CertMagic which events are worth emitting by @​u5surf in caddyserver/caddy#8010
• feat: implement the Incremental header field (RFC 10036) by @​dunglas in caddyserver/caddy#8020
• caddyfile: Keep an opening brace that ends the input by @​n0liu in caddyserver/caddy#8047
• listeners: close unix socket immediately and unlink file on reload by @​littfed in caddyserver/caddy#8061
• reverseproxy: stabilise half-close test by @​steadytao in caddyserver/caddy#8049
• caddyhttp: keep absent optional placeholders empty by @​steadytao in caddyserver/caddy#8019
• headers: Preserve separate Set-Cookie values by @​Indra55 in caddyserver/caddy#8080
• caddyhttp: end request-body deadline ownership with handler by @​steadytao in caddyserver/caddy#8107
• timeouts: fix idle writer terminate h2 response writers between writes by @​WeidiDeng in caddyserver/caddy#8119

New Contributors

• @​n0liu made their first contribution in caddyserver/caddy#8047
• @​littfed made their first contribution in caddyserver/caddy#8061

Full Changelog: caddyserver/caddy@v2.11.6...v2.11.7

v2.11.6

This patch release contains a large number of minor and some noticeable enhancements and bug fixes. Thank you to everyone who contributed or spent their LLM tokens responsibly to help with this release!

We have much more in the pipeline still, as AI has made contributions of all quality levels cheap and easy. We will be trying to go through them as quickly and efficiently as we can.

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

⚠️ Please read the breaking changes below before upgrading. Most of them come from security hardening, and most configs won't notice. If you were relying on one of the old behaviors, though, you'll want to know about it.

... (truncated)

Commits

• 72dd0fb timeouts: fix idle writer terminate h2 response writers between writes (#8119)
• ab7e6b6 caddyhttp: end request-body deadline ownership with handler (#8107)
• ac63faa headers: Preserve separate Set-Cookie values (#8080)
• 55a95ad caddyhttp: keep absent optional placeholders empty (#8019)
• f357e2b reverseproxy: stabilise half-close test (#8049)
• d483d78 listeners: close unix socket immediately and unlink file on reload (#8061)
• b72bf7a caddyfile: keep an opening brace that ends the input (#8047)
• 2f34b93 feat: implement the Incremental header field (RFC 10036) (#8020)
• 4978c54 events: tell CertMagic which events are worth emitting (#8010)
• ac834b5 ci: pin cosign to v2 for release signing (#8092)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)